GNN-Based Hardware Trojan Detection at Register Transfer Level Leveraging Multiple-Category Features

The existing hardware Trojan (HT) detection technology usually relies on the golden reference model. With the continuous improvement of circuit integration, the detection accuracy of traditional methods such as side-channel analysis has declined. Methods based on testability and switch probability analysis have shown high detection accuracy. However, these techniques have a limited detection scope and are generally ineffective at identifying HT where the Sandia controllability/observability analysis program (SCOAP) values or switch probabilities are similar to those of normal signals. Against this backdrop, this article proposes a detection method based on graph neural networks (GNNs), which can achieve HT detection at the register transfer level (RTL) without the golden reference model. First, the RTL code is transformed into a data flow graph (DFG), and node feature extraction and node label marking are carried out during the transformation process. To mitigate the impact of insufficient initial features on the GNN model performance, the node feature vector used in this article comprises 37-D node types and 6-D structural features such as the minimum distance from the primary input (PI) and primary output (PO), in-degree, and out-degree. Subsequently, several GNN models are built for node classification tasks. The best model achieves an average of 99.1% recall and 96.7% F1-score on the open-source dataset on the Trust-Hub platform. Compared to the state-of-the-art detection results at RTL, the F1-score in this article has increased by an average of 3.8%.

I. Introduction

The globalization of integrated circuit (IC) industries, such as smart devices, makes ICs face a huge risk of being implanted into hardware Trojans (HTs) by rivals. HTs typically consist of triggers and payloads [1], which will lead to product denial of service (DoS), functional damage, performance decline, or disclosure of confidential information when triggered [2], [3]. Traditional HT detection methods can be divided into pre-silicon detection [4], [5], [6], [7], [8] and post-silicon [9], [10], [11], [12] detection. Pre-silicon detection mainly involves test vector generation and formal verification (FV), while post-silicon detection encompasses reverse engineering and side-channel analysis. As some HTs can activate malicious functions by modifying circuit logic, testers aim to activate HTs using a set of test vectors. However, this approach proves to be highly inefficient in detecting large-scale designs. Furthermore, FV requires the definition of a set of security properties, limiting the effectiveness of this approach. In addition, the lack of golden models hinders the practical implementation of certain post-silicon detection techniques. Some suggested enhancements include integrating side-channel analysis with automatic test pattern generation (ATPG) algorithms to optimize path delay difference through logical testing [13]. Another enhancement is proposed by Chakraborty et al. [14], which reduces the target space of test vectors effectively using a genetic algorithm and significantly decreases the runtime compared to MERO [15].