Hardware Trojans classification based on controllability and observability in gate-level netlist

Abstract

This paper presents a hardware Trojan classification method that performs a static analysis in gate-level netlist. Based on the controllability and observability characteristics extracted in a circuit, the nets are clustered into two groups with the k-means method. Then inter-cluster distance is measured and taken as the major feature for Trojan identification. By combined with three other features in terms of circuit scale statistic number, a complementary representation of Trojan circuits is constructed. Finally, a support vector machine classifier is trained to distinguish the Trojan circuits from genuine circuits. Experimental results on Trust-HUB benchmarks demonstrate that our method can achieve up to 100% true positive rate.

Holistic hardware Trojan design of trigger and payload at gate level with rare switching signals eliminated

“…Since the trigger signals are generated first and then coupled with payload signal, there are always some signals, e.g. Trigger and O, in the Trojan circuit that stuck at one value most of the time which will be classified as Trojan signals by detection techniques such as [17,18,19].…”

“…Sandia combinational controllability reflects the difficulty of setting a signal line to a required logic value from primary inputs and combinational observability reflects the difficulty of propagating the logic value of the signal line to primary outputs [26]. Trojan signals are assumed to have high controllability/observability values in detections such as [17,18]. The controllability and observability in both SOP and POS keep in normal range since the firststage trigger signals of C mi can be any testable wires such as primary inputs, and the detailed values are present in Table II assuming that C mi have CC0 ¼ CC1 ¼ 1.…”

“…To keep dormant in functional verification, hardware Trojan is usually triggered by some rare conditions, which is the so-called trigger condition. In the existing Trojan benchmarks, the trigger part and payload part are designed separately and the rare-triggered condition is implemented by a combination of several low-activity or low testability signals, which may be detected by logic analysis techniques [17,18,19,20]. The traditional digital Trojan design methodology can be divided into two categories, the first exploits the rare transition signals in the original design [6,7,9,15], and the second attempts to partition the Trojan circuit into smaller parts and stages [12,14].…”

“…A uniform distribution of states is acquired by linear feedback shift register in [8], but low transition wire is still created when generating rare condition by combinational circuits. All these Trojans implement their rare conditions rely on one or more low activity or low testability signals, which may be detected by logic analysis detections, such as unused logic analysis [21,22], activation based analysis [23,24,25], Sandia Controllability/Observability based analysis [17,18] and probability analysis [19,20].…”

Fault attack hardware Trojan detection method based on ring oscillator

“…In 2007, D. Agrawal et al proposed the side-channel signal analysis detection method by using power, temperature and electromagnetic profiles to reflect HT effects [11]. Improving the detection precision by changing the profiles process algorithm [12,13,14,15,16,17,18,19]. In 2011, Zhang proposed an on-chip Ring Oscillator Network (RON) for HT detection as a trusted hardware design.…”