Hardware Trojan Detection through Backpropagation Neural Network
After getting to know how we could use Neural Network to stop a DOS attack from Detecting DoS attacks on Network-on-Chip using Neural Networks blog, let’s move on to another new interesting approach of detection hardware trojan through BP neural networks.
With the development of integrated circuits like System on chips, chip security has become an important part of research for every semiconductor industry. Hardware Trojan, are a major threat to the security of chips and has been widely concerned. At present, there have several hardware Trojan detection methods like reverse anatomy, function test, bypass signal analysis, etc. The bypass signal analysis based on power consumption is the most widely used method, but the problem is that the ability of the feature extraction method is not satisfied. However, the BP neural network has a strong ability of nonlinear mapping and adaptive learning, which can better retain and extract features in power consumption analysis and help detect hardware trojan. The proposed model/architecture uses the BP neural network to establish the mathematical model of feature extraction, and extract nonlinear features from power consumption analysis. The power acquisition and feature extraction experiment platform are based on FPGA, the experimental results show that the hardware Trojan detection method based on BP neural network is very effective.
As seen earlier in both the blogs Hardware Trojan are very dangerous at even more difficult to detect in the initial processes of manufacturing. IC design and production process is very complex, including several uncontrollable processes, such as design, manufacture, use, etc. Hardware Trojan can be inserted in these kinds of uncontrollable processed by a third party, which may lead to a great threat. Usually, hardware Trojan is in a quiescent state, but once be triggered, attacks will implement. Such as information stealing and leakage of bypass, failure acceleration, breaking the logic and physical destruction of SoCs, resource occupation, etc.
The detection method based on bypass power consumption information has a good effect and gradually becomes the main method of detection where it detects if the trojan consuming more power than necessary. Various other machine learning approaches like PCA (Principal component analysis) were also used to find subtle differences in the power consumption information. It used mathematical distances like Euclidean distance, Markov distance to detect hardware Trojan, but it will lose useful information when selecting the effective information. The reason to choose Neural Network in specific was its strong ability of nonlinear mapping and adaptive learning ability, which makes neural network able to retain and extract power consumption feature, its detection effect is worth looking forward to.
In the proposed network a very mathematical approach is been taken to categorize various power consumption parameters in an SoC. The general hardware Trojan detection process based on the bypass power consumption information is proposed as (i) Pick up several samples from a batch of chips, and acquire power consumption. (ii)Detect the samples by chip layout reverse analysis and select pure chips without hardware Trojan as parent sample M. (iii) Compare the power consumption of parent sample with a power consumption of chips under test, distinguish the chips with hardware Trojan. Taking these as our guidelines acquire power consumption of parent sample M for n times as well as the sample under test R for n times and find out the difference between them. The difference between parent sample M and sample under test R (delta P) is mainly affected by hardware Trojan power consumption and PVT and is used to classify whether an SoC has a hardware trojan or not.
BP(Back Propagation) network is a multilayer feed-forward network trained according to the error backpropagation algorithm and is one of the most widely applied neural network models. Basically, it is a simple Neural Network with various amounts of hidden layers and uses backpropagation to optimize the weights of individual nodes if the accuracy found to be is less than expected. The proposed network has chosen to take 3 hidden layers for its BP neural network to get the best results. Fuzzy clustering has been used to classify. Using BP neural network, it is actually using the nonlinear mapping function of the input layer to the hidden layer. Feature extraction based on BP neural network combined with classification makes the feature more classificatory than usual. Dealing the parent sample data by neural network learning, extracting features, and set the class number of clustering by threshold. The sample data with large differences in the parent samples will show different features in classification.
In the proposed network it was taken data from the power consumption of the parent circuit and circuit under test which has a hardware trojan. Each set of power consumption, which contains 1200 sampling points and is reshaped to a 500*24 matrix, is the input of the network. 500 feature tags will be extracted by the BP neural network. The main feature detection of the model is if the sample under test is infected by hardware Trojan, its overall feature is obviously a difference between the parent samples.
For calculating the performance of the proposed network, they have used the AES circuit as a hardware Trojan carrier. The implementation and verification of the circuit were based on FPGA design. Power consumption was achieved by the acquisition platform and has been analyzed by BP neural network using MATLAB software. When chips working, the current inside presents different forms in different periods, and the change of current is related to the working state of chips. So it is possible to know the working state of chips by analyzing power consumption. AES algorithm in encryption system is usually implemented by FPGA, which is convenient to operate the encryption in real-time. The circuit was burned in KC750 chip and made by Xilinx. Three hardware Trojan was designed. All of the hardware Trojan is triggered by sequence but has different functionalities.
The results show that the BP neural network can distinguish between SoCs with or without hardware trojans even if it’s difficult to detect. The result shows that this detection architecture has an obvious effect. And big hardware Trojan is easier to detect than the smaller one. When the proportion of hardware is getting smaller, the effect of this architecture is not good enough, the reason may be because of waveform alignment and noise. So this remains to be a problem to be solved in the coming future by more and more research.
Till then Stay safe, Stay connected, and be aware!
