CN109684834A

CN109684834A - A kind of gate leve hardware Trojan horse recognition method based on XGBoost

Info

Publication number: CN109684834A
Application number: CN201811567722.XA
Authority: CN
Inventors: 董晨; 陈景辉; 郭文忠; 贺国荣; 张凡
Original assignee: Fuzhou University
Current assignee: Fuzhou University
Priority date: 2018-12-21
Filing date: 2018-12-21
Publication date: 2019-04-26
Anticipated expiration: 2038-12-21
Also published as: CN109684834B

Abstract

The gate leve hardware Trojan horse recognition method based on XGBoost that the present invention relates to a kind of.Integrated circuit gate level netlist is parsed, the characteristic data set of each net in different gate level netlists is acquired；Using leaving-one method, gate level netlist characteristic data set is divided into training dataset and test data set；XGBoost classifier is trained using training dataset, obtains initial gate level netlist hardware Trojan horse detection model, and carries out the detection of hardware Trojan horse to test data set, the statistics of test result is carried out according to confusion matrix；Recall(R can be calculated in confusion matrix according to testing result), F-measure, Precision(P) and Accuracy index；If the average result of 4 indexs is relatively low, parameter adjusting and optimizing is carried out to gate level netlist hardware Trojan horse detection model；Gate level netlist to be detected is carried out to the extraction of characteristic data set, and data set is input in the gate level netlist hardware Trojan horse detection model after training optimization, that is, can determine that in the gate level netlist it is containing hardware Trojan horse.

Description

A kind of gate leve hardware Trojan horse recognition method based on XGBoost

Technical field

The invention belongs to information security and hardware Trojan horse detection technique field, it is related in integrated circuit gate level netlist The method that hardware Trojan horse is detected, especially a kind of gate level netlist hardware Trojan horse detection method based on XGBoost.

Background technique

The detection method of hardware Trojan horse is broadly divided into two major classes: preceding silicon detection and the detection of rear silicon.Silicon detection includes that side is believed afterwards Road detection, destructive detection and functional test.Since the detection of rear silicon needs to rely on gold plaque as reference, height spends, needs specific Detection device and be easily affected by noise in the detection process, therefore be subject to certain restrictions in practical applications. Especially in super large integrated circuit (VLSI), the detection difficulty of hardware Trojan horse is bigger, and rear silicon detection method is more not applicable.Before Silicon detection is a kind of detection method in chip design stage, and there is no the constraints of rear silicon detection, therefore are hardware Trojan horses The focus on research direction of detection.

In recent years, some researchers are by the method application of the machine learning such as SVM [1], NN [2], RandomForest [3] Into the detection method of gate level netlist hardware Trojan horse, and achieve relatively good detection effect.These methods mainly pass through The judgement of Precision and Accuracy two indices progress detection effect.But by analysis, in gate level netlist, normally The number of gauze (net) is much larger than the number of wooden horse net, and the calculated result of Precision and Accuracy two indices is by just The testing result of normal net is dominated, and in hardware Trojan horse detection process, it should stress as far as possible to detected wooden horse net. Therefore, the detection effect by Recall and F-measure two indices determination hardware wooden horse is more scientific.Existing by machine Device study is applied in the method for gate level netlist hardware Trojan horse detection, and the use of RandomForest method can obtain 94.9% Precision and 99.2%Accuracy, this is detection effect best at present.But the Recall of this method and F- Measure is only 74.9% and 79.8%.Therefore, there is also one in the application that gate level netlist hardware Trojan horse detects for machine learning method Fixed room for promotion.

Bibliography:

[1] K.Hasegawa et al., Hardware trojans classification for gate-level netlists based on machine learning, IEEE International Symposium on On-Line Testing and Robust System Design (2016), 203–206.

[2] K.Hasegawa, M.Yanagisawa, and N.Togawa, A hardware-trojan

classification method using machine learning at gate-level netlists based on trojan features, Ieice Transactions on Fundamentals of Electronics Communications & Computer Sciences E100.A (2017), no. 7, 1427–1438.

[3] K.Hasegawa, M.Yanagisawa, and N.Togawa, Trojan-feature extraction at gate-level netlists and its application to hardware-trojan detection using random forest classifier, IEEE International Symposium on Circuits and Systems (2017),1-4.。

Summary of the invention

It is an object of the invention to need to rely on gold plaque as reference for existing rear silicon detection method, height spends, needs Specific detection device and machine learning is utilized the problem of be easy in the detection process by influence of noise and for existing Method carries out gate level netlist hardware Trojan horse detection method to the deficiency of wooden horse net detection effect, and provides a kind of based on XGBoost Gate leve hardware Trojan horse recognition method, this method do not need gold plaque as reference, spends low, do not need specific detection device, It is not affected by noise in detection process, and door is carried out by defining effective wooden horse net in gate level netlist, and using XGBoost The detection of grade netlist hardware Trojan horse, further improves the detection effect of gate level netlist hardware Trojan horse.

To achieve the above object, the technical scheme is that a kind of gate leve hardware Trojan horse identification side based on XGBoost Method includes the following steps:

Step S1, according to N number of Trojan characteristics, integrated circuit gate level netlist is parsed, acquires each net in different gate level netlists Characteristic data set；

Step S2, using leaving-one method, gate level netlist characteristic data set is divided into training dataset and test data set；

Step S3, XGBoost classifier is trained using training dataset, obtains initial gate level netlist hardware Trojan horse inspection Survey model；

Step S4, the gate level netlist hardware Trojan horse detection model obtained using training carries out the inspection of hardware Trojan horse to test data set Survey, Recall(R can be calculated in confusion matrix according to testing result), F-measure, Precision(P) and Accuracy index；

If step S5, the Recall (R), F-measure, Precision (P) of the test data set that step S4 is calculated and The average result of Accuracy is relatively low, then carries out parameter adjusting and optimizing to gate level netlist hardware Trojan horse detection model；

Step S6, by gate level netlist to be detected carry out characteristic data set extraction, and by data set be input to training optimization after Gate level netlist hardware Trojan horse detection model in, that is, can determine that in the gate level netlist it is containing hardware Trojan horse.

In an embodiment of the present invention, in the step S1, N takes 51.

In an embodiment of the present invention, the specific implementation of the step S2 are as follows: extract different gate level netlists Characteristic data set is denoted as netlist (1), netlist (2) ... netlist (k), carries out the combination grouping of k kind to characteristic data set, Carry out k experiment；Wherein, i-th kind of grouping situation is by netlist (i) as test data set, remaining k-1 characteristic Training dataset is combined into according to collection group.

In an embodiment of the present invention, in the step S4, Recall(R), F-measure, Precision(P) and Accuracy index, calculation method are as follows:

Recall(R)=TP/(TP+FN)

F-measure=2P*R/(P+R)

Precision(P)=TN/(TN+FN)

Accuracy=(TP+TN)/(TP+FN+FP+TN)；

Wherein, what TP was indicated is that wooden horse net is correctly detected as the number of wooden horse net；FP indicates that wooden horse net is mistakenly detected as The number of normal net；FN indicates that normal net is mistakenly detected as the number of wooden horse net；TN indicates that normal net is normally identified For the number of wooden horse net.

In an embodiment of the present invention, in the step S1, defining effective wooden horse net is net inside wooden horse circuit, is based on Effective wooden horse net carries out the division of the positive negative sample of data set, wherein wooden horse net is negative sample, and normal net is positive sample.

Compared to the prior art, the invention has the following advantages: the present invention is to effective wooden horse line in gate level netlist Net is defined, and is effectively detected using XGBoost to gate level netlist hardware Trojan horse, and gate leve net is further improved The detection effect of table hardware Trojan horse；The present invention can preferably examine hardware Trojan horse in the integrated circuit gate level netlist design phase It surveys, compared to the rear silicon detection method in existing hardware Trojan detecting method, the present invention does not depend on gold plaque as object of reference, cost It is low, do not need special detection device and not affected by noise, and this efficiency of algorithm and accuracy rate are high, while the present invention is also Hardware Trojan horse suitable for VLSI detects.

Detailed description of the invention

Fig. 1 RS232-T1000 gate level netlist wooden horse circuit diagram.

Fig. 2 gate level netlist hardware Trojan horse overhaul flow chart.

Fig. 3 confusion matrix.

Specific embodiment

With reference to the accompanying drawing, technical solution of the present invention is specifically described.

Fig. 1, the present invention in define effective wooden horse net in gate level netlist.Typical wooden horse is by trigger circuit and load electricity Road composition.Load circuit converts it into effective trigger signal of loading section by the signal specific in monitoring normal circuit, To activate hardware Trojan horse.Therefore it is net inside wooden horse circuit that effective wooden horse net is defined in the present invention, and dotted line net is in Fig. 1 For effective wooden horse net.The division of the positive negative sample of data set is carried out based on effective wooden horse net, wherein wooden horse net is negative sample, just Normal net is positive sample.

Referring to figure 2., the present invention provides a kind of gate level netlist hardware Trojan horse detection method based on XGBoost, feature It is, comprising the following steps:

Step 1: according to 51 Trojan characteristics in document [3], integrated circuit gate level netlist being parsed, different gate leves are acquired The characteristic data set of each net in netlist；

Step 2: using leaving-one method, gate level netlist characteristic data set is divided into training dataset and test data set.Specific practice, The characteristic data set that different gate level netlists extract is denoted as netlist (1), netlist (2) ... netlist (k), to data Collection carries out the combination grouping of k kind, carries out k experiment.Wherein, i-th kind of grouping situation is to regard netlist (i) as test data set, Remaining k-1 netlist data collection group is combined into training dataset；

Step 3: XGBoost classifier being trained using training dataset, obtains initial gate level netlist hardware Trojan horse inspection Survey model；

Step 4: the gate level netlist hardware Trojan horse detection model obtained using training carries out the inspection of hardware Trojan horse to test data set It surveys, the statistics of test result is carried out according to the confusion matrix of Fig. 3.In confusion matrix, what TP was indicated is that wooden horse net is correctly detected For the number of wooden horse net；FP indicates that wooden horse net is mistakenly detected as the number of normal net；FN indicates that normal net is examined by mistake Survey the number for being wooden horse net；TN indicates that normal net is normally identified as the number of wooden horse net.According to testing result obscure square Battle array, can be calculated Recall(R), F-measure, Precision(P) and Accuracy index.The wherein meter of four indexs Calculation method is as follows:

Recall(R)=TP/(TP+FN)

F-measure=2P*R/(P+R)

Precision(P)=TN/(TN+FN)

Accuracy=(TP+TN)/(TP+FN+FP+TN)；

Step 5: if the Recall (R) for the k group test data set that step 4 is calculated, F-measure, Precision (P) and The average result of Accuracy is relatively low, then carries out parameter adjusting and optimizing to gate level netlist hardware Trojan horse detection model；

Step 6: gate level netlist file to be detected being carried out to the extraction of characteristic data set, and data set is input to trained optimization In gate level netlist hardware Trojan horse detection model afterwards, it is possible to determine that be containing hardware Trojan horse in the gate level netlist file.

Experiment simulation:

The first step acquires the characteristic data set of each net in different netlists.The gate level netlist file foundation that Trust-HUB is provided 51 Trojan characteristics of document [3] are parsed, and the characteristic data set of each net in different gate level netlists is acquired.Table 1 lists reality Gate level netlist used in testing has counted the quantity of normal net and wooden horse net in different netlists.Feature is carried out to each netlist to mention After taking, the .csv file for corresponding to each netlist is obtained.52 column datas are shared in this document, preceding 51 column indicate each net in the netlist 51 characteristic values, the 52nd is classified as class label column, and normal wooden horse net is labeled as 0, and wooden horse net is labeled as 1.The line number of this document For net number all in corresponding netlist.For example, sharing 313 row sample datas (normal net number and wood in RS232-T1000.csv The summation of horse net number), every a line sample data has 51 characteristic values and 1 class label.

The division of second step, training sample and test sample.The test sample of this experiment be gate level netlist containing wooden horse and Two class of gate level netlist without wooden horse.We by 12 netlists containing wooden horse preceding in 23 netlists in table 1 according to leaving-one method into The division of row training set and the test set of the netlist containing wooden horse.For example, when the data set of RS232-T1000 netlist is as test set When, remaining 11 netlist data assembles the training that a training set carries out model.The data set of each netlist in turn as The test set of the netlist containing wooden horse, thus altogether carry out 12 times model training and test, finally by 12 times test result into Row sum-average arithmetic obtains the model to the detection effect of the netlist containing wooden horse, as shown in table 2.Latter 11 in table 1 are free of wooden horse Netlist tests 11 netlists without wooden horse primarily as test set, by trained model, by by 11 realities The result tested carries out sum-average arithmetic, obtains the model to the detection effect for being free of wooden horse netlist, as shown in table 3.

The 1 difference normal net of gate level netlist of table and wooden horse net data statistic

Gate level netlist	Normal net quantity	Wooden horse net quantity
			RS232-T1000	303	10
RS232-T1100	310	11
			RS232-T1200	310	13
RS232-T1300	309	7
			RS232-T1400	306	12
RS232-T1500	311	11
			RS232-T1600	311	10
s35932-T100	6409	13
			s35932-T200	6405	12
s35932-T300	6405	37
			s38417-T100	5799	11
s38417-T200	5802	11
			free-RS232-T1000	313	0
free-RS232-T1100	314	0
			free-RS232-T1200	316	0
free-RS232-T1300	308	0
			free-RS232-T1400	312	0
free-RS232-T1500	316	0
			free-RS232-T1600	310	0
free-s15850	2419	0
			free-s35932	6405	0
free-s38417	5798	0
			free-s38584	7343	0

2 present invention of table is directed to the testing result of the netlist containing wooden horse

Gate level netlist	TN	FP	FN	TP	Recall	F-measure	Precision	Accuracy
									RS232-T1000	298	7	1	9	90.0%	69.2%	56.3%	97.5%
RS232-T1100	309	1	0	11	100.0%	95.7%	91.7%	99.7%
									RS232-T1200	310	0	0	13	100.0%	100.0%	100.0%	100.0%
RS232-T1300	309	0	0	7	100.0%	100.0%	100.0%	100.0%
									RS232-T1400	306	0	0	12	100.0%	100.0%	100.0%	100.0%
RS232-T1500	308	3	0	11	100.0%	88.0%	78.6%	99.1%
									RS232-T1600	311	0	1	9	90.0%	94.7%	100.0%	99.7%
s35932-T100	6409	0	2	11	84.6%	91.7%	100.0%	100.0%
									s35932-T200	6405	0	11	1	8.3%	15.4%	100.0%	99.8%
s35932-T300	6403	2	2	35	94.6%	94.6%	94.6%	99.9%
									s38417-T100	5790	9	2	9	81.8%	62.1%	50.0%	99.8%
s38417-T200	5797	5	2	9	81.8%	72.0%	64.3%	99.9%
									Average value	-	-	-	-	85.9%	81.9%	86.3%	99.6%

Testing result of 3 present invention of table for the netlist without wooden horse

Gate level netlist	TN	FP	FN	TP	Recall	F-measure	Precision	Accuracy
									free-RS232-T1000	312	1	0	0	0.0%	0.0%	0.0%	99.7%
free-RS232-T1100	306	8	0	0	0.0%	0.0%	0.0%	97.5%
									free-RS232-T1200	310	6	0	0	0.0%	0.0%	0.0%	98.1%
free-RS232-T1300	302	6	0	0	0.0%	0.0%	0.0%	98.1%
									free-RS232-T1400	304	8	0	0	0.0%	0.0%	0.0%	97.4%
free-RS232-T1500	308	8	0	0	0.0%	0.0%	0.0%	97.5%
									free-RS232-T1600	306	4	0	0	0.0%	0.0%	0.0%	98.7%
free-s15850	2419	0	0	0	0.0%	0.0%	0.0%	100.0%
									free-s35932	6405	0	0	0	0.0%	0.0%	0.0%	100.0%
free-s38417	5798	0	0	0	0.0%	0.0%	0.0%	100.0%
									free-s38584	7343	0	0	0	0.0%	0.0%	0.0%	100.0%
Average value	-	-	-	-	-	-	-	98.8%

Third step, training XGBoost classifier, and commented according to Recall, F-measure, Accuracy and Precision tetra- Valence index is adjusted the parameter of classifier.By the adjustment of many experiments, for the XGBoost classifier of the netlist containing wooden horse Parameter setting are as follows:

“max_depth=2”,“lambda=10”,“subsample=1”,“colsample_bytree=1”,“min_child_ weight=1”,“learning_rate=0.01”,“nthread=8”,“n_estimators=500”,“scale_pos_ weight=214","num_boostround=5000"；

For the parameter setting of the XGBoost classifier without wooden horse netlist are as follows:

“max_depth=10”,“lambda=10”,“subsample=0.85”,“colsample_bytree=0.75”,“min_ child_weight=2”,“learning_rate=0.001”,“nthread=8”,“n_estimators=500” ,“num_ boostround=5000”。

Table 2 and table 3 list the present invention for the hardware Trojan horse netlist containing wooden horse and for the hardware for being free of wooden horse respectively The detection effect of wooden horse netlist.We can see that the present invention can obtain 85.9%Recall for the netlist containing wooden horse, The detection effect of 86.3%Precision, 81.9%F-measure and 99.6%Accuracy.The present invention is directed to without wooden horse Netlist can obtain the detection effect of 98.8%Accuracy.The present invention is to RS232-T1200, RS232-T1300, RS232- These netlists of T1400, free-s15850, free-s35932, free-s38417 and free-s38584 can be accurate Identify normal net and wooden horse net, there is no erroneous judgement situations.

The above are preferred embodiments of the present invention, all any changes made according to the technical solution of the present invention, and generated function is made When with range without departing from technical solution of the present invention, all belong to the scope of protection of the present invention.

Claims

1. a kind of gate leve hardware Trojan horse recognition method based on XGBoost, which comprises the steps of:

2. a kind of gate leve hardware Trojan horse recognition method based on XGBoost according to claim 1, which is characterized in that institute It states in step S1, N takes 51.

3. a kind of gate leve hardware Trojan horse recognition method based on XGBoost according to claim 1, which is characterized in that institute State the specific implementation of step S2 are as follows: by the characteristic data set that different gate level netlists extract be denoted as netlist (1), Netlist (2) ... netlist (k) carries out the combination grouping of k kind to characteristic data set, carries out k experiment；Wherein, i-th kind of grouping Situation is by netlist (i) as test data set, remaining k-1 characteristic data set group is combined into training dataset.

4. a kind of gate leve hardware Trojan horse recognition method based on XGBoost according to claim 1, which is characterized in that institute State in step S4, Recall(R), F-measure, Precision(P) and Accuracy index, calculation method it is as follows:

Recall(R)=TP/(TP+FN)

F-measure=2P*R/(P+R)

Precision(P)=TN/(TN+FN)

Accuracy=(TP+TN)/(TP+FN+FP+TN)；

5. a kind of gate leve hardware Trojan horse recognition method based on XGBoost according to claim 1, which is characterized in that institute It states in step S1, defining effective wooden horse net is net inside wooden horse circuit, carries out the positive negative sample of data set based on effective wooden horse net Division, wherein wooden horse net be negative sample, normal net be positive sample.