基于XGBoost的混合模式门级硬件木马检测方法  

Hybrid Multi-level Hardware Trojan Detection Method for Gate-level Netlists Based on XGBoost

作　　者：张颖[1] 李森 陈鑫[1] 姚嘉祺 毛志明 ZHANG Ying;LI Shen;CHEN Xin;YAO Jiaqi;MAO Zhiming(College of Electronics and Information Engineering,Nanjing University of Aeronautics and Astronautics,Nanjing 211106,China)

机构地区：[1]南京航空航天大学电子信息工程学院,南京211106

出　　处：《电子与信息学报》2021年第10期3050-3057,共8页Journal of Electronics & Information Technology

基　　金：国家自然科学基金(61701228,61106029);模拟集成电路重点实验室基金(61428020304);航空科学基金(20180852005)。

摘　　要：针对恶意的第三方厂商在电路设计阶段中植入硬件木马的问题,该文提出一种基于XGBoost的混合模式门级硬件木马检测方法。该检测方法将电路的每个线网类型作为节点,采用混合模式3层级的检测方式。首先,基于提取的电路静态特征,利用XGBoost算法实现第1层级的检测。继而,通过分析扫描链的结构特征,对第1层级分离得到的正常电路继续进行第2层级的面向扫描链中存在木马电路的静态检测。最后,在第3层级采用动态检测方法进一步提升检测的准确性。Trust-Hub基准测试集的实测结果表明,该方法与现有的其他检测方法相比具有较优的木马检测率,可达到94.0%的平均真阳率(TPR)和99.3%的平均真阴率(TNR)。A hybrid multi-level hardware Trojan detection method based on XGBoost algorithm is proposed for the problem of hardware Trojans implanted by malicious third-party manufacturers.The detection method treats each wire in gate-level netlist as a node and detects Trojans in three levels.Firstly,the effective static features of the circuit are extracted and the XGBoost algorithm is applied to detect the suspicious Trojan circuits.Common circuits distinguished at the first level continued to be detected at the second level by analyzing scan chain structural features.Finally,dynamic detection is used to increase further the accuracy of Trojans detection.Experimental results on Trust-hub benchmark show that this method has a higher accuracy compared with other existing detection methods.This detection method can finally achieve 94.0%average True Positive Rate(TPR)and 99.3%average True Negative Rate(TNR).

关 键 词：硬件木马检测 XGBoost算法 门级网表 静态检测 动态检测 

分 类 号：TP309.5[自动化与计算机技术—计算机系统结构] TN47[自动化与计算机技术—计算机科学与技术]