A Deep Learning Method Based on the Attention Mechanism for Hardware Trojan Detection

Abstract

The chip manufacturing of integrated circuits requires the participation of multiple parties, which greatly increases the possibility of hardware Trojan insertion and poses a significant threat to the entire hardware device landing; however, traditional hardware Trojan detection methods require gold chips, so the detection cost is relatively high. The attention mechanism can extract data with more adequate features, which can enhance the expressiveness of the network. This paper combines an attention module with a multilayer perceptron and convolutional neural network for hardware Trojan detection based on side-channel information, and evaluates the detection results by implementing specific experiments. The results show that the proposed method significantly outperforms machine learning classification methods and network-related methods, such as SVM and KNN, in terms of accuracy, precision, recall, and F1 value. In addition, the proposed method is effective in detecting data containing one or multiple hardware Trojans, and shows high sensitivity to the size of datasets.

1. Introduction

With the advancement in today’s technology, both simple appliances in daily life and precision instruments in the military and industrial fields are trying to achieve higher application values by inserting better performance chips [1]. Since ICs manufactured by third-party companies have tremendous advantages in terms of manufacturing costs and time to market, many foundries have emerged, making the design, manufacturing, packaging, and testing stages of ICs separate from each other [2]. A hardware Trojan refers to the intentional modification of an original circuit or the implantation of dangerous codes by an attacker during the designing and manufacturing of an integrated circuit chip. A hardware Trojan causes a circuit chip to have redundant circuits that do not belong to the function of the chip, such that its circuit has some uncontrollable behaviors, such as destroying the original circuit logic structure of the underlying chip and modifying the parameters. Hardware Trojans have the characteristics of destructiveness, latency, mutability, and parasitism [3,4]. Once a hardware Trojan attacks an IC, it can lead to device function and performance changes, the leakage of sensitive information, and even system paralysis, which can seriously threaten production life [5].

The production chain of modern chip circuits is shown in Figure 1 [6]. The first and most crucial step in IC design is the specification. The requirements analysis of the chip and the definition of the product specifications are conducted to determine the overall direction of the design to ensure that the design of the chip will not include any mistakes, and so that there will not be the need to spend extra time modifying it. Subsequently, a hardware description language (HDL) is used to describe the circuit, and the specification is converted into the behavior level of the circuit. The commonly used HDL is Verilog, VHDL, etc. Next, a computer converts the HDL code into a logic circuit and the behavior level into a logic gate design. Following this, the synthesized code is put into another EDA tool for circuit layout and winding. Finally, a digital graphics database system (GDSII) is provided to the foundry for IC development so that the presilicon manufacturing stage is completed. The postsilicon stage includes three steps: factory manufacturing, chip packaging testing, and market entry [7,8,9,10,11,12]. The production process involves several third-party foundries, significantly increasing the risk of hardware Trojan insertion, and chip circuit security detection is urgent.

There have been various studies carried out to date to attempt to overcome the HT problem. Rongzhen Bian et al. [13] used unsupervised clustering algorithms to identify hardware Trojans, which gather structural data from a collection of unlabeled ICs and then separate the suspect ICs from the test ICs. Kyle Worley et al. [14] objectively compared four supervised machine learning techniques (FPR) to increase the accuracy and decrease the false positive rate. Using unlabeled manufactured ICs and imprecise simulation models, Mingfu Xue et al. [15] offered a cotraining-based hardware Trojan detection system that trains two classification algorithms using simulated ICs. Hau Sim Choo et al. [16] proposed utilizing machine learning and features to detect RTL Trojans using four branching-statement-related characteristics. The identification approach can categorize a branch as either a Trojan branch or a regular branch. Tomotaka Inoue et al. [17] generated six different types of hardware Trojans at the gate-level netlist level and used an approach based on a neural network (NN) to detect them. Antonios Pavlidis et al. [18] proposed a runtime monitoring approach for HT attack methods that impact the analog and mixed-signal (AMS) parts of an integrated circuit, which can identify different HT assaults.

The attention mechanism calculates the difference in the importance of each piece of input information, allocates computing resources according to their importance, uses the execution effect to reverse the information weight update, and finally completes the task efficiently and accurately [19]. In recent years, the attention mechanism has been widely used in deep learning, such as in fault detection, target detection, face recognition, text classification, and so on, and has achieved excellent results.

In order to extract the compelling features of side-channel information, improve the detection accuracy, and at the same time reduce the network model parameters, this paper proposes a deep learning method based on the attention mechanism for hardware Trojan detection. By analyzing the obtained side-channel information and improving the two different neural network models, the attention mechanism is introduced to further improve the network discrimination ability and achieve higher-precision detection tasks. This paper’s method validation experiments were carried out based on collected side-channel datasets. The results show that, compared with other machine learning methods and network-related methods, the accuracy, precision, recall, and F1 value of this method are improved. In addition, it also has high accuracy when dealing with multiclassification tasks.

The organizational structure of this paper is as follows: the second part is the background, the third part introduces the hardware Trojan detection method proposed in this paper, the fourth part is the analysis of the algorithm flow, the fifth part is the analysis of the experimental results, and the sixth part is the conclusion.

2. Background

2.1. Hardware Trojan Architecture

The hardware Trojan mentioned in this paper consists of two parts—a trigger and a payload [20]—and its structure is shown in Figure 2. The function of the trigger is to activate the load circuit to run. If the activation conditions do not meet its specific requirements, the load circuit cannot work in a dormant state. If the requirements are met, the load circuit is activated [21]. The function of the load circuit is a specific attack on the original circuit after the Trojan is activated, that is, the function module of the hardware Trojan [22].

2.2. Hardware Trojan Detection Technology

Hardware Trojan detection methods can be divided into presilicon and postsilicon detection, according to different stages [23]. Detection methods in the presilicon stage include formal verification, functional verification, and coding/structure analysis, whereas detection methods in the postsilicon stage include reverse engineering, logic testing, and side-channel analysis [24]. Specific methods are as follows:

2.2.1. Presilicon Detection

• Formal Verification

Formal verification is an automated checking method that catches many common design errors and finds ambiguities in the design. The authors of [25] present a fully automated formal verification approach to detect the presence of hardware Trojans in a third-party behavioral IP (3PBIP), in the absence of a golden reference IP, using some advanced HLS tools, including formal verification tools to detect malicious modifications made to a 3PIP. The authors of [26] concentrate on formal hardware Trojan detection in the design phase and emphasize highlighting the application of verification techniques to abstract and formalize Trojan designs into mathematical structures, as well as using reachability analysis and equivalence checks to detect the presence or absence of hardware Trojans.

• Functional Verification

The principle concept of functional verification is the same as that of logic testing described in postsilicon technology. Logic testing is performed on a tester and requires the collection of output responses for each input pattern, whereas functional verification is performed by a simulation using existing functional testing techniques [27].

• Coding/Structure Analysis

The authors of [28] proposed a classification method based on Unused Circuit Identification (UCI), a hybrid hardware and software method that separates suspicious circuits at runtime and compensates for UCI classifier errors—BlueChip. UCI marks new circuits (circuits that are not activated by design verification tests) as suspicious circuits. The BlueChip exception handling software is responsible for simulating the overall behavior of the hardware to allow the system to be used properly.

2.2.2. Postsilicon Detection

• Reverse Engineering

Reverse engineering, also known as failure analysis, is a violently irreversible physical testing method. By sampling some of the products from the same batch of test chips, the sampled products are dissected in layers from the bottom up [29]. The purpose of dissection is to obtain specific layout information, such that the logical structure of the circuit can be analyzed. The circuit design structure obtained after the dissection of the sample is compared with the original design file to determine whether they are identical [30].

• Logic Testing

Logic testing is performed on the digital logic layer of the IC. It focuses on detecting and activating hardware Trojans by generating guided test vectors and comparing the raw output generated by these vectors with the desired output [31]. This method can detect the presence of the Trojan and know the type of the structure of the Trojan as well as the area where it is implanted [32].

• Side-Channel Analysis

Side-channel information is the external physical characteristics revealed due to the operation of the circuit and commonly includes time consumption information, power consumption information, and electromagnetic information [33]. In the same experimental setting, the original circuit generates a set of inherent physical characteristic information when it operates. Similarly, the additional physical information generated by the hardware Trojan module will differ from the side-channel information of the original circuit. By comparing this difference, it is possible to distinguish whether the circuit contains a hardware Trojan [34,35]. Given the advantages of its high accuracy, high speed, and low price, side-channel analysis is gradually becoming the main direction of hardware Trojan detection research.

2.3. Attention Mechanism

The attention mechanism borrows from the signal processing mechanism of the human brain by quickly scanning all features, obtaining the feature categories that need to be focused on, and assigning the corresponding attention weights according to the criticality of the feature categories, such that the brain can use limited resources to process huge amounts of information [36]. In simple terms, the attention mechanism will focus more on the focused regions by reducing the attention level in some regions to obtain more important information. Its application in convolutional neural networks is reflected in generating differences in the importance of each piece of input information [37]. The prominent role of the attention mechanism is to effectively fuse the side-channel information collected by the sensors by suppressing the information that is not related to the Trojan and highlighting the information that is closely associated with the Trojan information. The principle of the attention module implementation is shown in Figure 3.

3. Hardware Trojan Detection Model

3.1. MLP-Attention Detection Model

A multilayer perceptron, also known as an artificial neural network and a deep feedforward network, is the most fundamental class of deep learning models, with broad applications in recognition and prediction problems [38,39]. It consists of three parts: an input layer, one or more hidden layers, and an output layer. The number of hidden layers can be single or multiple layers, and the layers are connected, utilizing full connectivity. The input layer is responsible for receiving input information, and the output of the previous layer continues to be used as the input of the next layer for passing information between them progressively until the output layer outputs the target result [40].

The hardware Trojan detection model proposed in this paper, based on MLP-Attention, adds the attention mechanism between the input layer and the first hidden layer, which obtains more critical features and improves the efficiency of hardware Trojan detection. As shown in Figure 4, the MLP-Attention network structure includes an input layer, multiple hidden layers, and an output layer. The layers are connected in the same fully connected way. First, the training data are fed into the input layer of MLP-Attention to obtain the attention distribution of the input data and the importance of each feature. For this layer, we set the number of the units to three. Then, the attention distribution from the first layer is stitched with the product of the input data to obtain the intermediate data with the attention influence factor. These data are then processed again by the intermediate hidden layer and then to the final output layer for classification prediction. For the first middle layer, we set the number of the units to 20. For the second middle layer, we set the number of the units to 50. For the output layer, we set the number of the units to 2 or more. The detection of hardware Trojans is a binary classification problem, so we use the softmax activation function in the last output layer to obtain the probability of Trojan insertion, and the expression of softmax is as follows:

$$softmax({\eta }_i)=\frac{e^{{\eta }_i}}{{\displaystyle \sum _{j=1}^k{e}^{{\eta }_j}{}_{}}}$$

(1)

The probability sum of the classifications is one. The output result with the Trojan insertion circuit is one, and, conversely, the output result without the Trojan insertion circuit is zero. After 50 iterations, the model reaches the convergence state. Finally, in the testing phase, we input the test set into the previously trained MLP-Attention model for hardware Trojan classification detection and obtain the final detection results.

3.2. CNN-Attention Detection Model

The convolutional neural network is the first multilayer neural network structure learning algorithm, including an input layer, convolutional layer, pooling layer, fully connected layer, and output layer, as well as multilayer cooperation to build a deep learning framework [41]. Convolutional neural networks can be used to analyze network data through the construction of learning networks, which can identify and process data parameters to meet the comprehensive needs of data analysis and information processing [42].

The CNN-Attention-based hardware Trojan detection model proposed in this paper is shown in Figure 5. The input layer receives data. After obtaining the side-channel input information, three convolutional layers are used to extract the side-channel information features. The activation function used in each convolutional layer is the ReLU activation function, and the stride is two. A pooling layer follows each convolutional layer to filter the extracted side-channel information and the useless features. The pooling function of the pooling layer is usually set to reduce the dimensionality of the convolutional output and make the data compact. The pooling layer chosen for this method is the highest pooling layer, which is used to reduce the estimated mean bias caused by errors in the training process of the convolutional layers. After the convolution and pooling layers, we add the attention module to give higher weights to the more important feature information to extract side-channel information better. We use the softmax function to activate the output data of the third convolution layer and multiply it by itself to obtain more attention information. A fully connected layer follows the attention module. Finally, the probability of the presence or absence of a Trojan insertion is obtained using the softmax activation function. For multiple Trojans, the total classification probability is still one. In the training process, the number of iterations is set to 80, and the model parameters are shown in

Table 1. Hyperparameter selection.

Hyperparameter	Value
Epoch	80
Learning_rate	0.001
Filters1	16
Kernel_size1	8
Filters2	64
Kernel_size2	4
Filters3	256
Kernel_size3	4
Dropout_rate	0.3
Dense_units	128
Output_units	2

.

4. Hardware Trojan Detection Flow

The specific flow of the proposed deep learning method based on the attention mechanism for hardware Trojan detection is shown in Figure 6, and the implementation steps are as follows:

• Step 1: Data Acquisition Stage

Collecting raw side-channel information data and normalizing it using a side-channel information collection device. The normalized data are divided into a labeled training set and an unlabeled test set in a ratio of 7:3. The training set is used for model training, and the test set is used for the subsequent testing of the model’s performance.

• Step 2: Model Training Stage

The maximum number of iterations, epoch values, and weights in the loss function are set empirically to initialize the parameters of the neural network and attention layers. Input the training set data, calculate the classification loss, and update the weights as well as bias parameters layer-by-layer by using backpropagation. Repeat the above steps until the maximum number of iterations is reached to stop training and obtain the trained classification model.

• Step 3: Hardware Trojan Detection Stage

Input the test-set data of the chip to be tested, use the trained classification model to classify and judge them, and detect whether the chip contains a hardware Trojan.

5. Results

5.1. Experimental Environment

The experiments in this paper use a Windows 10 operating system. The processor is an Intel(R) Core(TM) i7-5557U CPU @ 3.10 GHz. The memory is 8.0 GB. The engineering software is Pycharm, using the deep learning framework Tensorflow to build an MLP-Attention model and a CNN-Attention model; the machine learning library Sklearn is used to build the comparison experiments.

5.2. Data Acquisition and Preprocessing

This paper is based on a field-programmable gate array (FPGA) detection platform to obtain experimental data. The side-channel information collection system [43,44] has a SAKURA-G FPGA board specially designed for research and development on side-channel security analysis. Both power and electromagnetic radiation are collected using an oscilloscope. Then, the collected data are transferred to a PC and stored in a CSV format for further analysis.

The Trojan circuit is first implanted into the original circuit in the data acquisition process. Then, this circuit is transplanted into the FPGA chip, and the process of running the circuit causes the Trojan to be activated. The chip to be tested is the core component of the system. In the acquisition test, the probe end should be made as close as possible to the FPGA chip in this position, and the oscilloscope should be used to display and store the side-channel data generated during the operation of the circuit in real time according to the set sampling frequency. The format of the side-channel information is then converted to obtain the original input parameters required for preprocessing.

5.3. Experimental Results and Analysis

In order to further analyze the classification performance of the proposed method, we compare the classification results of the current mainstream machine learning classification methods for the dataset used in the experiments [45].

Table 2. Acronym for different classification methods.

Acronym	Definition
CNN	Convolutional neural network
CNN-Att	CNN-Attention
GB	Gradient boosting
KNN	K-nearest neighbors
LR	Logistic regression
MLP	Multilayer perceptron
MLP-Att	MLP-Attention
RF	Random forest
SVM	Support vector machine

discloses the methods in this paper and the six machine learning methods used for comparison, along with their corresponding abbreviations. The parameters of the machine learning models in the experiments are shown in

Table 3. Model parameters of different classification models.

Model Name	Model Parameters
GB	Number of decision trees	6
	Learning rate	0.1
KNN	Number of neighbors	8
	Distance measure	ED 1
LR	Number of decision trees	6
	Learning rate	0.1
RF	Max depth of tree	10
	Number of decision trees	10

¹ ED is Euclidean distance.

.

In order to verify the effectiveness of the attention module, this paper embeds the fully connected neural network and deep convolutional neural network as the base network, respectively, into the attention module and conducts comparative experiments on the dataset. In this paper, we use the MLP-Att and CNN-Att classification methods in addition to several machine learning classification methods to process the dichotomous classification task, and count the classification results to determine whether the experimental data contain hardware Trojans.

Table 4. Classification results of different classification methods.

Model Name	Accuracy (%)	Precision (%)	Recall (%)	F1 Score (%)
CNN	80.31	81.20	80.77	80.93
CNN-Att	85.17	85.50	85.36	84.22
GB	68.09	66.94	63.22	63.28
KNN	66.55	66.07	62.48	62.43
LR	63.79	62.88	57.36	55.21
MLP	76.08	75.90	69.86	72.63
MLI-Att	84.87	85.13	84.87	84.89
RF	68.21	66.80	63.80	64.01
SVM	62.46	60.00	54.69	51.44

shows the accuracy, precision, recall, and F1 value of hardware Trojan detection using different classification algorithms.

As can be seen from Table 4, the accuracy, precision, recall, and F1 value of the hardware Trojan detection method with the attention mechanism are significantly better than those of several other machine learning methods. In addition, the experiments show that the improved MLP-Att and CNN-Att methods both have higher detection effects than the base network, which proves the effectiveness of the improved method in this paper.

We extend the experimental data from one class to multiple ones to further evaluate the performance of the proposed method in this paper for multi classification problems. Specifically, we combine four different types of Trojan data with each other and then classify them using the MLP-Att and CNN-Att classification methods.

Table 5. Classification results of different datasets with MLP-Att.

Mix of Trojan	Accuracy (%)	Precision (%)	Recall (%)	F1 Score (%)
1-2	84.32	82.35	85.25	83.77
1-3	85.32	85.61	86.12	85.71
1-4	82.11	82.67	81.76	80.05
2-3	84.20	83.23	82.93	82.77
2-4	84.16	84.49	84.22	81.65
3-4	84.36	83.78	82.67	82.91
1-2-3	84.53	83.16	87.78	85.41
1-2-4	84.17	83.55	86.29	84.90
1-3-4	84.36	84.63	86.03	85.32
2-3-4	81.25	81.25	89.32	85.09
1-2-3-4	82.68	82.10	84.56	83.34

and

Table 6. Classification results of different datasets with CNN-Att.

Model Name	Accuracy (%)	Precision (%)	Recall (%)	F1 Score (%)
1-2	84.50	84.31	84.22	81.87
1-3	85.20	85.99	83.29	83.79
1-4	82.15	82.06	80.58	79.80
2-3	82.31	81.44	85.36	83.36
2-4	82.02	82.34	82.80	82.46
3-4	83.95	83.12	83.05	83.09
1-2-3	84.57	86.01	92.43	87.62
1-2-4	85.68	82.74	85.30	85.45
1-3-4	87.52	87.38	84.27	85.80
2-3-4	86.27	86.84	87.03	86.94
1-2-3-4	83.73	83.33	82.60	82.97

are the classification results of the two methods, where 1-2 indicates that the dataset includes two types of Trojan data: Trojan 1 and Trojan 2; 1-2-3 indicates that the dataset includes three types of Trojan data: Trojan 1, Trojan 2, and Trojan 3; and 1-2-3-4 indicates that the dataset includes four types of Trojan data: Trojan 1, Trojan 2, Trojan 3, and Trojan 4.

From Table 5, it can be seen that the proposed MLP-Att method has the highest accuracy and precision on the dataset containing Trojan 1 and Trojan 3; the lowest accuracy and precision on the dataset containing Trojan 2, Trojan 3, and Trojan 4; the highest recall on the dataset containing Trojan 2, Trojan 3, and Trojan 4; the lowest recall on the dataset containing Trojan 1 and Trojan 4; the highest F1 value on the dataset containing Trojan 1 and Trojan 3; and the lowest F1 value on the dataset containing Trojan 1 and Trojan 4.

From Table 6, it can be seen that the proposed CNN-Att method has the highest accuracy and precision on the dataset containing Trojan 1, Trojan 3, and Trojan 4; the lowest accuracy on the dataset containing Trojan 2 and Trojan 4; the lowest precision on the dataset containing Trojan 2 and Trojan 3; the highest recall and F1 value on the dataset containing Trojan 1, Trojan 2, and Trojan 3; and the lowest recall and F1 value on the dataset containing Trojan 1 and Trojan 4.

Combining Table 5 with Table 6, the deep learning method based on the attention mechanism for hardware Trojan detection gives better performance on each mixed dataset, further proving the effectiveness of this method.

In addition, a sensitivity analysis experiment of dataset size and model performance was conducted to observe the influence of different numbers of training sets on the model’s detection accuracy. It can be seen from Figure 7 that, with the increase in the training set data, the detection accuracy of all of the models is improved to a certain extent, and that the CNN-Att model is the most sensitive to the size of the data, with a detection accuracy difference of 60.8%.

As shown in

Table 7. Classification results of network-related methods.

Model Name	Accuracy (%)	Precision (%)	Recall (%)	F1 Score (%)
CNN-Att	85.17	85.50	85.36	84.22
MLI-Att	84.87	85.13	84.87	84.89
[46]	74.01	75.33	72.06	77.84
[47]	81.85	79.82	79.29	80.46
[48]	84.79	81.99	80.06	79.52

, this paper also makes a comparison with network-related methods. The same dataset that was used in the experiment in this paper was used in all comparative experiments. Additionally, it is seen to be the case that, compared with the literature [46,47,48], the proposed detection model improves the detection accuracy effectively.

6. Conclusions

Hardware Trojan detection is essential for the manufacturing and safe use of IC chips. In this paper, we propose a deep learning method based on the attention mechanism for hardware Trojan detection in a multilayer perceptron and convolutional neural network to verify the impact of this method on hardware Trojan classification performance. The experiments show that, compared with other machine learning classification methods and network-related methods, the proposed method in this paper has significantly improved detection accuracy, precision, recall, and F1 value, and is also applicable to multiclassification tasks. However, the improved method proposed in this paper has a significant time overhead in finding the optimal parameters and requires relatively high hardware computing power, memory bandwidth, and data storage. The detection cost is magnified to some extent. In later work, we will further analyze the characteristics of the experimental data, explore more available information on the existing bases, reduce the detection costs in many aspects, and further improve the generality of the hardware Trojan detection method.