The invention provides a hardware Trojan horse detection method and a hardware Trojan horse detection system. The method includes the following steps: collecting a by-pass signal of a to-be-detected integrated circuit; extracting features of the by-pass signal to form a feature collection; calculating mahalanobis distance values, including a mahalanobis value of a reference integrated circuit and a mahalanobis value of the to-be-detected integrated circuit, of the feature collection; comparing the mahalanobis value of the reference integrated circuit with that of the to-be-detected integrated circuit, and performing hardware Trojan horse detection according to a comparison result. By the hardware Trojan horse detection method and the hardware Trojan horse detection system which have the advantages of simple algorithm and short detection time, distinguishability and efficiency of hardware Trojan horse detection in integrated circuit testing are effectively improved, and any cost for hardware is not generated.

Hardware Trojan horse detection method and hardware Trojan horse detection system

The invention provides an integrated circuit hardware Trojan horse detection method and system. The method includes acquiring bypass information training samples of Trojan horse chips and non Trojan horse chips in the set numbers; performing main component analysis on the bypass information training samples of the non Trojan horse chips to acquire k-dimensional principal eigenvectors; calculating the feature projection of a chip to be detected of bypass information vectors of the chip to be detected on the k-dimensional principal eigenvectors of the non Trojan horse chips and the Trojan horse chip feature projection and non Trojan horse chip feature projection of the bypass information training samples of the Trojan horse chips and non Trojan horse chips on the k-dimensional principal eigenvectors of the non Trojan horse chips respectively; if K 3, judging the chip to be detected to be a Trojan horse chip or non Trojan horse chip according to the mahalanobis distance. The method is adaptive to the characteristic of uncertainty of the data dimension, the Trojan horse chip and non Trojan horse chip can be identified accurately, and the integrated circuit pattern identifying capability and efficiency are improved.

Integrated circuit hardware Trojan horse detection method and system

The invention provides a hardware Trojan horse recognition method based on a neural network. The problem that an existing recognition method does not need manual observation and is low in efficiency is solved, and recognition intelligentization of a hardware Trojan horse chip is achieved. The method comprises the following steps of first obtaining side channel information of a chip to be detected and performing data pre-processing; selecting a part of the chip to be detected to perform back subdivision analysis and confirming whether a back subdivision chip contains hardware Trojan horse or not; utilizing the back subdivision chip which does not contain the hardware Trojan horse to build a chip characteristic space through pro-processed side channel information; projecting all of chips to be detected into the characteristic space through a pro-processed side channel information matrix to obtain a side channel information characteristic data matrix; utilizing side channel information characteristic data of the back subdivision chip and a corresponding target output value to build and train the neural network; delivering the side channel information characteristic data of a tested chip to the trained neural network to be distinguished and output and achieving hardware Trojan horse recognition.

Hardware Trojan horse recognition method based on neural network

A hardware Trojan horse detection method based on a chip temperature field effect is disclosed. Based on the chip temperature field effect, a chip to be detected is firstly subjected to grid partition, then a test vector is inputted into the chip to be detected, the temperature in each grid of the chip during operation is measured to obtain a heat map of the chip, and the heat map is used for a neural network to identify Trojan horse information of the heat map. In addition, heat map sets of chips to which a Trojan horse is inputted and chips to which no Trojan horse is inputted are utilized to train the neural network, and then the trained neural network is utilized to detect the chip to be detected so as to determine whether a Trojan horse is inputted to the chip to be detected. The method has characteristics of a high detection rate and easy implementation, and can ensure correct detection of a hardware Trojan horse.

A hardware Trojan horse detection method based on a chip temperature field effect

The invention discloses a device and a method for detecting a trojan remote shell behavior. The device comprises a packet acquiring device, a data stream selecting and filtering device, a data stream character extracting device and a trojan shell behavior character detecting device. The detecting method comprises the following steps of firstly acquiring real-time network flow data of an internet access; then classifying data stream of the real-time network flow data, and filtering irrelevant protocol data stream; extracting an inlet and outlet packet load ratio, an inlet and outlet packet number ratio and a data stream answering interval in an answering and response process in each data stream; forming data stream characters extracted within certain time interval into a character vector, and inputting the character vector into a formed neural network model; finally calculating a result through the neural network model, judging whether the trojan remote shell behavior exists in the data stream or not, outputting the result, and feeding the detection result back to the data stream selecting and filtering device. The device and the method are applied to a large-scale network environment and can detect known and unknown trojan remote shell behaviors.

Device and method for detecting trojan remote shell behavior

The invention relates to a characteristic value processing method for hardware Trojan detection without a clean circuit board for comparison. A system is established for processing characteristic values acquired for hardware Trojan detection, and accordingly abnormal data are detected without the clean circuit board for comparison. Moreover, the method provides two selectable detection schemes which are a model-free detection scheme and a model detection scheme respectively, wherein the model-free detection scheme includes the steps of circularly calling various parameters (including distance functions and a classification method) by the aid of an unsupervised clustering method to obtain a clustering-based strategy highest in evaluation function, and then classifying, the model-free detection scheme is high in speed, and the precision already meet primary demand; and the model detection scheme uses a unsupervised neural network algorithm which is low in speed but high in precision, serves as an selection of the detection schemes but is not necessary, and is applicable to situations high in requirement on precision.

Characteristic value processing method for hardware Trojan detection

The invention relates to a hardware Trojan horse detection system based on puf. The system adds the puf into a plurality of modules of an integrated chip (IC) in an original IC design file, sends the IC design file with the puf to a factory for production, performs data acquisition on an IC sample produced by the factory according to the IC design file with the puf under a test mode, analyzes the acquired data through a data analysis module and outputs a judgment result; and a user judges whether the original IC design in an original data storage module is modified according to original data judged by a data judgment module and judges whether to put the original data into production. The hardware Trojan horse detection system has the advantages that the shortcomings that the conventional detection method is complicated, high in test cost and long in time period, and the original design or the original IC is needed are overcome; whether hardware Trojan horses are contained can be stably and effectively detected; naturally, the fact that the Trojan horses are very difficult to trigger is not considered; the Trojan horses are detected physically; and therefore, most hardware Trojan horses can be detected.

Hardware Trojan horse detection system based on puf

The invention relates to a sensitive element device for a bypass signal of a sensing circuit and a detection method of the sensitive element device. The sensitive element device mainly comprises a shell, a counting module which is arranged in the shell, a sensing module which is connected with the counting module, an input port and an output module, which are connected with the counting module, and an interaction control port which is connected with the sensing module, wherein the counting module is mainly used for converting an output waveform of a sensing part into a characteristic value and outputting the characteristic value; the interaction control port is a connection device of a sensitive element for circuit reaction characteristic; a port comprises input and output external ports; the input external port controls the working state of the sensitive element; the output external port outputs the characteristic value which is acquired by the sensitive element; and the sensing module is a core part, employs a ring oscillator and a delayer and is mainly embodied in the output waveform of a certain point of the circuit. The electrical characteristic of the circuit can be conveniently obtained without an additional test tool, the obtained characteristic value is stable and non-fluctuant, and a great number of labor resources and material resources are saved.

Tang Ming

Papers

Characteristic value processing method for hardware Trojan detection

Hardware Trojan horse detection system based on puf

Sensitive element device for bypass signal of sensing circuit and detection method of sensitive element device