A Command-Activated Hardware Trojan Detection Method Based on LUNAR Framework

Hardware Trojans have become a major challenge to ICs due to their serious damage to the reliability and security. However, hardware Trojans can be activated in a variety of ways, making accurate activation of hidden hardware Trojans extremely difficult. In this paper, we propose an automatic anomaly detection method based on LUNAR (Learnable Unified Neighborhood-based Anomaly Ranking) based on graph neural networks to efficiently, quickly, accurately, and automatically detect unknown commands secretly inserted by untrusted parties. This method could effectively detect the command-activated hardware Trojans, which are the most frequently used activation mode. While retaining the linear time complexity advantage of PBCS (Pruning Bytes Command Search), we try to use neighbor information in a trainable way to find anomalies in each node, which could effectively reduce manual intervention in unsupervised conditions. Our experiments mainly focus on the preprocessed waveform sets with obvious features, Gaussian noise waveform sets with weak features, and original waveform sets without any obvious features. The results show that the LUNAR framework can detect anomalies significantly better than One-Class SVM, Isolation Forest and Local Outlier Factor, which are easily affected by parameter adjustment, especially in scenarios with no preprocessing and no obvious features.