Hardware Security Meets Incomplete Netlists: Insights into Trojan Detection via Structural Reasoning

In order to better utilize the achievements of various countries and lower costs, the integrated circuit (IC) design and manufacturing process is based on a global supply chain model, highly relying on untrusted third parties, such as intellectual property (IP) cores, electronic design automation (EDA) tools, and employees. This globalized model creates lots of opportunities for the prosperity of hardware Trojans (HTs). However, existing countermeasures were all accomplished under some assumptions, such as finding HTs in a complete netlist. In practical industry scenarios, netlists may be obtained through reverse engineering, which has inherent limitations, including imaging resolution and inaccurate recognition of interconnections, making it almost impossible to obtain a complete netlist to detect whether HTs exist. Evidently, studying how to find HTs from incomplete netlists should be a reasonable, notable, critical and practical issue for the IC security research community. Addressing this problem entails substantial challenges. This paper is the first to propose the problem of detecting HTs with incomplete netlists, and also presents an effective approach named HTINS, which infers and completes incomplete circuit structures and utilizes the completed information for HTs detection. The method leverages GraphVAE to reconstruct incomplete netlist components and performs circuit feasibility validation on the reconstructed components. Local features are then extracted from the completed circuits and classified via a graph neural network. In the experiments, netlist components are randomly removed to set netlists with 1%, 5%, and 10% missing ratios, and the performance of HT detection on the completed netlists is evaluated under these conditions. Experimental results demonstrate that the proposed method can effectively reconstruct incomplete netlists and significantly improve HT detection performance.