Hardware Trojan Detection Using Changepoint-Based Anomaly Detection Techniques

There has been a growing trend in recent years to outsource various aspects of the semiconductor design and manufacturing flow to different parties spread across the globe. Such outsourcing increases the risk of adversaries adding malicious logic, referred to as hardware Trojans, to the original design. The increased complexity of modern microprocessors increases the difficulty in detecting hardware Trojans at early stages of design and manufacturing. Therefore, there is a need for run-time detection techniques to capture Trojans that escape detection at these stages. In this paper, we introduce a machine learning-based run-time hardware Trojan detection method for microprocessor cores. This approach uses changepoint-based anomaly detection algorithm to detect the activation of Trojans that introduce abnormal patterns in the data streams obtained from performance counters. It does not modify the original microprocessor design to integrate on-chip monitoring sensors. We evaluate our method by detecting the activation of Trojans that cause denial-of-service, the degradation of system performance, and change in functionality of a microprocessor core. Results obtained using the OpenSPARC T1 core and an field-programmable gate array (FPGA) prototyping framework show that the Trojan activation is detected with a true positive rate of above 99% and a false positive rate of 0% for most of the implemented Trojans.