CN112464297B - Hardware Trojan detection method, device and storage medium - Google Patents
Hardware Trojan detection method, device and storage medium Download PDFInfo
- Publication number
- CN112464297B CN112464297B CN202011495410.XA CN202011495410A CN112464297B CN 112464297 B CN112464297 B CN 112464297B CN 202011495410 A CN202011495410 A CN 202011495410A CN 112464297 B CN112464297 B CN 112464297B
- Authority
- CN
- China
- Prior art keywords
- power consumption
- consumption data
- preprocessed
- training set
- hardware trojan
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- ZXQYGBMAQZUVMI-GCMPRSNUSA-N gamma-cyhalothrin Chemical compound CC1(C)[C@@H](\C=C(/Cl)C(F)(F)F)[C@H]1C(=O)O[C@H](C#N)C1=CC=CC(OC=2C=CC=CC=2)=C1 ZXQYGBMAQZUVMI-GCMPRSNUSA-N 0.000 title claims abstract description 95
- 238000001514 detection method Methods 0.000 title claims abstract description 45
- 238000003860 storage Methods 0.000 title claims abstract description 10
- 230000002159 abnormal effect Effects 0.000 claims abstract description 57
- 238000000034 method Methods 0.000 claims abstract description 42
- 238000007781 pre-processing Methods 0.000 claims abstract description 28
- 238000004422 calculation algorithm Methods 0.000 claims abstract description 23
- 238000003064 k means clustering Methods 0.000 claims abstract description 20
- 230000008569 process Effects 0.000 claims abstract description 18
- 238000012549 training Methods 0.000 claims description 76
- 238000012360 testing method Methods 0.000 claims description 64
- 239000011159 matrix material Substances 0.000 claims description 44
- 238000009825 accumulation Methods 0.000 claims description 19
- 238000000513 principal component analysis Methods 0.000 claims description 17
- 239000013598 vector Substances 0.000 claims description 12
- 238000012545 processing Methods 0.000 claims description 9
- 238000005070 sampling Methods 0.000 claims description 9
- 238000012935 Averaging Methods 0.000 claims description 8
- 230000005856 abnormality Effects 0.000 claims description 7
- 230000009467 reduction Effects 0.000 claims description 5
- 238000004590 computer program Methods 0.000 claims description 3
- RKQKLZMMOQWTGB-HYBUGGRVSA-N diphenyl-[(1R,2S)-2-(phenylsulfanylmethyl)cyclopentyl]phosphane Chemical compound C([C@@H]1[C@@H](CCC1)P(C=1C=CC=CC=1)C=1C=CC=CC=1)SC1=CC=CC=C1 RKQKLZMMOQWTGB-HYBUGGRVSA-N 0.000 claims description 3
- 238000004458 analytical method Methods 0.000 abstract description 11
- 230000007613 environmental effect Effects 0.000 abstract description 5
- 238000005516 engineering process Methods 0.000 abstract description 2
- 238000004364 calculation method Methods 0.000 description 6
- 238000010586 diagram Methods 0.000 description 4
- 238000011161 development Methods 0.000 description 3
- 230000018109 developmental process Effects 0.000 description 3
- 238000004519 manufacturing process Methods 0.000 description 3
- 238000013461 design Methods 0.000 description 2
- 206010000117 Abnormal behaviour Diseases 0.000 description 1
- 230000015556 catabolic process Effects 0.000 description 1
- 230000008859 change Effects 0.000 description 1
- 238000012937 correction Methods 0.000 description 1
- 230000001186 cumulative effect Effects 0.000 description 1
- 238000006731 degradation reaction Methods 0.000 description 1
- 230000000694 effects Effects 0.000 description 1
- 239000007943 implant Substances 0.000 description 1
- 238000002513 implantation Methods 0.000 description 1
- 230000006872 improvement Effects 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 230000003287 optical effect Effects 0.000 description 1
- 238000011946 reduction process Methods 0.000 description 1
- 238000011160 research Methods 0.000 description 1
- 230000011218 segmentation Effects 0.000 description 1
- 238000000926 separation method Methods 0.000 description 1
- 230000003068 static effect Effects 0.000 description 1
- 238000006467 substitution reaction Methods 0.000 description 1
- 230000009466 transformation Effects 0.000 description 1
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
- G06F21/71—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information
- G06F21/76—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information in application-specific integrated circuits [ASIC] or field-programmable devices, e.g. field-programmable gate arrays [FPGA] or programmable logic devices [PLD]
-
- Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
- Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
- Y02D—CLIMATE CHANGE MITIGATION TECHNOLOGIES IN INFORMATION AND COMMUNICATION TECHNOLOGIES [ICT], I.E. INFORMATION AND COMMUNICATION TECHNOLOGIES AIMING AT THE REDUCTION OF THEIR OWN ENERGY USE
- Y02D10/00—Energy efficient computing, e.g. low power processors, power management or thermal management
Landscapes
- Engineering & Computer Science (AREA)
- Computer Hardware Design (AREA)
- Physics & Mathematics (AREA)
- Theoretical Computer Science (AREA)
- Microelectronics & Electronic Packaging (AREA)
- Mathematical Physics (AREA)
- Computer Security & Cryptography (AREA)
- Software Systems (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The application relates to the technical field of integrated circuits, in particular to a hardware Trojan detection method, a hardware Trojan detection device and a storage medium, which solve the problem that the conventional side channel analysis method is difficult to popularize in a large range due to the fact that a standard integrated circuit is difficult to acquire in the related technology. The method comprises the following steps: inputting the preprocessed power consumption data into a classifier which is trained in advance, and obtaining an abnormal score of the preprocessed power consumption data; calculating a classification threshold value of the abnormal score by adopting a K-means clustering algorithm; and comparing the abnormal score with a classification threshold, and if the abnormal score is larger than the classification threshold, judging that the integrated circuit to be tested contains the hardware Trojan horse. The application reduces the environmental and process noise by preprocessing the power consumption data, amplifies the influence of the hardware Trojan on the power consumption information, improves the detection accuracy, has low dependence on the standard integrated circuit and greatly improves the application range of the detection method.
Description
Technical Field
The present application relates to the field of integrated circuits, and in particular, to a method and apparatus for detecting a hardware Trojan horse, and a storage medium.
Background
With the continuous development of information industry, more and more integrated circuit products are in life, and people often neglect the safety and reliability of the integrated circuit products in the process of pursuing the performance improvement of the integrated circuit products. Hardware trojans are typically representative of many hardware security risks, which may be defined as tiny circuit modules that are implanted by a malicious attacker at various stages of integrated circuit design and manufacture, which may cause some abnormal behavior such as denial of service, functional errors, information leakage, or performance degradation when implanted into the integrated circuit. The trend of integrated circuit design and manufacturing separation is becoming more apparent in the integrated circuit industry today, which provides a multiplicative opportunity for untrusted third party wafer foundries to implant hardware trojans during chip manufacturing.
Hardware trojans generally possess three features: 1. the implantation of the hardware Trojan often has a malicious purpose, 2, the escape detectability of the hardware Trojan, and 3, the triggering condition of the hardware Trojan is difficult to appear. The above characteristics result in hardware trojans implanted in integrated circuits that are generally not found using conventional testing means. Therefore, how to detect the hardware Trojan becomes a research hot spot in the technical field of integrated circuit security.
The existing common hardware Trojan detection method is a side channel signal analysis method, and whether the integrated circuit is implanted into the hardware Trojan is judged by analyzing the side channel signal of the integrated circuit, but the influence of the hardware Trojan circuit on the side channel signal of the integrated circuit is easily hidden by environment or process noise because the scale of the hardware Trojan circuit is usually very small, and the accuracy of the existing side channel analysis method is easily influenced; in addition, side channel signal detection typically requires standard integrated circuits without Trojan horse for comparison, which makes existing side channel analysis methods difficult to popularize widely because standard integrated circuits are typically difficult to obtain.
Disclosure of Invention
In order to solve the problems, the application provides a hardware Trojan detection method, a hardware Trojan detection device and a storage medium, which solve the technical problem that the prior side channel analysis method is difficult to popularize in a large range due to the difficulty in acquiring a standard integrated circuit in the related technology.
In a first aspect, the present application provides a hardware Trojan detection method, the method comprising:
Collecting power consumption data of an integrated circuit to be tested;
preprocessing the power consumption data to obtain preprocessed power consumption data; the preprocessing comprises power consumption data difference accumulation and power consumption data principal component analysis;
Inputting the preprocessed power consumption data into a classifier which is trained in advance, and obtaining an abnormal score of the preprocessed power consumption data;
according to the abnormal score of the preprocessed power consumption data, a K-means clustering algorithm is adopted to calculate and obtain a classification threshold value of the abnormal score;
Comparing the abnormal score of the preprocessed power consumption data with the classification threshold, and judging that the integrated circuit to be tested contains the hardware Trojan if the abnormal score of the preprocessed power consumption data is larger than the classification threshold.
Optionally, the acquiring process of the classifier includes:
Acquiring power consumption data of an integrated circuit without the hardware Trojan and power consumption data of an integrated circuit with the hardware Trojan, and obtaining a power consumption data set;
Dividing the power consumption data set into a power consumption data training set and a power consumption data testing set according to a preset proportion;
Averaging the power consumption data training set to obtain an averaged power consumption data training set;
preprocessing the power consumption data training set after averaging and the power consumption data testing set to obtain a preprocessed power consumption data training set and a preprocessed power consumption data testing set; the preprocessing comprises power consumption data difference accumulation and power consumption data principal component analysis;
and training by using an isolated forest model according to the preprocessed power consumption data training set to obtain the classifier.
Optionally, the power consumption data principal component analysis includes:
according to the formula:
xc.i＝xi-μi(i＝1,2,…,m)
Performing decentralization processing on the power consumption data to obtain decentralized power consumption data; wherein x i is the power consumption data vector of the ith feature, mu i is the power consumption data average value of the ith feature, x c.i is the de-centering power consumption data vector of the ith feature, and m is the feature number;
according to the formula:
calculating a covariance matrix of the power consumption data after the decentralization; wherein X c is a power consumption data matrix of decentralization;
according to the formula:
PTCP＝Λ
Calculating eigenvalues and eigenvectors of the covariance matrix; wherein P is the eigenvector matrix of C, and Λ is the eigenvalue matrix;
Generating a power consumption data projection matrix according to the feature vector and the feature value;
according to the formula:
Y＝X×P′
And calculating to obtain a power consumption data matrix after the dimension reduction, wherein P' is a projection matrix, and X (X= { X 1,x2,x3…,xm }) is an original power consumption data matrix.
Optionally, the training is performed by using an isolated forest model according to the preprocessed power consumption data training set, so as to obtain the classifier, including:
Randomly and overlapping t sub-sample sets of the preprocessed power consumption data training set;
And establishing t isolated trees according to the t sub-sample sets to obtain the classifier.
Optionally, the inputting the preprocessed power consumption data test set into the classifier, to obtain an anomaly score of the preprocessed power consumption data test set, includes:
Calculating the path length of each sample in the preprocessed power consumption data test set on each of the t isolated trees;
And calculating an abnormality score of the preprocessed power consumption data test set according to the path length.
Optionally, the calculating the classification threshold by using a K-means clustering algorithm according to the abnormal score of the preprocessed power consumption data test set includes:
Dividing the abnormal score of the preprocessed power consumption data test set into two cluster groups according to the K-means clustering algorithm;
Calculating the distance between the clustering centers of the two clusters;
and calculating the classification threshold according to the number of the power consumption data samples contained by the two clusters and the distance between the cluster centers of the two clusters.
Optionally, the averaging the power consumption data training set to obtain an averaged power consumption data training set includes:
according to the formula:
Calculating the average value of the power consumption data training set to obtain a power consumption data training set after average value acquisition; wherein nb_tr represents the number of samples in the power consumption data training set, nb_tr is more than or equal to 2000, and tr.i is the ith sample in the training set.
Optionally, the accumulating of the power consumption data difference value includes:
grouping the power consumption data training set after the average value is taken and the power consumption data testing set according to a preset sampling number;
according to the formula:
Calculating to obtain the power consumption data difference value accumulation; wherein nb_sample represents the sampling number of each group, nb_sample is greater than or equal to 10, D tr.m represents the accumulated difference of the m-th group in the power consumption data training set after the average value is taken, D te.n represents the accumulated difference of the n-th group in the power consumption data testing set, nb_trg represents the grouping number of the power consumption data training set after the average value is obtained by dividing nb_tr by nb_sample, nb_ teg represents the grouping number of the power consumption data testing set, nb_te is obtained by dividing nb_sample, nb_te represents the number of samples in the power consumption data testing set, and nb_te is greater than or equal to 500.
In a second aspect, a hardware Trojan detection apparatus, the apparatus comprising:
The acquisition unit is used for acquiring power consumption data of the integrated circuit to be tested;
The processing unit is used for preprocessing the power consumption data to obtain preprocessed power consumption data; the preprocessing comprises power consumption data difference accumulation and power consumption data principal component analysis;
The input unit is used for inputting the preprocessed power consumption data into a classifier which is trained in advance, and obtaining an abnormal score of the preprocessed power consumption data;
the computing unit is used for computing a classification threshold value of the abnormal score by adopting a K-means clustering algorithm according to the abnormal score of the preprocessed power consumption data;
And the comparison unit is used for comparing the abnormal score of the preprocessed power consumption data with the classification threshold value, and judging that the integrated circuit to be tested contains a hardware Trojan if the abnormal score of the preprocessed power consumption data is larger than the classification threshold value.
In a third aspect, a storage medium stores a computer program executable by one or more processors to implement the hardware Trojan detection method according to the first aspect.
The application provides a hardware Trojan detection method, a device and a storage medium, comprising the following steps: collecting power consumption data of an integrated circuit to be tested; preprocessing the power consumption data to obtain preprocessed power consumption data; the preprocessing comprises power consumption data difference accumulation and power consumption data principal component analysis; inputting the preprocessed power consumption data into a classifier which is trained in advance, and obtaining an abnormal score of the preprocessed power consumption data; according to the abnormal score of the preprocessed power consumption data, a K-means clustering algorithm is adopted to calculate and obtain a classification threshold value of the abnormal score; comparing the abnormal score of the preprocessed power consumption data with the classification threshold, and judging that the integrated circuit to be tested contains the hardware Trojan if the abnormal score of the preprocessed power consumption data is larger than the classification threshold. The application reduces the environmental and process noise by preprocessing the power consumption data, amplifies the influence of the hardware Trojan on the power consumption information, improves the detection accuracy, has low dependence on the standard integrated circuit and greatly improves the application range of the detection method.
Drawings
In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings that are required to be used in the embodiments or the description of the prior art will be briefly described below, and it is obvious that the drawings in the following description are only embodiments of the present invention, and that other drawings can be obtained according to the provided drawings without inventive effort for a person skilled in the art.
Fig. 1 is a schematic flow chart of a hardware Trojan horse detection method according to an embodiment of the present application;
Fig. 2 is a schematic diagram of an acquisition flow of a classifier according to an embodiment of the present application;
FIG. 3 is a schematic diagram of a detection result provided by an embodiment of the present application;
fig. 4 is a schematic structural diagram of a hardware Trojan horse detection device according to an embodiment of the present application.
Detailed Description
The following will describe embodiments of the present application in detail with reference to the drawings and examples, thereby solving the technical problems by applying technical means to the present application, and realizing the corresponding technical effects can be fully understood and implemented accordingly. The embodiment of the application and the characteristics in the embodiment can be mutually combined on the premise of no conflict, and the formed technical scheme is within the protection scope of the application.
As known from the background art, the current common hardware Trojan detection method is a side channel signal analysis method, and whether the hardware Trojan is implanted or not is judged by analyzing the side channel signal of the integrated circuit, but because the scale of the hardware Trojan circuit is usually very small, the influence of the hardware Trojan circuit on the side channel signal of the integrated circuit is easily hidden by environment or process noise, and the accuracy of the existing side channel analysis method is easily influenced; in addition, side channel signal detection typically requires standard integrated circuits without Trojan horse for comparison, which makes existing side channel analysis methods difficult to popularize widely because standard integrated circuits are typically difficult to obtain.
In view of the above, the present application provides a method, an apparatus and a storage medium for detecting a hardware Trojan horse, which solve the technical problem that the existing side channel analysis method is difficult to be widely popularized due to the difficulty in acquiring a standard integrated circuit in the related art.
Example 1
Fig. 1 is a flow chart of a hardware Trojan horse detection method according to an embodiment of the present application, as shown in fig. 1, the method includes:
s101, collecting power consumption data of an integrated circuit to be tested.
It should be noted that, specifically, according to the principle of side channel analysis, an integrated circuit test platform is built, and under the same test environment (i.e. the conditions of temperature, humidity, test equipment, etc. are the same), the same test vector is input to the integrated circuit (e.g. the same plaintext and key are input to the encryption circuit), so that the integrated circuit works normally, and then the oscilloscope is used to collect the side channel power consumption data under the working state.
S102, preprocessing the power consumption data to obtain preprocessed power consumption data.
In step S102, the preprocessing includes power consumption data difference accumulation and power consumption data principal component analysis.
It should be noted that, the difference accumulation is to group the power consumption data according to a preset sampling number, and then, difference and sum each power consumption curve in all groups and the mean curve to obtain the power consumption data difference accumulation. The principal component analysis (PRINCIPAL COMPONENTS ANALYSIS, PCA) uses the idea of dimension reduction to reduce the dimension of the obtained difference accumulation, converts multiple indexes into a few comprehensive indexes, and further highlights the influence of hardware Trojan horse.
S103, inputting the preprocessed power consumption data into a classifier which is trained in advance, and obtaining an abnormality score of the preprocessed power consumption data.
S104, calculating a classification threshold value of the abnormal score by adopting a K-means clustering algorithm according to the abnormal score of the preprocessed power consumption data;
S105, comparing the abnormal score of the preprocessed power consumption data with the classification threshold, and judging that the integrated circuit to be tested contains a hardware Trojan if the abnormal score of the preprocessed power consumption data is larger than the classification threshold.
Optionally, as shown in fig. 2, the acquiring process of the classifier disclosed in the embodiment of the present application includes:
s201, acquiring power consumption data of an integrated circuit without the hardware Trojan and power consumption data of an integrated circuit with the hardware Trojan, and obtaining a power consumption data set.
S202, dividing the power consumption data set into a power consumption data training set and a power consumption data testing set according to a preset proportion.
When splitting the power consumption data set, the power consumption data set is split into the optimal data set according to the ratio of the training set to the test set being greater than 7 to 3, and specifically, the power consumption data set can be split by selecting the ratio of 8 to 2.
It should be noted that, the power consumption data of the integrated circuit without the hardware Trojan in the power consumption data training set is majority, and the power consumption data of the integrated circuit with the hardware Trojan is minority.
S203, taking the average value of the power consumption data training set to obtain the power consumption data training set after taking the average value.
It should be noted that, performing the averaging process on the power consumption data of the training set can reduce the influence from noise, and the finally obtained average curve can be similar to the power consumption data without noise influence, so as to improve the accuracy of the hardware Trojan detection.
S204, preprocessing the power consumption data training set after the average value is taken and the power consumption data testing set to obtain a preprocessed power consumption data training set and a preprocessed power consumption data testing set.
In step S204, the preprocessing includes power consumption data difference accumulation and power consumption data principal component analysis.
And S205, training by using an isolated forest model according to the preprocessed power consumption data training set to obtain the classifier.
After training of the classifier is completed, the power consumption data test set is used for testing the performance or accuracy of the classifier, and the preprocessed power consumption data test set is input into the classifier to obtain the anomaly score of the preprocessed power consumption data test set. And according to the abnormal score of the preprocessed power consumption data test set, calculating by adopting a K-means clustering algorithm to obtain a classification threshold. Comparing the abnormality score of the preprocessed power consumption data test set with the classification threshold, judging that the integrated circuit contains the hardware Trojan if the abnormality score is larger than the classification threshold, and judging that the integrated circuit does not contain the hardware Trojan if the abnormality score is smaller than the classification threshold.
Optionally, the power consumption data principal component analysis includes:
according to the formula:
xc.i＝xi-μi(i＝1,2,…,m)
Performing decentralization processing on the power consumption data to obtain decentralized power consumption data; wherein x i is the power consumption data vector of the ith feature, mu i is the power consumption data average value of the ith feature, x c.i is the de-centering power consumption data vector of the ith feature, and m is the feature number;
it should be noted that, the data features are each subtracted by the average value of all the features to complete the decentration.
According to the formula:
calculating a covariance matrix of the power consumption data after the decentralization; wherein X c is a power consumption data matrix of decentralization;
it should be noted that, the covariance matrix is calculated to eliminate the correlation between the data in different dimensions in the sample data set. Denote the transpose of the X c matrix, and P T is the same as below.
According to the formula:
PTCP＝Λ
Calculating eigenvalues and eigenvectors of the covariance matrix; wherein P is the eigenvector matrix of C, and Λ is the eigenvalue matrix;
the feature vector indicates the transformation direction, and the feature value indicates the scale of expansion.
Generating a power consumption data projection matrix according to the feature vector and the feature value;
according to the formula:
Y＝X×P′
And calculating to obtain a power consumption data matrix after the dimension reduction, wherein P' is a projection matrix, and X (X= { X 1,x2,x3…,xm }) is an original power consumption data matrix.
Specifically, feature vectors are arranged into a matrix according to the corresponding feature values from top to bottom, and the first k (k is more than or equal to 2) rows are taken to form a corresponding projection matrix. Multiplying the projection matrix with the original data matrix to obtain the dimensionality reduced data matrix.
Optionally, the training is performed by using an isolated forest model according to the preprocessed power consumption data training set, so as to obtain the classifier, including:
Randomly and overlapping t sub-sample sets of the preprocessed power consumption data training set;
And establishing t isolated trees according to the t sub-sample sets to obtain the classifier.
Wherein t is a positive integer greater than or equal to 100 for more accurate training of the classifier.
Optionally, the inputting the preprocessed power consumption data test set into the classifier, to obtain an anomaly score of the preprocessed power consumption data test set, includes:
Calculating the path length of each sample in the preprocessed power consumption data test set on each of the t isolated trees;
And calculating an abnormality score of the preprocessed power consumption data test set according to the path length.
Optionally, the calculating the classification threshold by using a K-means clustering algorithm according to the abnormal score of the preprocessed power consumption data test set includes:
Dividing the abnormal score of the preprocessed power consumption data test set into two cluster groups according to the K-means clustering algorithm;
Calculating the distance between the clustering centers of the two clusters;
and calculating the classification threshold according to the number of the power consumption data samples contained by the two clusters and the distance between the cluster centers of the two clusters.
It should be noted that, when the numbers of samples in the two clusters are consistent, the classification threshold is the midpoint of the two cluster centers, and if the numbers of samples in the two clusters are inconsistent, the samples are selected according to the number proportion, for example, when the number ratio is 3:2, the samples are at 3/5 of the connecting line of the two clusters; 2:3 is 2/5 of the connection line of the two.
Optionally, the averaging the power consumption data training set to obtain an averaged power consumption data training set includes:
according to the formula:
Calculating the average value of the power consumption data training set to obtain a power consumption data training set after average value acquisition; wherein nb_tr represents the number of samples in the power consumption data training set, nb_tr is more than or equal to 2000, and tr.i is the ith sample in the training set.
Optionally, the accumulating of the power consumption data difference value includes:
grouping the power consumption data training set after the average value is taken and the power consumption data testing set according to a preset sampling number;
according to the formula:
Calculating to obtain the power consumption data difference value accumulation; wherein nb_sample represents the sampling number of each group, nb_sample is greater than or equal to 10, D tr.m represents the accumulated difference of the m-th group in the power consumption data training set after the average value, D te.n represents the accumulated difference of the n-th group in the power consumption data testing set, nb_trg represents the grouping number of the power consumption data training set after the average value, the value is nb_tr divided by nb_sample, that is, nb_tr/nb_sample, nb_ teg represents the grouping number of the power consumption data testing set, the value is nb_te divided by nb_sample, that is, nb_te/nb_sample, nb_te represents the number of samples in the power consumption data testing set, and nb_te is greater than or equal to 500.
In order to facilitate understanding of the hardware Trojan detection method of the present application, the hardware Trojan detection method of the present application is described below by way of specific examples.
Specifically, the invention provides a hardware Trojan horse detection method based on an orphan forest model and a K-means clustering algorithm. The method effectively solves the problem of low detection precision of the hardware Trojan based on the side channel information due to the influence of environmental noise, process deviation and the like, and has the advantages of low cost, easy realization of algorithm, low dependence on a standard integrated circuit and the like.
In this embodiment, an FPGA is selected as a hardware implementation platform, and a SAKURA-G development board of Xilinx corporation is used, and two SPARTAN-6 series FPGA chips are provided on the development board, with specific models being XC6SLX75 and XC6SLX9, respectively, where XC6SLX75 is used to implement a main integrated circuit (including a hardware Trojan integrated circuit), and XC6SLX9 is used to implement a control circuit.
The main integrated circuit used in this embodiment is an AES-128 encryption circuit, and Advanced Encryption Standard (AES) is the most common symmetric encryption algorithm, and the main steps include: round-robin addition, byte substitution, row shifting, column mixing, etc. The latter number 128 refers to the 128 bits of length of its key.
The hardware Trojan circuit used in this embodiment is called T100, and its principle is based on Code Division Multiple Access (CDMA) theory. First, the CDMA columns are generated by a pseudo-random number generator (PRNG), then the generated code sequence is changed to secret information bits by exclusive-or modulation, and finally the modulated sequence is forwarded to a Leakage Circuit (LC) to establish a hidden CDMA channel in the power-side channel to steal the secret key of the cryptographic circuit. The hardware Trojan occupies about 1.1% of the AES-128 circuit area.
The hardware Trojan detection method of the application specifically comprises the following steps:
Step one, power consumption data acquisition and grouping.
The AES-128 circuit without the hardware Trojan and the AES-128 circuit with the hardware Trojan are respectively realized by SAKURA-G, SAKURA-G is operated by a computer to start encryption, then a power consumption acquisition port of SAKURA-G is connected to an oscilloscope, the power consumption waveform in the encryption process can be observed by the oscilloscope, the power consumption information acquisition work is completed, and after the power consumption information is extracted, the data is divided into a training set and a test set according to a certain proportion. 10000 pieces of power consumption information are collected in the embodiment, 10000 sampling points are arranged in each piece, meanwhile, the ratio of the training set to the testing set is set to be 4:1, namely 8000 pieces of power consumption information of the training set and 2000 pieces of power consumption information of the testing set. Since the integrated circuit power consumption data without the hardware Trojan needs to be set to account for most of the power consumption data set, only 400 pieces of power consumption information are from the AES-128 circuit with the hardware Trojan in the training set.
And step two, preprocessing power consumption data.
And 2.1, taking an average value of the power consumption data training set.
The influence from noise is reduced by adopting a mean value taking mode on the training set data, and the obtained mean value curve can be approximated to power consumption information without noise influence, and is calculated as follows:
The meaning of each element in the formula is described in the previous section, please refer to the content of the previous section, and the following formulas are the same.
And 2.2, accumulating the power consumption data difference value.
The power consumption data sets (comprising a power consumption data training set and a power consumption data testing set) are grouped according to a preset sampling number, and then each power consumption curve in all the groups is subjected to difference and summation with a mean value curve, so that the influence of hardware Trojan on the power consumption data is amplified, and a specific calculation formula is shown below. In this embodiment, the number of samples in each group is 20, and as a result, training set matrix with size of 400×1000 and test set data with size of 100×10000 are obtained;
and 2.3, analyzing the principal components of the power consumption data.
And reducing the dimension of the obtained cumulative difference matrix by using principal component analysis, and further amplifying the influence of the hardware Trojan on the power consumption.
The specific operation is as follows: firstly, carrying out centering operation on a power consumption data set (dimension: 10000), namely subtracting the average value of all the characteristics from each data characteristic; then, calculating covariance matrix of the processed data, and calculating eigenvalue and eigenvector of the matrix; after all eigenvalues are obtained, they are ordered from big to small, and then the first 2 eigenvalues and their corresponding eigenvectors are selected to generate an eigenvector matrix. Finally, the original data is projected onto the eigenvector matrix to obtain the dimension reduction data. In this embodiment, the size of the principal component training set matrix after PCA processing is 400×2, and the size of the principal component test set matrix is 100×2, and the specific calculation formula is as follows:
(PCtr,PCte)＝PCA(Dtr,Dte)；
and thirdly, generating an isolated forest model classifier according to the preprocessed power consumption data set and calculating an anomaly score.
In this embodiment, the isolated forest model is composed of 100 isolated trees. For a given power consumption data training set PC tr＝{PCtr.1,PCtr.2,…,PCtr.400},PCtr.i∈R2, a specific step of generating an isolated tree is
(1) Randomly selecting a sub-data set consisting of 256 power consumption data from a training set of power consumption data
(2) Randomly selecting a featureWherein q= { Q 1,q2 };
Wherein after the dimension reduction process, there are only two dimensions, each dimension has a representative feature, Q 1 represents the first feature, Q 2 represents the second feature, and Q is the feature set.
(3) Randomly selecting a segmentation value p of a magnitude between a minimum and a maximum value of the selected feature;
(4) Classifying each data in the PC tr', if the characteristic value of the data is smaller than p, putting the data into a left child node, otherwise, putting the data into a right child node;
(5) Recursively steps (2) through (4) until all child nodes meet one of the following conditions:
Only one sample point in the child node; the sample points refer to power consumption data, and the matrix of the principal component training set matrix 400 x2 after PCA processing obtained above can be understood as that the training set has 400 sample points, each sample point contains 2 features, and each feature has its own value, namely a feature value.
The orphan tree has reached a specified height;
all sample points in the child node have the same eigenvalue.
After an isolated forest model is generated, calculating an abnormal score of each sample in the power consumption data test set, wherein the method comprises the following specific steps of:
(1) The path length (PC te.j) of the power consumption data test set PC te.j on each island tree is calculated as follows:
(PCte.j)＝e+C(T.size)
Where e represents the number of edges traversed by the PC te.j from the root node to the leaf node of the orphan tree, and C (T.size) is a correction value representing the average path length of constructing the binary tree from T sample data. The specific calculation formula is as follows:
c(T.size)＝2H(T.size-1)-(2(T.size-1)/T.size)
where H (T.size) +.In (T.size) +0.5772156649,0.5772156649 is the Euler constant.
(2) According to the obtained path length, calculating an anomaly score, wherein the calculation formula is as follows:
Where E (h (PC te.j)) is the average path length, L is the sample size of the power consumption data test set, and in this embodiment, l=100. Generally, the path length from an abnormal sample (i.e., the power consumption data of an integrated circuit with a hardware Trojan) is shorter, so that the abnormal score is higher than that of a normal sample, and whether the integrated circuit contains the hardware Trojan can be distinguished.
And step four, calculating a classification threshold value by using a K-means clustering algorithm and completing Trojan detection.
The K-means clustering algorithm can be used for realizing dynamic change of the classification threshold, and the threshold is determined according to different conditions, and the specific algorithm in the embodiment is as follows:
generally, the path length from an abnormal sample (i.e., the power consumption data of an integrated circuit with a hardware Trojan) is shorter, so that the abnormal score is higher than that of a normal sample, and whether the integrated circuit contains the hardware Trojan can be distinguished. So based on the resulting classification threshold s th, if s i≥sth it can be determined that the ith sample is from an integrated circuit with a hardware Trojan horse, or vice versa.
In addition, the embodiment also judges the detection performance of the hardware Trojan horse by taking the accuracy (accuracy) and the recall (recall) as index parameters, and the calculation formulas of the accuracy and the recall are respectively as follows:
Wherein True Positive (TP) is the number of samples of the hardware-containing Trojan horse integrated circuit which is predicted correctly; false Positives (FP) are the number of samples that mispredict a hardware-containing Trojan integrated circuit; false Negatives (FN) are the number of samples that are mispredicted to not contain a hardware Trojan horse integrated circuit; true Negatives (TN) are the number of correctly predicted hardware-free Trojan horse integrated circuits.
The detection result in this embodiment is shown in fig. 3, which is a schematic diagram of the detection result provided in the embodiment of the present application. The star points represent the AES circuits which actually contain the hardware Trojan in the test set, the small circles represent the normal AES circuits which actually contain the hardware Trojan in the test set, and it can be seen that all the sample points which contain the hardware Trojan have higher abnormal scores and accord with the expectation. Specific data, the classification threshold in this embodiment is 0.531, the accuracy is 94%, and the recall rate is 100%, which indicates that the method proposed in the present application can detect the hardware Trojan in the integrated circuit with high accuracy.
In summary, the embodiment of the present application provides a method for detecting a hardware Trojan horse, including: collecting power consumption data of an integrated circuit to be tested; preprocessing the power consumption data to obtain preprocessed power consumption data; the preprocessing comprises power consumption data difference accumulation and power consumption data principal component analysis; inputting the preprocessed power consumption data into a classifier which is trained in advance, and obtaining an abnormal score of the preprocessed power consumption data; according to the abnormal score of the preprocessed power consumption data, a K-means clustering algorithm is adopted to calculate and obtain a classification threshold value of the abnormal score; comparing the abnormal score of the preprocessed power consumption data with the classification threshold, and judging that the integrated circuit to be tested contains the hardware Trojan if the abnormal score of the preprocessed power consumption data is larger than the classification threshold. The application reduces the environmental and process noise by preprocessing the power consumption data, amplifies the influence of the hardware Trojan on the power consumption information, improves the detection accuracy, has low dependence on the standard integrated circuit and greatly improves the application range of the detection method.
Example two
Based on the hardware Trojan detection method disclosed in the embodiment of the invention, fig. 4 specifically discloses a hardware Trojan detection device applying the hardware Trojan detection method.
As shown in fig. 4, an embodiment of the present invention discloses a hardware Trojan detection device, which includes:
the acquisition unit 401 is used for acquiring power consumption data of the integrated circuit to be tested;
a processing unit 402, configured to pre-process the power consumption data to obtain pre-processed power consumption data; the preprocessing comprises power consumption data difference accumulation and power consumption data principal component analysis;
An input unit 403, configured to input the preprocessed power consumption data into a classifier that completes training in advance, and obtain an anomaly score of the preprocessed power consumption data;
A calculating unit 404, configured to calculate, according to the anomaly score of the preprocessed power consumption data, a classification threshold value of the anomaly score by using a K-means clustering algorithm;
And the comparing unit 405 is configured to compare the abnormal score of the preprocessed power consumption data with the classification threshold, and determine that the integrated circuit to be tested contains a hardware Trojan if the abnormal score of the preprocessed power consumption data is greater than the classification threshold.
The specific working processes of the data acquisition unit 401, the processing unit 402, the input unit 403, the calculation unit 404 and the comparison unit 404 in the hardware Trojan horse detection device disclosed in the above embodiment of the present invention can be referred to the corresponding content in the hardware Trojan horse detection method disclosed in the above embodiment of the present invention, and will not be described herein.
In summary, an embodiment of the present application provides a hardware Trojan detection device, including: collecting power consumption data of an integrated circuit to be tested; preprocessing the power consumption data to obtain preprocessed power consumption data; the preprocessing comprises power consumption data difference accumulation and power consumption data principal component analysis; inputting the preprocessed power consumption data into a classifier which is trained in advance, and obtaining an abnormal score of the preprocessed power consumption data; according to the abnormal score of the preprocessed power consumption data, a K-means clustering algorithm is adopted to calculate and obtain a classification threshold value of the abnormal score; comparing the abnormal score of the preprocessed power consumption data with the classification threshold, and judging that the integrated circuit to be tested contains the hardware Trojan if the abnormal score of the preprocessed power consumption data is larger than the classification threshold. The application reduces the environmental and process noise by preprocessing the power consumption data, amplifies the influence of the hardware Trojan on the power consumption information, improves the detection accuracy, has low dependence on the standard integrated circuit and greatly improves the application range of the detection method.
Example III
The present embodiment also provides a computer readable storage medium, such as a flash memory, a hard disk, a multimedia card, a card memory (e.g., SD or DX memory, etc.), a Random Access Memory (RAM), a Static Random Access Memory (SRAM), a read-only memory (ROM), an electrically erasable programmable read-only memory (EEPROM), a programmable read-only memory (PROM), a magnetic memory, a magnetic disk, an optical disk, a server, an App application store, etc., on which a computer program is stored, which when executed by a processor, can implement the method steps as in the first embodiment, and the present embodiment will not be repeated here.
In the embodiments provided in the present application, it should be understood that the disclosed method may be implemented in other manners. The method embodiments described above are merely illustrative.
It should be noted that, in this document, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one … …" does not exclude the presence of other like elements in a process, method, article, or apparatus that comprises an element.
Although the embodiments of the present application are described above, the above description is only for the convenience of understanding the present application, and is not intended to limit the present application. Any person skilled in the art can make any modification and variation in form and detail without departing from the spirit and scope of the present disclosure, but the scope of the present disclosure is still subject to the scope of the appended claims.
Claims (10)
1. A method for detecting a hardware Trojan horse, the method comprising:
Collecting power consumption data of an integrated circuit to be tested;
preprocessing the power consumption data to obtain preprocessed power consumption data; the preprocessing comprises power consumption data difference accumulation and power consumption data principal component analysis;
Inputting the preprocessed power consumption data into a classifier which is trained in advance, and obtaining an abnormal score of the preprocessed power consumption data;
according to the abnormal score of the preprocessed power consumption data, a K-means clustering algorithm is adopted to calculate and obtain a classification threshold value of the abnormal score;
Comparing the abnormal score of the preprocessed power consumption data with the classification threshold, and judging that the integrated circuit to be tested contains the hardware Trojan if the abnormal score of the preprocessed power consumption data is larger than the classification threshold.
2. The method of claim 1, wherein the classifier acquisition process comprises:
Acquiring power consumption data of an integrated circuit without the hardware Trojan and power consumption data of an integrated circuit with the hardware Trojan, and obtaining a power consumption data set;
Dividing the power consumption data set into a power consumption data training set and a power consumption data testing set according to a preset proportion;
Averaging the power consumption data training set to obtain an averaged power consumption data training set;
preprocessing the power consumption data training set after averaging and the power consumption data testing set to obtain a preprocessed power consumption data training set and a preprocessed power consumption data testing set; the preprocessing comprises power consumption data difference accumulation and power consumption data principal component analysis;
and training by using an isolated forest model according to the preprocessed power consumption data training set to obtain the classifier.
3. The method of claim 1, wherein the power consumption data principal component analysis comprises:
according to the formula:
xc.i＝xi-μi(i＝1,2,…,m)
Performing decentralization processing on the power consumption data to obtain decentralized power consumption data; wherein x i is the power consumption data vector of the ith feature, mu i is the power consumption data average value of the ith feature, x c.i is the de-centering power consumption data vector of the ith feature, and m is the feature number;
according to the formula:
calculating a covariance matrix of the power consumption data after the decentralization; wherein X c is a power consumption data matrix of decentralization;
according to the formula:
PTCP＝Λ
Calculating eigenvalues and eigenvectors of the covariance matrix; wherein P is the eigenvector matrix of C, and Λ is the eigenvalue matrix;
Generating a power consumption data projection matrix according to the feature vector and the feature value;
according to the formula:
Y＝X×P′
And calculating to obtain a power consumption data matrix after the dimension reduction, wherein P' is a projection matrix, and X (X= { X 1,x2,x3…,xm }) is an original power consumption data matrix.
4. The method of claim 2, wherein the training using an orphan forest model from the preprocessed training set of power consumption data results in the classifier, comprising:
Randomly and overlapping t sub-sample sets of the preprocessed power consumption data training set;
And establishing t isolated trees according to the t sub-sample sets to obtain the classifier.
5. The method of claim 4, wherein inputting the preprocessed power consumption data test set into the classifier results in an anomaly score for the preprocessed power consumption data test set, comprising:
Calculating the path length of each sample in the preprocessed power consumption data test set on each of the t isolated trees;
And calculating an abnormality score of the preprocessed power consumption data test set according to the path length.
6. The method of claim 2, wherein the computing the classification threshold using a K-means clustering algorithm based on the anomaly score of the preprocessed power consumption data test set comprises:
Dividing the abnormal score of the preprocessed power consumption data test set into two cluster groups according to the K-means clustering algorithm;
Calculating the distance between the clustering centers of the two clusters;
and calculating the classification threshold according to the number of the power consumption data samples contained by the two clusters and the distance between the cluster centers of the two clusters.
7. The method of claim 2, wherein the averaging the power consumption data training set to obtain an averaged power consumption data training set comprises:
according to the formula:
Calculating the average value of the power consumption data training set to obtain a power consumption data training set after average value acquisition; wherein nb_tr represents the number of samples in the power consumption data training set, nb_tr is more than or equal to 2000, and tr.i is the ith sample in the training set.
8. The method of claim 2, wherein the power consumption data difference accumulation comprises:
grouping the power consumption data training set after the average value is taken and the power consumption data testing set according to a preset sampling number;
according to the formula:
Calculating to obtain the power consumption data difference value accumulation; wherein nb_sample represents the sampling number of each group, nb_sample is greater than or equal to 10, D tr.m represents the accumulated difference of the mth group in the power consumption data training set after the average value is taken, D te.n represents the accumulated difference of the nth group in the power consumption data testing set, nb_trg represents the grouping number of the power consumption data training set after the average value is obtained by dividing nb_tr by nb_sample, nb_ teg represents the grouping number of the power consumption data testing set, nb_te is obtained by dividing nb_sample, nb_te is obtained by representing the number of samples in the power consumption data testing set, nb_te is greater than or equal to 500, P tr.i is obtained by representing the value of the ith sample in the testing set, P te.j is obtained by dividing nb_tr by the nb_sample, and P mean is obtained by dividing nb_sample by the average value of the power consumption data testing set.
9. A hardware Trojan detection device, the device comprising:
The acquisition unit is used for acquiring power consumption data of the integrated circuit to be tested;
The processing unit is used for preprocessing the power consumption data to obtain preprocessed power consumption data; the preprocessing comprises power consumption data difference accumulation and power consumption data principal component analysis;
The input unit is used for inputting the preprocessed power consumption data into a classifier which is trained in advance, and obtaining an abnormal score of the preprocessed power consumption data;
the computing unit is used for computing a classification threshold value of the abnormal score by adopting a K-means clustering algorithm according to the abnormal score of the preprocessed power consumption data;
And the comparison unit is used for comparing the abnormal score of the preprocessed power consumption data with the classification threshold value, and judging that the integrated circuit to be tested contains a hardware Trojan if the abnormal score of the preprocessed power consumption data is larger than the classification threshold value.
10. A storage medium storing a computer program executable by one or more processors for implementing a hardware Trojan detection method according to any of claims 1 to 8.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202011495410.XA CN112464297B (en) | 2020-12-17 | 2020-12-17 | Hardware Trojan detection method, device and storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202011495410.XA CN112464297B (en) | 2020-12-17 | 2020-12-17 | Hardware Trojan detection method, device and storage medium |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN112464297A CN112464297A (en) | 2021-03-09 |
| CN112464297B true CN112464297B (en) | 2024-06-04 |
Family
ID=74803176
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202011495410.XA Active CN112464297B (en) | 2020-12-17 | 2020-12-17 | Hardware Trojan detection method, device and storage medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN112464297B (en) |
Families Citing this family (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US11579185B2 (en) * | 2019-07-01 | 2023-02-14 | University Of Florida Research Foundation, Inc. | Maximization of side-channel sensitivity for trojan detection |
| CN113553630B (en) * | 2021-06-15 | 2023-06-23 | 西安电子科技大学 | Hardware Trojan horse detection system and information data processing method based on unsupervised learning |
| CN114021126A (en) * | 2021-11-18 | 2022-02-08 | 北京数缘科技有限公司 | Method, device and computer for side channel detection hardware Trojan horse |
| CN114861858A (en) * | 2022-05-30 | 2022-08-05 | 长安大学 | A kind of road abnormal data detection method, device, equipment and readable storage medium |
Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN108062477A (en) * | 2017-12-12 | 2018-05-22 | 北京电子科技学院 | Hardware Trojan horse detection method based on side Multiple Channel Analysis |
| CN108898034A (en) * | 2018-06-27 | 2018-11-27 | 天津大学 | Hardware Trojan horse side channel detection method based on algorithm of dividing and ruling |
| CN109948374A (en) * | 2019-03-14 | 2019-06-28 | 中国科学院微电子研究所 | A kind of hardware Trojan detection method and device |
Family Cites Families (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US9606167B2 (en) * | 2011-08-03 | 2017-03-28 | President And Fellows Of Harvard College | System and method for detecting integrated circuit anomalies |
-
2020
- 2020-12-17 CN CN202011495410.XA patent/CN112464297B/en active Active
Patent Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN108062477A (en) * | 2017-12-12 | 2018-05-22 | 北京电子科技学院 | Hardware Trojan horse detection method based on side Multiple Channel Analysis |
| CN108898034A (en) * | 2018-06-27 | 2018-11-27 | 天津大学 | Hardware Trojan horse side channel detection method based on algorithm of dividing and ruling |
| CN109948374A (en) * | 2019-03-14 | 2019-06-28 | 中国科学院微电子研究所 | A kind of hardware Trojan detection method and device |
Also Published As
| Publication number | Publication date |
|---|---|
| CN112464297A (en) | 2021-03-09 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN112464297B (en) | Hardware Trojan detection method, device and storage medium | |
| CN109302410B (en) | Method and system for detecting abnormal behavior of internal user and computer storage medium | |
| US10963551B2 (en) | Method and apparatus for user authentication based on feature information | |
| CN108734012B (en) | Malicious software identification method and device and electronic equipment | |
| CN112837069B (en) | Block chain and big data based secure payment method and cloud platform system | |
| CN109491914B (en) | High-impact defect report prediction method based on unbalanced learning strategy | |
| CN111753290B (en) | Software type detection method and related equipment | |
| CN105718795B (en) | Malicious code evidence collecting method and system under Linux based on condition code | |
| CN112632609B (en) | Abnormality detection method, abnormality detection device, electronic device, and storage medium | |
| Salazar et al. | Surrogate techniques for testing fraud detection algorithms in credit card operations | |
| CN112733146B (en) | Penetration testing method, device and equipment based on machine learning and storage medium | |
| US11977633B2 (en) | Augmented machine learning malware detection based on static and dynamic analysis | |
| CN110554961A (en) | abnormal software detection method and device, computer equipment and storage medium | |
| CN112866292B (en) | Attack behavior prediction method and device for multi-sample combination attack | |
| US20230145544A1 (en) | Neural network watermarking | |
| CN111309584A (en) | Data processing method and device, electronic equipment and storage medium | |
| CN113902041A (en) | Method and device for training and authentication of target detection model | |
| EP3499429A1 (en) | Behavior inference model building apparatus and method | |
| CN111581640A (en) | Malicious software detection method, device and equipment and storage medium | |
| CN118194341A (en) | Personal data privacy disclosure detection method and device and electronic equipment | |
| CN117826771A (en) | Cold rolling mill control system abnormality detection method and system based on AI analysis | |
| CN117134958A (en) | Information processing method and system for network technology service | |
| CN106936561A (en) | A kind of side-channel attack protective capacities appraisal procedure and system | |
| CN113886765B (en) | Method and device for detecting error data injection attack | |
| CN116167336A (en) | Sensor data processing method based on cloud computing, cloud server and medium |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |