A Hardware Trojan Trigger Localization Method in RTL based on Control Flow Features

Most proposed studies focus on detecting the entire hardware Trojan (HT) in one step, which is very difficult. Since the results of most proposed method have false positive, it is still necessary to check the detection results manually in real-world application. Therefore, what we need is an accurate and efficient method to locate the core part of HTs, which can assist designers to the follow-up verification and modification. In this paper, we define several RTL features based on hardware Trojan trigger control flow characteristics, and then use these features to train a decision tree-based hardware Trojan trigger localization model. The experimental results on Trust-Hub show that our method can obtain 100% true positive rate on all benchmarks and average 98.20% true negative rate. And our method can complete feature extraction and HT trigger localization within 0.1s on average.