This paper presents a novel hardware Trojan detection technique in gate-level netlist based on the controllability and observability analyses. Using an unsupervised clustering analysis, the paper shows that the controllability and observability characteristics of Trojan gates present significant inter-cluster distance from those of genuine gates in a Trojan-inserted circuit, such that Trojan gates are easily distinguishable. The proposed technique does not require any golden model and can be easily integrated into the current integrated circuit design flow. Furthermore, it performs a static analysis and does not require any test pattern application for Trojan activation either partially or fully. In addition, the timing complexity of the proposed technique is an order of the number of signals in a circuit. Moreover, the proposed technique makes it possible to fully restore an inserted Trojan and to isolate its trigger and payload circuits. The technique has been applied on various types of Trojans, and all Trojans are successfully detected with 0 false positive and negative rates in less than 14 s in the worst case.

The integrated circuit design flow is highly susceptible to hardware Trojan (HT) insertion. While there have been significant efforts to detect HTs, techniques usually demand a golden model, suffer limited scalability, or experience high false positives. This article introduced a new technique called gradual-N-justification (GNJ) to reduce false-positives HT detection in the gate-level netlist. The GNJ technique combines the signal justification and unsupervised K-means machine learning (ML) algorithm. The GNJ technique is a general technique that can be applied to a set of reported suspicious signals (SSs) in order to identify the most SSs and reduce false-positive rates (FPRs) in detecting HTs. The GNJ technique is applied to 60 different combinations of full-scan and partial-scan circuits and hard-to-detect combinational HTs. To realize valid and hard-to-detect HTs, a configurable HT insertion platform is developed. Furthermore, to the best of our knowledge, it is for the first time that an extensive evaluation of partial-scan circuits for HT detection at the gate level is being performed. The comprehensive results on both full- and partial-scan circuits have shown that the GNJ technique is highly scalable as it presents a linear relationship between the number of SSs and the execution time of GNJ. Furthermore, the GNJ technique does not miss an HT circuit if exists. The GNJ technique offers an FPR as low as 3.89% for full-scan circuits and 3.31% for partial-scan circuits on average.