Learning Malicious Circuits in FPGA Bitstreams

Computing platforms are integrating field-programmable gate arrays (FPGAs) to support domain-specific customization. Multiple tenants can share these FPGAs by configuring them at runtime. However, attackers can abuse this capability by programming the FPGAs with malicious functions. A malicious configuration bitstream can launch denial of service, overheat the FPGA, leak sensitive information via side channels, enable remote monitoring, and launch voltage and timing attacks. We consider time-based multitenancy, where multiple tenants use the FPGA at different time intervals and not at the same time. We propose a defense based on machine learning (ML) algorithms to detect bitstreams of malicious circuits and malicious circuits mixed with legitimate circuits by analyzing the static features extracted from FPGA bitstreams. The proposed approach can help detect malicious bitstreams without the need for reverse engineering of the bitstream or having access to the design netlist. Our results on Xilinx FPGAs indicate that supervised classifiers may identify malicious bitstreams representing ring-oscillator circuits with a true-positive rate (TPR) of 100% and a false-positive rate (FPR) of only 4%. In addition, for the extremely difficult problem of detecting malicious bitstreams embedded in legitimate bitstreams, a pipeline of a random forest and a support vector machine classifiers trained on subarrays of bitstreams can help detect bitstreams of malicious circuits embedded in legitimate designs with TPR of 95.5% and FPR of 30.4%.