On using control signals for word-level identification in a gate-level netlist

This work tackles the problem of reverse engineering a gate-level netlist in order to identify groups of wires corresponding to words. It serves as the major step to find high-level modules and analyze their correct functionality in the presence of Hardware Trojans. Our core idea is to find and utilize control signals to more effectively identify words. Specifically, modern designs provide ample opportunities because they contain numerous control signals which are automatically inserted by the CAD tools. But finding control signals is itself an unresolved challenge. We propose a procedure to identify words which at its core finds and utilizes a small subset of relevant control signals by exploiting partial structural similarity. In our experiments, we show the effectiveness of our procedure by showing a high number of identified words with high accuracy using many benchmarks with already-identified words as the reference case.