  Outsourcing integrated circuit (IC) manufacturing to offshore foundries has
grown exponentially in recent years. Given the critical role of ICs in the
control and operation of vehicular systems and other modern engineering
designs, such offshore outsourcing has led to serious security threats due to
the potential of insertion of hardware trojans - malicious designs that, when
activated, can lead to highly detrimental consequences. In this paper, a novel
game-theoretic framework is proposed to analyze the interactions between a
hardware manufacturer, acting as attacker, and an IC testing facility, acting
as defender. The problem is formulated as a noncooperative game in which the
attacker must decide on the type of trojan that it inserts while taking into
account the detection penalty as well as the damage caused by the trojan.
Meanwhile, the resource-constrained defender must decide on the best testing
strategy that allows optimizing its overall utility which accounts for both
damages and the fines. The proposed game is based on the robust behavioral
framework of prospect theory (PT) which allows capturing the potential
uncertainty, risk, and irrational behavior in the decision making of both the
attacker and defender. For both, the standard rational expected utility (EUT)
case and the PT case, a novel algorithm based on fictitious play is proposed
and shown to converge to a mixed-strategy Nash equilibrium. For an illustrative
case study, thorough analytical results are derived for both EUT and PT to
study the properties of the reached equilibrium as well as the impact of key
system parameters such as the defender-set fine. Simulation results assess the
performance of the proposed framework under both EUT and PT and show that the
use of PT will provide invaluable insights on the outcomes of the proposed
hardware trojan game, in particular, and system security, in general.
