arXiv subjects

Steffen Becker

Publications and source records attributed to Steffen Becker.

At least 19 recordsLinked to original sources

arXiv2026

Designing a Hardware Reverse Engineering Course: Lessons from Eight Years in a Rapidly Evolving Tech Domain

Integrated Circuits (ICs) are omnipresent, yet their globalized manufacturing process remains vulnerable to supply chain threats. Hardware Reverse Engineering (HRE) is essential for detecting such threats and re-establishing trust; however domain experts remain scarce due to a lack of educational programs. To contribute educational insights in this critical and rapidly evolving technology domain, we present our HRE course focusing on digital circuit analysis and digital circuit extraction from ICs. The course targets junior-level undergraduates at a major European research university. The curriculum has been refined over nine iterations (2017-2025), with several alumni subsequently pursuing careers in the HRE field. By reflecting on the evolution of the course organization, content, and assignments, we derive key lessons learned. We further distill these insights into actionable design priorities for educators developing courses in rapidly evolving technological domains, emphasizing iterative growth and sustainable workload management for both students and instructors.

cs.CY↗

arXiv2026

Hardware Trojans from Invisible Inversions: On the Trojanizability of Standard Cell Libraries

At S&P 2023, Puschner et al. made a valuable dataset for hardware Trojan detection research publicly available. It contains a complete set of Scanning Electron Microscope (SEM) images of four different digital Integrated Circuits (ICs) fabricated at progressively smaller semiconductor technology nodes. Puschner et al. reported preliminary evidence that feature sizes affect Trojan detection performance, but they were unable to disentangle effects caused by insertion strategies or by degrading image quality from those intrinsic to the underlying standard cell libraries. Distinguishing those causes, however, is crucial to understand whether improved tooling (e.g., higher resolution imaging equipment) can remove the observed technology bias, or whether susceptibility to stealthy hardware Trojans is indeed an inherent property of a cell library. In this work, we dive deep into the S&P 2023 dataset to answer these questions. We devise alternative metrics to those of Puschner et al., in order to assess and compare the potential susceptibility of standard cell libraries more meaningfully. We find clear differences between the evaluated process nodes. However, in all cases we identify cells that implement distinct logic functions yet are visually indistinguishable in backside SEM images. We exploit this property to construct stealthy, standard-cell-based hardware Trojans and present a concrete case study: a privilege-escalation backdoor in an Ibex RISCV core. Our results demonstrate that cell libraries can - and should - be evaluated for their potential "Trojanizability", and we recommend practical defenses.

cs.CR↗

arXiv2026

SoK: From Silicon to Netlist and Beyond $-$ Two Decades of Hardware Reverse Engineering Research

Hardware serves as the root of trust in modern computing systems, making Hardware Reverse Engineering (HRE) essential for security assurance$-$from design verification and supply-chain integrity to vulnerability discovery. We scope HRE to netlist recovery and its subsequent analysis, spanning the three subdomains of Integrated Circuit (IC), Field-Programmable Gate Array (FPGA), and netlist reverse engineering. These subdomains differ in their methodologies, but share core processes and are shaped by common requirements and legal constraints of the same stakeholders. Despite an increasing number of publications, the field lacks a systematic understanding of how these obstacles have stunted the research ecosystem. To address this gap, we present the first large-scale Systematization of Knowledge (SoK) of the HRE workflow, analyzing 187 peer-reviewed publications. Across all three subdomains, we identify eleven concrete technical challenges$-$from a widening gap between academic research and modern semiconductor technology nodes to overly idealized assumptions in netlist analysis$-$and propose actionable directions for each. A retrospective evaluation of all 30 published artifacts reveals that key results could be reproduced for only seven, a mere 4 % of all 187 papers in our corpus, confirming a systemic reproducibility crisis. We trace both the technical and reproducibility challenges to three structural barriers that recur across all subdomains: scarce reusable artifacts, missing benchmarks, and unresolved legal constraints on data sharing and collaboration. Based on these findings, we derive stakeholder-specific recommendations for academia, industry, and government to transition HRE from isolated research silos toward a collaborative discipline capable of assuring increasingly complex, global hardware supply chains.

cs.CR↗

arXiv2025

HAL -- An Open-Source Framework for Gate-Level Netlist Analysis

HAL is an open-source framework for gate-level netlist analysis, an integral step in hardware reverse engineering. It provides analysts with an interactive GUI, an extensible plugin system, and APIs in both C++ and Python for rapid prototyping and automation. In addition, HAL ships with plugins for word-level modularization, cryptographic analysis, simulation, and graph-based exploration. Since its release in 2019, HAL has become widely adopted in academia, industry, government, and teaching. It underpins at least 23 academic publications, is taught in hands-on trainings, conference tutorials, and university classes, and has collected over 680 stars and 86 forks on GitHub. By enabling accessible and reproducible hardware reverse engineering research, HAL has significantly advanced the field and the understanding of real-world capabilities and threats.

cs.CR↗

arXiv2025

Campus AI vs Commercial AI: A Late-Breaking Study on How LLM As-A-Service Customizations Shape Trust and Usage Patterns

As the use of Large Language Models (LLMs) by students, lecturers and researchers becomes more prevalent, universities - like other organizations - are pressed to develop coherent AI strategies. LLMs as-a-Service (LLMaaS) offer accessible pre-trained models, customizable to specific (business) needs. While most studies prioritize data, model, or infrastructure adaptations (e.g., model fine-tuning), we focus on user-salient customizations, like interface changes and corporate branding, which we argue influence users' trust and usage patterns. This study serves as a functional prequel to a large-scale field study in which we examine how students and employees at a German university perceive and use their institution's customized LLMaaS compared to ChatGPT. The goals of this prequel are to stimulate discussions on psychological effects of LLMaaS customizations and refine our research approach through feedback. Our forthcoming findings will deepen the understanding of trust dynamics in LLMs, providing practical guidance for organizations considering LLMaaS deployment.

cs.CY↗

arXiv2025

MVVM Revisited: Exploring Design Variants of the Model-View-ViewModel Pattern

Many enterprise software systems provide complex Graphical User Interfaces (GUIs) that need robust architectural patterns for well-structured software design. However, popular GUI architectural patterns like Model-View-ViewModel (MVVM) often lack detailed implementation guidance, leading GUI developers to inappropriately use the pattern without a comprehensive overview of design variants and often-mentioned trade-offs. Therefore, this paper presents an extensive review of MVVM design aspects and trade-offs, extending beyond the standard MVVM definition. We conducted a multivocal literature review (MLR), including white and gray literature, to cover essential knowledge from blogs, published papers, and other unpublished formats like books. Using the standard MVVM definition as a baseline, our study identifies (1) 76 additional design constructs grouped into 29 design aspects and (2) 16 additional benefits and 15 additional drawbacks. These insights can guide enterprise application developers in implementing practical MVVM solutions and enable informed design decisions.

cs.SE↗

arXiv2025

ViMoTest: A Tool to Specify ViewModel-Based GUI Test Scenarios using Projectional Editing

Automated GUI testing is crucial in ensuring that presentation logic behaves as expected. However, existing tools often apply end-to-end approaches and face challenges such as high specification efforts, maintenance difficulties, and flaky tests while coupling to GUI framework specifics. To address these challenges, we introduce the ViMoTest tool, which leverages Behavior-driven Development, the ViewModel architectural pattern, and projectional Domain-specific Languages (DSLs) to isolate and test presentation logic independently of GUI frameworks. We demonstrate the tool with a small JavaFX-based task manager example and generate executable code.

cs.SE↗

arXiv2025

An Architectural View Type for Elasticity Modeling and Simulation -- The Slingshot Approach

The cloud computing model enables the on-demand provisioning of computing resources, reducing manual management, increasing efficiency, and improving environmental impact. Software architects now play a strategic role in designing and deploying elasticity policies for automated resource management. However, creating policies that meet performance and cost objectives is complex. Existing approaches, often relying on formal models like Queueing Theory, require advanced skills and lack specific methods for representing elasticity within architectural models. This paper introduces an architectural view type for modeling and simulating elasticity, supported by the Scaling Policy Definition (SPD) modeling language, a visual notation, and precise simulation semantics. The view type is integrated into the Palladio ecosystem, providing both conceptual and tool-based support. We evaluate the approach through two single-case experiments and a user study. In the first experiment, simulations of elasticity policies demonstrate sufficient accuracy when compared to load tests, showing the utility of simulations for evaluating elasticity. The second experiment confirms feasibility for larger applications, though with increased simulation times. The user study shows that participants completed 90% of tasks, rated the usability at 71%, and achieved an average score of 76% in nearly half the allocated time. However, the empirical evidence suggests that modeling with this architectural view requires more time than modeling control flow, resource environments, or usage profiles, despite its benefits for elasticity policy design and evaluation.

cs.SE↗

arXiv2025

"Make the Voodoo Box Go Bleep Bloop:" Exploring End Users' Understanding and Information Needs Regarding Microchips

Microchips are fundamental components of modern electronic devices, yet they remain opaque to the users who rely on them daily. This opacity, compounded by the complexity of global supply chains and the concealment of proprietary information, raises significant security, trust, and accountability issues. We investigate end users' understanding of microchips, exploring their perceptions of the societal implications and information needs regarding these essential technologies. Through an online survey with 250 participants, we found that while our participants were aware of some microchip applications, they lacked awareness of the broader security, societal, and economic implications. While our participants unanimously desired more information on microchips, their specific information needs were shaped by various factors such as the microchip's application environment and one's affinity for technology interaction. Our findings underscore the necessity for improving end users' awareness and understanding of microchips, and we provide possible directions to pursue this end.

cs.HC↗

arXiv2025

From Assistance to Autonomy -- A Researcher Study on the Potential of AI Support for Qualitative Data Analysis

The advent of AI technologies, such as Large Language Models, has introduced new possibilities for Qualitative Data Analysis (QDA), offering both opportunities and challenges. To help navigate the responsible integration of AI into QDA, we conducted semi-structured interviews with 15 Human-Computer Interaction (HCI) researchers experienced in QDA. While our participants were open to AI support in their QDA workflows, they expressed concerns about data privacy, autonomy, and the quality of AI outputs. In response, we developed a framework that spans from minimal to high AI involvement, providing tangible scenarios for integrating AI into QDA practices while addressing researchers' needs and concerns. Aligned with real-life QDA workflows, we identify potential for AI tools in areas such as data pre-processing, researcher onboarding, or conflict mediation. Our framework aims to provoke further discussion on the development of AI-supported QDA and to help establish community standards for responsible Human-AI collaboration.

cs.CY↗

arXiv2024

Patching FPGAs: The Security Implications of Bitstream Modifications

Field Programmable Gate Arrays (FPGAs) are known for their reprogrammability that allows for post-manufacture circuitry changes. Nowadays, they are integral to a variety of systems including high-security applications such as aerospace and military systems. However, this reprogrammability also introduces significant security challenges, as bitstream manipulation can directly alter hardware circuits. Malicious manipulations may lead to leakage of secret data and the implementation of hardware Trojans. In this paper, we present a comprehensive framework for manipulating bitstreams with minimal reverse engineering, thereby exposing the potential risks associated with inadequate bitstream protection. Our methodology does not require a complete understanding of proprietary bitstream formats or a fully reverse-engineered target design. Instead, it enables precise modifications by inserting pre-synthesized circuits into existing bitstreams. This novel approach is demonstrated through a semi-automated framework consisting of five steps: (1) partial bitstream reverse engineering, (2) designing the modification, (3) placing and (4) routing the modification into the existing circuit, and (5) merging of the modification with the original bitstream. We validate our framework through four practical case studies on the OpenTitan design synthesized for Xilinx 7-Series FPGAs. While current protections such as bitstream authentication and encryption often fall short, our work highlights and discusses the urgency of developing effective countermeasures. We recommend using FPGAs as trust anchors only when bitstream manipulation attacks can be reliably excluded.

cs.CR↗

arXiv2024

An Evidence-Based Curriculum Initiative for Hardware Reverse Engineering Education

The increasing importance of supply chain security for digital devices -- from consumer electronics to critical infrastructure -- has created a high demand for skilled cybersecurity experts. These experts use Hardware Reverse Engineering (HRE) as a crucial technique to ensure trust in digital semiconductors. Recently, the US and EU have provided substantial funding to educate this cybersecurity-ready semiconductor workforce, but success depends on the widespread availability of academic training programs. In this paper, we investigate the current state of education in hardware security and HRE to identify efficient approaches for establishing effective HRE training programs. Through a systematic literature review, we uncover 13 relevant courses, including eight with accompanying academic publications. We identify common topics, threat models, key pedagogical features, and course evaluation methods. We find that most hardware security courses do not prioritize HRE, making HRE training scarce. While the predominant course structure of lectures paired with hands-on projects appears to be largely effective, we observe a lack of standardized evaluation methods and limited reliability of student self-assessment surveys. Our results suggest several possible improvements to HRE education and offer recommendations for developing new training courses. We advocate for the integration of HRE education into curriculum guidelines to meet the growing societal and industry demand for HRE experts.

cs.CY↗

arXiv2024

HyLiMo: A Hybrid Live-Synchronized Modular Diagramming Editor as IDE Extension for Technical and Scientific Publications

Creating suitable diagrams for technical and scientific publications is challenging and time-consuming, as manual control over the layout is required to communicate information effectively. Existing diagramming tools usually allow modeling the diagrams via a textual domain-specific language (DSL) that can be rendered and auto-layouted or via a graphical editor. While auto-layout is fast, the results are often not satisfying for most publications. However, graphical editors are time-consuming to create large diagrams. The blended or hybrid modeling concept enables creating diagrams efficiently using a DSL and editing the rendered diagram via the graphical editor for fine-tuning. However, hybrid modeling editors are limited to individual diagram types and do not save the layout and style information in the textual description. Therefore, we propose HyLiMo, a hybrid live-synchronized modular diagramming editor. In HyLiMo, diagrams are created using an internal DSL and live synchronized with an interactive graphical editor for the rendered diagram, allowing a straightforward layout and style change, which is stored in the DSL code. HyLiMo is independent of specific diagram types, but we offer specific functionality for UML class diagrams. Using the language server protocol, we implement it as a web app and IDE extension. The results of our user study indicate that such an approach enables fast and precise diagramming.

cs.SE↗

arXiv2024

Large Language Models to Generate System-Level Test Programs Targeting Non-functional Properties

System-Level Test (SLT) has been a part of the test flow for integrated circuits for over a decade and still gains importance. However, no systematic approaches exist for test program generation, especially targeting non-functional properties of the Device under Test (DUT). Currently, test engineers manually compose test suites from off-the-shelf software, approximating the end-user environment of the DUT. This is a challenging and tedious task that does not guarantee sufficient control over non-functional properties. This paper proposes Large Language Models (LLMs) to generate test programs. We take a first glance at how pre-trained LLMs perform in test program generation to optimize non-functional properties of the DUT. Therefore, we write a prompt to generate C code snippets that maximize the instructions per cycle of a super-scalar, out-of-order architecture in simulation. Additionally, we apply prompt and hyperparameter optimization to achieve the best possible results without further training.

cs.SE↗

arXiv2024

Decoding Complexity: Exploring Human-AI Concordance in Qualitative Coding

Qualitative data analysis provides insight into the underlying perceptions and experiences within unstructured data. However, the time-consuming nature of the coding process, especially for larger datasets, calls for innovative approaches, such as the integration of Large Language Models (LLMs). This short paper presents initial findings from a study investigating the integration of LLMs for coding tasks of varying complexity in a real-world dataset. Our results highlight the challenges inherent in coding with extensive codebooks and contexts, both for human coders and LLMs, and suggest that the integration of LLMs into the coding process requires a task-by-task evaluation. We examine factors influencing the complexity of coding tasks and initiate a discussion on the usefulness and limitations of incorporating LLMs in qualitative research.

cs.HC↗

arXiv2024

CARISMA: CAR-Integrated Service Mesh Architecture

The amount of software in modern cars is increasing continuously with traditional electric/electronic (E/E) architectures reaching their limit when deploying complex applications, e.g., regarding bandwidth or computational power. To mitigate this situation, more powerful computing platforms are being employed and applications are developed as distributed applications, e.g., involving microservices. Microservices received widespread adoption and changed the way modern applications are developed. However, they also introduce additional complexity regarding inter-service communication. This has led to the emergence of service meshes, a promising approach to cope with this complexity. In this paper, we present an architecture applying the service mesh approach to automotive E/E platforms comprising multiple interlinked High-Performance Computers (HPCs). We validate the feasibility of our approach through a prototypical implementation.

cs.DC↗

arXiv2024

I see an IC: A Mixed-Methods Approach to Study Human Problem-Solving Processes in Hardware Reverse Engineering

Trust in digital systems depends on secure hardware, often assured through Hardware Reverse Engineering (HRE). This work develops methods for investigating human problem-solving processes in HRE, an underexplored yet critical aspect. Since reverse engineers rely heavily on visual information, eye tracking holds promise for studying their cognitive processes. To gain further insights, we additionally employ verbal thought protocols during and immediately after HRE tasks: Concurrent and Retrospective Think Aloud. We evaluate the combination of eye tracking and Think Aloud with 41 participants in an HRE simulation. Eye tracking accurately identifies fixations on individual circuit elements and highlights critical components. Based on two use cases, we demonstrate that eye tracking and Think Aloud can complement each other to improve data quality. Our methodological insights can inform future studies in HRE, a specific setting of human-computer interaction, and in other problem-solving settings involving misleading or missing information.

cs.HC↗

arXiv2023

REVERSIM: An Open-Source Environment for the Controlled Study of Human Aspects in Hardware Reverse Engineering

Hardware Reverse Engineering (HRE) is a technique for analyzing integrated circuits. Experts employ HRE for security-critical tasks, like detecting Trojans or intellectual property violations, relying not only on their experience and customized tools but also on their cognitive abilities. In this work, we introduce ReverSim, a software environment that models key HRE subprocesses and integrates standardized cognitive tests. ReverSim enables quantitative studies with easier-to-recruit non-experts to uncover cognitive factors relevant to HRE. We empirically evaluated ReverSim in three studies. Semi-structured interviews with 14 HRE professionals confirmed its comparability to real-world HRE processes. Two online user studies with 170 novices and intermediates revealed effective differentiation of participant performance across a spectrum of difficulties, and correlations between participants' cognitive processing speed and task performance. ReverSim is available as open-source software, providing a robust platform for controlled experiments to assess cognitive processes in HRE, potentially opening new avenues for hardware protection.

cs.CR↗