ThermoTrust: Self-Supervised Thermal Vision for Runtime Detection of Hardware Trojans and Malicious Firmware in Edge Devices

Abstract

Attackers can alter the runtime behavior of edge devices through Hardware Trojans and malicious firmware without producing clearly observable changes in network traffic or file-system activity. Existing integrity-monitoring approaches commonly depend on golden references, labeled attack traces, static firmware inspection, or intrusive side-channel instrumentation. This study proposes ThermoTrust, an integrated self-supervised thermal-vision framework that learns device-specific normal thermal behavior and detects previously unseen integrity deviations through spatial-temporal residual learning and firmware-state consistency analysis. The framework is evaluated using a controlled thermal protocol aligned with the publicly available Hardware Trojan Power and Electromagnetic Side-Channel Dataset, which includes twelve Trust-Hub AES Trojan benchmarks under disabled, enabled, and triggered operating conditions. ThermoTrust combines emissivity-normalized thermal frames, masked spatial-temporal reconstruction, persistent residual scoring, and firmware-state mismatch estimation to generate a composite runtime integrity score and localized thermal evidence. The experimental evaluation comprises 12,000 thermal windows distributed across normal operation, firmware deviation, and Trojan activation conditions. ThermoTrust achieves 97.44% accuracy, 97.55% precision, 97.33% recall, a 97.44% F1-score, an area under the receiver operating characteristic curve of 0.992, and an inference latency of 18.6 ms. The results demonstrate that combining self-supervised thermal normality learning with firmware-aware consistency analysis provides accurate, lightweight, and contactless runtime integrity monitoring for edge devices.