Security is now becoming a well-established challenge for integrated circuits (ICs). Various types of IC attacks have been reported, including reverse engineering IPs, dumping on-chip data, and controlling/modifying IC operation. IEEE 1149.1, commonly known as Joint Test Action Group (JTAG), is a standard for providing test access to an IC. JTAG is primarily used for IC manufacturing test, but also for in-field debugging and failure analysis since it gives access to internal subsystems of the IC. Because the JTAG needs to be left intact and operational after fabrication, it inevitably provides a “backdoor” that can be exploited outside its intended use. This paper proposes machine learning-based approaches to detect illegitimate use of the JTAG. Specifically, JTAG operation is characterized using various features that are then classified as either legitimate or attack. Experiments using the OpenSPARC T2 platform demonstrate that the proposed approaches can classify legitimate JTAG operation and known attacks with significantly high accuracy. Experiments also demonstrate that unknown and disguised attacks can be detected with high accuracy as well (99% and 94%, respectively).