## 5 Experiments and Results
### Performance Evaluation
#### 5.2.1 Security Capability Evaluation  
The Hybrid Information Integrity Monitoring Architecture (HIIMA) designed by us can realize the integrity protection of key data and control flows when the embedded system executes programs, and detect malicious behaviors of attackers tampering with data or hijacking the control flow in real time. Figure 2 illustrates the attack methods and attack locations of the OR1200 embedded systems. Since the extracted hybrid integrity reference information (HI\({}_{\text{REF}}\)) and bitmaps (FE\({}_{\text{Address}}\) Bitmap and BB\({}_{\text{Address}}\) Bitmap) are loaded into the designated memory of the HMM through the secure channel when the program is loaded, no external security module is required to encrypt the reference information. Therefore, side-channel attacks are not effective for HIIMA. In this section, software attacks \begin{table}
\begin{tabular}{c c} \hline \hline
**Content** & **Specification** \\ \hline \multirow{4}{*}{Processor Core} & OR1200 (svn rev 853) \\  & Clock Frequency @100 MHz \\  & The size of Data Cache: 4 KB \\  & The size of Instruction Cache: 4 KB \\ \hline \multirow{2}{*}{Memory} & The size of DDR2 SDRAM: 256 MB \\  & The size of Flash: 16 MB \\ \hline Board & Digilent Genesys \\ \hline FPGA Chip & Xilinx Virtex 5, XC5 VLX50T \\ \hline \hline \end{tabular}
\end{table} 
Table 3: The configuration of the SoC. and physical attacks will be used to simulate the tampering of key data and control flows by an attacker, and the security analysis will be performed separately. We mainly simulate data tampering attacks in three ways:  
* To simulate the tampering of the program code by an attacker, we randomly select a parameter in the source file of each benchmark test program, such as input variables and static variables, and tamper with the value of the parameter. Then, we ran the tampered program on the test platform to observe whether HIIMA can detect the attack. Each experiment was repeated 1000 times. * To simulate the attacker's attack on the external memory, we designed a fault implant circuit on the Flash. When the binary code is loaded on the Flash, the binary code and address of the program can be tampered with. Each set of experiments randomly selected 1000 attack samples to launch attacks on corresponding locations. * To simulate an attacker's attack on dynamic data, we have implanted an attack circuit inside DDR2. When the embedded system is running the program, if too many dynamic data are generated, this part of the data will be stored in an off-chip memory, such as DDR2. When the data are needed, the embedded system reads the data from the off-chip memory. The attack circuit will randomly tamper with certain data written to DDR2. Each experiment will be repeated 1000 times. Table 4 shows the detection rate of the HIIMA proposed in this paper for three types of data attacks. DI Check represents the probability that HIIMA discovers that data has been tampered with through the DI check mechanism. CFI Check indicates the probability that HIIMA finds that the control flow has been tampered with through the CFI check mechanism. The data in Table 4 show that even if the attack only aims at the data, the control flow of programs may change. However, the rate of discovering tampering attacks on data through the CFI protection mechanism is less than the rate of discovering tampering attacks through the DI protection mechanism. Therefore, many tampering-type attacks against data will not be detected if the CFI check mechanisms are only used. In addition, compared to attacks on data in the memory, attacks on code and attacks on dynamic data are easier to detect. The reason is that the binary may contain library functions that the program does not use. Even if attackers tampered with the data of these functions, their code would not have been executed. Thus, the HIIMA did not detect attacks. This does not mean that attackers have bypassed the HIIMA and tampered with the data.