## 5 Experiments and Results
### Performance Evaluation
#### 5.2.1 Security Capability Evaluation
As soon as these tampered data are extracted from the memory and ready for execution, the HIIMA can discover them at the ID stage. The attack methods against the control flow are as follows:  
* Modifications for direct jumps. The attackers can use the buffer overflow attack to overwrite the value of the general-purpose register, so that the target address of the \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline \multirow{2}{*}{**Benchmarks**} & \multicolumn{2}{c}{**Attacks on Code**} & \multicolumn{2}{c}{**Attacks on Memory**} & \multicolumn{2}{c}{**Attacks on Dyn. Data**} \\ \cline{2-7}  & **DI Check** & **CFI Check** & **DI Check** & **CFI Check** & **DI Check** & **CFI Check** \\ \hline OpenECC & 100\% & 72.3\% & 98.7\% & 59.2\% & 100\% & 83.4\% \\ SHA1 & 100\% & 84.2\% & 99.1\% & 69.4\% & 100\% & 92.8\% \\ FFT & 100\% & 77.5\% & 99.6\% & 65.7\% & 100\% & 85.4\% \\ CRC16 & 100\% & 80.4\% & 99.5\% & 67.4\% & 100\% & 87.1\% \\ BasicMath & 100\% & 76.3\% & 98.1\% & 63.1\% & 100\% & 88.3\% \\ AES & 100\% & 81.7\% & 98.9\% & 68.9\% & 100\% & 86.7\% \\ Bitcount & 100\% & 85.1\% & 98.6\% & 70.6\% & 100\% & 91.2\% \\ Blowfish & 100\% & 75.8\% & 98.2\% & 60.3\% & 100\% & 81.3\% \\ Patricia & 100\% & 74.5\% & 98.8\% & 64.5\% & 100\% & 83.7\% \\ QuickSort & 100\% & 81.6\% & 99.3\% & 68.8\% & 100\% & 89.5\% \\ \hline Average & 100\% & 78.9\% & 98.9\% & 65.8\% & 100\% & 86.9\% \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Statistics on the detection rate of data attacks. direct jump instruction and the direct function call instruction becomes the value set by the attacker. * Modifications for branch jumps. The attacker can attack the value of the register to change the target address of the branch instruction. In addition, the attacker can also change the judgment condition of the branch jump by changing the value of the flag. * Modification for the return address. Using the ROP attack, the attacker can modify the return address of the program to hijack the control flow. * Modifications for indirect jumps. For indirect jump instructions and indirect function call instructions, an attacker can use the JOP attack to modify the target address of the indirect jump and hijack the control flow. In order to simulate the above-mentioned attacks, we designed a fault implant circuit inside the embedded system, which can modify the binary code and general registers, and realize the malicious tampering of direct jumps, branch jumps, return addresses, and indirect jumps. For each benchmark, 1000 attack samples were randomly selected for attack. Every time the program is executed, the fault implant circuit implants an attack sample into the embedded processor and judges whether the HMM has completed the real-time monitoring function of the attack according to whether the HMM gives a fault abnormal signal. The statistical results of attacks on the control flow are shown in Table 5.  
Facing the direct jump and branch jump attacks, the HMM has a high attack-detection rate. For the attack behavior of the return address, indirect jump, and indirect function call, HMM has a missed detection rate. For indirect function call instructions, since we only limit the legal range of the destination address, when the address represented by the register happens to be a function entry that should not be called, the HMM will miss the detection. For the return address and indirect jump instructions, the HMM will also miss the detection due to similar reasons. However, in general, the HMM has high detection rates for attacks on return addresses, indirect jumps, and indirect calls, which are all above 90%.