## 1 Introduction  
State-of-the-art embedded systems are increasingly employed in various applications due to their superior features of high processing performance, low power consumption, and good functional adaptation. However, in some security-critical application scenarios, the unintended behaviors of programs could jeopardize precious human lives and expensive scientific instruments. Thus, high-security capability is equally important for embedded system designs, especially for embedded processors, which are applied as the control kernels in these safety-sensitive scenes of automotive, aerospace, avionics, and railway transport [1, 2, 3, 4]. Therefore, the hardware-enhanced security protection is an important consideration in System-on-Chip (SoC) architecture. In previous reports, the various forms of hardware-oriented attacks have been implemented from the different-level sources, and can be categorized into the two main types: hardware-level attack and software-level attack. At the hardware-level attack, a malicious logic (well-known as a hardware Trojan) is a typical example that might be inserted into an untrusted third-part intellectual property (IP) beforehand and become activated under a specific condition to modify the processor's behaviors, cause program execution failure [5], or even create backdoors for confidential data leakage and control system hijacking to attackers [6]. On the other hand, software-level attacks mainly exploit the security vulnerabilities or bugs in software applications to disturb program executions or perform other unintended actions, such as tampering with the program code or injecting malicious code. Up to the present, most embedded programs and applications have been developed based on the high-level programming languages of C and C++, which access memory without any valid bound checks, and this situation will bring serious security risks to remote-controlled embedded systems. For instance, a famous case is the American Lockheed Martin RQ-170 sentinel unmanned aerial vehicle (UAV) that was captured by Iranian forces through instruction tampering attacks and false coordinate injections [7]. Moreover, the software-level attacks also easily cause memory buffer overflows [8; 9; 10] via stack smashing and then take control of hardware platforms during program execution. Various techniques have been proposed to protect SoCs against hardware-level and software-level attacks. For resisting hardware Trojan attacks, existing techniques using standard functional validation [11] and side-channel analysis [12; 13] can analyze and detect hardware for a hardware Trojan. However, the large scale integrated circuit chip after manufacturing technology makes it expensive and time-consuming to analyze all IPs. Furthermore, some purposefully inserted hardware Trojans are designed to be activated only by very rare events under a specific execution condition, which is difficult to detect in the function validations. Therefore, it is critical and challenging to eliminate the risks of these hardware-level attacks. For defending against software-level attacks, the multivariant execution technique (MET) [14], control flow integrity (CFI) [15], execute-only memory (XOM) [16], address space layout randomization (ASLR) [17], etc. have been proposed to monitor whether the program execution is following the intended behaviors. However, most protection techniques require extended instruction set architectures (ISAs) and modified compilers, which make them difficult to transplant into different embedded systems. The instruction codes of embedded programs could be deliberately tampered with--the attacks originating from both hardware-level and software-level attacks. Although some sapientii monitoring strategies have been proposed to observe whether program execution is under attack or not, it is not yet sufficient to ensure the correct completion of program execution only by detecting unintended behaviors.