The inherent limitations of embedded systems make them particularly vulnerable to attacks. We have developed a hardware monitor that operates in parallel to the embedded processor and detects any attack that causes the embedded processor to deviate from its originally programmed behavior. We explore several different characteristics that can be used for monitoring and quantitative tradeoffs between these approaches. Our results show that our proposed hash-based monitoring pattern can detect attacks within one instruction cycle at lower memory requirements than traditional approaches that use control-flow information. Categories and Subject Descriptors C.3 [Special purpose and application-based systems]: Real-time and embedded systems. General Terms Design, Security. Keywords Embedded system security, processing monitor, hardware monitor.