Searching for an Effective Defender: Benchmarking Defense against Adversarial Word Substitution