1. A computing device for exploit mitigation, the computing device comprising: a hardware processor comprising a processor trace module to generate trace data indicative of control flow of a process of the computing device during an execution of the process, wherein the control flow comprises an order of instructions executed by the processor; an exploit detector module to: (i) detect preemption of the process during the execution of the process; (ii) in response to detection of the preemption of the process, analyze the trace data using a heuristic algorithm to identify a suspected control flow exploit that is a suspected return-oriented programming exploit, wherein to analyze the trace data using the heuristic algorithm to identify the suspected return-oriented programming exploit comprises to: identify a first target instruction pointer packet in the trace data, wherein the first target instruction pointer packet is associated with a destination address; find a return instruction in memory at an address that follows the destination address of the first target instruction packet; and identify the suspected return-oriented programming exploit in response to finding the return instruction in memory; and (iii) determine a cost value in response to identification of the suspected control flow exploit, wherein the cost value is indicative of a likelihood that the suspected control flow exploit is an actual control flow exploit, wherein to determine the cost value comprises to: (a) subtract the cost value from a total cost budget, wherein the total cost budget is associated with the process; and (b) determine whether the total cost budget has been exceeded; and a security response module to handle the suspected control flow exploit in response to a determination that the total cost budget has been exceeded.