1. A host system comprising at least one hardware processor configured to: identify a target area of a call stack of a target process executing on the host system; identify a set of gadget references within the target area, each identified gadget reference pointing to a section of memory hosting a return-oriented programming (ROP) gadget; and in response to identifying the target area and the set of gadget references, determine whether the target process is malicious according to a proportion of the target area occupied by the set of gadget references.