1. A processor comprising: a decode unit to decode instructions; at least one execution unit to execute decoded instructions; a retirement unit to retire executed instructions; and a Return Oriented Programming (ROP) detection logic to: increment a count in response to detection of a control transfer event of a first type and decrement the count in response to detection of a control transfer event of a second type, determine whether the count exceeds a threshold, and in response to a determination that the count exceeds the threshold, provide a ROP attack notification.