1. A processor comprising: at least one execution unit; and a Return Oriented Programming (ROP) detection logic to: determine a ROP metric based on a plurality of control transfer events, determine whether the ROP metric exceeds a threshold, and in response to a determination that the ROP metric exceeds the threshold, provide a ROP attack notification.