1. A method of detecting a Return-Oriented Programming exploitation, the method comprising, at a computer device: establishing hooking rules to hook code locations relating to respective functions stored in a computer readable medium in the form of a non-transitory memory; in the event that a control transfer of a code location relating to one of said functions is detected, comparing a code location address with values in a stack space freed by the control transfer and, in the event that the code location address and any of the values in the freed stack match, determining that the control transfer relates to a Return-Oriented Programming exploitation, wherein a number of values with which the code location address is compared is determined by identifying a number of parameters used by each of the functions and selecting the highest of these numbers as said number of values.