1. A processor comprising: a core including a fetch unit to fetch instructions, a decode unit to decode the fetched instructions, at least one execution unit to execute one or more of the decoded instructions and a first logic comprising at least one hardware circuit coupled to the at least one execution unit, the first logic to: adjust a count in a first direction in response to detection of one or more control transfer events of a first type and adjust the count in a second direction in response to detection of one or more control transfer events of a second type; and in response to a determination that the count exceeds a threshold, notify a protection agent of a possible Return Oriented Programming (ROP) attack.