1. A processor comprising: a core including a fetch unit to fetch instructions, a decode unit to decode the fetched instructions, at least one execution unit to execute one or more of the decoded instructions and a hardware detection circuit coupled to the at least one execution unit, the hardware detection circuit to: adjust a count in a first direction in response to detection of one or more control transfer events of a first type and adjust the count in a second direction in response to detection of one or more control transfer events of a second type; determine a Return Oriented Programming (ROP) metric based at least in part on a plurality of control transfer events; and in response to a determination that the ROP metric exceeds a threshold, notify a protection agent to indicate detection of a possible ROP attack.