1. A processor comprising: a Return Oriented Programming (ROP) detection unit to: adjust a count in a first direction in response to detection of one or more control transfer events of a first type and adjust the count in a second direction in response to detection of one or more control transfer events of a second type; and in response to a determination that the count exceeds a threshold, provide an indication of a possible ROP attack.