A return-oriented programming attack protection apparatus (10, 100) comprising: a first region of memory (50, 130) having stored therein a protection function (60, 140), said first region of memory set as executable; and a second region of memory (40, 120) having stored therein a plurality of operation functions (70, 150), said second region of memory set as non-executable, wherein said protection function is arranged to: responsive to a call to one of said plurality of operation functions and further responsive to at least one predetermined rule, allow execution of said called operation function; and after receiving a return from said executed operation function, set said executed operation function as non-executable, wherein responsive to said at least one predetermined rule, said protection function is further arranged to determine whether a return address of said call is valid, wherein said allowance of said execution of said called operation function is responsive to said return address of said call being determined to be valid, and wherein, responsive to said return address of said call being determined to not be valid, said protection function is further arranged to: not allow said execution of said called operation function; and output a notification regarding the non-valid return address, wherein said plurality of operation functions comprises said called function and a caller function, said call to said called function received from said caller function, and wherein said protection function is further arranged to: responsive to said call, set said caller function as non-executable; and responsive to said received return, allow execution of said caller function. a first region of memory (50, 130) having stored therein a protection function (60, 140), said first region of memory set as executable; and a second region of memory (40, 120) having stored therein a plurality of operation functions (70, 150), said second region of memory set as non-executable, wherein said protection function is arranged to: responsive to a call to one of said plurality of operation functions and further responsive to at least one predetermined rule, allow execution of said called operation function; and after receiving a return from said executed operation function, set said executed operation function as non-executable, responsive to a call to one of said plurality of operation functions and further responsive to at least one predetermined rule, allow execution of said called operation function; and after receiving a return from said executed operation function, set said executed operation function as non-executable, wherein responsive to said at least one predetermined rule, said protection function is further arranged to determine whether a return address of said call is valid, wherein said allowance of said execution of said called operation function is responsive to said return address of said call being determined to be valid, and wherein, responsive to said return address of said call being determined to not be valid, said protection function is further arranged to: not allow said execution of said called operation function; and output a notification regarding the non-valid return address, not allow said execution of said called operation function; and output a notification regarding the non-valid return address, wherein said plurality of operation functions comprises said called function and a caller function, said call to said called function received from said caller function, and wherein said protection function is further arranged to: responsive to said call, set said caller function as non-executable; and responsive to said received return, allow execution of said caller function. responsive to said call, set said caller function as non-executable; and responsive to said received return, allow execution of said caller function.