A computer implemented method for detection and prevention of Return-Oriented-Programming, ROP, attacks in one or more applications, comprising: performing stack inspection, using a stack inspection device, to detect one or more ROP gadgets in a stack, characterized in that the stack inspection further comprises: stack walking from a stack frame at a top of the stack toward a bottom of the stack to detect one or more failure conditions; determining whether a valid stack frame and return code is present; and determining a failure condition if no valid stack frame and return code is present, wherein the failure condition indicates an ROP attack, the failure condition being determined (i) by detecting an invalid stack pointer by the stack pointer not belonging to a valid stack memory section, or (ii) by detecting an invalid return code address by the return code address not belonging to any code memory sections or the return code address belonging to an unexecutable code memory section, wherein an ROP gadget causes the return code address of a stack frame to give a stack distance that is different from a stack distance to the next stack frame and at that position the invalid return code address is detected; containing the ROP attack using a containment device; and analyzing, using an attack analysis device, the one or more ROP gadgets detected in the stack during the ROP attack. performing stack inspection, using a stack inspection device, to detect one or more ROP gadgets in a stack, characterized in that the stack inspection further comprises: stack walking from a stack frame at a top of the stack toward a bottom of the stack to detect one or more failure conditions; determining whether a valid stack frame and return code is present; and determining a failure condition if no valid stack frame and return code is present, wherein the failure condition indicates an ROP attack, the failure condition being determined (i) by detecting an invalid stack pointer by the stack pointer not belonging to a valid stack memory section, or (ii) by detecting an invalid return code address by the return code address not belonging to any code memory sections or the return code address belonging to an unexecutable code memory section, wherein an ROP gadget causes the return code address of a stack frame to give a stack distance that is different from a stack distance to the next stack frame and at that position the invalid return code address is detected; stack walking from a stack frame at a top of the stack toward a bottom of the stack to detect one or more failure conditions; determining whether a valid stack frame and return code is present; and determining a failure condition if no valid stack frame and return code is present, wherein the failure condition indicates an ROP attack, the failure condition being determined (i) by detecting an invalid stack pointer by the stack pointer not belonging to a valid stack memory section, or (ii) by detecting an invalid return code address by the return code address not belonging to any code memory sections or the return code address belonging to an unexecutable code memory section, wherein an ROP gadget causes the return code address of a stack frame to give a stack distance that is different from a stack distance to the next stack frame and at that position the invalid return code address is detected; containing the ROP attack using a containment device; and analyzing, using an attack analysis device, the one or more ROP gadgets detected in the stack during the ROP attack.