and prevent return oriented programming attacks in another use case monitoring of system calls 210 can be utilized to detect malicious software code 310 at various stages ranging from early shellcode to advanced persistent malware the embodiments can be used to not only detect an initial malicious attack but also to counter attack malware that is running on a system that has already been infected in another use case trapping far branches in processor 110 when processor 110 follows the intel x86 architecture allows the system to interrupt the page fault handler running within operating system 130 when operating system 130 is windows this will allow malware detection to apply memory protection policies that could detect exploitation attempts prior to any control flow hijack even taking place the embodiments described above provide a new system and method for detecting system calls using a module operating at the kernel level and the performance monitoring unit of a processor monitoring data is collected for each system call and analyzed using a data analysis module which generates alerts that identify potential malicious software code any malicious software code can be counteracted by a malicious code counter attack module the foregoing merely illustrates the principles of the disclosure various modifications and alterations to the described embodiments will be apparent to those skilled in the art in view of the teachings herein it will thus be appreciated that those skilled in the art will be able to devise numerous systems arrangements and procedures which although not explicitly shown or described herein embody the principles of the disclosure and can be thus within the spirit and scope of the disclosure various different exemplary embodiments can be used together with one another as.