JStill: mostly static detection of obfuscated malicious JavaScript code
Cujo: efficient detection and prevention of drive-by-download attacks