Paper: Kizzle: A Signature Compiler for Exploit Kits

In recent years, the drive-by malware
space has undergone significant consolidation. Today,
the most common source of drive-by downloads are
the so-called exploit kits. Exploit kits signify a drastic
consolidation of the process of malware creation and
delivery. Exploit kit authors are often significantly
more skillful and better financially motivated than an
average “standalone” JavaScript malware author. This
paper presents Kizzle, the first prevention technique
specifically designed for finding exploit kits.

more here............http://research.microsoft.com/pubs/240495/tr.pdf