I got a chance to met Ben Livshits after my web worm talk at BH where we had a discussion about these detection techniques (and why McCabe complexity diagrams are too coarse). I'm finally getting around to reading his paper.

Spectator: Detection and containment of JavaScript worms