Defending browsers against drive-by downloads : mitigating heap-spraying code injection attacks