Protecting against the introduction of alien content

1. A computer-implemented security method, comprising:

obtaining, by a computer server system, a common web resource that is to be served in response to requests from a plurality of different client devices;

recoding portions of the common web resource in a manner that does not affect user perception of a presentation of the web resource on the plurality of different client devices, the recoding differing for different ones of the plurality of client devices;

serving the web resource to the plurality of different client devices, wherein each of a plurality of instances of the served web resource includes:

(i) the recoded portions, and

(ii) instrumentation code that is configured to be executed on a corresponding client device to which the web resource is being served and to monitor interaction by other resources on the corresponding client device with the web resource;

receiving, from the plurality of client devices, responses that result from the serving of the web resource, the responses having different content that depends on how a corresponding instance of the recoding of the portions of the web resource occurred for a particular one of the plurality of client devices; and

decoding content in the responses from particular ones of the client devices in a manner that corresponds to a manner in which the portions of the web resource were recoded for the particular ones of the client devices.

2. The computer-implemented method of claim 1 , further comprising receiving, from the instrumentation code that executes on the client devices, reports indicating that the instrumentation code detected abnormal behavior at particular ones of the client devices.

3. The computer-implemented method of claim 1 , wherein particular ones of the reports include an indication that an un-recoded form of the web resource attempted to interact with the corresponding client device.

4. The computer-implemented method of claim 1 , further comprising:

receiving, from particular ones of the plurality of different client devices, requests that each respond to corresponding web resources having recoded portions and instrumentation code;

modifying the received requests in a manner that is a functional inverse of the recoding of corresponding ones of the portions of the common web resource; and

providing modified requests to one or more server systems that served the common web resources.

5. The computer-implemented method of claim 1 , wherein recoding portions of the common web resource comprises changing names of functions in computer code for the common web resource to obscure operation of a web server system that generated the common web resource.

6. The computer-implemented method of claim 1 , wherein recoding portions of the common web resource comprises changing values of attributes in computer code that makes up the common web resource.

7. The computer-implemented method of claim 1 , wherein recoding portions of the common web resource comprises changing values associated with at least one of a link, a form, a field, and a function in an HTML document.

8. The computer-implemented method of claim 1 , wherein recoding portions of the common web resource comprises at least one of adding, removing, and rearranging content in a web document.

9. The computer-implemented method of claim 1 , wherein serving the web resource with the recoded portions to the plurality of different client devices includes associating each instance of the web resource that is served to a respective one of the plurality of different client devices with a corresponding session identifier, and wherein the received responses that result from serving the web resource include the corresponding session identifiers.

10. The computer-implemented method of claim 9 , further comprising:

storing information about modifications made in recoding the common web resource in a data structure that is identifiable by the session identifier, and

wherein decoding the content in the responses includes identifying the data structure using the corresponding session identifiers in the received responses, and using the information about the modifications that is stored in the data structure.

11. The computer-implemented method of claim 1 , wherein the computer server system is arranged to recode the common web resource in different manners across multiple different computing sessions from a single one of the plurality of client devices.

12. The computer-implemented security method of claim 1 , wherein serving the web resource with the recoded portions to the plurality of different client devices comprises serving, to each of the plurality of different client devices, a respective version of the common web resource that has been recoded differently from other versions of the common web resource served to other ones of the plurality of different client devices.

13. The computer-implemented security method of claim 1 , wherein recoding portions of the common web resource comprises randomly modifying the portions of the common web resource, wherein the common web resource is recoded differently for different ones of the plurality of client devices as a result of randomly modifying the portions of the common web resource for each of the plurality of client devices.

14. A computer system for identifying abnormal computer behavior, the system comprising:

a web server that is configured to provide a resource in the form of computer code to requesting client computing devices; and

a security intermediary arranged to

(i) receive the resource from the web server before the resource is provided to the requesting client computing devices,

(ii) process the received resource,

(iii) transmit the processed resource to corresponding requesting client computing devices, and

(iv) provide instrumentation code to corresponding requesting client computing devices with the processed resource, the instrumentation code programmed to monitor operation of the resource on corresponding requesting client computing devices,

wherein processing the received resource includes modifying the computer code for the received resource to obscure operation of the web server system, the modifying being different for different requests from clients for the received resource.

15. The computer system of claim 14 , wherein the security intermediary is further arranged to receive, from the instrumentation code provided to particular ones of the corresponding requesting client computing devices, reports that the instrumentation code detected abnormal behavior at the particular ones of the corresponding requesting client computing devices.

16. The computer system of claim 15 , wherein the report from a first corresponding client computing device includes an indication that the first corresponding requesting client computing device attempted to interact with an unmodified form of the computer code for the received resource.

17. The computer-implemented method of claim 14 , wherein the instrumentation code is programmed to detect alien content interaction with a document object model at a corresponding client computing device.

18. The computer system of claim 14 , wherein modifying the computer code for the received resource comprises changing names of functions in the computer code.

19. The computer system of claim 14 , wherein the security intermediary is further configured to modify the computer code for the received resource differently in response to each of a plurality of requests from a particular one of the client computing devices.

20. The computer system of claim 14 , wherein the security intermediary is arranged to process the received resource such that the processed resource, when executed by particular ones of the requesting client computing devices, presents a substantially consistent computing experience to users of the requesting client computing devices as a user experience for an unprocessed version of the resource.

21. The computer system of claim 14 , further comprising a central security server that is configured to receive security information from a plurality of security intermediaries that includes the security intermediary and other security intermediaries, the security information characterizing information about execution of one or more processed web resources by client computing devices.

22. One or more tangible computer-readable devices having instructions stored thereon that, when executed by one or more processors of a computer system, perform actions comprising:

obtaining, by the computer system, a common web resource that is to be served in response to requests from a plurality of different client devices;

recoding portions of the common web resource in a manner that does not affect user perception of a presentation of the web resource on the plurality of different client devices, the recoding differing for different ones of the plurality of client devices;

serving the web resource to the plurality of different client devices, wherein each of a plurality of instances of the served web resource includes:

(i) the recoded portions, and

(ii) instrumentation code that is configured to be executed on a corresponding client device to which the web resource is being served and to monitor interaction by other resources on the corresponding client device with the web resource;

receiving, from the plurality of client devices, responses that result from the serving of the web resource, the responses having different content that depends on how a corresponding instance of the recoding of the portions of the web resource occurred for a particular one of the plurality of client devices; and

decoding content in the responses from particular ones of the client devices in a manner that corresponds to a manner in which the portions of the web resource were recoded for the particular ones of the client devices.

23. The tangible computer-readable devices of claim 22 , wherein recoding portions of the common web resource comprises changing names of functions in computer code for the common web resource to obscure operation of a web server system that generated the common web resource.

24. The tangible computer-readable devices of claim 22 , wherein serving the web resource with the recoded portions to the plurality of different client devices includes associating each instance of the web resource that is served to a respective one of the plurality of different client devices with a corresponding session identifier, and wherein the received responses that result from serving the of the web resource include the corresponding session identifiers.

25. A computer-implemented security method, comprising:

receiving, at a computer system, a particular web resource that is to be served in response to respective requests from a first client device and a second client device;

recoding the particular web resource to generate a first recoded resource that is to be served to the first client device, the recoding including modifying computer code for the particular web resource to obscure operation of a server that generated or provided the particular web resource without changing a user experience with the first recoded resource executed by the first client device as compared to a user experience with the particular web resource if the particular web resource was executed by the first client device without having been recoded;

recoding the particular web resource to generate a second recoded resource that is to be served to the second client device, the recoding including modifying the computer code for the particular web resource to obscure operation of the server that generated or provided the particular web resource without changing a user experience with the second recoded resource executed by the second client device as compared to a user experience with the particular web resource if the particular web resource was executed by the second client device without having been recoded, wherein the second recoded resource is recoded differently than the first recoded resource;

inserting instrumentation code into computer code for the first recoded resource, wherein the instrumentation code is configured to be executed at the first client device in conjunction with execution of the first recoded resource and to monitor interaction by other resources on the first client device with the first recoded resource;

serving the first recoded resource, including the inserted instrumentation code, and the second recoded resource to the first client device and the second client device, respectively;

receiving, from the first client device, a first response resulting from the first recoded resource, and decoding content in the first response in a manner that corresponds to a manner in which the particular web resource was recoded to generate the first recoded resource; and

receiving, from the second client device, a second response resulting from the second recoded resource, and decoding content in the second response in a manner that corresponds to a manner in which the particular web resource was recoded to generate the second recoded resource.

26. The computer-implemented method of claim 25 , wherein the instrumentation code is further configured to identify one or more features of the first client device and to report information about the one or more features of the first client device to a server system remote from the first client device.