Detecting the introduction of alien content

1. A computer-implemented method for identifying abnormal computer behavior, the method comprising:

receiving, at a computer server subsystem, data that characterizes subsets of document object models for web pages rendered by client computers;

identifying clusters from the data that characterize the subsets of the document object models; and

using the clusters to identify alien content on the client computers by determining that the alien content comprises content in the document object models that is not a result of content that is the basis of a particular document object model defined in a first set of code served to a particular client computer of the client computers.

2. The computer-implemented method of claim 1 , wherein the data that characterizes subsets of the document object models is generated by a second set of code that is provided by the computer server subsystem and to the client computers in coordination with the web pages.

3. The computer-implemented method of claim 2 , wherein the second set of code that is provided by the computer server subsystem identifies changes to the particular document object model in response to occurrence of events relating to the web pages.

4. The computer-implemented method of claim 3 , wherein the events comprise defined user selections of an object on the web pages.

5. The computer-implemented method of claim 2 , wherein the second set of code provided by the computer server subsystem performs reduction processes to generate strings that are smaller than the first set of code that defines the particular document object model and that characterize content of the document object models.

6. The computer-implemented method of claim 5 , wherein the reduction processes comprise a hash function that is performed on at least portions of the document object models.

7. The computer-implemented method of claim 1 , wherein the clusters are identified by plotting data from particular ones of the client computers on a hyperplane.

8. The computer-implemented method of claim 7 , wherein the hyperplane is defined by dimensions that correspond to particular features of the web pages identified as being relevant to determining whether one or more actions are benign or malicious.

9. The computer-implemented method of claim 1 , wherein using the cluster to identify alien content comprises identifying whether the clusters correspond to features previously identified as being related to benign variations in client computers.

10. The computer-implemented method of claim 1 , further comprising sending, by the computer server subsystem and to a security server system, at least a portion of the data that characterizes subsets of document object models, wherein the security server system is configured to receive data from a plurality of computer server subsystems, and wherein particular ones of the plurality of computer server subsystems serve different web domains.

11. The computer-implemented method of claim 1 , further comprising receiving, at the computer server subsystem, data that indicates context of at least one of (i) the web pages and (ii) the client computers.

12. The computer-implemented method of claim 11 , wherein the data that indicates context comprises information that identifies the client computers.

13. The computer-implemented method of claim 11 , wherein the data that indicates context comprises information that identifies an application that rendered one or more particular web pages of the web pages at particular ones of the client computers.

14. The computer-implemented method of claim 11 , wherein the data that indicates context comprises information that identifies a web site or a web domain for which particular ones of the web pages were served.

15. The computer-implemented method of claim 11 , wherein identifying clusters from the data that characterizes the subsets of the document object models comprises using the data that indicates context.

16. The computer-implemented method of claim 7 , wherein the hyperplane is defined by dimensions that include at least one identifier of the particular ones of the client computers, an identifier of an application that rendered a particular web page of the web pages at particular ones of the client computers, and an identifier of a web site or a web domain that served particular ones of the web pages.

17. The computer-implemented method of claim 1 , wherein the clusters are identified based at least in part on identities of particular ones of the web pages or on one or more identities of web domains that served particular ones of the web pages.

18. The computer-implemented method of claim 1 , further comprising determining whether the identified alien content is benign or malicious.

19. The computer-implemented method of claim 18 , wherein determining whether the identified alien content is benign or malicious comprises comparing the identified alien content to other alien content that has previously been identified as benign or malicious.

20. A computer system for identifying abnormal computer behavior comprising:

one or more processors;

a memory coupled to the one or more processors and storing one or more instructions, which when executed by the one or more hardware processors cause the one or more hardware processors to:

supplement web code with instrumentation code that is executable on a client device and that can collect information about execution of the web code at the client device, wherein the information includes representations of a document object model of the web code;

analyze information received from a plurality of client devices that was collected by instrumentation code on each of the plurality of client devices to identify alien content on the client devices.