Detecting and identifying anomalies for single page applications

1. A method, comprising:

obtaining, at a device, page load information corresponding to a loaded web application;

detecting, by the device and based on the page load information, an anomalous feature of the loaded web application;

identifying, by the device, a type of the anomalous feature based on a number of resource anomalies within the loaded web application, wherein the type of the anomalous feature is one of: a page anomaly when the number of resource anomalies is zero, a resource anomaly when the number of resource anomalies is one, or a domain anomaly when the number of resource anomalies is greater than one; and

performing, by the device, one or more mitigation actions according to the type of the anomalous feature.

2. The method as in claim 1 , wherein the domain anomaly is:

a single domain anomaly when resource anomalies within the loaded web application belong to a particular domain, and

a multi-domain anomaly when the resource anomalies belong to a plurality of domains.

3. The method as in claim 1 , the method further comprising:

aggregating, by the device, page load information corresponding to the loaded web application; and

determining, by the device, one or more baselines of expected page load times for the loaded web application.

4. The method as in claim 3 , wherein detecting, by the device and based on the page load information, the anomalous feature of the loaded web application is further based on the one or more baselines of expected page load times.

5. The method as in claim 1 , the method further comprising:

generating, by the device and based on the page load information, a hierarchy of the loaded web application.

6. The method as in claim 1 , wherein the page load information comprises a page load time of a page of the loaded web application.

7. The method as in claim 1 wherein the page load information comprises a resource load time of a resource from a page of the loaded web application.

8. The method as in claim 1 , wherein the one or more mitigation actions comprises causing a graphical user interface to display an indication of the type of the anomalous feature at an end-user device.

9. The method as in claim 1 , wherein the page load information is obtained from an agent selected from a group consisting of: a cloud agent, an enterprise agent, and an endpoint agent.

10. A tangible, non-transitory, computer-readable medium having computer-executable instructions stored thereon that, when executed by a processor on a computer, cause the computer to perform a method comprising:

obtaining page load information corresponding to a loaded web application;

detecting, based on the page load information, an anomalous feature of the loaded web application;

identifying a type of the anomalous feature based on a number of resource anomalies within the loaded web application, wherein the type of the anomalous feature is one of: a page anomaly when the number of resource anomalies is zero, a resource anomaly when the number of resource anomalies is one, or a domain anomaly when the number of resource anomalies is greater than one; and

performing one or more mitigation actions according to the type of the anomalous feature.

11. The tangible, non-transitory, computer-readable medium as in claim 10 , wherein the domain anomaly is:

a single domain anomaly when resource anomalies within the loaded web application belong to a particular domain, and

a multi-domain anomaly when the resource anomalies belong to a plurality of domains.

12. The tangible, non-transitory, computer-readable medium as in claim 10 , wherein the method further comprises:

aggregating page load information corresponding to the loaded web application; and

determining one or more baselines of expected page load times for the loaded web application.

13. The tangible, non-transitory, computer-readable medium as in claim 12 , wherein detecting, based on the page load information, the anomalous feature of the loaded web application is further based on the one or more baselines of expected page load times.

14. The tangible, non-transitory, computer-readable medium as in claim 10 , wherein the method further comprises:

generating, based on the page load information, a hierarchy of the loaded web application.

15. The tangible, non-transitory, computer-readable medium as in claim 10 , wherein the page load information comprises a page load time of a page of the loaded web application.

16. The tangible, non-transitory, computer-readable medium as in claim 10 , wherein the page load information comprises a resource load time of a resource from a page of the loaded web application.

17. The tangible, non-transitory, computer-readable medium as in claim 10 , wherein the one or more mitigation actions comprises causing a graphical user interface to display an indication of the type of the anomalous feature at an end-user device.

18. An apparatus, comprising:

one or more network interfaces to communicate with a network;

a processor coupled to the one or more network interfaces and configured to execute one or more processes; and

a memory configured to store a process that is executable by the processor, the process, when executed, configured to:

obtain page load information corresponding to a loaded web application;

detect, based on the page load information, an anomalous feature of the loaded web application;

identify a type of the anomalous feature based on a number of resource anomalies within the loaded web application, wherein the type of the anomalous feature is one of: a page anomaly when the number of resource anomalies is zero, a resource anomaly when the number of resource anomalies is one, or a domain anomaly when the number of resource anomalies is greater than one; and

perform one or more mitigation actions according to the type of the anomalous feature.