1. A computer-implemented method for identifying abnormal computer behavior, the method comprising: identifying, at a computer server subsystem, electronic content that has been served in one or more electronic resources to particular client computers for rendering web pages; receiving, at the computer server subsystem, data that characterizes subsets of particular document object models for the web pages rendered by the particular client computers; identifying clusters from the data that characterize the subsets of the particular document object models; and analyzing the clusters to identify alien content on the particular client computers, the alien content including content that is determined to be present, in the subsets of the particular document object models, not as a result of the electronic content that was served to the particular client computers for rendering the web pages.