1. A computer-implemented method for identifying abnormal computer behavior, the method comprising: receiving, at a computer server subsystem, data that characterizes subsets of particular document object models for web pages rendered by particular client computers; identifying clusters from the data that characterize the subsets of the particular document object models; and using the clusters to identify alien content on the particular client computers by determining that the alien content comprises content in the document object models that is not a result of content that is the basis of a document object model served to a particular client computer of the client computers.