11. The computer-implemented method of claim 1 , further comprising receiving, at the computer server subsystem, data that indicates a context of at least one of (i) the web pages and (ii) the particular client computers, wherein identifying the clusters from the data that characterizes the subsets of the particular document object models comprises correlating features in the subsets of the particular document object models with features indicated by the context.
1. A computer-implemented method for identifying abnormal computer behavior, the method comprising: identifying, at a computer server subsystem, electronic content that has been served in one or more electronic resources to particular client computers for rendering web pages; receiving, at the computer server subsystem, data that characterizes subsets of particular document object models for the web pages rendered by the particular client computers; identifying clusters from the data that characterize the subsets of the particular document object models; and analyzing the clusters to identify alien content on the particular client computers, the alien content including content that is determined to be present, in the subsets of the particular document object models, not as a result of the electronic content that was served to the particular client computers for rendering the web pages.