20. A computer-implemented method for identifying abnormal computer behavior, the method comprising: receiving, at a security server system, data that characterizes execution of one or more web resources by a plurality of client computing devices, the data having been generated by instrumentation code that was injected into initial web code for the one or more web resources, the data including representations of at least portions of document object models rendered by the plurality of client computing devices while executing the one or more web resources; identifying, based on the representations of the at least portions of the document object models, a subset of executions of the one or more web resources on particular ones of the plurality of client computing devices that deviated from expected executions of the one or more web resources; and using information from the subset of executions of the one or more web resources to identify alien content on the particular ones of the plurality of client computing devices that correspond to the subset of executions of the one or more web resources.
20. A computer-implemented method for identifying abnormal computer behavior, the method comprising: receiving, at a security server system, data that characterizes execution of one or more web resources by a plurality of client computing devices, the data having been generated by instrumentation code that was injected into initial web code for the one or more web resources, the data including representations of at least portions of document object models rendered by the plurality of client computing devices while executing the one or more web resources; identifying, based on the representations of the at least portions of the document object models, a subset of executions of the one or more web resources on particular ones of the plurality of client computing devices that deviated from expected executions of the one or more web resources; and using information from the subset of executions of the one or more web resources to identify alien content on the particular ones of the plurality of client computing devices that correspond to the subset of executions of the one or more web resources. 24. The computer-implemented method of claim 20 , wherein identifying the subset of the executions of the one or more web resources that deviated from the expected executions of the one or more web resources comprises identifying clusters of particular executions of the one or more web resources in a hyperplane.