I have done something similar before. A customer was trying to find a leak for a specific web page.
I ended up building a business transaction which was counting the number of open connections and close connections split by URL. I had to create a method sensor for the close connection as it isn't instrumented by default. I have attached a couple of screenshots.
If the numbers don't match then you have found the culprit!