The system specifically tailored to the detection of web-based attacks, taking advantage of application-specific correlation between server-side programs and parameters used in their invocation. Ideally, the system will not require any installation- specific configuration and learns all query characteristics from training data, even though the level of sensitivity to anomalous data can be configured via thresholds to suit different site policies