that now will compare with the first discrete part of the profile subsequent http requests sent by the clients to the web application to detect deviations from the normal behavior represented by the first discrete part application_number US 201715696100 A description referring to fig1 an exemplary application level security system 100 for illustrating the principles of the present invention is shown a security system 100 comprises a plurality of network sensors 130 1 130 2 130 m connected to a secure server 110 the network sensors 130 may be connected to secure server 110 through a conventional network or through an out of band network oob 120 for transferring traffic over a dedicated and secure network that is completely separated from the production traffic a network sensor 130 is placed on each network segment that is coupled to the web servers 160 160 n and the database servers 170 170 r to be protected in one embodiment the network sensor 130 is a passive sniffing device that taps gathers and reconstructs requests sent to the protected servers 160 170 from an attacker machine 180 network device 150 may be but is not limited to a hub a switch a tap device and so on network sensor 130 taps the traffic sent to and from web servers 160 and database servers 170 network sensor 130 is not installed in the line of traffic between client 180 and web servers 160 or database server 170 thus traffic is copied to network sensors 130 and at the same time passing directly through in.