https://www.sans.org/reading-room/whitepapers/detection/profiling-web-applications-improved-intrusion-detection-37257