How practical are anomaly based web application firewall in mitigating web based attacks ? Which types of threats do they mitigate against and which don't they? Are their any practical implementation of them.
Check ModSecurity - it's quite decent approach, it does include anomaly as well collective scoring system. You can have a look at Core Rules, there are anomaly entries too. You just load Core Rules to ModSecurity, and there you go, all you need is to test applications and eventually delete, add, modify some rules.
Anomaly entries protect mainly from automated bots or other suspicious clients doing very unsual requests. Without rules made for specific applications (there are rules for popular cmses), what it does prevent is eg requesting web content with non-standard set of headers.
When there are rules for specific applications, it prevents some requests which are not typical for specific application, however how this specifically works and to what level you would need to have a look at Core Rules.
These rules are not some super-specific, but they have more practical approach the way that with no big philosophy they just score anomalies based on rules, and it requires a lot of tuning and changing to get this to work with any specific app, so basically it does what is in the rules, plus what you can do yourself.
They don't protect from bad words, but that's easy to add, they also don't protect from well obfuscated and designed attacks.
ModSecurity is used in vast space of Internet - for example, Akamai, the biggest CDN has this installed on many servers, since they integrated it / or somewhat forked it to their own software. This is because it is cloud friendly - anomaly detection which is collective based - the information comes from several servers, hence it detects anomalies which are geographically distributed between your own servers.
Try checking Big-IP from F5... used by Facebook, BoA and other companies..
It is the ASM (Application Security Manager) that handles the web attack protection... http://www.f5.com/products/big-ip/