I should recommend this whitepaper with all the technical details related to your idea: https://wallarm.com/files/resources/Wallarm%20AI%20Engine.pdf

Technically you need to solve 3 tasks to apply application-specific detection in the right way:

1. application endpoints profiling (clustering or so) to find all the web scripts and API calls, like /api/user/create, etc

2. data profiling. To understand wich kind of data is legitimate for each parameter in each endpoint. I.e. to understand that your "login" field in a "/api/user/create" should looks like email

3. attacks classification. To understand, for example, is an abnormal data in a "login" field at "/api/user/create" endpoint looks like SQL injection, or I just have a De'Contour lastname with a quote inside.

I recommend this whitepaper with all the technical details related to your idea: https://wallarm.com/files/resources/Wallarm%20AI%20Engine.pdf

Technically you need to solve 3 tasks to apply application-specific detection in the right way:

1. application endpoints profiling (clustering or so) to find all the web scripts and API calls, like /api/user/create, etc

2. data profiling. To understand which kind of data is legitimate for each parameter in each endpoint. I.e. to understand that your "login" field in a /api/user/create should look like an email address

3. attacks classification. To understand, for example, if an abnormal data in a "login" field at the /api/user/create endpoint looks like SQL injection, or I just have a De'Contour lastname with a quote inside.