Detecting Application-layer Attacks Based on User's Application-layer Behaviors