1. A computer-implemented method comprising: an engine of an in-memory database executing a user action with a Multi-Party Web Application (MPWA); the engine receiving a trace of HTTP traffic with the MPWA resulting from the user action, the HTTP traffic comprising part of a security protocol; the engine causing an element to be removed from the trace that results in the HTTP traffic ceasing and the security protocol not completing successfully; the engine assigning a semantic label to the trace comprising the element, to create a labeled trace indicated as mandatory; the engine applying an attack pattern to the labeled trace to identify an attack, wherein the attack pattern is stored in the in-memory database; and the engine reporting the attack to a user interface.