1. A computer-implemented method comprising: an engine executing a user action with a Multi-Party Web Application (MPWA); the engine receiving a trace of HTTP traffic with the MPWA resulting from the user action; the engine assigning a label to the trace to create a labeled trace; the engine applying an attack pattern to the labeled trace to identify an attack; and the engine reporting the attack to a user interface.