1. A method in a computing device communicatively coupled to a set of web application layer attack detectors (ADs), wherein the set of ADs are communicatively coupled between a set of one or more Hypertext Transfer Protocol (HTTP) clients and a set of one or more web application servers to protect the set of web application servers against web application layer attacks, and wherein each AD applies rules that each comprise a condition including a set of one or more attributes, wherein each of the set of attributes includes an attribute identifier and a set of one or more attribute values, the method comprising: learning a new set of one or more attribute values for a set of one or more attribute identifiers for each of a sequence of rules through an iterative process having a plurality of iterations, wherein the iterative process begins with a current rule that is an attack specific rule that relies upon the attack specific rule's set of attribute values of the attack specific rule's set of attribute identifiers that are indicative of a first type of web application layer attack, wherein the sequence of rules includes an attacker specific rule that relies upon the attacker specific rule's set of attribute values of the attacker specific rule's set of attribute identifiers that identify an HTTP client of the set of HTTP clients, and wherein the last of the sequence of rules is another attack specific rule that relies upon the another attack specific rule's set of attribute values for the another attack specific rule's set of attribute identifiers that are indicative of a second type of web application layer attack, wherein each iteration of the iterative process includes: receiving, from one of the set of ADs, a current alert package comprising a current web application layer request message sent by one of the set of HTTP clients to one of the set of web application servers, wherein the current alert package was sent responsive to a current set of one or more packets that collectively carried the current web application layer request message and that resulted in the condition of the current rule being met, automatically generating, using the current alert package, a current new set of one or more attribute values for each of a current set of one or more attribute identifiers, and transmitting, for delivery to the set of ADs, the current new set of attribute values for each of the current set of attribute identifiers for a different rule than the current rule, wherein the different rule becomes the current rule in a subsequent iteration of the iterative process.