Abstract: A methodology and system for application intrusion detection wherein the methodology constructs an application profile database that compares user requests to computer applications to determine their security threat. The methodology, Application Profiling, defines the characteristics of user interactions that are to be catalogued in the application profile database. In addition, the methodology identifies the process for creating the application profile database and defines the logic used to evaluate user application requests for anomalous behavior. The methodology also provides a format for communication of application security threats. The system implements the methodology in a stand-alone fashion.