Policy-based intrusion detection in Web applications by monitoring Java information flows