The sensor also outputs one or more ???candidate events??? to the engines 210-1 to 210-N. In one implementation, a candidate event is an event that has (1) a URL that required normalization, (2) a redundant UTF-8 anomaly in a URL, (3) a double URL encoding anomaly in a URL, (4) an illegal byte code in a URL anomaly, and/or (5) an illegal path encoding anomaly.