On the symbiosis of specification-based and anomaly-based detection