A company hosts a public-facing web application behind an Application Load Balancer. The security team has noticed repeated attempts to exploit the application using SQL injection and cross-site scripting (XSS) attacks embedded in HTTP requests. Which AWS service should the company use to inspect incoming web requests and block these malicious patterns at the application layer?