43. A system for outputting data based on anomaly detection, comprising: digital processing device that: receives a known-good dataset; stores distinct n-grams from the known-good dataset to form a binary anomaly detection model; receives known-good new n-grams; computes a rate of receipt of distinct n-grams in the new n-grams; determines whether further training of the anomaly detection model is necessary based on the rate of receipt on distinct n-grams; uses the binary anomaly detection model to determine whether an input dataset contains an anomaly, wherein the binary anomaly detection model is used to determine whether the input dataset contains an anomaly by checking the binary anomaly detection model for an n-gram in the input dataset; and outputs the input dataset based on whether the input dataset contains an anomaly.
45. The system of claim 43 , wherein the rate of receipt of distinct n-grams is based on how many distinct n-grams are received in a given time period.