2. The method of claim 1 , wherein the binary detection model is represented using a Bloom filter.
1. A method for outputting data based on anomaly detection, comprising: receiving, using a hardware processor, a known-good dataset; storing, using the hardware processor, distinct n-grams from the known-good dataset to form a binary anomaly detection model; receiving, using the hardware processor, known-good new n-grams; computing, using the hardware processor, a rate of receipt of distinct n-grams in the new n-grams; determining, using the hardware processor, whether further training of the anomaly detection model is necessary based on the rate of receipt on distinct n-grams; using the binary anomaly detection model to determine whether an input dataset contains an anomaly, wherein the binary anomaly detection model is used to determine whether the input dataset contains an anomaly by checking the binary anomaly detection model for an n-gram in the input dataset; and outputting, using the hardware processor, the input dataset based on whether the input dataset contains an anomaly.