22. A non-transitory computer-readable medium containing computer-executable instructions that, when executed by a processor, cause the processor to perform a method for outputting data based on anomaly detection, the method comprising: receiving a known-good dataset; storing distinct n-grams from the known-good dataset to form a binary anomaly detection model; receiving known-good new n-grams; computing a rate of receipt of distinct n-grams in the new n-grams; determining whether further training of the anomaly detection model is necessary based on the rate of receipt on distinct n-grams; using the binary anomaly detection model to determine whether an input dataset contains an anomaly, wherein the binary anomaly detection model is used to determine whether the input dataset contains an anomaly by checking the binary anomaly detection model for an n-gram in the input dataset; and outputting the input dataset based on whether the input dataset contains an anomaly.
23. The medium of claim 22 , wherein the binary detection model is represented using a Bloom filter.