8. The system of claim 5 , wherein the hardware processor is further configured to send the input dataset to a host based anomaly detector in response to determining that the input dataset is likely to be anomalous.
5. A system for outputting data based on anomaly detection, comprising: a hardware processor configured to: receive an input dataset; identify commonly occurring grams in the input dataset that substantially include distinct byte values; create an input subset by removing the identified grams from the input dataset; determine whether the input dataset is likely to be anomalous based on the identified grams, and determines whether the input dataset is likely to be anomalous by applying the input subset to a binary anomaly detection model to check for an n-gram in the input subset, wherein the binary detection model is represented using a Bloom filter; and output the input dataset based on the likelihood that the input dataset is anomalous.