15. The non-transitory computer-readable medium of claim 14 , wherein the training n-grams include a first plurality of distinct training n-grams and a second plurality of distinct training n-grams.
16. The non-transitory computer-readable medium of claim 15 , wherein the method further comprises: determining a first plurality of appearance frequencies corresponding to the first plurality of distinct training n-grams; and determining a second plurality of appearance frequencies corresponding to the second plurality of distinct training n-grams; and determining a first anomaly detection score based on the first plurality of appearance frequencies and a second anomaly detection score based on the second plurality of appearance frequencies.