2. The method of claim 1 , further comprising: defining a second window in the input dataset; identifying second matching n-grams by determining whether the first input n-grams in the second window correspond to one of the first plurality of distinct training n-grams; and computing a second anomaly detection score for the input dataset using the second matching n-grams and first plurality of appearance frequencies.
2. The method of claim 1 , further comprising: defining a second window in the input dataset; identifying second matching n-grams by determining whether the first input n-grams in the second window correspond to one of the first plurality of distinct training n-grams; and computing a second anomaly detection score for the input dataset using the second matching n-grams and first plurality of appearance frequencies. 4. The method of claim 2 , wherein the plurality of n-grams in the training dataset also includes a second plurality of distinct training n-grams that are each a second size, and the input dataset also includes second input n-grams that are each the second size, and wherein the method further comprises: computing a second plurality of appearance frequencies, wherein each of the first plurality of appearance frequencies corresponds to one of the second plurality of distinct training n-grams; identifying third matching n-grams by determining whether the second input n-grams in the first window correspond to one of the second plurality of distinct training n-grams; computing a third anomaly detection score for the input dataset using the third matching n-grams and the second plurality of appearance frequencies; and determining based upon the third anomaly detection score whether the input dataset contains an anomaly.