13. A system for detecting network anomalies, the system comprising: a processor that: receives a training dataset of communication protocol messages having argument strings; determines a content and a structure associated with each of the argument strings; receives a mixture size that specifies a number of Markov chains to use in a probabilistic model; trains the probabilistic model using the determined content and structure of each of the argument strings and using a mixture of Markov chains specified by the received mixture size; receives a communication protocol message having an argument string that is transmitted from a first processor to a second processor across a computer network; applies the probabilistic model to the received communication protocol message to determine whether the communication protocol message is anomalous; and performs a predetermined action in response to determining that the communication protocol message is anomalous.
13. A system for detecting network anomalies, the system comprising: a processor that: receives a training dataset of communication protocol messages having argument strings; determines a content and a structure associated with each of the argument strings; receives a mixture size that specifies a number of Markov chains to use in a probabilistic model; trains the probabilistic model using the determined content and structure of each of the argument strings and using a mixture of Markov chains specified by the received mixture size; receives a communication protocol message having an argument string that is transmitted from a first processor to a second processor across a computer network; applies the probabilistic model to the received communication protocol message to determine whether the communication protocol message is anomalous; and performs a predetermined action in response to determining that the communication protocol message is anomalous. 17. The system of claim 13 , wherein the processor is further configured to assemble the communication protocol message from the plurality of packets, wherein the assembled communication protocol message is substantially similar to a request received by an application running on the second processor.