1. A method for detecting network anomalies, the method comprising: receiving a training dataset of communication protocol messages having argument strings; determining a content and a structure associated with each of the argument strings; receiving a mixture size that specifies a number of Markov chains to use in a probabilistic model; training the probabilistic model using the determined content and structure of each of the argument strings and using a mixture of Markov chains specified by the received mixture size; receiving a communication protocol message having an argument string that is transmitted from a first processor to a second processor across a computer network; applying the probabilistic model to the received communication protocol message to determine whether the communication protocol message is anomalous; and performing a predetermined action in response to determining that the communication protocol message is anomalous.
1. A method for detecting network anomalies, the method comprising: receiving a training dataset of communication protocol messages having argument strings; determining a content and a structure associated with each of the argument strings; receiving a mixture size that specifies a number of Markov chains to use in a probabilistic model; training the probabilistic model using the determined content and structure of each of the argument strings and using a mixture of Markov chains specified by the received mixture size; receiving a communication protocol message having an argument string that is transmitted from a first processor to a second processor across a computer network; applying the probabilistic model to the received communication protocol message to determine whether the communication protocol message is anomalous; and performing a predetermined action in response to determining that the communication protocol message is anomalous. 3. The method of claim 1 , further comprising: receiving a plurality of packets transmitted from the first processor to the second processor across the computer network; assembling the plurality of packets to form the communication protocol message; and extracting the argument string from the communication protocol message.