12. The system of claim 8 , wherein the training n-grams include a first plurality of distinct training n-grams and a second plurality of distinct training n-grams.
12. The system of claim 8 , wherein the training n-grams include a first plurality of distinct training n-grams and a second plurality of distinct training n-grams. 13. The system of claim 12 , wherein the hardware processor is further configured to: determine a first plurality of appearance frequencies corresponding to the first plurality of distinct training n-grams; and determine a second plurality of appearance frequencies corresponding to the second plurality of distinct training n-grams; and determining a first anomaly detection score based on the first plurality of appearance frequencies and a second anomaly detection score based on the second plurality of appearance frequencies.