1. A method for outputting a dataset based upon anomaly detection, the method comprising: receiving a training dataset having a plurality of n-grams that includes a first plurality of distinct training n-grams, wherein each of the first plurality of distinct training n-grams is a first size; computing a first plurality of appearance frequencies, wherein each of the first plurality of appearance frequencies corresponds to one of the first plurality of distinct training n-grams; receiving an input dataset including first input n-grams, wherein each of the first input n-grams is the first size; defining a first window in the input dataset; identifying first matching n-grams by determining whether the first input n-grams in the first window correspond to one of the first plurality of distinct training n-grams; computing a first anomaly detection score for the input dataset using the first matching n-grams and the first plurality of appearance frequencies, wherein the first anomaly detection score is indicative of the presence of anomalous n-grams in the input dataset; and outputting the input dataset based on the first anomaly detection score.
1. A method for outputting a dataset based upon anomaly detection, the method comprising: receiving a training dataset having a plurality of n-grams that includes a first plurality of distinct training n-grams, wherein each of the first plurality of distinct training n-grams is a first size; computing a first plurality of appearance frequencies, wherein each of the first plurality of appearance frequencies corresponds to one of the first plurality of distinct training n-grams; receiving an input dataset including first input n-grams, wherein each of the first input n-grams is the first size; defining a first window in the input dataset; identifying first matching n-grams by determining whether the first input n-grams in the first window correspond to one of the first plurality of distinct training n-grams; computing a first anomaly detection score for the input dataset using the first matching n-grams and the first plurality of appearance frequencies, wherein the first anomaly detection score is indicative of the presence of anomalous n-grams in the input dataset; and outputting the input dataset based on the first anomaly detection score. 7. The method of claim 1 , further comprising excluding from the plurality of n-grams in the training dataset a portion of the training dataset that includes malicious code.