2. The method of claim 1 , further comprising: defining a second window in the input dataset; identifying second matching n-grams by determining whether the first input n-grams in the second window correspond to one of the first plurality of distinct training n-grams; and computing a second anomaly detection score for the input dataset using the second matching n-grams and first plurality of appearance frequencies.
2. The method of claim 1 , further comprising: defining a second window in the input dataset; identifying second matching n-grams by determining whether the first input n-grams in the second window correspond to one of the first plurality of distinct training n-grams; and computing a second anomaly detection score for the input dataset using the second matching n-grams and first plurality of appearance frequencies. 3. The method of claim 2 , further comprising determining which of the first anomaly detection score and the second anomaly detection score is higher.