A model creation method for creating a model (M j ) serving to detect whether a message (MSGEv) that is to be evaluated, that is constituted by symbols (C i ), and that might be received by an application (AP j ), constitutes an anomaly, the method being implemented by a computer and comprising: - an obtaining step (E10) for obtaining a set of messages (MSGAa j ) belonging to a reference class (CR j ) specific to the application (AP j ) in order to constitute a training database (BA j ); - an identification step (E15) for identifying the set of N-grams (NG k,j ) in the messages (MSGAa j ) of the training database (BA j ); and - a generation step (E20) for generating a vector (VP j ) of the model (M j ), the vector (VP j ) associating: - each of said N-grams with a value representing the probability (pb k,j ) of said N-gram (NG k,j ) occurring in the training database (BA j ); and - a default value (vbd j ) for giving to the N-grams (NG) that do not belong to the messages (MSGAa j ) of the training database (BA j ); said method further comprising: - a definition step (E30, E40) for defining a function (SCR j ) for giving a score (SC) to a message (MSGEv) that is to be evaluated from the values of the vector (VP j ) associated with the N-grams of said message (MSGEv) that is to be evaluated, this function being selected so as to discriminate between the scores of anomalies and the scores of normally expected messages by comparing those scores with a defined threshold (TH j ) that is defined (E40) for the function; said message (MSGEv) that is to be evaluated being considered as being an anomaly or not an anomaly as a function of the result of the comparison between said score (SC) given to the message and said threshold (TH j ), the method being characterized in that the function (SCR j ) uses, for giving said score (SC) to the message (MSGEv) that is to be evaluated, a generalized mean of order less than 1 applied to the components of the vector (VP j ) corresponding to the N-grams of the message (MSGEv) that is to be evaluated. - an obtaining step (E10) for obtaining a set of messages (MSGAa j ) belonging to a reference class (CR j ) specific to the application (AP j ) in order to constitute a training database (BA j ); - an identification step (E15) for identifying the set of N-grams (NG k,j ) in the messages (MSGAa j ) of the training database (BA j ); and - a generation step (E20) for generating a vector (VP j ) of the model (M j ), the vector (VP j ) associating: - each of said N-grams with a value representing the probability (pb k,j ) of said N-gram (NG k,j ) occurring in the training database (BA j ); and - a default value (vbd j ) for giving to the N-grams (NG) that do not belong to the messages (MSGAa j ) of the training database (BA j ); - each of said N-grams with a value representing the probability (pb k,j ) of said N-gram (NG k,j ) occurring in the training database (BA j ); and - a default value (vbd j ) for giving to the N-grams (NG) that do not belong to the messages (MSGAa j ) of the training database (BA j ); - a definition step (E30, E40) for defining a function (SCR j ) for giving a score (SC) to a message (MSGEv) that is to be evaluated from the values of the vector (VP j ) associated with the N-grams of said message (MSGEv) that is to be evaluated, this function being selected so as to discriminate between the scores of anomalies and the scores of normally expected messages by comparing those scores with a defined threshold (TH j ) that is defined (E40) for the function; <EOS>