Patent Document ID: 9519778
Application ID: 13769774

Base Claim:
1. A method for outputting a dataset based upon anomaly detection, the method comprising: receiving, using a hardware processor, an input dataset; determining, using the hardware processor, an anomaly detection score that is indicative of the presence of anomalous n-grams in the input dataset by applying a content anomaly detection model to the received input data, wherein the content anomaly detection model is trained with data that includes training n-grams and wherein the anomaly detection score is based on a comparison of n-grams in the input dataset, which each represent a sequence of n bytes, with the training n-grams; and causing, using the hardware processor, the input dataset to be outputted based on the anomaly detection score.

---

Claim 2:
2. The method of claim 1 , wherein the content anomaly detection model is a frequency distribution-based detection model that determines a plurality of appearance frequencies, and wherein each of the plurality of appearance frequencies corresponds to one of the training n-grams.