Here is the basic idea of the coin-toss run length detection. (Small value indicates fake coin-toss data)...
In[9]:= rTest[{}] := 1;
rTest[{_}] := 0;
rTest[runs_] := DistributionFitTest[runs - 1, GeometricDistribution[1/2]];
In[16]:= fakeData = {"h", "t", "h", "t", "h", "t", "h", "t", "h", "t", "h", "t", "h", "t", "h", "t", "h", "t", "h", "t", "h", "t", "h", "t", "h", "t", "h", "t", "h", "t"};
In[20]:= rTest[Length /@ Split[fakeData]]
Out[20]= 3.4191*10^-6
In[18]:= realData = RandomChoice[{"h", "t"}, 30];
In[21]:= rTest[Length /@ Split[realData]]
Out[21]= 0.861536
But since I wrote that example, we have added
https://reference.wolfram.com/language/ref/AnomalyDetection.html
to the language, which is simpler, and richer, so check that out too.