1. A method for detecting anomalous traffic flow, comprising: generating a sketch of an incoming data flow; calculating a time series forecast of the sketch including a corresponding forecast error; and indicating an alarm condition when the forecast error is greater than an established threshold.