1. A method for detecting anomalous traffic flow, comprising: generating a sketch at a network device, wherein the sketch is a probabilistic summary technique analyzing incoming data flow received at the network device; calculating a time series forecast of the sketch including a corresponding forecast error at the network device; indicating an alarm condition at the network device when the forecast error is greater than an established threshold; and using the alarm condition for network anomaly detection at the network device, wherein the sketch comprises a k-ary sketch that uses a Turnstile model of the incoming data flow for identifying each data item in the incoming data flow by a key value and an update value, and the key value comprises a destination Internet Protocol (IP) address of the data item.