1. A method for detecting an anomaly in a network comprising: combining a number of data-created sketch-sets using an aggregator; requesting, using the aggregator, a finer sketch-set for an identified sketch-set among the combined number of sketch-sets; and creating the finer sketch-set for the identified sketch-set to detect the anomaly in the network using a monitor.