2. The method of claim 1 , wherein the finer sketch-set for the identified sketch-set includes a sketch-set with a finer flow range than the identified sketch-set.
1. A method for detecting an anomaly in a network comprising: combining a number of data-created sketch-sets using an aggregator, wherein the aggregator includes a processing resource; requesting, using the aggregator, a finer sketch-set for an identified sketch-set among the combined number of sketch-sets; creating the finer sketch-set for the identified sketch-set to detect the anomaly in the network using a monitor; and requesting, using the aggregator, a revised action for the identified sketch-set among the combined number of sketch-sets to detect a revised anomaly.