9. A non-transitory computer readable medium storing a set of instructions executable by a processor to cause a computer to: create a number of sketch-sets using flow data; combine the number of sketch-sets into a number of common sketch-sets; identify a first sketch-set among the number of common sketch-sets above a first threshold value as an anomaly; eliminate a second sketch-set among the number of common sketch-sets below a second threshold value; and request a finer sketch-set for a third sketch-set among the number of common sketch-sets below the first threshold value and above the second threshold value to determine if the third sketch-set is the anomaly.
9. A non-transitory computer readable medium storing a set of instructions executable by a processor to cause a computer to: create a number of sketch-sets using flow data; combine the number of sketch-sets into a number of common sketch-sets; identify a first sketch-set among the number of common sketch-sets above a first threshold value as an anomaly; eliminate a second sketch-set among the number of common sketch-sets below a second threshold value; and request a finer sketch-set for a third sketch-set among the number of common sketch-sets below the first threshold value and above the second threshold value to determine if the third sketch-set is the anomaly. 10. The non-transitory computer readable medium of claim 9 , wherein the first threshold value and the second threshold value further include at least one of a traffic volume of a sketch-set, a number of ports of a sketch-set, and a flow size of a sketch-set.