In this talk, we will explore the idea of using the sketch data structure
to summarize information about network flows, and then use the "sketch" to
detect changes in the traffic pattern. The change detection is based on
forecasting models such as EWMA and ARIMA. These models are typically used
in time series forecasting and change detection. The paper first describes
a variant of the sketch data structure called k-ary sketch and elaborates
the technique to detect changes by performing certain operations on the
data structure. Next, the paper describes the experimental results
obtained by running experiments on real Internet traffic data. The authors
compare the performance of the sketch based technique by running similar
experiments on a per-flow basis. Finally, the paper concludes with a brief
discussion of the ongoing work and future directions.