1. Introduction
With the growth in Internet traffic and the growing variety of Internet applications, traffic measurement is becoming more important for efficient and effective network management. In particular, measuring traffic at the flow level is important to apply usage-based charging, detect network anomalies, identify heavy users, and perform traffic engineering. To obtain flow-level statistics, we conventionally need to collect all packets in the relevant network. However, as many previous studies have indicated, such an approach lacks scalability [1], [2], [3], [4]. Direct measurement of all flows on a very high-speed link is beyond the capability of measuring equipment in terms of CPU power, memory/storage capacity, and memory access speed. As a solution to such problems, measuring and collecting flow statistics through packet sampling has recently become a very attractive and scalable method (e.g., NetFlow [5] and sFlow [6]). On the other hand, establishing a method of detecting network anomalies through traffic measurement has become required because the number of anomalies, which waste network resources, cause performance degradations, and lead to security issues, is increasing.