1: \begin{abstract}

2: In the backbone of large-scale networks, origin-to-destination (OD) 

3: traffic flows experience abrupt unusual changes known

4: as \textit{traffic volume anomalies}, which can result in congestion and 

5: limit the extent to which end-user quality of service requirements are met. 

6: As a means of maintaining seamless end-user experience in dynamic environments, 

7: as well as for ensuring network security, this paper deals with a crucial 

8: network monitoring task termed \textit{dynamic anomalography}. 

9: Given link traffic measurements (noisy superpositions of

10: unobserved OD flows) periodically acquired by backbone routers, 

11: the goal is to construct an estimated \textit{map} of anomalies in \textit{real time}, 

12: and thus summarize the network `health state' along both the flow and time dimensions.

13: Leveraging the low intrinsic-dimensionality of OD flows and the

14: \textit{sparse} nature of anomalies, a novel online estimator is proposed

15: based on an exponentially-weighted least-squares criterion regularized with the 

16: sparsity-promoting $\ell_1$-norm of the anomalies, 

17: and the nuclear norm of the nominal traffic matrix. After recasting the 

18: non-separable nuclear norm into a form amenable to online

19: optimization, a real-time algorithm for dynamic anomalography is developed

20: and its convergence established under simplifying technical assumptions. 

21: For operational conditions where computational complexity reductions are at a premium, a lightweight

22: stochastic gradient algorithm based on Nesterov's acceleration

23: technique is developed as well. Comprehensive numerical 

24: tests with both synthetic and real network data corroborate the 

25: effectiveness of the proposed online algorithms and their tracking

26: capabilities, and demonstrate that they outperform state-of-the-art approaches developed

27: to diagnose traffic anomalies.

28: \end{abstract}