An apparatus, comprising at least: means for receiving, from each edge device (113, 213) in a set of edge devices of a communication network, a respective set of network traffic information comprising a first traffic record indicative of respective measures of request packets exiting the communication network via the respective edge device (113, 213) for respective data flows and a second traffic record indicative of respective measures of response packets entering the communication network via the respective edge device (113, 213) for respective data flows, wherein, for at least one of the edge devices (113, 213), the first traffic record comprises a first reversible sketch and the second traffic record comprises a second reversible sketch; and means for determining, based on the sets of network traffic information of the edge devices (113, 213), whether a traffic anomaly indicative of an attack on the communication network is detected, wherein, to determine whether the traffic anomaly indicative of an attack on the communication network is detected, the apparatus at least comprises: means for aggregating the first traffic records of the edge devices (113, 213) and the second traffic records of the edge devices (113, 213) to form thereby an aggregated traffic record; and means for determining, based on the aggregated traffic record, whether a traffic anomaly indicative of an attack on the communication network is detected, wherein to form the aggregated traffic record, the apparatus further at least comprises: means for applying a first set of weights to values of the first traffic records of the edge devices (113, 213) to provide respective weighted first traffic records; means for applying a second set of weights to values of the second traffic records of the edge devices (113, 213) to provide respective weighted second traffic records; and means for aggregating the weighted first traffic records of the edge devices (113, 213) and the weighted second traffic records of the edge devices (113, 213) to form thereby the aggregated traffic record. means for receiving, from each edge device (113, 213) in a set of edge devices of a communication network, a respective set of network traffic information comprising a first traffic record indicative of respective measures of request packets exiting the communication network via the respective edge device (113, 213) for respective data flows and a second traffic record indicative of respective measures of response packets entering the communication network via the respective edge device (113, 213) for respective data flows, wherein, for at least one of the edge devices (113, 213), the first traffic record comprises a first reversible sketch and the second traffic record comprises a second reversible sketch; and means for determining, based on the sets of network traffic information of the edge devices (113, 213), whether a traffic anomaly indicative of an attack on the communication network is detected, wherein, to determine whether the traffic anomaly indicative of an attack on the communication network is detected, the apparatus at least comprises: means for aggregating the first traffic records of the edge devices (113, 213) and the second traffic records of the edge devices (113, 213) to form thereby an aggregated traffic record; and means for determining, based on the aggregated traffic record, whether a traffic anomaly indicative of an attack on the communication network is detected, wherein to form the aggregated traffic record, the apparatus further at least comprises: means for applying a first set of weights to values of the first traffic records of the edge devices (113, 213) to provide respective weighted first traffic records; means for applying a second set of weights to values of the second traffic records of the edge devices (113, 213) to provide respective weighted second traffic records; and means for aggregating the weighted first traffic records of the edge devices (113, 213) and the weighted second traffic records of the edge devices (113, 213) to form thereby the aggregated traffic record. means for aggregating the first traffic records of the edge devices (113, 213) and the second traffic records of the edge devices (113, 213) to form thereby an aggregated traffic record; and means for determining, based on the aggregated traffic record, whether a traffic anomaly indicative of an attack on the communication network is detected, wherein to form the aggregated traffic record, the apparatus further at least comprises: means for applying a first set of weights to values of the first traffic records of the edge devices (113, 213) to provide respective weighted first traffic records; means for applying a second set of weights to values of the second traffic records of the edge devices (113, 213) to provide respective weighted second traffic records; and means for aggregating the weighted first traffic records of the edge devices (113, 213) and the weighted second traffic records of the edge devices (113, 213) to form thereby the aggregated traffic record. means for applying a first set of weights to values of the first traffic records of the edge devices (113, 213) to provide respective weighted first traffic records; means for applying a second set of weights to values of the second traffic records of the edge devices (113, 213) to provide respective weighted second traffic records; and means for aggregating the weighted first traffic records of the edge devices (113, 213) and the weighted second traffic records of the edge devices (113, 213) to form thereby the aggregated traffic record.