Describir: Optimal volume anomaly detection in network traffic flows