Nowadays, with the increasing speed ofcommunication links and generated traffic volume, NetworkIntrusion Detection Systems (NIDSs) encounter new challenges.NIDSs iect all packets to find attacks and abnormalbehaviors. In addition, NIDSs keep the state of each flow toincrease accuracy of detection. Performing packet iection intoday’s high-speed networks is hard, or even impossible andkeeping per flow state is not scalable. Large-scale attacks such asDoS attack usually produce many flows and keeping their staterequires many resources. Consequently, approaches thatinvestigate behavior of communication patterns in flow-level -instead of packet iection - are taken into consideration.Different algorithms and techniques have been proposed forflow-based detection of DoS attacks. Recently, approaches basedon data streaming algorithms have attracted much attention.These algorithms enable the analysis and processing of large datasets by constructing a compact synopsis of input data. Thissynopsis can be used to answer certain queries over the originaldata. Sketch is one of these synopsis structures which differentintrusion detection systems are proposed by using it. Most ofthese proposed approaches have good performance if just oneflow has anomalous characteristics. But if there are severalabnormal flows, sketches encounter difficulties. This paper forthe first time provides a framework to avoid such problems inpresence of several abnormal flows. The proposed frameworkrearranges hash functions in an appropriate data structures andovercomes such problems in presence of several abnormal flows. Keywords: Anomaly Detection, Flow-based Approache, Streaming Algorithms, Reversible Sketch