Mapping origin-to-destination network-traffic-state is pivotal for network management and proactive security tasks. However, lack of flow-level measurements as well as potential anomalies pose major challenges toward achieving these goals. Leveraging the spatiotemporal correlation of nominal traffic, and the sparse nature of anomalies, this paper proposes a novel estimator to map out both nominal and anomalous trallic components, based on link counts along with a small subset of flowcounts. Adopting a Bayesian approach with a bilinear charactrization of the nuclear-and the (l(1)-norm, a non convex optimization problem is formulated which takes into account inherent patterns of nominal trallic and anomalies, captured through trallic correlations, via quadratic regularizers. Traffic correlations are learned from (cyclo) stationary historical data. The nonconvex problem is solved using an alternating majorization-minimization technique which provably converges to a stationary point. Simulated tests confirm the effectiveness of the novel estimator.
