Monitoring network traffic to identify malicious applications is an active research topic in network security. In the era of mobile big data, smart mobile devices have become an integral part of our daily life, which brings many benefits to the digital society. However, the popularity and relatively lax security make them vulnerable to various cyber threats. Traditional network traffic analysis techniques utilizing pattern matching and regular expressions matching algorithms is becoming insufficient for mobile big data. Network traffic anomaly detection is an effective method to replace traditional methods. Meanwhile, network traffic mirroring is the foundation of digital twin for Mobile Network(DTMN). With the ongoing development of 6G and space Internet in the future, mobile networks will become more and more dense and require more rapid response. Network traffic anomaly detection can solve many new challenges brought by future networks and protect the security of DTMN. In this article, we propose a streaming network framework for mobile big data, referred to as SNMDF, which provides massive data traffic collection, processing, analysis and updating functions, to cope with the tremendous amount of data traffic. In particular, by analyzing the specific characteristic of anomaly traffic data from flow and user behavior, our proposed SNMDF demonstrates its capability to offer real data-based advice to address new challenges for future wireless networks from the viewpoints of operators. Tested by real mobile big data, SNMDF has proven its efficiency and reliability. Furthermore, SNMDF is accessed for the digital twin of the space Internet, which validates that it can be generalized to other environments with massive data traffic or big data.