1. A method comprising: receiving, at a network device, a data flow associated with a host; accessing a memory maintaining a data structure comprising one or more count values for the host, wherein each of the count values correspond to a number of events detected over a time interval and wherein each event corresponding to a count value exhibits a correlation to a network application; determining a flow affinity value by multiplying each count value by a correlation value corresponding to the count value to yield a component product and summing the component products for each count value to yield the flow affinity value; and classifying the data flow as the network application based on a comparison of the flow affinity value to a threshold flow affinity value.