1. A method for monitoring traffic in a computer network comprising acts of: receiving flow information related to network traffic a plurality of hosts in the computer network; and determining similarity between the plurality of hosts in the computer network based on the flow information.