1. A method, comprising: determining a frequency range corresponding to a subset of a plurality of program files on a plurality of hosts in a network environment, each program file of the subset having a respective frequency included within the frequency range; generating a first set of counts including a first count representing an aggregate amount of program files in a first grouping of one or more program files of the subset, wherein each of the one or more program files of the first grouping includes a first value of a primary attribute.