1. A computer system for tracking network behavior, comprising: a processor; a memory that stores: a connection table that maps each host of a network to a record that stores traffic information from the host to other hosts or from the other hosts to the host in the network for a specified time interval, and a profile table that stores historical traffic information as exponentially weighted moving average values; and a merging mechanism configured to merge the record associated with each host for the specified time interval from the connection table into the historical traffic information in the profile table.