1. A network computer for monitoring network traffic in a network, comprising: a transceiver that communicates over the network; a memory that stores at least instructions; and one or more processors that execute instructions to perform actions, comprising: employing a network monitoring engine to perform further actions, including: monitoring the network to provide one or more metric profiles based on a plurality of characteristics associated with one or more network flows; providing one or more profile objects based on the one or more metric profiles; and providing the one or more profile objects to a classifier engine; and employing the classifier engine to perform further actions, including: providing one or more trained activity models selected from a plurality of trained activity models that are based on a ranked ordering of one or more characteristics of the one or more trained activity models and the one or more profile objects; and providing one or more classification results for the one or more profile objects based on the one or more trained activity models; and employing the network monitoring engine to execute one or more policies based on the one or more classification results associated with the one or more profile object.