Update to the scoring algorithm

After running this for a while it turns out that favoring active
talker pairs by flow count wasn't working.  Got lots of broadcast
traffic. So, we're scoring based on bytes on the pair.  Also the
decrement should work much faster now.  It's time based.  As long
as things are actively talking they should hang around but should
quickly fall off when they stop talking.