Mapping entities to accounts

A system for de-anonymizing anonymous Internet Protocol (IP) addresses, the system comprising:

• at least one hardware processor;
• and
• one or more software modules that, when executed by the at least one hardware processor,
• receive a plurality of events from a plurality of sources, wherein each of the plurality of events represents an online activity and comprises an IP address and event information,
• aggregate subsets of the plurality of events into a plurality of mappings, wherein each of the plurality of mappings associates the IP address, shared by a subset of the plurality of events, with an account, and is associated with a plurality of statistics regarding the subset of events,
• for each of the plurality of mappings, compute a confidence value for the mapping based on the associated plurality of statistics,
• select a final subset of the plurality of mappings based on the confidence values for the plurality of mappings, and
• respond to one or more requests, comprising a requested IP address, by searching the final subset of mappings for the requested IP address, and returning an indication of an account associated with the requested IP address in the final subset of mappings.

A non-transitory computer-readable medium having instructions stored therein, wherein the instructions, when executed by a processor, cause the processor to:

• receive a plurality of events from a plurality of sources, wherein each of the plurality of events represents an online activity and comprises an IP address and event information;
• aggregate subsets of the plurality of events into a plurality of mappings, wherein each of the plurality of mappings associates the IP address, shared by a subset of the plurality of events, with an account, and is associated with a plurality of statistics regarding the subset of events;
• for each of the plurality of mappings, compute a confidence value for the mapping based on the associated plurality of statistics;
• select a final subset of the plurality of mappings based on the confidence values for the plurality of mappings;
• and
• respond to one or more requests, comprising a requested IP address, by searching the final subset of mappings for the requested IP address, and returning an indication of an account associated with the requested IP address in the final subset of mappings.