In one embodiment, a mapping/translation technique is provided for generating an association between an observed network address and one or more attributes that are not directly observed. A network address is observed that is associated with a source device. A first attribute is determined, the first attribute being a directly observed attribute. The first attribute is mapped to a second attribute based on at least a predefined spatial, temporal, or identity-related correspondence between the first attribute and the second attribute, wherein the second attribute was not directly observed in connection with the network address. An association is generated between the second attribute and the network address. A record that maintains the association between the second attribute and the network address is stored.