Implementations described and claimed herein provide systems and methods for differentiating a portion of network traffic having an Internet Protocol-based attribute with reasonable certainty. In one implementation, data corresponding to a delivery of network traffic across a communications network is received. A first filter is applied to obtain a first subset of the data based on one or more characteristics of originating access traffic. The first subset includes network traffic known to originate with the Internet Protocol-based attribute. A second filter is applied to data excluded from the first subset based on one or more characteristics of terminating access traffic to obtain a second subset of the data. The second subset includes network traffic known to terminate with the Internet Protocol-based attribute. The first subset is correlated with the second subset to identify the portion of network traffic having the Internet Protocol-based attribute.