A method and system for aggregating into a unique aggregated group (AG), protection groups (PGs) that are possible classifications with at least a threshold probability for a same unique combination of IP addresses. The PGs and the unique combination of IP addresses are included in the AG. Each of the IP addresses of the unique combination of IP addresses have respective associated probabilities for each PG included in the AG. The method further includes selecting and providing for display AGs based on the probabilities associated with the respective IP addresses included in the AGs, and providing for display at least one interactive graphical element in association with each AG selected for display. User activation of one of the interactive graphical element accepts assignment of one or more selected IP addresses included in the AG to a selected one of the one or more PGs included in the AG.