Social relationships are detected between a plurality of users. A set of user activity logs is input, where these logs originate from one or more network services and cover a prescribed period of time. Each of the logs originates from a particular one of the services and includes a structured data stream that records each interaction that each of one or more of the users has with the particular one of the services. This structured data stream includes a timestamp specifying when this interaction occurred, and a public network identifier specifying a network address from which this interaction occurred. The set of user activity logs is then analyzed to detect a prescribed kind of social relationship between the users. A data structure is then generated that identifies the users between whom the prescribed kind of social relationship is detected, and the data structure is output.