Mapping network addresses in logs of network activity to corresponding host computers includes generating lists of known-dynamic addresses, static addresses and other-dynamic addresses from network addresses appearing in the logs. The static addresses and other-dynamic addresses are assigned to host computers having respective first host identifiers, and the known-dynamic addresses are associated with corresponding host computers having respective second host computer identifiers contained in dynamic address assignment activity. For the static and other-dynamic addresses, the first host identifiers are obtained, and first address-to-host bindings are created for address-based lookups of first host identifiers using respective addresses. For the known-dynamic addresses, the second host computer identifiers and log-time information from the dynamic address activity are used to create second address-to-host bindings usable to perform address-based lookup of second host identifiers and corresponding use-time information using respective addresses to which the second host identifiers are bound.