Amazon patents system to spot suspicious IP activity in its network

1. A system comprising: one or more processors; and one or more non-transitory computer-readable media storing instructions executable by the one or more processors, wherein the instructions, when executed, cause the one or more processors to perform operations comprising: receiving first data representing first activity associated with an internet protocol (IP) address over a first time period; receiving second data representing second activity associated with the IP address over a second time period that is subsequent to the first time period; determining a probabilistic data structure to approximate a first number of accounts that the IP address exchanged data with during the first time period and a second number of data exchanges with an account over the first time period; determining a first state for the IP address for the first time period and a second state for the IP address for the second time period, the first state or the second state including a value to represent the first activity or the second activity by the IP address for the first time period or the second time period, and wherein determining the first state is based at least in part on the probabilistic data structure; determining a difference between the first activity and the second activity based on comparing the first state and the second state; determining that the difference meets or exceeds a threshold value; and configuring, based on the difference meeting or exceeding the threshold value, a message for sending to one or more computing devices accessed by the IP address, the message indicating a portion of the one or more computing devices to protect from a potential malicious event included in the first activity or the second activity.