A pirated video identification system for network operators to detect and identify both encrypted and unencrypted Internet protocol (IP) pirated video. The system uses ground truth data gathered from various video player clients as input to train a machine learning that then is used to analyze both real-time and historical IP flow data from a network to identify the IP addresses of both the source and destination of pirate video traffic on the network. They system can be used to aid in accurately measuring the volume and scale of pirated video traffic on a network as well as aiding in taking countermeasures against both the distributors and consumers of the pirated video.