1. A computer program product for identifying an unknown user, the computer program product comprising: a computer readable storage medium having computer readable program code embodied therewith, the computer readable program code comprising: computer readable program code configured to provide a plurality of historical network traces of user activity; computer readable program code configured to extract a footprint for each of a plurality of users from the historical network traces; computer readable program code configured to aggregate the footprints of the users to determine an ensemble prior; computer readable program code configured to receive a plurality of network traces relevant to an unknown user in a computer environment; computer readable program code configured to match the network traces against each of the footprints to determine a plurality of matches; computer readable program code configured to aggregate the matches using the ensemble prior according to a plurality of contexts and a plurality of facets; and computer readable program code configured to output a probable user identity for the unknown user.