Probabilistic cross-device place visitation rate measurement at scale
Provided is a process including: obtaining network traffic logs; matching a set of a plurality of the user computing devices; obtaining an indicator of content to be measured for effectiveness in driving place visits; selecting from the network traffic logs records of network exchanges in which the indicator is present; obtaining a device identifier from each of the selected records; matching the obtained device identifiers to respective matching sets including the respective obtained identifier; obtaining respective mobile device identifiers from the respective matching sets; selecting from the network traffic logs records indicating communications from mobile computing devices identified by the obtained mobile device identifiers; obtaining geolocations from the records indicating communications from the mobile computing devices identified; determining that a subset of the records have geolocations that correspond to at least one of a set of geographic areas; and determining an effectiveness of the content in driving visits.
1. A method, comprising:
obtaining, with one or more computer processors, one or more network traffic logs documenting communications via a network between one or more servers and more than 10,000 user computing devices, wherein:
at least some of the communications are associated with a respective timestamp and a device identifier of a respective user computing device among the more than 10,000 user computing devices, and
at least 1,000 of the user computing devices are mobile computing devices that emitted a respective geolocation of the respective mobile computing device stored in the network traffic logs;
for more than 1,000 individuals, matching a set of user computing devices comprising a respective plurality of the user computing devices to the respective individual, each set including at least one of the mobile computing devices, wherein matching comprises:
determining a residential dwelling geolocation of the respective individual, the residential dwelling being specified by both a network address and a residential geographic area of less than one square kilometer, at least some of the residential geographic areas being associated with a plurality of different residential dwelling geolocations of a plurality of different individuals, wherein determining the residential dwelling comprises:
clustering, with a density based clustering algorithm, a plurality of geolocations emitted by the mobile computing device of the respective individual in both time and geographic space,
selecting a resulting cluster based on a measure of central tendency of time of day of timestamps associated with the clustered geolocations, and
distinguishing geolocations in the same residential geographic area by network address;
matching the respective mobile device to another of the user computing devices at least in part based on the matched devices sharing the network address of the residential dwelling in the network traffic logs; and
storing data associating the matching devices in a respective matching set having an identifier of the individual;
obtaining an indicator of content to be measured for effectiveness in driving place visits;
selecting from the network traffic logs records of network exchanges in which the indicator is present, the selected records indicating that the content was sent to one of the user computing devices, wherein more than 5,000 records are selected;
obtaining a device identifier from each of the selected records;
matching the obtained device identifiers to respective matching sets including the respective obtained identifier, each matching set corresponding to a set of user computing devices inferred to be used by a respective individual;
obtaining respective mobile device identifiers from the respective matching sets;
selecting from the network traffic logs records indicating communications from mobile computing devices identified by the obtained mobile device identifiers;
obtaining geolocations from the records indicating communications from the mobile computing devices identified by the obtained mobile device identifiers;
determining that a subset of the records indicating communications from the mobile computing devices have geolocations that correspond to at least one of a set of geographic areas for which visits are to be measured; and
determining an effectiveness of the content in driving visits to the geographic areas based the on subset of the records.
2. The method of claim 1 , wherein matching the set of user computing devices comprises:
assigning different subsets of the network traffic logs to different subordinate computing nodes in a compute cluster by a name node and recording the assignment in a job tracker of the name node, wherein the assignment is based on a locality of geolocations in the network traffic logs;
concurrently determining residential dwellings with the different subordinate computing nodes; and
storing data mapping residential dwelling geolocations and network addresses to mobile device identifiers in a distributed file system of the compute cluster, wherein at least some of the data is replicated on multiple nodes.
3. The method of claim 1 , wherein matching the set of user computing devices comprises:
assigning different subsets of the network traffic logs to different worker nodes of a compute cluster by a driver node, wherein at least some of the network traffic logs are structured as a distributed dataset comprising a collection of elements distributed across nodes of the cluster and each worker node comprises at least some same data from one or more other worker nodes of the cluster; and
concurrently processing the distributed datasets.
4. The method of claim 1 , wherein the residential dwelling is specified by both an Internet Protocol address and geographic tile of less than 1 square kilometer.
5. The method of claim 1 , wherein the residential dwelling is specified by both the network address and a bounding polygon.
6. The method of claim 1 , wherein determining a residential dwelling geolocation of the respective individual comprises:
determining a geolocation associated with the network address in the network traffic logs corresponds to a geographic place in a geographic information system (GIS);
retrieving a score indicative of residential activity associated with the geographic place from the GIS; and
designating the geographic place and the network address pair as indicating a residential dwelling of a respective individual based on the score.
7. The method of claim 1 , wherein determining a residential dwelling geolocation of the respective individual comprises:
filtering geolocations emitted by the mobile computing device according to time of day.
8. The method of claim 1 , wherein the network traffic logs are obtained from a plurality of different servers, at least some of the servers populating the network traffic logs with records indicating sessions with a native mobile application of a first device and at least some of the servers populating network traffic logs with records indicating sessions with a desktop web browser executing on a second computing device different from the first computing device, the first computing device and the second computing device being in the same matching set, the content being sent to the second computing device, and a visit being detected based on a geolocation sensed by the first computing device.
9. The method of claim 1 , wherein matching the parccd obtained device identifiers to respective matching sets including the respective obtained identifier comprises:
matching based on at least two of the following parameters: Internet Protocol (IP) address, User-Agent string of a Hypertext Transfer Protocol request, temporal locality, and frequency of shared use of an IP address.
10. The method of claim 1 , wherein matching the obtained device identifiers to respective matching sets including the respective obtained identifier comprises:
determining a match score based on at least two of the following aspects: Internet Protocol (IP) address, User-Agent string of a Hypertext Transfer Protocol request, temporal locality, and frequency of shared use of an IP address.
11. The method of claim 10 , wherein the match score comprises a weighted combination of an amount of fields in a User-Agent string that match between two devices, a distance in temporal locality, and frequency of shared use of an IP address.
12. The method of claim 1 , wherein determining an effectiveness of the content in driving visits to the geographic areas comprises:
determining a plurality of place visitation rates, each place visitation rate corresponding to a different geographic area to which the content was sent.
13. The method of claim 1 , wherein determining an effectiveness of the content in driving visits to the geographic areas comprises:
determining a plurality of place visitation rates, each place visitation rate corresponding to a different geographic area where a visit occurred.
14. The method of claim 1 , wherein determining an effectiveness of the content in driving visits to the geographic areas comprises:
determining a plurality of place visitation rates for each of a plurality of a different geographic area to which the content was sent, each place visitation rate corresponding to a different geographic area where a visit occurred.
15. The method of claim 1 , wherein matching a set of user computing devices comprises performing steps for matching a set of user computing devices.
16. The method of claim 1 , wherein determining an effectiveness of the content in driving visits comprises performing steps for determining an effectiveness of the content in driving visits.
17. The method of claim 1 , wherein determining an effectiveness of the content in driving visits to the geographic areas comprises:
determining an effectiveness of the content in driving visits to the geographic areas for content sent to different computing devices than those by which visits are detected by probabilistically matching computing devices shared by an individual according to the network traffic logs.
18. The method of claim 1 , wherein the network traffic logs comprise records of more than one billion exchanges between one or more servers and user computing devices, and wherein determining an effectiveness of the content in driving visits to the geographic areas comprises performing steps for concurrently analyzing data.
19. A system, comprising:
one or more processors; and
memory storing instructions that when executed by at least some of the processors effectuate operations comprising:
obtaining, with one or more computer processors, one or more network traffic logs documenting communications via a network between one or more servers and more than 10,000 user computing devices, wherein:
at least some of the communications are associated with a respective timestamp and a device identifier of a respective user computing device among the more than 10,000 user computing devices, and
at least 1,000 of the user computing devices are mobile computing devices that emitted a respective geolocation of the respective mobile computing device stored in the network traffic logs;
for more than 1,000 individuals, matching a set of user computing devices comprising a respective plurality of the user computing devices to the respective individual, each set including at least one of the mobile computing devices, wherein matching comprises:
determining a residential dwelling geolocation of the respective individual, the residential dwelling being specified by both a network address and a residential geographic area of less than one square kilometer, at least some of the residential geographic areas being associated with a plurality of different residential dwelling geolocations of a plurality of different individuals, wherein determining the residential dwelling comprises:
clustering, with a density based clustering algorithm, a plurality of geolocations emitted by the mobile computing device of the respective individual in both time and geographic space;
selecting a resulting cluster based on a measure of central tendency of time of day of timestamps associated with the clustered geolocations, and
distinguishing geolocations in the same residential geographic area by network address;
matching the respective mobile device to another of the user computing devices at least in part based on the matched devices sharing the network address of the residential dwelling in the network traffic logs; and
storing data associating the matching devices in a respective matching set having an identifier of the individual;
obtaining an indicator of content to be measured for effectiveness in driving place visits;
selecting from the network traffic logs records of network exchanges in which the indicator is present, the selected records indicating that the content was sent to one of the user computing devices, wherein more than 5,000 records are selected;
obtaining a device identifier from each of the selected records;
matching the obtained device identifiers to respective matching sets including the respective obtained identifier, each matching set corresponding to a set of user computing devices inferred to be used by a respective individual;
obtaining respective mobile device identifiers from the respective matching sets;
selecting from the network traffic logs records indicating communications from mobile computing devices identified by the obtained mobile device identifiers;
obtaining geolocations from the records indicating communications from the mobile computing devices identified by the obtained mobile device identifiers;
determining that a subset of the records indicating communications from the mobile computing devices have geolocations that correspond to at least one of a set of geographic areas for which visits are to be measured; and
determining an effectiveness of the content in driving visits to the geographic areas based the on subset of the records.
20. The system of claim 19 , wherein matching the set of user computing devices comprises:
assigning, by a primary node of a compute cluster, different subsets of the network traffic logs to different secondary nodes of the compute cluster;
recording the assignment at the primary node and storing data mapping residential dwelling geolocations and network addresses to mobile device identifiers in a distributed file system of the compute cluster, wherein at least some of the mapping data is replicated on multiple secondary nodes and the assignment is based on a locality of geolocations in the network traffic logs; and
concurrently determining residential dwellings with the different secondary nodes of the computer cluster.
21. The system of claim 19 , wherein the network traffic logs are obtained from a plurality of different servers, at least some of the servers populating the network traffic logs with records indicating sessions with a native mobile application of a first device and at least some of the servers populating network traffic logs with records indicating sessions with a desktop web browser executing on a second computing device different from the first computing device, the first computing device and the second computing device being in the same matching set, the content being sent to the second computing device, and a visit being detected based on a geolocation sensed by the first computing device.
22. The system of claim 19 , wherein matching the obtained device identifiers to respective matching sets including the respective obtained identifier comprises:
matching based on at least two of the following parameters: Internet Protocol (IP) address, User-Agent string of a Hypertext Transfer Protocol request, temporal locality, and frequency of shared use of an IP address.
23. The system of claim 19 , wherein matching the obtained device identifiers to respective matching sets including the respective obtained identifier comprises:
determining a match score based on at least two of the following aspects: Internet Protocol (IP) address, User-Agent string of a Hypertext Transfer Protocol request, temporal locality, and frequency of shared use of an IP address.
24. The system of claim 23 , wherein the match score comprises a weighted combination of an amount of fields in a User-Agent string that match between two devices, a distance in temporal locality, and frequency of shared use of an IP address.
25. A tangible, non-transitory, machine-readable medium storing instructions that when executed by one or more processors effectuate operations comprising:
obtaining, with one or more computer processors, one or more network traffic logs documenting communications via a network between one or more servers and more than 10,000 user computing devices, wherein:
at least some of the communications are associated with a respective timestamp and a device identifier of a respective user computing device among the more than 10,000 user computing devices, and
at least 1,000 of the user computing devices are mobile computing devices that emitted a respective geolocation of the respective mobile computing device stored in the network traffic logs;
for more than 1,000 individuals, matching a set of user computing devices comprising a respective plurality of the user computing devices to the respective individual, each set including at least one of the mobile computing devices, wherein matching comprises:
determining a residential dwelling geolocation of the respective individual, the residential dwelling being specified by both a network address and a residential geographic area of less than one square kilometer, at least some of the residential geographic areas being associated with a plurality of different residential dwelling geolocations of a plurality of different individuals, wherein determining the residential dwelling comprises clustering a plurality of geolocations emitted by the mobile computing device of the respective individual in both time and geographic space and distinguishing geolocations in the same residential geographic area by network address;
matching the respective mobile device to another of the user computing devices at least in part based on the matched devices sharing the network address of the residential dwelling in the network traffic logs; and
storing data associating the matching devices in a respective matching set having an identifier of the individual, wherein:
different subsets of the network traffic logs are assigned to different subordinate computing nodes in a compute cluster based on a locality of geolocations in the network traffic logs by a name node, the assignment is recorded in a job tracker of the name node, and residential dwelling geolocations are determined concurrently with the different subordinate computing nodes, and
data mapping residential dwelling geolocations and network addresses to mobile device identifiers is stored in a distributed file system of the compute cluster with at least some of the data replicated on multiple nodes;
obtaining an indicator of content to be measured for effectiveness in driving place visits;
selecting from the network traffic logs records of network exchanges in which the indicator is present, the selected records indicating that the content was sent to one of the user computing devices, wherein more than 5,000 records are selected;
obtaining a device identifier from each of the selected records;
matching the obtained device identifiers to respective matching sets including the respective obtained identifier, each matching set corresponding to a set of user computing devices inferred to be used by a respective individual;
obtaining respective mobile device identifiers from the respective matching sets;
selecting from the network traffic logs records indicating communications from mobile computing devices identified by the obtained mobile device identifiers;
obtaining geolocations from the records indicating communications from the mobile computing devices identified by the obtained mobile device identifiers;
determining that a subset of the records indicating communications from the mobile computing devices have geolocations that correspond to at least one of a set of geographic areas for which visits are to be measured; and
determining an effectiveness of the content in driving visits to the geographic areas based the on subset of the records.
26. The medium of claim 25 , wherein the network traffic logs are obtained from a plurality of different servers, at least some of the servers populating the network traffic logs with records indicating sessions with a native mobile application of a first device and at least some of the servers populating network traffic logs with records indicating sessions with a desktop web browser executing on a second computing device different from the first computing device, the first computing device and the second computing device being in the same matching set, the content being sent to the second computing device, and a visit being detected based on a geolocation sensed by the first computing device.
27. The medium of claim 25 , wherein matching the obtained device identifiers to respective matching sets including the respective obtained identifier comprises:
determining a match score based on at least two of the following aspects: Internet Protocol (IP) address, User-Agent string of a Hypertext Transfer Protocol request, temporal locality, and frequency of shared use of an IP address.
28. The medium of claim 27 , wherein the match score comprises a weighted combination of an amount of fields in a User-Agent string that match between two devices, a distance in temporal locality, and frequency of shared use of an IP address.
29. The medium of claim 25 , wherein determining a residential dwelling geolocation of the respective individual comprises:
clustering the geolocations with a density based clustering algorithm; and
selecting a resulting cluster based on a measure of central tendency of time of day of timestamps associated with the clustered geolocations.
30. A tangible, non-transitory, machine-readable medium storing instructions that when executed by one or more processors effectuate operations comprising:
obtaining, with one or more computer processors, one or more network traffic logs documenting communications via a network between one or more servers and more than 10,000 user computing devices, wherein:
at least some of the communications are associated with a respective timestamp and a device identifier of a respective user computing device among the more than 10,000 user computing devices, and
at least 1,000 of the user computing devices are mobile computing devices that emitted a respective geolocation of the respective mobile computing device stored in the network traffic logs;
for more than 1,000 individuals, matching a set of user computing devices comprising a respective plurality of the user computing devices to the respective individual, each set including at least one of the mobile computing devices, wherein matching comprises:
determining a residential dwelling geolocation of the respective individual, the residential dwelling being specified by both a network address and a residential geographic area of less than one square kilometer, at least some of the residential geographic areas being associated with a plurality of different residential dwelling geolocations of a plurality of different individuals, wherein determining the residential dwelling comprises clustering a plurality of geolocations emitted by the mobile computing device of the respective individual in both time and geographic space and distinguishing geolocations in the same residential geographic area by network address;
matching the respective mobile device to another of the user computing devices at least in part based on the matched devices sharing the network address of the residential dwelling in the network traffic logs; and
storing data associating the matching devices in a respective matching set having an identifier of the individual, wherein:
different subsets of the network traffic logs are assigned to different worker nodes of a compute cluster by a driver node, at least some of the network traffic logs are structured as a distributed dataset comprising a collection of elements distributed across nodes of the cluster and each worker node comprises at least some same data from one or more other worker nodes of the cluster, and
the distributed datasets are concurrently processed with the different worker nodes to determine residential dwelling geolocations;
obtaining an indicator of content to be measured for effectiveness in driving place visits;
selecting from the network traffic logs records of network exchanges in which the indicator is present, the selected records indicating that the content was sent to one of the user computing devices, wherein more than 5,000 records are selected;
obtaining a device identifier from each of the selected records;
matching the obtained device identifiers to respective matching sets including the respective obtained identifier, each matching set corresponding to a set of user computing devices inferred to be used by a respective individual;
obtaining respective mobile device identifiers from the respective matching sets;
selecting from the network traffic logs records indicating communications from mobile computing devices identified by the obtained mobile device identifiers;
obtaining geolocations from the records indicating communications from the mobile computing devices identified by the obtained mobile device identifiers;
determining that a subset of the records indicating communications from the mobile computing devices have geolocations that correspond to at least one of a set of geographic areas for which visits are to be measured; and
determining an effectiveness of the content in driving visits to the geographic areas based the on subset of the records.
31. The medium of claim 30 , wherein the network traffic logs are obtained from a plurality of different servers, at least some of the servers populating the network traffic logs with records indicating sessions with a native mobile application of a first device and at least some of the servers populating network traffic logs with records indicating sessions with a desktop web browser executing on a second computing device different from the first computing device, the first computing device and the second computing device being in the same matching set, the content being sent to the second computing device, and a visit being detected based on a geolocation sensed by the first computing device.
32. The medium of claim 30 , wherein matching the obtained device identifiers to respective matching sets including the respective obtained identifier comprises:
determining a match score based on at least two of the following aspects: Internet Protocol (IP) address, User-Agent string of a Hypertext Transfer Protocol request, temporal locality, and frequency of shared use of an IP address.
33. The medium of claim 32 , wherein the match score comprises a weighted combination of an amount of fields in a User-Agent string that match between two devices, a distance in temporal locality, and frequency of shared use of an IP address.
34. The medium of claim 30 , wherein determining a residential dwelling geolocation of the respective individual comprises:
clustering the geolocations with a density based clustering algorithm; and
selecting a resulting cluster based on a measure of central tendency of time of day of timestamps associated with the clustered geolocations.
35. A method, comprising:
obtaining, with one or more computer processors, one or more network traffic logs documenting communications via a network between one or more servers and more than 10,000 user computing devices, wherein:
at least some of the communications are associated with a respective timestamp and a device identifier of a respective user computing device among the more than 10,000 user computing devices,
at least 1,000 of the user computing devices are mobile computing devices that emitted a respective geolocation of the respective mobile computing device stored in the network traffic logs, and
the network traffic logs are obtained from a plurality of different servers, at least some of the servers populating the network traffic logs with records indicating sessions with a native mobile application of a first device and at least some of the servers populating network traffic logs with records indicating sessions with a desktop web browser executing on a second computing device different from the first computing device;
for more than 1,000 individuals, matching a set of user computing devices comprising a respective plurality of the user computing devices to the respective individual, each set including at least one of the mobile computing devices, wherein matching comprises:
determining a residential dwelling geolocation of the respective individual, the residential dwelling being specified by both a network address and a residential geographic area of less than one square kilometer, at least some of the residential geographic areas being associated with a plurality of different residential dwelling geolocations of a plurality of different individuals, wherein determining the residential dwelling comprises clustering a plurality of geolocations emitted by the mobile computing device of the respective individual in both time and geographic space and distinguishing geolocations in the same residential geographic area by network address;
matching the respective mobile device to another of the user computing devices at least in part based on the matched devices sharing the network address of the residential dwelling in the network traffic logs; and
storing data associating the matching devices in a respective matching set having an identifier of the individual;
obtaining an indicator of content to be measured for effectiveness in driving place visits;
selecting from the network traffic logs records of network exchanges in which the indicator is present, the selected records indicating that the content was sent to one of the user computing devices, wherein more than 5,000 records are selected;
obtaining a device identifier from each of the selected records;
matching the obtained device identifiers to respective matching sets including the respective obtained identifier, each matching set corresponding to a set of user computing devices inferred to be used by a respective individual, wherein:
the first computing device and the second computing device are in the same matching set corresponding to a respective individual, the content being sent to the second computing device, and a visit being detected based on a geolocation sensed by the first computing device;
obtaining respective mobile device identifiers from the respective matching sets;
selecting from the network traffic logs records indicating communications from mobile computing devices identified by the obtained mobile device identifiers;
obtaining geolocations from the records indicating communications from the mobile computing devices identified by the obtained mobile device identifiers;
determining that a subset of the records indicating communications from the mobile computing devices have geolocations that correspond to at least one of a set of geographic areas for which visits are to be measured; and
determining an effectiveness of the content in driving visits to the geographic areas based the on subset of the records.
36. The method of claim 35 , wherein matching the obtained device identifiers to respective matching sets including the respective obtained identifier comprises:
determining a match score based on at least two of the following aspects: Internet Protocol (IP) address, User-Agent string of a Hypertext Transfer Protocol request, temporal locality, and frequency of shared use of an IP address.
37. The method of claim 36 , wherein the match score comprises a weighted combination of an amount of fields in a User-Agent string that match between two devices, a distance in temporal locality, and frequency of shared use of an IP address.
38. The method of claim 35 , wherein matching the set of user computing devices comprises:
assigning, by a primary node of a compute cluster, different subsets of the network traffic logs to different secondary nodes of the compute cluster;
recording the assignment at the primary node and storing data mapping residential dwelling geolocations and network addresses to mobile device identifiers in a distributed file system of the compute cluster, wherein at least some of the mapping data is replicated on multiple secondary nodes and the assignment is based on a locality of geolocations in the network traffic logs; and
concurrently determining residential dwellings with the different secondary nodes of the computer cluster.
39. The method of claim 35 , wherein determining a residential dwelling geolocation of the respective individual comprises:
clustering the geolocations with a density based clustering algorithm; and
selecting a resulting cluster based on a measure of central tendency of time of day of timestamps associated with the clustered geolocations.
40. A tangible, non-transitory, machine-readable medium storing instructions that when executed by one or more processors effectuate operations comprising:
obtaining, with one or more computer processors, one or more network traffic logs documenting communications via a network between one or more servers and more than 10,000 user computing devices, wherein:
at least some of the communications are associated with a respective timestamp and a device identifier of a respective user computing device among the more than 10,000 user computing devices, and
at least 1,000 of the user computing devices are mobile computing devices that emitted a respective geolocation of the respective mobile computing device stored in the network traffic logs;
for more than 1,000 individuals, matching a set of user computing devices comprising a respective plurality of the user computing devices to the respective individual, each set including at least one of the mobile computing devices, wherein matching comprises:
determining a residential dwelling geolocation of the respective individual, the residential dwelling being specified by both a network address and a residential geographic area of less than one square kilometer, at least some of the residential geographic areas being associated with a plurality of different residential dwelling geolocations of a plurality of different individuals, wherein determining the residential dwelling comprises clustering a plurality of geolocations emitted by the mobile computing device of the respective individual in both time and geographic space and distinguishing geolocations in the same residential geographic area by network address;
matching the respective mobile device to another of the user computing devices at least in part based on the matched devices sharing the network address of the residential dwelling in the network traffic logs; and
storing data associating the matching devices in a respective matching set having an identifier of the individual;
obtaining an indicator of content to be measured for effectiveness in driving place visits;
selecting from the network traffic logs records of network exchanges in which the indicator is present, the selected records indicating that the content was sent to one of the user computing devices, wherein more than 5,000 records are selected;
obtaining a device identifier from each of the selected records;
matching the obtained device identifiers to respective matching sets including the respective obtained identifier based on match scores, wherein:
each matching set corresponds to a set of user computing devices inferred to be used by a respective individual, and
each match score is based on a weighted combination of at least two of the following aspects: frequency of shared use of an Internet Protocol (IP) address between devices, an amount of fields in a User-Agent string of a Hypertext Transfer Protocol request that match between devices, a distance in temporal locality between devices, and frequency of shared use of an IP address between devices;
obtaining respective mobile device identifiers from the respective matching sets;
selecting from the network traffic logs records indicating communications from mobile computing devices identified by the obtained mobile device identifiers;
obtaining geolocations from the records indicating communications from the mobile computing devices identified by the obtained mobile device identifiers;
determining that a subset of the records indicating communications from the mobile computing devices have geolocations that correspond to at least one of a set of geographic areas for which visits are to be measured; and
determining an effectiveness of the content in driving visits to the geographic areas based the on subset of the records.
41. The medium of claim 40 , wherein matching the set of user computing devices comprises:
assigning, by a primary node of a compute cluster, different subsets of the network traffic logs to different secondary nodes of the compute cluster;
recording the assignment at the primary node and storing data mapping residential dwelling geolocations and network addresses to mobile device identifiers in a distributed file system of the compute cluster, wherein at least some of the mapping data is replicated on multiple secondary nodes and the assignment is based on a locality of geolocations in the network traffic logs; and
concurrently determining residential dwellings with the different secondary nodes of the computer cluster.
42. The medium of claim 40 , wherein the network traffic logs are obtained from a plurality of different servers, at least some of the servers populating the network traffic logs with records indicating sessions with a native mobile application of a first device and at least some of the servers populating network traffic logs with records indicating sessions with a desktop web browser executing on a second computing device different from the first computing device, the first computing device and the second computing device being in the same matching set, the content being sent to the second computing device, and a visit being detected based on a geolocation sensed by the first computing device.
43. The medium of claim 40 , wherein determining a residential dwelling geolocation of the respective individual comprises:
clustering the geolocations with a density based clustering algorithm; and
selecting a resulting cluster based on a measure of central tendency of time of day of timestamps associated with the clustered geolocations.