Systems and methods for matching and scoring sameness

1. A computer-implemented method for providing a profile of an anchor value, comprising acts of:

detecting a plurality of digital interactions at different points in time, the plurality of digital interactions comprising web site and/or mobile device app interactions;

for each digital interaction of the plurality of digital interactions:

identifying from the digital interaction an anchor value X of an anchor type T, wherein the anchor type T is selected from a group consisting of network address, account identifier, email address, phone number, credit card number, location, device characteristic, and device identifier; and

updating a profile of the anchor value X, wherein:

the profile of the anchor value X comprises a plurality of counters C[i,j] (i=0, . . . , M−1; j=0, . . . , N i −1);

for each i=0, . . . , M−1 and j=0, . . . , N i −1, the counter C[i,j] indicates a number of times an event E is observed during a time interval I i,j ; and

updating the profile of the anchor value X comprises:

analyzing the digital interaction to determine if the event E is observed in connection with the digital interaction; and

in response to determining that the event E is observed in connection with the digital interaction, incrementing the counter C[i,0] for each i=0, . . . , M−1;

identifying the anchor value X from an on-going web site or mobile device app interaction;

using the profile of the anchor value X to generate a score indicative of a level of risk associated with the on-going web site or mobile device app interaction; and

if the score is above a selected threshold, alerting an operator of a web site or mobile device app via which the on-going web site or mobile device app interaction is conducted.

2. The computer-implemented method of claim 1 , wherein:

the time intervals I 0,j (j=0, . . . , N 0 −1) are five-minute intervals and N 0 =12;

the time intervals I 1,j (j=0, . . . , N 1 −1) are one-hour intervals and N 1 =24; and

the time intervals I 2,j (j=0, . . . , N 2 −1) are one-day intervals and N 2 =14.

3. The computer-implemented method of claim 1 , wherein:

for each i=0, . . . , M−1, the time intervals I i,j (j=0, . . . , N i −1) have a same length L i .

4. The computer-implemented method of claim 3 , wherein:

for each i=0, . . . , M−2, L i+1 =N i *L i .

5. The computer-implemented method of claim 3 , further comprising an act of:

for each i=0, . . . , M−1, shifting the counters C[i,j] (j=0, . . . , N i −1) periodically, wherein:

a period for shifting the counters C[i,j] (j=0, . . . , N i −1) is L i , and

shifting the counters C[i,j] (j=0, . . . , N i −1) comprises:

for each j=0, . . . , N i −2, setting the counter C[i,j+1] to a value of the counter C[i,j]; and

setting the counter C[i,0] to 0.

6. The computer-implemented method of claim 1 , wherein:

determining if the event E is observed in connection with the digital interaction comprises determining if both the anchor value X and an anchor value Y are observed from the digital interaction.

7. The computer-implemented method of claim 1 , wherein:

a plurality of anchor values of a same anchor type are divided into a plurality of buckets of anchor values; and

determining if the event E is observed in connection with the digital interaction comprises determining if both the anchor value X and any anchor value from a bucket B of anchor values are observed from the digital interaction.

8. The computer-implemented method of claim 7 , wherein:

the plurality of anchor values are divided into the plurality of buckets of anchor values at least in part by applying a hash-modding operation on the plurality of anchor values.

9. The computer-implemented method of claim 7 , wherein:

the plurality of anchor values comprise a plurality of network addresses;

the plurality of buckets of anchor values comprise a plurality of buckets of network addresses; and

the plurality of network addresses are divided into the plurality of buckets of network addresses at least in part by applying a hash-modding operation on the plurality of network addresses.

10. A system comprising at least one processor and at least one computer-readable storage medium having stored thereon instructions which, when executed, program the at least one processor to perform a method for providing a profile of an anchor value, the method comprising acts of:

detecting a plurality of digital interactions at different points in time, the plurality of digital interactions comprising web site and/or mobile device app interactions;

for each digital interaction of the plurality of digital interactions:

identifying from the digital interaction an anchor value X of an anchor type T, wherein the anchor type T is selected from a group consisting of network address, account identifier, email address, phone number, credit card number, location, device characteristic, and device identifier; and

updating a profile of the anchor value X, wherein:

the profile of the anchor value X comprises a plurality of counters C[i,j] (i=0, . . . , M−1; j=0, . . . , N i −1);

for each i=0, . . . , M−1 and j=0, . . . , N i −1, the counter C[i,j] indicates a number of times an event E is observed during a time interval I i,j ; and

updating the profile of the anchor value X comprises:

analyzing the digital interaction to determine if the event E is observed in connection with the digital interaction; and

in response to determining that the event E is observed in connection with the digital interaction, incrementing the counter C[i,0] for each i=0, . . . , M−1;

identifying the anchor value X from an on-going web site or mobile device app interaction;

using the profile of the anchor value X to generate a score indicative of a level of risk associated with the on-going web site or mobile device app interaction; and

if the score is above a selected threshold, alerting an operator of a web site or mobile device app via which the on-going web site or mobile device app interaction is conducted.

11. The system of claim 10 , wherein:

the time intervals I 0,j (j=0, . . . , N 0 −1) are five-minute intervals and N 0 =12;

the time intervals I 1,j (j=0, . . . , N 1 −1) are one-hour intervals and N 1 =24; and

the time intervals I 2,j (j=0, . . . , N 2 −1) are one-day intervals and N 2 =14.

12. The system of claim 10 , wherein:

for each i=0, . . . , M−1, the time intervals I i,j (j=0, . . . , N i −1) have a same length L i .

13. The system of claim 12 , wherein:

for each i=0, . . . , M−2, L i+1 =N i *L i .

14. The system of claim 12 , wherein the method further comprises an act of:

for each i=0, . . . , M−1, shifting the counters C[i,j] (j=0, . . . , N i −1) periodically, wherein:

a period for shifting the counters C[i,j] (j=0, . . . , N i −1) is L i , and

shifting the counters C[i,j] (j=0, . . . , N i −1) comprises:

for each j=0, . . . , N i −2, setting the counter C[i,j+1] to a value of the counter C[i,j]; and

setting the counter C[i,0] to 0.

15. The system of claim 10 , wherein:

determining if the event E is observed in connection with the digital interaction comprises determining if both the anchor value X and an anchor value Y are observed from the digital interaction.

16. The system of claim 10 , wherein:

a plurality of anchor values of a same anchor type are divided into a plurality of buckets of anchor values; and

determining if the event E is observed in connection with the digital interaction comprises determining if both the anchor value X and any anchor value from a bucket B of anchor values are observed from the digital interaction.

17. The system of claim 16 , wherein:

the plurality of anchor values are divided into the plurality of buckets of anchor values at least in part by applying a hash-modding operation on the plurality of anchor values.

18. The system of claim 16 , wherein:

the plurality of anchor values comprise a plurality of network addresses;

the plurality of buckets of anchor values comprise a plurality of buckets of network addresses; and

the plurality of network addresses are divided into the plurality of buckets of network addresses at least in part by applying a hash-modding operation on the plurality of network addresses.

19. At least one non-transitory computer-readable storage medium having stored thereon instructions which, when executed, program at least one processor to perform a method for providing a profile of an anchor value, the method comprising acts of:

detecting a plurality of digital interactions at different points in time, the plurality of digital interactions comprising web site and/or mobile device app interactions;

for each digital interaction of the plurality of digital interactions:

identifying from the digital interaction an anchor value X of an anchor type T, wherein the anchor type T is selected from a group consisting of network address, account identifier, email address, phone number, credit card number, location, device characteristic, and device identifier; and

updating a profile of the anchor value X, wherein:

the profile of the anchor value X comprises a plurality of counters C[i,j] (i=0, . . . , M−1; j=0, . . . , N i −1);

for each i=0, . . . , M−1 and j=0, . . . , N i −1, the counter C[i,j] indicates a number of times an event E is observed during a time interval I i,j ; and

updating the profile of the anchor value X comprises:

analyzing the digital interaction to determine if the event E is observed in connection with the digital interaction; and

in response to determining that the event E is observed in connection with the digital interaction, incrementing the counter C[i,0] for each i=0, . . . , M−1;

identifying the anchor value X from an on-going web site or mobile device app interaction;

using the profile of the anchor value X to generate a score indicative of a level of risk associated with the on-going web site or mobile device app interaction; and

if the score is above a selected threshold, alerting an operator of a web site or mobile device app via which the on-going web site or mobile device app interaction is conducted.

20. The at least one non-transitory computer-readable storage medium of claim 19 , wherein:

the time intervals I 0,j (j=0, . . . , N 0 −1) are five-minute intervals and N 0 =12;

the time intervals I 1,j (j=0, . . . , N 1 −1) are one-hour intervals and N 1 =24; and

the time intervals I 2,j (j=0, . . . , N 2 −1) are one-day intervals and N 2 =14.

21. The at least one non-transitory computer-readable storage medium of claim 19 , wherein:

for each i=0, . . . , M−1, the time intervals (j=0, . . . , N i −1) have a same length L i .

22. The at least one non-transitory computer-readable storage medium of claim 21 , wherein:

for each i=0, . . . , M−2, L i+1 =N i *L i .

23. The at least one non-transitory computer-readable storage medium of claim 21 , wherein the method further comprises an act of:

for each i=0, . . . , M−1, shifting the counters C[i,j] (j=0, . . . , N i −1) periodically, wherein:

a period for shifting the counters C[i,j] (j=0, . . . , N i −1) is L i , and

shifting the counters C[i,j] (j=0, . . . , N i −1) comprises:

for each j=0, . . . , N i −2, setting the counter C[i,j+1] to a value of the counter C[i,j]; and

setting the counter C[i,0] to 0.

24. The at least one non-transitory computer-readable storage medium of claim 19 , wherein:

determining if the event E is observed in connection with the digital interaction comprises determining if both the anchor value X and an anchor value Y are observed from the digital interaction.

25. The at least one non-transitory computer-readable storage medium of claim 19 , wherein:

a plurality of anchor values of a same anchor type are divided into a plurality of buckets of anchor values; and

determining if the event E is observed in connection with the digital interaction comprises determining if both the anchor value X and any anchor value from a bucket B of anchor values are observed from the digital interaction.

26. The at least one non-transitory computer-readable storage medium of claim 25 , wherein:

the plurality of anchor values are divided into the plurality of buckets of anchor values at least in part by applying a hash-modding operation on the plurality of anchor values.

27. The at least one non-transitory computer-readable storage medium of claim 25 , wherein:

the plurality of anchor values comprise a plurality of network addresses;

the plurality of buckets of anchor values comprise a plurality of buckets of network addresses; and

the plurality of network addresses are divided into the plurality of buckets of network addresses at least in part by applying a hash-modding operation on the plurality of network addresses.