Systems and methods for matching and scoring sameness

1. A computer-implemented method for analyzing a web site or mobile device app interaction, the method comprising acts of:

identifying an anchor value X from the web site or mobile device app interaction;

identifying, in a record of the web site or mobile device app interaction, a data structure associated with an anchor type T of the anchor value X, wherein a plurality of anchor values of the anchor type T are divided into a plurality of buckets of anchor values, and wherein the anchor type T is selected from a group consisting of network address, account identifier, email address, phone number, credit card number, location, device characteristic, and device identifier;

identifying a bucket B of the plurality of buckets of anchor values, wherein the anchor value X falls into the bucket B;

operating on the data structure associated with the anchor type T to indicate that at least one anchor value from the bucket B has been observed in connection with the web site or mobile device app interaction;

looking up the anchor value X in the data structure associated with the anchor type T to determine if the anchor value X has been stored in the data structure associated with the anchor type T;

in response to determining that the anchor value X has not been stored in the data structure associated with the anchor type T, storing the anchor value X in the data structure associated with the anchor type T;

using the data structure associated with the anchor type T to generate a score indicative of a level of risk associated with the web site or mobile device app interaction; and

if the score is above a selected threshold, alerting an operator of a web site or mobile device app via which the web site or mobile device app interaction is conducted.

2. The computer-implemented method of claim 1 , wherein:

the plurality of anchor values of the anchor type T are divided into a plurality of buckets of anchor values at least in part by applying a hash-modding operation on the plurality of anchor values of the anchor type T.

3. The computer-implemented method of claim 2 , wherein:

the hash-modding operation divides the plurality of anchor values of the anchor type T into M buckets;

the data structure associated with the anchor type T comprises an M-bit value, wherein each bit of the M-bit value corresponds to a respective bucket of the M buckets; and

operating on the data structure associated with the anchor type T to indicate that at least one anchor value from the bucket B has been observed in connection with the web site or mobile device app interaction comprises setting a bit of the M-bit value to 1, the bit corresponding to the bucket B.

4. The computer-implemented method of claim 1 , wherein:

the data structure associated with the anchor type T is configured to store N distinct anchor values of the anchor type T.

5. The computer-implemented method of claim 4 , further comprising an act of:

determining if N distinct anchor values have been stored in the data structure associated with the anchor type T, wherein:

the anchor value X is stored in the data structure associated with the anchor type T in response to determining that fewer than N distinct anchor values have been stored in the data structure associated with the anchor type T.

6. The computer-implemented method of claim 4 , wherein:

if N distinct anchor values have been stored in the data structure associated with the anchor type T, the anchor value X replaces an oldest anchor value in the data structure associated with the anchor type T.

7. The computer-implemented method of claim 4 , further comprising acts of:

determining if N distinct anchor values have been stored in the data structure associated with the anchor type T; and

determining if the anchor value X has a higher utility than at least one anchor value stored in the data structure associated with the anchor type T, wherein:

the anchor value X is stored in the data structure associated with the anchor type T in response to determining that N distinct anchor values have been stored in the data structure associated with the anchor type T, but the anchor value X has a higher utility than at least one anchor value stored in the data structure associated with the anchor type T; and

the anchor value X replaces a lowest utility anchor value in the data structure associated with the anchor type T.

8. The computer-implemented method of claim 1 , wherein:

the record of the web site or mobile device app interaction comprises a plurality of data structures associated, respectively, with a plurality of anchor types; and

for each anchor type of the plurality of anchor types, the data structure associated with that anchor type stores a plurality of distinct anchor values of that anchor type.

9. A system comprising at least one processor and at least one computer-readable storage medium having stored thereon instructions which, when executed, program the at least one processor to perform a method for analyzing a web site or mobile device app interaction, the method comprising acts of:

identifying an anchor value X from the web site or mobile device app interaction;

identifying, in a record of the web site or mobile device app interaction, a data structure associated with an anchor type T of the anchor value X, wherein a plurality of anchor values of the anchor type T are divided into a plurality of buckets of anchor values, and wherein the anchor type T is selected from a group consisting of network address, account identifier, email address, phone number, credit card number, location, device characteristic, and device identifier;

identifying a bucket B of the plurality of buckets of anchor values, wherein the anchor value X falls into the bucket B;

operating on the data structure associated with the anchor type T to indicate that at least one anchor value from the bucket B has been observed in connection with the web site or mobile device app interaction;

looking up the anchor value X in the data structure associated with the anchor type T to determine if the anchor value X has been stored in the data structure associated with the anchor type T;

in response to determining that the anchor value X has not been stored in the data structure associated with the anchor type T, storing the anchor value X in the data structure associated with the anchor type T;

using the data structure associated with the anchor type T to generate a score indicative of a level of risk associated with the web site or mobile device app interaction; and

if the score is above a selected threshold, alerting an operator of a web site or mobile device app via which the web site or mobile device app interaction is conducted.

10. The system of claim 9 , wherein:

the plurality of anchor values of the anchor type T are divided into a plurality of buckets of anchor values at least in part by applying a hash-modding operation on the plurality of anchor values of the anchor type T.

11. The system of claim 10 , wherein:

the hash-modding operation divides the plurality of anchor values of the anchor type T into M buckets;

the data structure associated with the anchor type T comprises an M-bit value, wherein each bit of the M-bit value corresponds to a respective bucket of the M buckets; and

operating on the data structure associated with the anchor type T to indicate that at least one anchor value from the bucket B has been observed in connection with the web site or mobile device app interaction comprises setting a bit of the M-bit value to 1, the bit corresponding to the bucket B.

12. The system of claim 9 , wherein:

the data structure associated with the anchor type T is configured to store N distinct anchor values of the anchor type T.

13. The system of claim 12 , wherein the method further comprises an act of:

determining if N distinct anchor values have been stored in the data structure associated with the anchor type T, wherein:

the anchor value X is stored in the data structure associated with the anchor type T in response to determining that fewer than N distinct anchor values have been stored in the data structure associated with the anchor type T.

14. The system of claim 12 , wherein:

if N distinct anchor values have been stored in the data structure associated with the anchor type T, the anchor value X replaces an oldest anchor value in the data structure associated with the anchor type T.

15. The system of claim 12 , wherein the method further comprises acts of:

determining if N distinct anchor values have been stored in the data structure associated with the anchor type T; and

determining if the anchor value X has a higher utility than at least one anchor value stored in the data structure associated with the anchor type T, wherein:

the anchor value X is stored in the data structure associated with the anchor type T in response to determining that N distinct anchor values have been stored in the data structure associated with the anchor type T, but the anchor value X has a higher utility than at least one anchor value stored in the data structure associated with the anchor type T; and

the anchor value X replaces a lowest utility anchor value in the data structure associated with the anchor type T.

16. The system of claim 9 , wherein:

the record of the web site or mobile device app interaction comprises a plurality of data structures associated, respectively, with a plurality of anchor types; and

for each anchor type of the plurality of anchor types, the data structure associated with that anchor type stores a plurality of distinct anchor values of that anchor type.

17. At least one non-transitory computer-readable storage medium having stored thereon instructions which, when executed, program at least one processor to perform a method for analyzing a web site or mobile device app interaction, the method comprising acts of:

identifying an anchor value X from the web site or mobile device app interaction;

identifying, in a record of the web site or mobile device app interaction, a data structure associated with an anchor type T of the anchor value X, wherein a plurality of anchor values of the anchor type T are divided into a plurality of buckets of anchor values, and wherein the anchor type T is selected from a group consisting of network address, account identifier, email address, phone number, credit card number, location, device characteristic, and device identifier;

identifying a bucket B of the plurality of buckets of anchor values, wherein the anchor value X falls into the bucket B;

operating on the data structure associated with the anchor type T to indicate that at least one anchor value from the bucket B has been observed in connection with the web site or mobile device app interaction;

looking up the anchor value X in the data structure associated with the anchor type T to determine if the anchor value X has been stored in the data structure associated with the anchor type T;

in response to determining that the anchor value X has not been stored in the data structure associated with the anchor type T, storing the anchor value X in the data structure associated with the anchor type T;

using the data structure associated with the anchor type T to generate a score indicative of a level of risk associated with the web site or mobile device app interaction; and

if the score is above a selected threshold, alerting an operator of a web site or mobile device app via which the web site or mobile device app interaction is conducted.

18. The at least one non-transitory computer-readable storage medium of claim 17 , wherein:

the plurality of anchor values of the anchor type T are divided into a plurality of buckets of anchor values at least in part by applying a hash-modding operation on the plurality of anchor values of the anchor type T.

19. The at least one non-transitory computer-readable storage medium of claim 18 , wherein:

the hash-modding operation divides the plurality of anchor values of the anchor type T into M buckets;

the data structure associated with the anchor type T comprises an M-bit value, wherein each bit of the M-bit value corresponds to a respective bucket of the M buckets; and

operating on the data structure associated with the anchor type T to indicate that at least one anchor value from the bucket B has been observed in connection with the web site or mobile device app interaction comprises setting a bit of the M-bit value to 1, the bit corresponding to the bucket B.

20. The at least one non-transitory computer-readable storage medium of claim 17 , wherein:

the data structure associated with the anchor type T is configured to store N distinct anchor values of the anchor type T.

21. The at least one non-transitory computer-readable storage medium of claim 20 , wherein the method further comprises an act of:

determining if N distinct anchor values have been stored in the data structure associated with the anchor type T, wherein:

the anchor value X is stored in the data structure associated with the anchor type T in response to determining that fewer than N distinct anchor values have been stored in the data structure associated with the anchor type T.

22. The at least one non-transitory computer-readable storage medium of claim 20 , wherein:

if N distinct anchor values have been stored in the data structure associated with the anchor type T, the anchor value X replaces an oldest anchor value in the data structure associated with the anchor type T.

23. The at least one non-transitory computer-readable storage medium of claim 20 , wherein the method further comprises acts of:

determining if N distinct anchor values have been stored in the data structure associated with the anchor type T; and

determining if the anchor value X has a higher utility than at least one anchor value stored in the data structure associated with the anchor type T, wherein:

the anchor value X is stored in the data structure associated with the anchor type T in response to determining that N distinct anchor values have been stored in the data structure associated with the anchor type T, but the anchor value X has a higher utility than at least one anchor value stored in the data structure associated with the anchor type T; and

the anchor value X replaces a lowest utility anchor value in the data structure associated with the anchor type T.

24. The at least one non-transitory computer-readable storage medium of claim 17 , wherein:

the record of the web site or mobile device app interaction comprises a plurality of data structures associated, respectively, with a plurality of anchor types; and

for each anchor type of the plurality of anchor types, the data structure associated with that anchor type stores a plurality of distinct anchor values of that anchor type.