Automatically detecting unauthorized re-identification

1. A method for detecting third-party re-identification of anonymized computing devices, comprising:

retrieving, by an analyzer of a computing system, a log of content items provided to anonymized computing devices;

identifying, by the analyzer, a first content item provided to a plurality of anonymized computing devices within a first predetermined time period;

for each anonymized computing device of the plurality of anonymized computing devices, generating, by the analyzer, a set of identifications of second content items retrieved by the anonymized computing device prior to receiving the first content item within a second predetermined time period;

determining, by the analyzer, that a signal or a combination of signals with a highest predictive ability between a first set of identifications and a second set of identifications exceeds a threshold;

identifying, by the analyzer, a provider of the first content item; and

responsive to the determination that the signal or combination of signals with the highest predictive ability between the first set of identifications and the second set of identifications exceeds the threshold, preventing, by the computing system, transmission of a request of an anonymized computing device for a content item to the identified provider.

2. The method of claim 1 , wherein the identifications of the second content items comprise identifications of web pages visited by each anonymized computing device.

3. The method of claim 1 , wherein the identifications of the second content items comprise identifications of domains visited by each anonymized computing device.

4. The method of claim 1 , wherein the identifications of the second content items comprise identifications of keywords associated with domains visited by each anonymized computing device.

5. The method of claim 1 , further comprising determining, by the analyzer, that a size of the signal or combination of signals with the highest predictive ability between the first set of identifications and the second set of identifications exceeds sizes of signals or combinations of signals with the highest predictive ability between each other pair of sets of identifications.

6. The method of claim 1 , further comprising determining, by the analyzer, that the signal or combination of signals with the highest predictive ability between the first set of identifications and the second set of identifications is common to a third set of identifications.

7. The method of claim 1 , wherein preventing transmission of the request further comprises:

receiving, by the computing system, the request for the content item from the anonymized computing device; and

redirecting, by the computing system, the request to a second provider.

8. The method of claim 1 , wherein preventing transmission of the request is further responsive to:

identifying, by the analyzer, a third content item provided by the identified provider to the plurality of anonymized computing devices within the first predetermined time period;

for each anonymized computing device of the plurality of anonymized computing devices, generating, by the analyzer, a set of identifications of fourth content items retrieved by the anonymized computing device prior to receiving the third content item within the second predetermined time period; and

determining, by the analyzer, that the signal or combination of signals with the highest predictive ability between a first set of identifications of fourth content items and a second set of identifications of fourth content items exceeds the threshold.

9. The method of claim 1 , further comprising incrementing a counter associated with the identified provider, responsive to the determination that the signal or combination of signals with the highest predictive ability between the first set of identifications and the second set of identifications exceeds the threshold.

10. The method of claim 9 , wherein preventing transmission of the request is further responsive to the counter associated with the identified provider exceeding a second threshold.

11. A system for detecting third-party re-identification of anonymized computing devices, comprising:

a computing system comprising a processor, a memory device, and a network interface, the processor executing an analyzer;

wherein the analyzer is configured to:

retrieve from the memory device a log of content items provided to anonymized computing devices,

identify a first content item provided to a plurality of anonymized computing devices within a first predetermined time period,

for each anonymized computing device of the plurality of anonymized computing devices, generate a set of identifications of second content items retrieved by the anonymized computing device prior to receiving the first content item within a second predetermined time period,

determine that a signal or a combination of signals with a highest predictive ability between a first set of identifications and a second set of identifications exceeds a threshold, and

identify a provider of the first content item; and

wherein the network interface is configured to prevent, responsive to the determination that the signal or combination of signals with the highest predictive ability between the first set of identifications and the second set of identifications exceeds the threshold, transmission of a request of an anonymized computing device for a content item to the identified provider.

12. The system of claim 11 , wherein the identifications of the second content items comprise identifications of web pages visited by each anonymized computing device.

13. The system of claim 11 , wherein the identifications of the second content items comprise identifications of domains visited by each anonymized computing device.

14. The system of claim 11 , wherein the identifications of the second content items comprise identifications of keywords associated with domains visited by each anonymized computing device.

15. The system of claim 11 , wherein the analyzer is further configured to determine that a size of the signal or combination of signals with the highest predictive ability between the first set of identifications and the second set of identifications exceeds sizes of signals or combinations of signals with the highest predictive ability between each other pair of sets of identifications.

16. The system of claim 11 , wherein the analyzer is further configured to determine that the signal or combination of signals with the highest predictive ability between the first set of identifications and the second set of identifications is common to a third set of identifications.

17. The system of claim 11 , wherein the network interface is further configured to:

receive the request for the content item from the anonymized computing device; and

redirect the request to a second provider.

18. The system of claim 11 , wherein the analyzer is further configured to:

identify a third content item provided by the identified provider to the plurality of anonymized computing devices within the first predetermined time period;

for each anonymized computing device of the plurality of anonymized computing devices, generate a set of identifications of fourth content items retrieved by the anonymized computing device prior to receiving the third content item within the second predetermined time period; and

determine that a signal or a combination of signals with the highest predictive ability between a first set of identifications of fourth content items and a second set of identifications of fourth content items exceeds the threshold.

19. The system of claim 11 , wherein the analyzer is further configured to increment a counter associated with the identified provider, responsive to the determination that the signal or combination of signals with the highest predictive ability between the first set of identifications and the second set of identifications exceeds the threshold.

20. The system of claim 19 , wherein the network interface is further configured to prevent transmission of the request responsive to the counter associated with the identified provider exceeding a second threshold.