A tangible, non-transitory, machine-readable medium storing instructions that when executed by one or more processors effectuate operations comprising:
- obtaining, with one or more computer processors, one or more network traffic logs documenting communications via a network between one or more servers and more than 10,000 user computing devices, wherein:
- at least some of the communications are associated with a respective timestamp and a device identifier of a respective user computing device among the more than 10,000 user computing devices, and
- at least 1,000 of the user computing devices are mobile computing devices that emitted a respective geolocation of the respective mobile computing device stored in the network traffic logs;
- for more than 1,000 individuals, matching a set of user computing devices comprising a respective plurality of the user computing devices to the respective individual, each set including at least one of the mobile computing devices, wherein matching comprises:
- determining a residential dwelling geolocation of the respective individual, the residential dwelling being specified by both a network address and a residential geographic area of less than one square kilometer, at least some of the residential geographic areas being associated with a plurality of different residential dwelling geolocations of a plurality of different individuals, wherein determining the residential dwelling comprises clustering a plurality of geolocations emitted by the mobile computing device of the respective individual in both time and geographic space and distinguishing geolocations in the same residential geographic area by network address;
- matching the respective mobile device to another of the user computing devices at least in part based on the matched devices sharing the network address of the residential dwelling in the network traffic logs;
- and
- storing data associating the matching devices in a respective matching set having an identifier of the individual, wherein:
- different subsets of the network traffic logs are assigned to different subordinate computing nodes in a compute cluster based on a locality of geolocations in the network traffic logs by a name node, the assignment is recorded in a job tracker of the name node, and residential dwelling geolocations are determined concurrently with the different subordinate computing nodes, and
- data mapping residential dwelling geolocations and network addresses to mobile device identifiers is stored in a distributed file system of the compute cluster with at least some of the data replicated on multiple nodes;
- obtaining an indicator of content to be measured for effectiveness in driving place visits;
- selecting from the network traffic logs records of network exchanges in which the indicator is present, the selected records indicating that the content was sent to one of the user computing devices, wherein more than 5,000 records are selected;
- obtaining a device identifier from each of the selected records;
- matching the obtained device identifiers to respective matching sets including the respective obtained identifier, each matching set corresponding to a set of user computing devices inferred to be used by a respective individual;
- obtaining respective mobile device identifiers from the respective matching sets;
- selecting from the network traffic logs records indicating communications from mobile computing devices identified by the obtained mobile device identifiers;
- obtaining geolocations from the records indicating communications from the mobile computing devices identified by the obtained mobile device identifiers;
- determining that a subset of the records indicating communications from the mobile computing devices have geolocations that correspond to at least one of a set of geographic areas for which visits are to be measured;
- and
- determining an effectiveness of the content in driving visits to the geographic areas based the on subset of the records.