# US 10,318,973 B2 · Probabilistic cross-device place visitation rate measurement at scale

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,318,973 B2
- Document ID: US10318973B2
- Status: Granted
- Kind: B2
- Application number: 15/152,157
- Filed: 2016-05-11
- Published: 2016-09-01
- Granted: 2019-06-11
- Earliest claimed: 2013-01-04
- Assignees: PlaceIQ, Inc.
- Applicants: PlaceIQ, Inc.
- Inventors: Stephen Milton; Duncan McCall; Bishwaroop Ganguly
- Web page: https://patentgrep.com/patent/US10318973B2

## CPC

- G06Q 30/0205: {based on location or geographical consideration}
- G06F 16/9537: Spatial or temporal dependent retrieval, e.g. spatiotemporal queries
- G06F 16/958: Organisation or management of web site content, e.g. publishing, maintaining pages or automatic linking
- G06Q 30/02: Marketing; Price estimation or determination; Fundraising
- H04W 4/029: Location-based management or tracking services
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)

## Abstract

Provided is a process including: obtaining network traffic logs; matching a set of a plurality of the user computing devices; obtaining an indicator of content to be measured for effectiveness in driving place visits; selecting from the network traffic logs records of network exchanges in which the indicator is present; obtaining a device identifier from each of the selected records; matching the obtained device identifiers to respective matching sets including the respective obtained identifier; obtaining respective mobile device identifiers from the respective matching sets; selecting from the network traffic logs records indicating communications from mobile computing devices identified by the obtained mobile device identifiers; obtaining geolocations from the records indicating communications from the mobile computing devices identified; determining that a subset of the records have geolocations that correspond to at least one of a set of geographic areas; and determining an effectiveness of the content in driving visits.

## Claims

### Claim 1

A method, comprising:
obtaining, with one or more computer processors, one or more network traffic logs documenting communications via a network between one or more servers and more than 10,000 user computing devices, wherein:
at least some of the communications are associated with a respective timestamp and a device identifier of a respective user computing device among the more than 10,000 user computing devices, and
at least 1,000 of the user computing devices are mobile computing devices that emitted a respective geolocation of the respective mobile computing device stored in the network traffic logs;
for more than 1,000 individuals, matching a set of user computing devices comprising a respective plurality of the user computing devices to the respective individual, each set including at least one of the mobile computing devices, wherein matching comprises:
determining a residential dwelling geolocation of the respective individual, the residential dwelling being specified by both a network address and a residential geographic area of less than one square kilometer, at least some of the residential geographic areas being associated with a plurality of different residential dwelling geolocations of a plurality of different individuals, wherein determining the residential dwelling comprises:
clustering, with a density based clustering algorithm, a plurality of geolocations emitted by the mobile computing device of the respective individual in both time and geographic space,
selecting a resulting cluster based on a measure of central tendency of time of day of timestamps associated with the clustered geolocations, and
distinguishing geolocations in the same residential geographic area by network address;
matching the respective mobile device to another of the user computing devices at least in part based on the matched devices sharing the network address of the residential dwelling in the network traffic logs; and
storing data associating the matching devices in a respective matching set having an identifier of the individual;
obtaining an indicator of content to be measured for effectiveness in driving place visits;
selecting from the network traffic logs records of network exchanges in which the indicator is present, the selected records indicating that the content was sent to one of the user computing devices, wherein more than 5,000 records are selected;
obtaining a device identifier from each of the selected records;
matching the obtained device identifiers to respective matching sets including the respective obtained identifier, each matching set corresponding to a set of user computing devices inferred to be used by a respective individual;
obtaining respective mobile device identifiers from the respective matching sets;
selecting from the network traffic logs records indicating communications from mobile computing devices identified by the obtained mobile device identifiers;
obtaining geolocations from the records indicating communications from the mobile computing devices identified by the obtained mobile device identifiers;
determining that a subset of the records indicating communications from the mobile computing devices have geolocations that correspond to at least one of a set of geographic areas for which visits are to be measured; and
determining an effectiveness of the content in driving visits to the geographic areas based the on subset of the records.

### Claim 2 (depends on 1)

The method of claim 1, wherein matching the set of user computing devices comprises:
assigning different subsets of the network traffic logs to different subordinate computing nodes in a compute cluster by a name node and recording the assignment in a job tracker of the name node, wherein the assignment is based on a locality of geolocations in the network traffic logs;
concurrently determining residential dwellings with the different subordinate computing nodes; and
storing data mapping residential dwelling geolocations and network addresses to mobile device identifiers in a distributed file system of the compute cluster, wherein at least some of the data is replicated on multiple nodes.

### Claim 3 (depends on 1)

The method of claim 1, wherein matching the set of user computing devices comprises:
assigning different subsets of the network traffic logs to different worker nodes of a compute cluster by a driver node, wherein at least some of the network traffic logs are structured as a distributed dataset comprising a collection of elements distributed across nodes of the cluster and each worker node comprises at least some same data from one or more other worker nodes of the cluster; and
concurrently processing the distributed datasets.

### Claim 4 (depends on 1)

The method of claim 1, wherein the residential dwelling is specified by both an Internet Protocol address and geographic tile of less than 1 square kilometer.

### Claim 5 (depends on 1)

The method of claim 1, wherein the residential dwelling is specified by both the network address and a bounding polygon.

### Claim 6 (depends on 1)

The method of claim 1, wherein determining a residential dwelling geolocation of the respective individual comprises:
determining a geolocation associated with the network address in the network traffic logs corresponds to a geographic place in a geographic information system (GIS);
retrieving a score indicative of residential activity associated with the geographic place from the GIS; and
designating the geographic place and the network address pair as indicating a residential dwelling of a respective individual based on the score.

### Claim 7 (depends on 1)

The method of claim 1, wherein determining a residential dwelling geolocation of the respective individual comprises:
filtering geolocations emitted by the mobile computing device according to time of day.

### Claim 8 (depends on 1)

The method of claim 1, wherein the network traffic logs are obtained from a plurality of different servers, at least some of the servers populating the network traffic logs with records indicating sessions with a native mobile application of a first device and at least some of the servers populating network traffic logs with records indicating sessions with a desktop web browser executing on a second computing device different from the first computing device, the first computing device and the second computing device being in the same matching set, the content being sent to the second computing device, and a visit being detected based on a geolocation sensed by the first computing device.

### Claim 9 (depends on 1)

The method of claim 1, wherein matching the parccd obtained device identifiers to respective matching sets including the respective obtained identifier comprises:
matching based on at least two of the following parameters: Internet Protocol (IP) address, User-Agent string of a Hypertext Transfer Protocol request, temporal locality, and frequency of shared use of an IP address.

### Claim 10 (depends on 1)

The method of claim 1, wherein matching the obtained device identifiers to respective matching sets including the respective obtained identifier comprises:
determining a match score based on at least two of the following aspects: Internet Protocol (IP) address, User-Agent string of a Hypertext Transfer Protocol request, temporal locality, and frequency of shared use of an IP address.

### Claim 11 (depends on 10)

The method of claim 10, wherein the match score comprises a weighted combination of an amount of fields in a User-Agent string that match between two devices, a distance in temporal locality, and frequency of shared use of an IP address.

### Claim 12 (depends on 1)

The method of claim 1, wherein determining an effectiveness of the content in driving visits to the geographic areas comprises:
determining a plurality of place visitation rates, each place visitation rate corresponding to a different geographic area to which the content was sent.

### Claim 13 (depends on 1)

The method of claim 1, wherein determining an effectiveness of the content in driving visits to the geographic areas comprises:
determining a plurality of place visitation rates, each place visitation rate corresponding to a different geographic area where a visit occurred.

### Claim 14 (depends on 1)

The method of claim 1, wherein determining an effectiveness of the content in driving visits to the geographic areas comprises:
determining a plurality of place visitation rates for each of a plurality of a different geographic area to which the content was sent, each place visitation rate corresponding to a different geographic area where a visit occurred.

### Claim 15 (depends on 1)

The method of claim 1, wherein matching a set of user computing devices comprises performing steps for matching a set of user computing devices.

### Claim 16 (depends on 1)

The method of claim 1, wherein determining an effectiveness of the content in driving visits comprises performing steps for determining an effectiveness of the content in driving visits.

### Claim 17 (depends on 1)

The method of claim 1, wherein determining an effectiveness of the content in driving visits to the geographic areas comprises:
determining an effectiveness of the content in driving visits to the geographic areas for content sent to different computing devices than those by which visits are detected by probabilistically matching computing devices shared by an individual according to the network traffic logs.

### Claim 18 (depends on 1)

The method of claim 1, wherein the network traffic logs comprise records of more than one billion exchanges between one or more servers and user computing devices, and wherein determining an effectiveness of the content in driving visits to the geographic areas comprises performing steps for concurrently analyzing data.

### Claim 19

A system, comprising:
one or more processors; and
memory storing instructions that when executed by at least some of the processors effectuate operations comprising:
obtaining, with one or more computer processors, one or more network traffic logs documenting communications via a network between one or more servers and more than 10,000 user computing devices, wherein:
at least some of the communications are associated with a respective timestamp and a device identifier of a respective user computing device among the more than 10,000 user computing devices, and
at least 1,000 of the user computing devices are mobile computing devices that emitted a respective geolocation of the respective mobile computing device stored in the network traffic logs;
for more than 1,000 individuals, matching a set of user computing devices comprising a respective plurality of the user computing devices to the respective individual, each set including at least one of the mobile computing devices, wherein matching comprises:
determining a residential dwelling geolocation of the respective individual, the residential dwelling being specified by both a network address and a residential geographic area of less than one square kilometer, at least some of the residential geographic areas being associated with a plurality of different residential dwelling geolocations of a plurality of different individuals, wherein determining the residential dwelling comprises:
clustering, with a density based clustering algorithm, a plurality of geolocations emitted by the mobile computing device of the respective individual in both time and geographic space;
selecting a resulting cluster based on a measure of central tendency of time of day of timestamps associated with the clustered geolocations, and
distinguishing geolocations in the same residential geographic area by network address;
matching the respective mobile device to another of the user computing devices at least in part based on the matched devices sharing the network address of the residential dwelling in the network traffic logs; and
storing data associating the matching devices in a respective matching set having an identifier of the individual;
obtaining an indicator of content to be measured for effectiveness in driving place visits;
selecting from the network traffic logs records of network exchanges in which the indicator is present, the selected records indicating that the content was sent to one of the user computing devices, wherein more than 5,000 records are selected;
obtaining a device identifier from each of the selected records;
matching the obtained device identifiers to respective matching sets including the respective obtained identifier, each matching set corresponding to a set of user computing devices inferred to be used by a respective individual;
obtaining respective mobile device identifiers from the respective matching sets;
selecting from the network traffic logs records indicating communications from mobile computing devices identified by the obtained mobile device identifiers;
obtaining geolocations from the records indicating communications from the mobile computing devices identified by the obtained mobile device identifiers;
determining that a subset of the records indicating communications from the mobile computing devices have geolocations that correspond to at least one of a set of geographic areas for which visits are to be measured; and
determining an effectiveness of the content in driving visits to the geographic areas based the on subset of the records.

### Claim 20 (depends on 19)

The system of claim 19, wherein matching the set of user computing devices comprises:
assigning, by a primary node of a compute cluster, different subsets of the network traffic logs to different secondary nodes of the compute cluster;
recording the assignment at the primary node and storing data mapping residential dwelling geolocations and network addresses to mobile device identifiers in a distributed file system of the compute cluster, wherein at least some of the mapping data is replicated on multiple secondary nodes and the assignment is based on a locality of geolocations in the network traffic logs; and
concurrently determining residential dwellings with the different secondary nodes of the computer cluster.

### Claim 21 (depends on 19)

The system of claim 19, wherein the network traffic logs are obtained from a plurality of different servers, at least some of the servers populating the network traffic logs with records indicating sessions with a native mobile application of a first device and at least some of the servers populating network traffic logs with records indicating sessions with a desktop web browser executing on a second computing device different from the first computing device, the first computing device and the second computing device being in the same matching set, the content being sent to the second computing device, and a visit being detected based on a geolocation sensed by the first computing device.

### Claim 22 (depends on 19)

The system of claim 19, wherein matching the obtained device identifiers to respective matching sets including the respective obtained identifier comprises:
matching based on at least two of the following parameters: Internet Protocol (IP) address, User-Agent string of a Hypertext Transfer Protocol request, temporal locality, and frequency of shared use of an IP address.

### Claim 23 (depends on 19)

The system of claim 19, wherein matching the obtained device identifiers to respective matching sets including the respective obtained identifier comprises:
determining a match score based on at least two of the following aspects: Internet Protocol (IP) address, User-Agent string of a Hypertext Transfer Protocol request, temporal locality, and frequency of shared use of an IP address.

### Claim 24 (depends on 23)

The system of claim 23, wherein the match score comprises a weighted combination of an amount of fields in a User-Agent string that match between two devices, a distance in temporal locality, and frequency of shared use of an IP address.

### Claim 25

A tangible, non-transitory, machine-readable medium storing instructions that when executed by one or more processors effectuate operations comprising:
obtaining, with one or more computer processors, one or more network traffic logs documenting communications via a network between one or more servers and more than 10,000 user computing devices, wherein:
at least some of the communications are associated with a respective timestamp and a device identifier of a respective user computing device among the more than 10,000 user computing devices, and
at least 1,000 of the user computing devices are mobile computing devices that emitted a respective geolocation of the respective mobile computing device stored in the network traffic logs;
for more than 1,000 individuals, matching a set of user computing devices comprising a respective plurality of the user computing devices to the respective individual, each set including at least one of the mobile computing devices, wherein matching comprises:
determining a residential dwelling geolocation of the respective individual, the residential dwelling being specified by both a network address and a residential geographic area of less than one square kilometer, at least some of the residential geographic areas being associated with a plurality of different residential dwelling geolocations of a plurality of different individuals, wherein determining the residential dwelling comprises clustering a plurality of geolocations emitted by the mobile computing device of the respective individual in both time and geographic space and distinguishing geolocations in the same residential geographic area by network address;
matching the respective mobile device to another of the user computing devices at least in part based on the matched devices sharing the network address of the residential dwelling in the network traffic logs; and
storing data associating the matching devices in a respective matching set having an identifier of the individual, wherein:
different subsets of the network traffic logs are assigned to different subordinate computing nodes in a compute cluster based on a locality of geolocations in the network traffic logs by a name node, the assignment is recorded in a job tracker of the name node, and residential dwelling geolocations are determined concurrently with the different subordinate computing nodes, and
data mapping residential dwelling geolocations and network addresses to mobile device identifiers is stored in a distributed file system of the compute cluster with at least some of the data replicated on multiple nodes;
obtaining an indicator of content to be measured for effectiveness in driving place visits;
selecting from the network traffic logs records of network exchanges in which the indicator is present, the selected records indicating that the content was sent to one of the user computing devices, wherein more than 5,000 records are selected;
obtaining a device identifier from each of the selected records;
matching the obtained device identifiers to respective matching sets including the respective obtained identifier, each matching set corresponding to a set of user computing devices inferred to be used by a respective individual;
obtaining respective mobile device identifiers from the respective matching sets;
selecting from the network traffic logs records indicating communications from mobile computing devices identified by the obtained mobile device identifiers;
obtaining geolocations from the records indicating communications from the mobile computing devices identified by the obtained mobile device identifiers;
determining that a subset of the records indicating communications from the mobile computing devices have geolocations that correspond to at least one of a set of geographic areas for which visits are to be measured; and
determining an effectiveness of the content in driving visits to the geographic areas based the on subset of the records.

### Claim 26 (depends on 25)

The medium of claim 25, wherein the network traffic logs are obtained from a plurality of different servers, at least some of the servers populating the network traffic logs with records indicating sessions with a native mobile application of a first device and at least some of the servers populating network traffic logs with records indicating sessions with a desktop web browser executing on a second computing device different from the first computing device, the first computing device and the second computing device being in the same matching set, the content being sent to the second computing device, and a visit being detected based on a geolocation sensed by the first computing device.

### Claim 27 (depends on 25)

The medium of claim 25, wherein matching the obtained device identifiers to respective matching sets including the respective obtained identifier comprises:
determining a match score based on at least two of the following aspects: Internet Protocol (IP) address, User-Agent string of a Hypertext Transfer Protocol request, temporal locality, and frequency of shared use of an IP address.

### Claim 28 (depends on 27)

The medium of claim 27, wherein the match score comprises a weighted combination of an amount of fields in a User-Agent string that match between two devices, a distance in temporal locality, and frequency of shared use of an IP address.

### Claim 29 (depends on 25)

The medium of claim 25, wherein determining a residential dwelling geolocation of the respective individual comprises:
clustering the geolocations with a density based clustering algorithm; and
selecting a resulting cluster based on a measure of central tendency of time of day of timestamps associated with the clustered geolocations.

### Claim 30

A tangible, non-transitory, machine-readable medium storing instructions that when executed by one or more processors effectuate operations comprising:
obtaining, with one or more computer processors, one or more network traffic logs documenting communications via a network between one or more servers and more than 10,000 user computing devices, wherein:
at least some of the communications are associated with a respective timestamp and a device identifier of a respective user computing device among the more than 10,000 user computing devices, and
at least 1,000 of the user computing devices are mobile computing devices that emitted a respective geolocation of the respective mobile computing device stored in the network traffic logs;
for more than 1,000 individuals, matching a set of user computing devices comprising a respective plurality of the user computing devices to the respective individual, each set including at least one of the mobile computing devices, wherein matching comprises:
determining a residential dwelling geolocation of the respective individual, the residential dwelling being specified by both a network address and a residential geographic area of less than one square kilometer, at least some of the residential geographic areas being associated with a plurality of different residential dwelling geolocations of a plurality of different individuals, wherein determining the residential dwelling comprises clustering a plurality of geolocations emitted by the mobile computing device of the respective individual in both time and geographic space and distinguishing geolocations in the same residential geographic area by network address;
matching the respective mobile device to another of the user computing devices at least in part based on the matched devices sharing the network address of the residential dwelling in the network traffic logs; and
storing data associating the matching devices in a respective matching set having an identifier of the individual, wherein:
different subsets of the network traffic logs are assigned to different worker nodes of a compute cluster by a driver node, at least some of the network traffic logs are structured as a distributed dataset comprising a collection of elements distributed across nodes of the cluster and each worker node comprises at least some same data from one or more other worker nodes of the cluster, and
the distributed datasets are concurrently processed with the different worker nodes to determine residential dwelling geolocations;
obtaining an indicator of content to be measured for effectiveness in driving place visits;
selecting from the network traffic logs records of network exchanges in which the indicator is present, the selected records indicating that the content was sent to one of the user computing devices, wherein more than 5,000 records are selected;
obtaining a device identifier from each of the selected records;
matching the obtained device identifiers to respective matching sets including the respective obtained identifier, each matching set corresponding to a set of user computing devices inferred to be used by a respective individual;
obtaining respective mobile device identifiers from the respective matching sets;
selecting from the network traffic logs records indicating communications from mobile computing devices identified by the obtained mobile device identifiers;
obtaining geolocations from the records indicating communications from the mobile computing devices identified by the obtained mobile device identifiers;
determining that a subset of the records indicating communications from the mobile computing devices have geolocations that correspond to at least one of a set of geographic areas for which visits are to be measured; and
determining an effectiveness of the content in driving visits to the geographic areas based the on subset of the records.

### Claim 31 (depends on 30)

The medium of claim 30, wherein the network traffic logs are obtained from a plurality of different servers, at least some of the servers populating the network traffic logs with records indicating sessions with a native mobile application of a first device and at least some of the servers populating network traffic logs with records indicating sessions with a desktop web browser executing on a second computing device different from the first computing device, the first computing device and the second computing device being in the same matching set, the content being sent to the second computing device, and a visit being detected based on a geolocation sensed by the first computing device.

### Claim 32 (depends on 30)

The medium of claim 30, wherein matching the obtained device identifiers to respective matching sets including the respective obtained identifier comprises:
determining a match score based on at least two of the following aspects: Internet Protocol (IP) address, User-Agent string of a Hypertext Transfer Protocol request, temporal locality, and frequency of shared use of an IP address.

### Claim 33 (depends on 32)

The medium of claim 32, wherein the match score comprises a weighted combination of an amount of fields in a User-Agent string that match between two devices, a distance in temporal locality, and frequency of shared use of an IP address.

### Claim 34 (depends on 30)

The medium of claim 30, wherein determining a residential dwelling geolocation of the respective individual comprises:
clustering the geolocations with a density based clustering algorithm; and
selecting a resulting cluster based on a measure of central tendency of time of day of timestamps associated with the clustered geolocations.

### Claim 35

A method, comprising:
obtaining, with one or more computer processors, one or more network traffic logs documenting communications via a network between one or more servers and more than 10,000 user computing devices, wherein:
at least some of the communications are associated with a respective timestamp and a device identifier of a respective user computing device among the more than 10,000 user computing devices,
at least 1,000 of the user computing devices are mobile computing devices that emitted a respective geolocation of the respective mobile computing device stored in the network traffic logs, and
the network traffic logs are obtained from a plurality of different servers, at least some of the servers populating the network traffic logs with records indicating sessions with a native mobile application of a first device and at least some of the servers populating network traffic logs with records indicating sessions with a desktop web browser executing on a second computing device different from the first computing device;
for more than 1,000 individuals, matching a set of user computing devices comprising a respective plurality of the user computing devices to the respective individual, each set including at least one of the mobile computing devices, wherein matching comprises:
determining a residential dwelling geolocation of the respective individual, the residential dwelling being specified by both a network address and a residential geographic area of less than one square kilometer, at least some of the residential geographic areas being associated with a plurality of different residential dwelling geolocations of a plurality of different individuals, wherein determining the residential dwelling comprises clustering a plurality of geolocations emitted by the mobile computing device of the respective individual in both time and geographic space and distinguishing geolocations in the same residential geographic area by network address;
matching the respective mobile device to another of the user computing devices at least in part based on the matched devices sharing the network address of the residential dwelling in the network traffic logs; and
storing data associating the matching devices in a respective matching set having an identifier of the individual;
obtaining an indicator of content to be measured for effectiveness in driving place visits;
selecting from the network traffic logs records of network exchanges in which the indicator is present, the selected records indicating that the content was sent to one of the user computing devices, wherein more than 5,000 records are selected;
obtaining a device identifier from each of the selected records;
matching the obtained device identifiers to respective matching sets including the respective obtained identifier, each matching set corresponding to a set of user computing devices inferred to be used by a respective individual, wherein:
the first computing device and the second computing device are in the same matching set corresponding to a respective individual, the content being sent to the second computing device, and a visit being detected based on a geolocation sensed by the first computing device;
obtaining respective mobile device identifiers from the respective matching sets;
selecting from the network traffic logs records indicating communications from mobile computing devices identified by the obtained mobile device identifiers;
obtaining geolocations from the records indicating communications from the mobile computing devices identified by the obtained mobile device identifiers;
determining that a subset of the records indicating communications from the mobile computing devices have geolocations that correspond to at least one of a set of geographic areas for which visits are to be measured; and
determining an effectiveness of the content in driving visits to the geographic areas based the on subset of the records.

### Claim 36 (depends on 35)

The method of claim 35, wherein matching the obtained device identifiers to respective matching sets including the respective obtained identifier comprises:
determining a match score based on at least two of the following aspects: Internet Protocol (IP) address, User-Agent string of a Hypertext Transfer Protocol request, temporal locality, and frequency of shared use of an IP address.

### Claim 37 (depends on 36)

The method of claim 36, wherein the match score comprises a weighted combination of an amount of fields in a User-Agent string that match between two devices, a distance in temporal locality, and frequency of shared use of an IP address.

### Claim 38 (depends on 35)

The method of claim 35, wherein matching the set of user computing devices comprises:
assigning, by a primary node of a compute cluster, different subsets of the network traffic logs to different secondary nodes of the compute cluster;
recording the assignment at the primary node and storing data mapping residential dwelling geolocations and network addresses to mobile device identifiers in a distributed file system of the compute cluster, wherein at least some of the mapping data is replicated on multiple secondary nodes and the assignment is based on a locality of geolocations in the network traffic logs; and
concurrently determining residential dwellings with the different secondary nodes of the computer cluster.

### Claim 39 (depends on 35)

The method of claim 35, wherein determining a residential dwelling geolocation of the respective individual comprises:
clustering the geolocations with a density based clustering algorithm; and
selecting a resulting cluster based on a measure of central tendency of time of day of timestamps associated with the clustered geolocations.

### Claim 40

A tangible, non-transitory, machine-readable medium storing instructions that when executed by one or more processors effectuate operations comprising:
obtaining, with one or more computer processors, one or more network traffic logs documenting communications via a network between one or more servers and more than 10,000 user computing devices, wherein:
at least some of the communications are associated with a respective timestamp and a device identifier of a respective user computing device among the more than 10,000 user computing devices, and
at least 1,000 of the user computing devices are mobile computing devices that emitted a respective geolocation of the respective mobile computing device stored in the network traffic logs;
for more than 1,000 individuals, matching a set of user computing devices comprising a respective plurality of the user computing devices to the respective individual, each set including at least one of the mobile computing devices, wherein matching comprises:
determining a residential dwelling geolocation of the respective individual, the residential dwelling being specified by both a network address and a residential geographic area of less than one square kilometer, at least some of the residential geographic areas being associated with a plurality of different residential dwelling geolocations of a plurality of different individuals, wherein determining the residential dwelling comprises clustering a plurality of geolocations emitted by the mobile computing device of the respective individual in both time and geographic space and distinguishing geolocations in the same residential geographic area by network address;
matching the respective mobile device to another of the user computing devices at least in part based on the matched devices sharing the network address of the residential dwelling in the network traffic logs; and
storing data associating the matching devices in a respective matching set having an identifier of the individual;
obtaining an indicator of content to be measured for effectiveness in driving place visits;
selecting from the network traffic logs records of network exchanges in which the indicator is present, the selected records indicating that the content was sent to one of the user computing devices, wherein more than 5,000 records are selected;
obtaining a device identifier from each of the selected records;
matching the obtained device identifiers to respective matching sets including the respective obtained identifier based on match scores, wherein:
each matching set corresponds to a set of user computing devices inferred to be used by a respective individual, and
each match score is based on a weighted combination of at least two of the following aspects: frequency of shared use of an Internet Protocol (IP) address between devices, an amount of fields in a User-Agent string of a Hypertext Transfer Protocol request that match between devices, a distance in temporal locality between devices, and frequency of shared use of an IP address between devices;
obtaining respective mobile device identifiers from the respective matching sets;
selecting from the network traffic logs records indicating communications from mobile computing devices identified by the obtained mobile device identifiers;
obtaining geolocations from the records indicating communications from the mobile computing devices identified by the obtained mobile device identifiers;
determining that a subset of the records indicating communications from the mobile computing devices have geolocations that correspond to at least one of a set of geographic areas for which visits are to be measured; and
determining an effectiveness of the content in driving visits to the geographic areas based the on subset of the records.

### Claim 41 (depends on 40)

The medium of claim 40, wherein matching the set of user computing devices comprises:
assigning, by a primary node of a compute cluster, different subsets of the network traffic logs to different secondary nodes of the compute cluster;
recording the assignment at the primary node and storing data mapping residential dwelling geolocations and network addresses to mobile device identifiers in a distributed file system of the compute cluster, wherein at least some of the mapping data is replicated on multiple secondary nodes and the assignment is based on a locality of geolocations in the network traffic logs; and
concurrently determining residential dwellings with the different secondary nodes of the computer cluster.

### Claim 42 (depends on 40)

The medium of claim 40, wherein the network traffic logs are obtained from a plurality of different servers, at least some of the servers populating the network traffic logs with records indicating sessions with a native mobile application of a first device and at least some of the servers populating network traffic logs with records indicating sessions with a desktop web browser executing on a second computing device different from the first computing device, the first computing device and the second computing device being in the same matching set, the content being sent to the second computing device, and a visit being detected based on a geolocation sensed by the first computing device.

### Claim 43 (depends on 40)

The medium of claim 40, wherein determining a residential dwelling geolocation of the respective individual comprises:
clustering the geolocations with a density based clustering algorithm; and
selecting a resulting cluster based on a measure of central tendency of time of day of timestamps associated with the clustered geolocations.