# US 2018/0027084 A1 · Network-Based Probabilistic Device Linking > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2018/0027084 A1 - Document ID: US20180027084A1 - Status: Published application - Kind: A1 - Application number: 15/214,303 - Filed: 2016-07-19 - Published: 2018-01-25 - Earliest claimed: 2016-07-19 - Assignees: Adobe Systems Incorporated - Applicants: Adobe Systems Incorporated - Inventors: Nedim Lipka; Eunyee Koh - Web page: https://patentgrep.com/patent/US20180027084A1 ## CPC - H04L 41/069: using logs of notifications; Post-processing of notifications - H04L 67/306: User profiles - H04L 67/52: specially adapted for the location of the user terminal - H04L 67/535: {Tracking the activity of the user (network monitoring arrangements H04L43/00; recording of computer activity G06F11/34)} - H04L 45/74: Address processing for routing - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Network-based probabilistic device linking techniques are described that link multiple devices associated with a common entity. In one example, log records are received from service providers including a device identifier and an IP address associated with a computing device that uses the service providers to access resources. The received log records are filtered and analyzed to identify connection frequencies between each device identifier and various IP addresses. Connection frequencies are scored and used to identify a subset of connections for computing linked devices belonging to a common entity, such as a single user, a household of users, users in a specific location, and so on. Linked devices are computed from the subset of selected connections and combined into linked device clusters. These linked device clusters can then be output so that market analysis can be performed on the linked device cluster rather than data pertaining to a single device. ## Claims ### Claim 1 In a digital medium environment to link computing devices associated with a common entity, a method implemented by a computing device, the method comprising: receiving, by the computing device and from at least one service provider, log records that include a plurality of IP addresses and a plurality of device identifiers used to access service provider resources; generating connection scores, by the computing device, for connections between individual ones of the plurality of IP addresses and individual ones of the plurality of device identifiers included in the received log records; selecting, by the computing device, a subset of connections between at least some of the plurality of IP addresses and at least some of the plurality of device identifiers based on the connection scores; identifying, by the computing device, device identifiers from the at least some of the plurality of device identifiers that are connected to similar ones of the at least some of the plurality of IP addresses to determine linked devices for at least one common entity; and outputting, by the computing device, at least one linked device cluster that includes the linked device identifiers for the at least one common entity. ### Claim 2 (depends on 1) A method as described in claim 1, further comprising removing at least some of the received log records for scoring connections between individual ones of the plurality of IP addresses and individual ones of the plurality of device identifiers. ### Claim 3 (depends on 1) A method as described in claim 1, wherein the at least one linked device cluster is output independent of ascertaining a username or a password for a user in the at least one common entity. ### Claim 4 (depends on 1) A method as described in claim 1, wherein said generating connection scores is based at least in part on a connection frequency between an IP address and a device identifier in the received log records during a specified timeframe. ### Claim 5 (depends on 1) A method as described in claim 1, wherein said generating connection scores comprises: identifying a service provider associated with a connected IP address and device identifier; assigning a scoring weight to the identified service provider; and generating a connection score based on the assigned scoring weight. ### Claim 6 (depends on 1) A method as described in claim 1, wherein said generating connection scores comprises: identifying a location associated with a connected IP address and device identifier; assigning a scoring weight to the identified location; and computing a connection score based on the assigned scoring weight. ### Claim 7 (depends on 6) A method as described in claim 6, wherein the location associated with the connected IP address and device identifier is identified based on one of HyperText Transfer Protocol (HTTP) header data, a network identifier, or a cookie included in the device identifier. ### Claim 8 (depends on 1) A method as described in claim 1, wherein said generating connection scores comprises: identifying a time associated with a connected IP address and device identifier; assigning a weight to the identified time; and computing a connection score based on the assigned scoring weight. ### Claim 9 (depends on 1) A method as described in claim 1, wherein said selecting the subset of connections comprises selecting a top-scored IP address connection for each of the plurality of device identifiers. ### Claim 10 (depends on 1) A method as described in claim 1, wherein said selecting the subset of connections comprises selecting a top-scored IP address connection for each service provider associated with a device identifier for each of the plurality of device identifiers. ### Claim 11 In a digital medium environment in which a computing device identifies linked devices based on device identifier and IP address connections, a computer-readable storage medium storing instructions that implement a filtering component which, responsive to execution by a computing device, perform improved device linking operations comprising: receiving a plurality of service provider log records, individual ones of the service provider log records identifying an IP address and a device identifier used to access a service provider resource; filtering the plurality of service provider log records by removing at least some of the plurality of service provider log records for computing linked devices from the plurality of service provider log records; and generating, from the filtered plurality of service provider log records, at least one linked device cluster including at least two of the device identifiers that are associated with a common entity. ### Claim 12 (depends on 11) A computer-readable storage medium as described in claim 11, wherein the common entity associated with the linked device cluster comprises at least a single user, a household of multiple users, a group of users in a common geolocation, multiple users of a corporation, or multiple users of an educational institution. ### Claim 13 (depends on 11) A computer-readable storage medium as described in claim 11, wherein said filtering the plurality of service provider log records comprises: identifying at least one of the plurality of service provider log records as corresponding to a computing device that is opted-out of device linking; and removing the at least one of the plurality of log records that correspond to the opted-out computing device. ### Claim 14 (depends on 11) A computer-readable storage medium as described in claim 11, wherein said filtering the plurality of service provider log records comprises: identifying a normal IP address frequency in the plurality of service provider log records; and removing service provider log records having an associated IP address that occurs more often than the normal IP address frequency. ### Claim 15 (depends on 11) A computer-readable storage medium as described in claim 11, wherein said filtering the plurality of service provider log records comprises: identifying a normal device identifier frequency in the plurality of service provider log records; and removing service provider log records having an associated device identifier that occurs more often than the normal device identifier frequency. ### Claim 16 (depends on 11) A computer-readable storage medium as described in claim 11, wherein said filtering the plurality of service provider log records comprises: receiving a blacklist of IP addresses; and removing one or more service provider log records having an associated IP addresses that is included in the blacklist of IP addresses. ### Claim 17 (depends on 11) A computer-readable storage medium as described in claim 11, wherein filtering the plurality of service provider log records comprises: identifying a device type of the device identifier included in individual ones of the plurality of service provider log records; and removing at least one service provider log record that is associated with a particular device type. ### Claim 18 (depends on 11) A computer-readable storage medium as described in claim 11, wherein said filtering the plurality of service provider log records comprises: identifying a connection time associated with each of the plurality of service provider log records; and removing one or more service provider log records having connection times within a specified range of connection times. ### Claim 19 (depends on 11) A computer-readable storage medium as described in claim 11, wherein said filtering the plurality of service provider log records comprises: identifying a location associated with each of the plurality of service provider log records; and removing one or more service provider log records that are associated with a specified location. ### Claim 20 In a digital medium environment to link computing devices associated with a common entity, a system comprising: a data storage module implemented at least partially in hardware to receive and store service provider log records that identify connections between device identifiers and IP addresses; a filtering module implemented at least partially in hardware to filter the received log records by removing at least one log record from the received log records; a connection scoring module implemented at least partially in hardware to compute a connection score between each connected IP address and device identifier in the filtered log records based on a connection frequency between the IP address and the device identifier over a specified period of time; a connection selection module implemented at least partially in hardware to select at least one IP address connection for each device identifier in the filtered log records based on the connection scoring module's computed connection scores; and a clustering module implemented at least partially in hardware to: identify linked devices among the device identifiers from the at least one selected IP address connection for each device identifier; and output linked devices in at least one linked device cluster.