Patent Publication Number: US-2022230078-A1

Title: Machine learning techniques for associating network addresses with information object access locations

Description:
RELATED APPLICATIONS 
     The present application is a continuation of U.S. application Ser. No. 16/163,283 filed Oct. 17, 2018, which is a continuation-in-part (CIP) of U.S. application Ser. No. 14/981,529 filed on Dec. 28, 2015, which is a CIP of U.S. application Ser. No. 14/498,056 filed Sep. 26, 2014 now issued as U.S. Pat. No. 9,940,634, the contents of each of which are hereby incorporated by reference in their entireties. 
    
    
     TECHNICAL FIELD 
     Embodiments described herein generally relate to machine learning (ML) and artificial intelligence (AI), and in particular, ML/AI techniques for associating network addresses with locations from which content and/or information objects is/are accessed. 
     BACKGROUND 
     Domain mapping services map domain names to different network addresses, and analytic services link IP-related analytic data with the associated domain names or business names. For example, a business intelligence company may use the IP-related analytic data to target different types of advertising content to different companies. 
     The same company may use multiple different network addresses (e.g., internet protocol (IP) or the like). Some of the network addresses may be used at private org locations and other network addresses may be used at public org locations. For example, a coffee company may use a first set of network addresses for corporate office locations and use a second set of network addresses for retail coffee shop locations. In a second example, an entertainment company may use a first set of network addresses at their corporate offices and use a second set of network addresses at their amusement parks or casinos. 
     Domain mapping services may only associate one domain name with all of the network addresses associated with a company and not distinguish between the private and public org locations. Analytic data derived from the coffee shops and amusement parks may not accurately indicate the interests of employees who work for the company at corporate office locations. Thus, analytics generated from IP related data may not accurately identify topics of interest to companies. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         FIG. 1  depicts an example content consumption monitor (CCM). 
         FIG. 2  depicts an example of the CCM in more detail. 
         FIG. 3  depicts an example operation of a CCM tag. 
         FIG. 4  depicts example events processed by the CCM. 
         FIG. 5  depicts an example user intent vector. 
         FIG. 6  depicts an example process for segmenting users. 
         FIG. 7  depicts an example process for generating organization (org) intent vectors. 
         FIG. 8  depicts an example consumption score generator. 
         FIG. 9  depicts the example consumption score generator in more detail. 
         FIG. 10  depicts an example process for identifying a surge in consumption scores. 
         FIG. 11  depicts an example process for calculating initial consumption scores. 
         FIG. 12  depicts an example process for adjusting the initial consumption scores based on historic baseline events. 
         FIG. 13  depicts an example process for mapping surge topics with contacts. 
         FIG. 14  depicts an example content consumption monitor calculating content intent. 
         FIG. 15  depicts an example process for adjusting a consumption score based on content intent. 
         FIG. 16  depicts an example network address classification system (NACS) according to various embodiments. 
         FIG. 17  depicts an example of the NACS of  FIG. 16  in more detail. 
         FIG. 18  depicts an example of how the content consumption monitor uses a network address entity map to generate consumption data. 
         FIG. 19  depicts an example feature dataset generated by the NACS. 
         FIG. 20  depicts an example process for generating the feature dataset in  FIG. 19 . 
         FIG. 21  depicts example organization features/characteristics (F ORG ) generated by the NACS. 
         FIG. 22  depicts an example computing system suitable for practicing various aspects of the various embodiments discussed herein. 
     
    
    
     DETAILED DESCRIPTION 
     Embodiments disclosed herein are related to network address location services, and in particular, to associating network addresses with the locations of organizations from which information objects are accessed. According to various embodiments, a network address classification system (NACS) uses various machine learning (ML) techniques to determine physical locations associated with network addresses. In embodiments, the NACS receives network session events (or simply “events”) identifying various aspects of accessing information objects such as how and when the information objects were accessed and/or various user interactions with the accessed information objects. The NACS determines network addresses associated with the events and associates the network addresses with locations where the users accessed the information objects. The NACS determines types of entities, organizations (orgs), and/or establishments associated with the network addresses based on the various aspects of the information objects access at the locations. 
     In some embodiments, the determined locations may be used by a content consumption monitor (CCM) to generate consumption scores for the network addresses more likely to be associated with specific locations. The NACS and/or the CCM may determine the establishment as a particular type of location when a particular percentage of the events, or a particular number of the events from a particular user, at a particular time of day, at a particular time of year, and/or using other criteria/parameters. In one example, the NACS and/or the CCM may determine the establishment to be a private org location when a particular percentage of the events, or a particular number of the events from a particular user, occur during normal business operating hours. This may distinguish the network address from public org locations, such as coffee shops or amusement parks, where users may view content at all hours of the day or view smaller amounts of content. 
     In another example, the NACS and/or the CCM may determine the establishment to be a private org location when a particular percentage of the users accessing content over a relative long period of time. This may indicate private org locations, such as corporate offices, where employees generally access content at the same network location for longer periods of time during work hours. In another example, the NACS and/or the CCM may determine the types of computing devices used for accessing content at the different network addresses. Network address locations where users mostly access content via smartphones may indicate public org locations, such as coffee shops and casinos, whereas network address locations where users mostly access content via desktop computers or workstations may indicate a private org location. 
     The embodiments discussed herein allow the CCM to generate more accurate intent data than existing/conventional solutions by distinguishing the locations or location types of various events, such as by distinguishing company events from general public or customer events. The CCM uses processing resources more efficiently by generating certain consumption scores only for business related intent data. The CCM may also provide more secure network analytics by generating consumption scores for network addresses without using personally identifiable information (PII), sensitive data, and/or confidential data, thereby improving information security for end-users. 
     The network address location predictions can be used to more efficiently process events, more accurately calculate consumption scores, and more accurately detect associated surges such as organization (org) surges (also referred to as “company surges” or the like). The more accurate intent data and consumptions scores allow third party service providers to conserve computational and network resources by providing a means for better targeting users so that unwanted and seemingly random content is not distributed to users that do not want such content. This is a technological improvement in that it conserves network and computational resources of organizations (orgs) that distribute this content by reducing the amount of content generated and sent to end-user devices. Network resources may be reduced and/or conserved at end-user devices by reducing or eliminating the need for using resources to receive unwanted content, and computational resources may be reduced and/or conserved at end-user devices by reducing or eliminating the need to implement spam filters and/or reducing the amount of data to be processed when analyzing and/or deleting such content. This amounts to an improvement in the technological fields of machine learning and location services, and also amounts to an improvement in the functioning of computing systems and computing networks themselves. 
     Furthermore, since the network address location predictions identify specific types of orgs associated with a particular network address and location, the NACS embodiments discussed herein can be used for other use cases such as, for example, network troubleshooting, anti-spam and anti-phishing technologies (e.g., for email systems and the like), cybersecurity threat detection and tracking, system/network monitoring and logging, network resource allocation and/or network appliance topology optimization, and/or the like. Other embodiments may be described and/or claimed. 
     1. Machine Learning Aspects 
     Machine learning (ML) involves programming computing systems to optimize a performance criterion using example (training) data and/or past experience. ML involves using algorithms to perform specific task(s) without using explicit instructions to perform the specific task(s), but instead relying on learnt patterns and/or inferences. ML uses statistics to build mathematical model(s) (also referred to as “ML models” or simply “models”) in order to make predictions or decisions based on sample data (e.g., training data). The model is defined to have a set of parameters, and learning is the execution of a computer program to optimize the parameters of the model using the training data or past experience. The trained model may be a predictive model that makes predictions based on an input dataset, a descriptive model that gains knowledge from an input dataset, or both predictive and descriptive. Once the model is learned (trained), it can be used to make inferences (e.g., predictions). 
     ML algorithms perform a training process on a training dataset to estimate an underlying ML model. An ML algorithm is a computer program that learns from experience with respect to some task(s) and some performance measure(s)/metric(s), and an ML model is an object or data structure created after an ML algorithm is trained with training data. In other words, the term “ML model” or “model” may describe the output of an ML algorithm that is trained with training data. After training, an ML model may be used to make predictions on new datasets. Additionally, separately trained AI/ML models can be chained together in a AI/ML pipeline during inference or prediction generation. Although the term “ML algorithm” refers to different concepts than the term “ML model,” these terms may be used interchangeably for the purposes of the present disclosure. 
     ML techniques generally fall into the following main types of learning problem categories: supervised learning, unsupervised learning, and reinforcement learning. Supervised learning is an ML task that aims to learn a mapping function from the input to the output, given a labeled data set. Supervised learning algorithms build models from a set of data that contains both the inputs and the desired outputs. For example, supervised learning may involve learning a function (model) that maps an input to an output based on example input-output pairs or some other form of labeled training data including a set of training examples. Each input-output pair includes an input object (e.g., a vector) and a desired output object or value (referred to as a “supervisory signal”). Supervised learning can be grouped into classification algorithms, regression algorithms, instance-based algorithms (e.g., k-nearest neighbor, and the like), decision tree Algorithms (e.g., Classification And Regression Tree (CART), Iterative Dichotomiser 3 (ID3), C4.5, chi-square automatic interaction detection (CHAID), etc.), Fuzzy Decision Tree (FDT), and the like), Support Vector Machines (SVM), Bayesian Algorithms (e.g., Bayesian network (BN), a dynamic BN (DBN), Naive Bayes, and the like), and ensemble algorithms (e.g., Extreme Gradient Boosting, voting ensemble, bootstrap aggregating (“bagging”), Random Forest and the like). 
     Classification involves determining the classes to which various data points belong. Here, “classes” are categories, and are sometimes called “targets” or “labels.” ML algorithms for classification may be referred to as a “classifier.” Examples of classifiers include linear classifiers, k-nearest neighbor (kNN), decision trees, random forests, support vector machines (SVMs), Bayesian classifiers, convolutional neural networks (CNNs), among many others (note that some of these algorithms can be used for other ML tasks as well). Classification is used when the outputs are restricted to a limited set of quantifiable properties. In other words, classification problems involve predicting a label whereas regression problems involve predicting a quantity. These quantifiable properties are referred to as “features.” In the context of ML, a feature is an individual measureable property or characteristic of a phenomenon being observed. Features are usually represented using numbers/numerals (e.g., integers), strings, variables, ordinals, real-values, categories, and/or the like. A set of features may be referred to as a “feature vector.” A vector is a tuple of one or more values called scalars, and a feature vector may include a tuple of one or more features. Classification algorithms may describe an individual (data) instance whose category is to be predicted using a feature vector. As an example, when the instance includes a collection (corpus) of text, each feature in a feature vector may be the frequency that specific words appear in the corpus of text. In ML classification, labels are assigned to instances, and models are trained to correctly predict the pre-assigned labels of from the training examples. 
     Regression analysis is a set of statistical processes for estimating the relationships between a dependent variable (often referred to as the “outcome variable”) and one or more independent variables (often referred to as “predictors”, “covariates”, or “features”). One type of regression algorithm/model is linear regression. Linear regression is one type of supervised ML algorithm that uses a linear approach to modelling the relationship between a scalar response and one or more explanatory variables (also known as dependent and independent variables). In linear regression, the relationships are modeled using linear predictor functions whose unknown model parameters are estimated from the data. Gradient descent (GD) and/or stochastic GD (SGD) algorithms are often used to estimate linear regression models. GD/SGD is an optimization algorithm used to train ML algorithms/models including artificial NNs used in deep learning. Here “optimization” refers to a type of searching (or “learning”) process. In GD, the “gradient” refers to the calculation of an error gradient or slope of error and the “descent” refers to iteratively moving toward a set of parameter values that minimize the function (or moves down along the gradient or slope towards some minimum level of error). The iterative nature of GD/SGD means that the search process occurs over multiple discrete steps, and each step should improve the model parameters. Each step involves using the model with a current set of internal parameters to make predictions on some samples, comparing the predictions to the real expected outcomes, calculating the error, and using the error to update the internal model parameters. Here, a “sample” is some set of data, and may be referred to as an instance, an observation, an input vector, or a feature vector. In GD, the model/algorithm is updated iteratively, where several passes can be made over the dataset (e.g., training data) until the algorithm converges. One complete pass through the training dataset is referred to as an “epoch”, and the number of epochs is a hyperparameter that controls the number of complete passes through the training dataset. Logistic regression is an ML model for binary classification predictive modeling. Logistic regression is used to describe data and to explain the relationship between one dependent binary variable and one or more nominal, ordinal, interval or ratio-level independent variables. 
     Ensemble learning is an ML technique that uses multiple learning algorithms to obtain better predictive performance than could be obtained from any of the constituent learning algorithms alone. An ML ensemble usually includes a concrete finite set of alternative models, but typically allows for much more flexible structure to exist among those alternatives. As alluded to previously, supervised learning involves searching through a hypothesis space to find a suitable hypothesis that will make good predictions with a particular problem. Ensembles combine multiple hypotheses to form a potentially better hypothesis. The term “ensemble” is usually reserved for methods that generate multiple hypotheses using the same base learner, whereas the term “multiple classifier” or “multiclass classification” systems also covers hybridization of hypotheses that are not induced by the same base learner. Outputs of individual models that are used as inputs of ensemble models are referred to as “base learners” or “base models”. A base learner is usually generated from training data by a base learning algorithm which can be decision tree, neural network or other kinds of machine learning algorithms Each base model can be created using different sets of the same training dataset and the same algorithms, using the same dataset with different ML algorithms, or any other method or combination thereof. 
     One example of an ensemble model is the Random Forest algorithm, which combines multiple decision trees and aggregates their predictions using a majority vote in case of a classification problem or by taking the average for regression tasks. Another example is the voting ensemble, which estimates multiple base models and uses voting to combine the individual predictions to arrive at the final prediction(s). The multiple base models can be different from one another, for example, a decision tree model and a logistic regression model can be trained separately, and then the voting ensemble can be used to combine the results. Majority voting involves each base model makes a prediction (e.g., “votes”) for each test instance and the final output prediction is the one that receives more than half of the votes and receives the most votes. Plurality voting can be used, where the prediction that receives the most votes is used even if that prediction does not receive more than 50% of the votes. In majority voting, each model has the same voting weight. In weighted voting, the importance of one or more of the base models can be increased or decreased using one or more weight factors. The weight factors may be selected based on design choice, using an optimization algorithm, or the like 
     Another type of ensemble learning includes Bayes optimal classifier, which is a classification technique and an ensemble of all the hypotheses in the hypothesis space. Each hypothesis is given a vote proportional to the likelihood that the training dataset would be sampled from a system if that hypothesis were true. To facilitate training data of finite size, the vote of each hypothesis is also multiplied by the prior probability of that hypothesis. Another type of ensemble learning is bootstrap aggregating (also referred to as “bagging”), which involves having each model in the ensemble vote with equal weight. In order to promote model variance, bagging trains each model in the ensemble using a randomly drawn subset of the training set. In one example, a random forest algorithm can be used to combine random decision trees with bagging to achieve very high classification accuracy. Ensemble techniques may also be used for unsupervised learning such as, for example, in consensus clustering. 
     Unsupervised learning is an ML task that aims to learn a function to describe a hidden structure from unlabeled data. Unsupervised learning algorithms build models from a set of data that contains only inputs and no desired output labels. Unsupervised learning algorithms are used to find structure in the data, like grouping or clustering of data points. Some examples of unsupervised learning are K-means clustering and principal component analysis (PCA). Semi-supervised learning algorithms develop ML models from incomplete training data, where a portion of the sample input does not include labels. 
     Neural networks (NNs) are usually used for supervised learning, but can be used for unsupervised learning as well. Examples of NNs include deep NN (DNN), feed forward NN (FFN), a deep FNN (DFF), convolutional NN (CNN), deep CNN (DCN), deconvolutional NN (DNN), a deep belief NN, a perception NN, recurrent NN (RNN) (e.g., including Long Short Term Memory (LSTM) algorithm, gated recurrent unit (GRU), etc.), deep stacking network (DSN). 
     Reinforcement learning (RL) is a goal-oriented learning based on interaction with environment. In RL, an agent aims to optimize a long-term objective by interacting with the environment based on a trial and error process. Examples of RL algorithms include Markov decision process, Markov chain, Q-learning, multi-armed bandit learning, and deep RL. 
     ML may require, among other things, obtaining and cleaning a dataset, performing feature selection, selecting an ML algorithm, dividing the dataset into training data and testing data, training a model (e.g., using the selected ML algorithm), testing the model, optimizing or tuning the model, and determining metrics for the model. Some of these tasks may be optional or omitted depending on the use case and/or the implementation used. ML algorithms accept parameters and/or hyperparameters (collectively referred to herein as “training parameters,” “model parameters,” or simply “parameters” herein) that can be used to control certain properties of the training process and the resulting model. Parameters are characteristics or properties of the training process that are learnt during training. Model parameters may differ for individual experiments and may depend on the type of data and ML tasks being performed. Hyperparameters are characteristics, properties, or parameters for a training process that cannot be learnt during the training process and are set before training takes place. The particular values selected for the parameters and/or hyperparameters affect the training speed, training resource consumption, and the quality of the learning process. As examples for topic classification and/or natural language processing (NLP) tasks, model parameters may include word frequency, sentence length, noun or verb distribution per sentence, the number of specific character n-grams per word, lexical diversity, constraints, weights, and the like. Examples of hyperparameters may include model size (e.g., in terms of memory space or bytes), whether (and how much) to shuffle the training data, the number of evaluation instances or epochs (e.g., a number of iterations or passes over the training data), learning rate (e.g., the speed at which the algorithm reaches (converges to) the optimal weights), learning rate decay (or weight decay), the number and size of the hidden layers, weight initialization scheme, dropout and gradient clipping thresholds, and the like. In embodiments, the parameters and/or hyperparameters may additionally or alternatively include vector size and/or word vector size. 
     2. Content Consumption Monitor Embodiments 
       FIG. 1  depicts a content consumption monitor (CCM)  100 . CCM  100  includes one or more physical and/or virtualized systems that communicates with a service provider  118  and monitors user accesses to information object(s)  112  (e.g., third party content and/or the like). The physical and/or virtualized systems include one or more logically or physically connected servers and/or data storage devices distributed locally or across one or more geographic locations. In some implementations, the CCM  100  may be provided by (or operated by) a cloud computing service and/or a cluster of machines in a datacenter. In some implementations, the CCM  100  may be a distributed application provided by (or operated by) various servers of a content delivery network (CDN) or edge computing network. Other implementations are possible in other embodiments. 
     Service provider  118  (also referred to as a “publisher,” “B2B publisher,” or the like) comprises one or more physical and/or virtualized computing systems owned and/or operated by a company, enterprise, and/or individual that wants to send information object(s)  114  to an interested group of users, which may include targeted content or the like. This group of users is alternatively referred to as “contact segment  124 .” The physical and/or virtualized systems include one or more logically or physically connected servers and/or data storage devices distributed locally or across one or more geographic locations. Generally, the service provider  118  uses IP/network resources to provide information objects such as electronic documents, webpages, forms, applications (e.g., web apps), data, services, web services, media, and/or content to different user/client devices. As examples, the service provider  118  may provide search engine services; social networking, microblogging, and/or message board services; content (media) streaming services; e-commerce services; blockchain services; communication services such as Voice-over-Internet Protocol (VoIP) sessions, text messaging, group communication sessions, and the like; immersive gaming experiences; and/or other like services. The user/client devices that utilize services provided by service provider  118  may be referred to as “subscribers” or the like. Although  FIG. 1  shows only a single service provider  118 , the service provider  118  may represent multiple service providers  118 , each of which may have their own subscribing users. 
     In one example, service provider  118  may be a company that sells electric cars. Service provider  118  may have a contact list  120  of email addresses for customers that have attended prior seminars or have registered on the service provider&#39;s  118  website. Contact list  120  may also be generated by CCM tags  110  that are described in more detail below. Service provider  118  may also generate contact list  120  from lead lists provided by third parties lead services, retail outlets, and/or other promotions or points of sale, or the like or any combination thereof. Service provider  118  may want to send email announcements for an upcoming electric car seminar Service provider  118  would like to increase the number of attendees at the seminar. In another example, service provider  118  may be a platform or service provider that offers a variety of user targeting services to their subscribers such as sales enablement, digital advertising, content/engagement marketing, and marketing automation, among others. 
     The information objects  112  comprise any data structure including or indicating information on any subject accessed by any user. The information objects  112  may include any type of information object (or collection of information objects). Information objects  112  may include electronic documents, database objects, electronic files, resources, and/or any data structure that includes one or more data elements, each of which may include one or more data values and/or content items. 
     In some implementations, the information objects  112  may include webpages provided on (or served) by one or more webservers operated by different service provides, businesses, and/or individuals. For example, information objects  112  may come from different websites operated by on-line retailers and wholesalers, on-line newspapers, universities, blogs, municipalities, social media sites, or any other entity that supplies content. information objects  112  may also include information not accessed directly from websites. For example, users may access registration information at seminars, retail stores, and other events. Information objects  112  may also include content provided by service provider  118 . 
     Computers and/or servers associated with service provider  118 , content segment  124 , and CCM  100  may communicate over the Internet or any other wired or wireless network including local area networks (LANs), wide area networks (WANs), wireless networks, cellular networks, WiFi networks, Personal Area Networks (e.g., Bluetooth® and/or the like), Digital Subscriber Line (DSL) and/or cable networks, and/or the like, and/or any combination thereof. 
     Some of information objects  112  contain CCM tags  110  that capture and send network session events  108  (or simply “events  108 ”) to CCM  100 . For example, CCM tags  110  may comprise JavaScript added to webpages of a website (or individual components of a web app or the like). The website downloads the webpages, along with CCM tags  110 , to user computers (e.g., computer  230  of  FIG. 2 ). CCM tags  110  monitor network sessions (or web sessions) and sends some or all captured session events  108  to CCM  100 . 
     In one example, the CCM tags  110  may intercept or otherwise obtain HTTP messages being sent by and/or sent to a computer  230 , and these HTTP messages may be provided to the CCM  100  as the events  108 . In this example, the CCM tags  110  or the CCM  100  may extract or otherwise obtain a network address of the computer  230  from an X-Forwarded-For (XFF) field of the HTTP header, a time and date that the HTTP message was sent from a Date field of the HTTP header, and/or a user agent string contained in a User Agent field of an HTTP header of the HTTP message. The user agent string may indicate the operating system (OS) type/version of the sending device (e.g., a computer  230 ); system information of the sending device (e.g., a computer  230 ); browser version/type of the sending device (e.g., a computer  230 ); rendering engine version/type of the sending device (e.g., a computer  230 ); a device type of the of the sending device (e.g., a computer  230 ), as well as other information. In another example, the CCM tags  110  may derive various information from the computer  230  that is not typically included in an HTTP header, such as time zone information, GPS coordinates, screen or display resolution of the computer  230 , data from one or more applications operated by the computer  230 , and/or other like information. In various implementations, the CCM tags  110  may generate and send events  108  or messages based on the monitored network session. For example, the CCM tags  110  may obtain data when various events/triggers are detected, and may send back information (e.g., in additional HTTP messages). Other methods may be used to obtain or derive user information. 
     In some implementations, the information objects  112  that include CCM tags  110  may be provided or hosted by a collection of service providers  118  such as, for example, notable business-to-business (B2B) publishers, marketers, agencies, technology providers, research firms, events firms, and/or any other desired entity/org type. This collection of service providers  118  may be referred to as a “data cooperative” or “data co-op.” Additionally or alternatively, events  108  may be collected by one or more other data tracking entities separate from the CCM  100 , and provided as one or more datasets to the CCM  100  (e.g., a “bulk” dataset or the like). 
     Events  108  may identify information objects  112  and identify the user accessing information objects  112 . For example, event  108  may include a URL link to information objects  112  and may include a hashed user email address or cookie identifier (ID) associated with the user that accessed information objects  112 . Events  108  may also identify an access activity associated with information objects  112 . For example, an event  108  may indicate the user viewed a webpage, downloaded an electronic document, or registered for a seminar. Additionally or alternatively, events  108  may identify various user interactions with information objects  112  such as, for example, topic consumption, scroll velocity, dwell time, and/or other user interactions such as those discussed herein. In one example, the tags  110  may collect anonymized information about a visiting user&#39;s network address (e.g., IP address), an anonymized cookie ID, a timestamp of when the user visited or accessed an information object  112 , and/or geo-location information associated with the user&#39;s computing device. In some embodiments, device fingerprinting can be used to track users, while in other embodiments, device fingerprinting may be excluded to preserver user anonymity. 
     CCM  100  builds user profiles  104  from events  108 . User profiles  104  may include anonymous identifiers  105  that associate information objects  112  with particular users. User profiles  104  may also include intent data  106 . Intent data  106  includes or indicates insights into users&#39; interests and may include predictions about their potential to take certain actions based on their content consumption. The intent data  106  identifies or indicates topics  102  in information objects  112  accessed by the users. For example, intent data  106  may comprise a user intent vector that identifies the topics  102  and identifies levels of user interest in the topics  102 . 
     This approach to intent data  106  collection makes possible a consistent and stable historical baseline for measuring content consumption. This baseline effectively spans the web, delivering at an exponential scale greater than any one site. In embodiments, the CCM  100  monitors content consumption behavior from a collection of service providers  118  (e.g., the aforementioned data co-op) and applies data science and/or ML techniques to identify changes in activity compared to the historical baselines. As examples, research frequency, depth of engagement, and content relevancy all contribute to measuring an org&#39;s interest in topic(s)  102 . In some embodiments, the CCM  100  may employ a natural language processing (NLP) engine that reads, deciphers, and understands content across a taxonomy of intent topics  102  that grows on a periodic basis (e.g., monthly). 
     As mentioned previously, service provider  118  may want to send an email announcing an electric car seminar to a particular contact segment  124  of users interested in electric cars. Service provider  118  may send information object(s)  114 , such as the aforementioned email to CCM  100 , and the CCM  100  identifies topics  102  in information object(s)  114 . The CCM  100  compares content topics  102  with the intent data  106 , and identifies user profiles  104  that indicate an interest in information object(s)  114 . Then, the CCM  100  sends an anonymous contact segment  116  to service provider  118 , which includes anonymized or pseudonymized identifiers  105  associated with the identified user profiles  104 . In some embodiments, the CCM  100  includes an anonymizer or pseudonymizer, which is the same or similar to anonymizer  122 , to anonymize or pseudonymize user identifiers. 
     Contact list  120  may include personally identifying information (PII) and/or personal data such as email addresses, names, phone numbers, or some other user identifier(s), or any combination thereof. Additionally or alternatively, the contact list  120  may include sensitive data and/or confidential information. The personal, sensitive, and/or confidential data in contact list  120  are anonymized or pseudonymized or otherwise de-identified by an anonymizer  122 . 
     The anonymizer  122  may anonymize or pseudonymize any personal, sensitive, and/or confidential data using any number of data anonymization or pseudonymization techniques including, for example, data encryption, substitution, shuffling, number and date variance, and nulling out specific fields or data sets. Data encryption is an anonymization or pseudonymization technique that replaces personal/sensitive/confidential data with encrypted data. A suitable hash algorithm may be used as an anonymization or pseudonymization technique in some embodiments. Anonymization is a type of information sanitization technique that removes personal, sensitive, and/or confidential data from data or datasets so that the person or information described or indicated by the data/datasets remain anonymous. Pseudonymization is a data management and de-identification procedure by which personal, sensitive, and/or confidential data within information objects (e.g., fields and/or records, data elements, documents, etc.) is/are replaced by one or more artificial identifiers, or pseudonyms. In most pseudonymization mechanisms, a single pseudonym is provided for each replaced data item or a collection of replaced data items, which makes the data less identifiable while remaining suitable for data analysis and data processing. Although “anonymization” and “pseudonymization” refer to different concepts, these terms may be used interchangeably throughout the present disclosure. 
     The service provider  118  compares the anonymized/pseudonymized identifiers (e.g., hashed identifiers) from contact list  120  with the anonymous identifiers  105  in anonymous contact segment  116 . Any matching identifiers are identified as contact segment  124 . Service provider  118  identifies the unencrypted email addresses in contact list  120  associated with contact segment  124 . Service provider  118  sends information object(s)  114  to the addresses (e.g., email addresses) identified for contact segment  124 . For example, service provider  118  may send an email announcing the electric car seminar to contact segment  124 . 
     Sending information object(s)  114  to contact segment  124  may generate a substantial lift in the number of positive responses  126 . For example, assume service provider  118  wants to send emails announcing early bird specials for the upcoming seminar. The seminar may include ten different tracks, such as electric cars, environmental issues, renewable energy, etc. In the past, service provider  118  may have sent ten different emails for each separate track to everyone in contact list  120 . 
     Service provider  118  may now only send the email regarding the electric car track to contacts identified in contact segment  124 . The number of positive responses  126  registering for the electric car track of the seminar may substantially increase since content  114  is now directed to users interested in electric cars. 
     In another example, CCM  100  may provide local ad campaign or email segmentation. For example, CCM  100  may provide a “yes” or “no” as to whether a particular advertisement should be shown to a particular user. In this example, CCM  100  may use the hashed data without re-identification of users and the “yes/no” action recommendation may key off of a de-identified hash value. 
     CCM  100  may revitalize cold contacts in service provider contact list  120 . CCM  100  can identify the users in contact list  120  that are currently accessing other information objects  112  and identify the topics associated with information objects  112 . By monitoring accesses to information objects  112 , CCM  100  may identify current user interests even though those interests may not align with the content currently provided by service provider  118 . Service provider  118  might reengage the cold contacts by providing content  114  more aligned with the most relevant topics identified in information objects  112 . 
       FIG. 2  is a diagram explaining the content consumption manager in more detail. A user may enter a search query  232  into a computer  230 , for example, via a search engine. The computer  230  may include any communication and/or processing device including but not limited to desktop computers, workstations, laptop computers, smartphones, tablet computers, wearable devices, servers, smart appliances, network appliances, and/or the like, or any combination thereof. The user may work for an organization Y (org_Y). For example, the user may have an associated email address: user@org_y.com. 
     In response to search query  232 , the search engine may display links or other references to information objects  112 A and  112 B on website1 and website2, respectively (note that website1 and website2 may also be respective information objects  112  or collections of information objects  112 ). The user may click on the link to website1, and website1 may download a webpage to a client app operated by computer  230  that includes a link to information object  112 A, which may be a white paper in this example. Website1 may include one or more webpages with CCM tags  110 A that capture different events  108  during a network session (or web session) between website1 and computer  230  (or between website1 and the client app operated by computer  230 ). Website1 or another website may have downloaded a cookie onto a web browser operating on computer  230 . The cookie may comprise an identifier X, such as a unique alphanumeric set of characters associated with the web browser on computer  230 . 
     During the session with website1, the user of computer  230  may click on a link to white paper  112 A. In response to the mouse click, CCM tag  110 A may download an event  108 A to CCM  100 . Event  108 A may identify the cookie identifier X loaded on the web browser of computer  230 . In addition, or alternatively, CCM tag  110 A may capture a user name and/or email address entered into one or more webpage fields during the session. CCM tag  110  hashes the email address and includes the hashed email address in event  108 A. Any identifier associated with the user is referred to generally as user X or user ID. 
     CCM tag  110 A may also include a link in event  108 A to the white paper downloaded from website1 to computer  230 . For example, CCM tag  110 A may capture the URL for white paper  112 A. CCM tag  110 A may also include an event type identifier in event  108 A that identifies an action or activity associated with information object  112 A. For example, CCM tag  110 A may insert an event type identifier into event  108 A that indicates the user downloaded an electric document. 
     CCM tag  110 A may also identify the launching platform for accessing information object  112 B. For example, CCM tag  110 B may identify a link www.searchengine.com to the search engine used for accessing website1. 
     An event profiler  240  in CCM  100  forwards the URL identified in event  108 A to a content analyzer  242 . Content analyzer  242  generates a set of topics  236  associated with or suggested by white paper  112 A. For example, topics  236  may include electric cars, cars, smart cars, electric batteries, etc. Each topic  236  may have an associated relevancy score indicating the relevancy of the topic in white paper  112 A. Content analyzers that identify topics in documents are known to those skilled in the art and are therefore not described in further detail. 
     Event profiler  240  forwards the user ID, topics  236 , event type, and any other data from event  108 A to event processor  244 . Event processor  244  may store personal information captured in event  108 A in a personal database  248 . For example, during the session with website1, the user may have entered an employer company name into a webpage form field. CCM tag  110 A may copy the employer company name into event  108 A. Alternatively, CCM  100  may identify the company name from a domain name of the user email address. 
     Event processor  244  may store other demographic information from event  108 A in personal database  248 , such as user job title, age, sex, geographic location (postal address), etc. In one example, some of the information in personal database  248  is hashed, such as the user ID and or any other personally identifiable information. Other information in personal database  248  may be anonymous to any specific user, such as org name and job title. 
     Event processor  244  builds a user intent vector  145  from topic vectors  236 . Event processor  244  continuously updates user intent vector  145  based on other received events  108 . For example, the search engine may display a second link to website2 in response to search query  132 . User X may click on the second link and website2 may download a webpage to computer  230  announcing the seminar on electric cars. 
     The webpage downloaded by website2 may also include a CCM tag  110 B. User X may register for the seminar during the session with website2. CCM tag  110 B may generate a second event  108 B that includes the user ID: X, a URL link to the webpage announcing the seminar, and an event type indicating the user registered for the electric car seminar advertised on the webpage. 
     CCM tag  110 B sends event  108 B to CCM  100 . Content analyzer  242  generates a second set of topics  236 . Event  108 B may contain additional personal information associated with user X. Event processor  244  may add the additional personal information to personal database  248 . 
     Event processor  244  updates user intent vector  145  based on the second set of topics  236  identified for event  108 B. Event processor  244  may add new topics to user intent vector  145  or may change the relevancy scores for existing topics. For example, topics identified in both event  108 A and  108 B may be assigned higher relevancy scores. Event processor  244  may also adjust relevancy scores based on the associated event type identified in events  108 . 
     Service provider  118  may submit a search query  254  to CCM  100  via a user interface  252  on a computer  255 . For example, search query  254  may ask “who is interested in buying electric cars?” A transporter  250  in CCM  100  searches user intent vectors  145  for electric car topics with high relevancy scores. Transporter  250  may identify user intent vector  145  for user X. Transporter  250  identifies user X and other users A, B, and C interested in electric cars in search results  156 . 
     As mentioned above, the user IDs may be hashed and CCM  100  may not know the actual identities of users X, A, B, and C. CCM  100  may provide a segment of hashed user IDs X, A, B, and C to service provider  118  in response to query  254 . 
     Service provider  118  may have a contact list  120  of users (see e.g.,  FIG. 1 ). Service provider  118  may hash email addresses in contact list  120  and compare the hashed identifiers with the encrypted or hashed user IDs X, A, B, and C. Service provider  118  identifies the unencrypted email address for matching user identifiers. Service provider  118  then sends information related to electric cars to the email addresses of the identified user segment. For example, service provider  118  may send emails containing white papers, advertisements, articles, announcements, seminar notifications, or the like, or any combination thereof. 
     CCM  100  may provide other information in response to search query  254 . For example, event processor  244  may aggregate user intent vectors  145  for users employed by the same company Y into a company intent vector. The company intent vector for org Y may indicate a strong interest in electric cars. Accordingly, CCM  100  may identify org Y in search results  156 . By aggregating user intent vectors  145 , CCM  100  can identify the intent of a company or other category without disclosing any specific user personal information (e.g., without regarding a user&#39;s online browsing activity). 
     CCM  100  continuously receives events  108  for different third party content. Event processor  244  may aggregate events  108  for a particular time period, such as for a current day, for the past week, or for the past 30 days. Event processor  244  then may identify trending topics  158  within that particular time period. For example, event processor  244  may identify the topics with the highest average relevancy values over the last 30 days. 
     Different filters  259  may be applied to the intent data stored in event database  246 . For example, filters  259  may direct event processor  244  to identify users in a particular company Y that are interested in electric cars. In another example, filters  259  may direct event processor  244  to identify companies with less than 200 employees that are interested in electric cars. 
     Filters  259  may also direct event processor  244  to identify users with a particular job title that are interested in electric cars or identify users in a particular city that are interested in electric cars. CCM  100  may use any demographic information in personal database  248  for filtering query  254 . 
     CCM  100  monitors content accessed from multiple different third party websites. This allows CCM  100  to better identify the current intent for a wider variety of users, companies, or any other demographics. CCM  100  may use hashed and/or other anonymous identifiers to maintain user privacy. CCM  100  further maintains user anonymity by identifying the intent of generic user segments, such as companies, marketing groups, geographic locations, or any other user demographics. 
       FIG. 3  depicts example operations performed by CCM tags  110  according to various embodiments. In operation  370 , a service provider  118  provides a list of form fields  374  for monitoring on webpages  376 . In operation  372 , CCM tags  110  are generated and loaded in webpages  376  on the service provider&#39;s  118  website. For example, CCM tag  110 A is loaded onto a first webpage  376 A of the service provider&#39;s  118  website and a CCM tag  110 B is loaded onto a second webpage  376 B of the service provider&#39;s  118  website. In one example, CCM tags  110  comprise JavaScript loaded into the webpage document object model (DOM). 
     The service provider  118  may download webpages  376 , along with CCM tags  110 , to user computers (e.g., computer  230  of  FIG. 2 ) during sessions. Additionally or alternatively, the CCM tags  110  may be executed when the user computers access and/or load the webpages  376  (e.g., within a browser, mobile app, or other client application). CCM tag  110 A captures the data entered into some of form fields  374 A and CCM tag  110 B captures data entered into some of form fields  374 B. 
     A user enters information into form fields  374 A and  374 B during the session. For example, the user may enter an email address into one of form fields  374 A during a user registration process or a shopping cart checkout process. CCM tags  110  may capture the email address in operation  378 , validate and hash the email address, and then send the hashed email address to CCM  100  in event  108 . 
     CCM tags  110  may first confirm the email address includes a valid domain syntax and then use a hash algorithm to encode the valid email address string. CCM tags  110  may also capture other anonymous user identifiers, such as a cookie identifier. If no identifiers exist, CCM tag  110  may create a unique identifier. Other data may be captured as well, such as client app data, data mined from other applications, and/or other data from the user computers. 
     CCM tags  110  may capture any information entered into fields  374 . For example, CCM tags  110  may also capture user demographic data, such as organization (org) name, age, sex, postal address, etc. In one example, CCM tags  110  capture some the information for service provider contact list  120 . 
     CCM tags  110  may also identify information object  112  and associated event activities in operation  378 . For example, CCM tag  110 A may detect a user downloading the white paper  112 A or registering for a seminar (e.g., through an online form or the like hosted by website1 or some other website or web app). CCM tag  110 A captures the URL for white paper  112 A and generates an event type identifier that identifies the event as a document download. 
     Depending on the application, CCM tag  110  in operation  378  sends the captured web session information in event  108  to service provider  118  and/or to CCM  100 . For example, event  108  is sent to service provider  118  when CCM tag  110  is used for generating service provider contact list  120 . In another example, the event  108  is sent to CCM  100  when CCM tag  110  is used for generating intent data. 
     CCM tags  110  may capture session information in response to the user leaving webpage  376 , existing one of form fields  374 , selecting a submit icon, mousing out of one of form fields  374 , mouse clicks, an off focus, and/or any other user action. Note again that CCM  100  might never receive personally identifiable information (PII) since any PII data in event  108  is hashed by CCM tag  110 . 
       FIG. 4  is a diagram showing how the CCM generates intent data  106  according to various embodiments. As mentioned previously, a CCM tag  110  may send a captured raw event  108  to CCM  100 . For example, the CCM tag  110  may send event  108  to CCM  100  in response to a user downloading a white paper. Event  108  may include a timestamp indicating when the white paper was downloaded, an identifier (ID) for event  108 , a user ID associated with the user that downloaded the white paper, a URL for the downloaded white paper, and a network address for the launching platform for the content. Event  108  may also include an event type indicating the user downloaded an electronic document. 
     Event profiler  240  and event processor  244  may generate intent data  106  from one or more events  108 . Intent data  106  may be stored in a structured query language (SQL) database or non-SQL database. In one example, intent data  106  is stored in user profile  104 A and includes a user ID  452  and associated event data  454 . 
     Event data  454 A is associated with a user downloading a white paper. Event profiler  240  identifies a car topic  462  and a fuel efficiency topic  462  in the white paper. Event profiler  240  may assign a 0.5 relevancy value to the car topic and assign a 0.6 relevancy value to the fuel efficiency topic  462 . 
     Event processor  244  may assign a weight value  464  to event data  454 A. Event processor  244  may assign larger a weight value  264  to more assertive events, such as downloading the white paper. Event processor  244  may assign a smaller weight value  464  to less assertive events, such as viewing a webpage. Event processor  244  may assign other weight values  464  for viewing or downloading different types of media, such as downloading a text, video, audio, electronic books, on-line magazines and newspapers, etc. 
     CCM  100  may receive a second event  108  for a second piece of content accessed by the same user. CCM  100  generates and stores event data  454 B for the second event  108  in user profile  104 A. Event profiler  240  may identify a first car topic with a relevancy value of 0.4 and identify a second cloud computing topic with a relevancy value of 0.8 for the content associated with event data  454 B. Event processor  244  may assign a weight value of 0.2 to event data  454 B. 
     CCM  100  may receive a third event  108  for a third piece of content accessed by the same user. CCM  100  generates and stores event data  454 C for the third event  108  in user profile  104 A. Event profiler  240  identifies a first topic associated with electric cars with a relevancy value of 1.2 and identifies a second topic associated with batteries with a relevancy value of 0.8. Event processor  244  may assign a weight value of 0.4 to event data  454 C. 
     Event data  454  and associated weighting values  264  may provide a better indicator of user interests/intent. For example, a user may complete forms on a service provider website indicating an interest in cloud computing. However, CCM  100  may receive events  108  for third party content accessed by the same user. Events  108  may indicate the user downloaded a whitepaper discussing electric cars and registered for a seminar related to electric cars. 
     CCM  100  generates intent data  106  based on received events  108 . Relevancy values  466  in combination with weighting values  464  may indicate the user is highly interested in electric cars. Even though the user indicated an interest in cloud computing on the service provider website, CCM  100  determined from the third party content that the user was actually more interested in electric cars. 
     CCM  100  may store other personal user information from events  108  in user profile  104 B. For example, event processor  244  may store third party identifiers  460  and attributes  462  associated with user ID  452 . Third party identifiers  460  may include user names or any other identifiers used by third parties for identifying user  452 . Attributes  462  may include an org name (e.g., employer company name), org size, country, job title, hashed domain name, and/or hashed email addresses associated with user ID  452 . Attributes  462  may be combined from different events  108  received from different websites accessed by the user. CCM  100  may also obtain different demographic data in user profile  104  from third party data sources (whether sourced online or offline). 
     An aggregator may use user profile  104  to update and/or aggregate intent data for different segments, such as service provider contact lists, companies, job titles, etc. The aggregator may also create snapshots of intent data  106  for selected time periods. 
     Event processor  244  may generate intent data  106  for both known and unknown users. For example, the user may access a webpage and enter an email address into a form field in the webpage. A CCM tag  110  captures and hashes the email address and associates the hashed email address with user ID  452 . 
     The user may not enter an email address into a form field. Alternatively, the CCM tag  110  may capture an anonymous cookie ID in event  108 . Event processor  244  then associates the cookie ID with user identifier  452 . The user may clear the cookie or access data on a different computer. Event processor  244  may generate a different user identifier  452  and new intent data  106  for the same user. 
     The cookie ID may be used to create a de-identified cookie data set. The de-identified cookie data set then may be integrated with ad platforms or used for identifying destinations for target advertising. 
     CCM  100  may separately analyze intent data  106  for the different anonymous user IDs. If the user ever fills out a form providing an email address, event processor then may re-associate the different intent data  106  with the same user identifier  452 . 
       FIG. 5  depicts an example of how the CCM  100  generates a user intent vector from the event data described previously in  FIG. 4 . A user may use computer  530  (which may be the same or similar to the computer  230  of  FIG. 2 ) to access different information objects  582  (including information objects  582 A,  582 B, and  582 C). For example, the user may download a white paper  282 A associated with storage virtualization, register for a network security seminar on a webpage  582 B, and view a webpage article  582 C related to virtual private networks (VPNs). As examples, information objects  582 A,  582 B, and  582 C may come from the same website or come from different websites. 
     The CCM tags  110  capture three events  584 A,  584 B, and  584 C associated with information objects  582 A,  582 B, and  582 C, respectively. CCM  100  identifies topics  586  in content  582 A,  582 B, and/or  582 C. Topics  586  include virtual storage, network security, and VPNs. CCM  100  assigns relevancy values  590  to topics  586  based on known algorithms. For example, relevancy values  590  may be assigned based on the number of times different associated keywords are identified in content  582 . 
     CCM  100  assigns weight values  588  to content  582  based on the associated event activity. For example, CCM  100  assigns a relatively high weight value of 0.7 to a more assertive off-line activity, such as registering for the network security seminar. CCM  100  assigns a relatively low weight value of 0.2 to a more passive on-line activity, such as viewing the VPN webpage. 
     CCM  100  generates a user intent vector  594  in user profile  104  based on the relevancy values  590 . For example, CCM  100  may multiply relevancy values  590  by the associated weight values  588 . CCM  100  then may sum together the weighted relevancy values for the same topics to generate user intent vector  594 . 
     CCM  100  uses intent vector  594  to represent a user, represent content accessed by the user, represent user access activities associated with the content, and effectively represent the intent/interests of the user. In another embodiment, CCM  100  may assign each topic in user intent vector  594  a binary score of 1 or 0. CCM  100  may use other techniques for deriving user intent vector  594 . For example, CCM  100  may weigh the relevancy values based on timestamps. 
       FIG. 6  depicts an example of how the CCM  100  segments users according to various embodiments. CCM  100  may generate user intent vectors  594 A and  594 B for two different users, including user X and user Y in this example. A service provider  118  may want to email content  698  to a segment of interested users. The service provider submits content  698  to CCM  100 . CCM  100  identifies topics  586  and associated relevancy values  600  for content  698 . 
     CCM  100  may use any variety of different algorithms to identify a segment of user intent vectors  594  associated with content  698 . For example, relevancy value  600 B indicates content  698  is primarily related to network security. CCM  100  may identify any user intent vectors  594  that include a network security topic with a relevancy value above a given threshold value. 
     In this example, assume the relevancy value threshold for the network security topic is 0.5. CCM  100  identifies user intent vector  594 A as part of the segment of users satisfying the threshold value. Accordingly, CCM  100  sends the service provider of content  698  a contact segment that includes the user ID associated with user intent vector  594 A. As mentioned above, the user ID may be a hashed email address, cookie ID, or some other encrypted or unencrypted identifier associated with the user. 
     In another example, CCM  100  calculates vector cross products between user intent vectors  594  and content  698 . Any user intent vectors  594  that generate a cross product value above a given threshold value are identified by CCM  100  and sent to the service provider  118 . 
       FIG. 7  depicts examples of how the CCM  100  aggregates intent data  106  according to various embodiments. In this example, a service provider  118  operating a computer  702  (which may be the same or similar as computer  230  and computer  530  of  FIGS. 2 and 5 ) submits a search query  704  to CCM  100  asking what companies are interested in electric cars. In this example, CCM  100  associates five different topics  586  with user profiles  104 . Topics  586  include storage virtualization, network security, electric cars, e-commerce, and finance. 
     CCM  100  generates user intent vectors  594  as described previously in  FIG. 6 . User intent vectors  594  have associated personal information, such as a job title  707  and an org (e.g., employer company) name  710 . As explained above, users may provide personal information, such as employer name and job title in form fields when accessing a service provider  118  or third party website. 
     The CCM tags  110  described previously capture and send the job title and employer name information to CCM  100 . CCM  100  stores the job title and employer information in the associated user profile  104 . CCM  100  searches user profiles  104  and identifies three user intent vectors  594 A,  594 B, and  594 C associated with the same employer name  710 . CCM  100  determines that user intent vectors  594 A and  594 B are associated with a same job title of analyst and user intent vector  594 C is associated with a job title of VP of finance. 
     In response to, or prior to, search query  704 , CCM  100  generates a company intent vector  712 A for company X. CCM  100  may generate company intent vector  712 A by summing up the topic relevancy values for all of the user intent vectors  594  associated with company X. 
     In response to search query  704 , CCM  100  identifies any company intent vectors  712  that include an electric car topic  586  with a relevancy value greater than a given threshold. For example, CCM  100  may identify any companies with relevancy values greater than 4.0. In this example, CCM  100  identifies company X in search results  706 . 
     In one example, intent is identified for a company at a particular zip code, such as zip code 11201. CCM  100  may take customer supplied offline data, such as from a Customer Relationship Management (CRM) database, and identify the users that match the company and zip code 11201 to create a segment. 
     In another example, service provider  118  may enter a query  705  asking which companies are interested in a document (DOC 1) related to electric cars. Computer  702  submits query  705  and DOC 1 to CCM  100 . CCM  100  generates a topic vector for DOC 1 and compares the DOC 1 topic vector with all known company intent vectors  712 A. 
     CCM  100  may identify an electric car topic in the DOC 1 with high relevancy value and identify company intent vectors  712  with an electric car relevancy value above a given threshold. In another example, CCM  100  may perform a vector cross product between the DOC 1 topics and different company intent vectors  712 . CCM  100  may identify the names of any companies with vector cross product values above a given threshold value and display the identified company names in search results  706 . 
     CCM  100  may assign weight values  708  for different job titles. For example, an analyst may be assigned a weight value of 1.0 and a vice president (VP) may be assigned a weight value of 7.0. Weight values  708  may reflect purchasing authority associated with job titles  707 . For example, a VP of finance may have higher authority for purchasing electric cars than an analyst. Weight values  708  may vary based on the relevance of the job title to the particular topic. For example, CCM  100  may assign an analyst a higher weight value  708  for research topics. 
     CCM  100  may generate a weighted company intent vector  712 B based on weighting values  708 . For example, CCM  100  may multiply the relevancy values for user intent vectors  594 A and  594 B by weighting value 1.0 and multiply the relevancy values for user intent vector  594 C by weighting value 3.0. The weighted topic relevancy values for user intent vectors  594 A,  594 B, and  594 C are then summed together to generate weighted company intent vector  712 B. 
     CCM  100  may aggregate together intent vectors for other categories, such as job title. For example, CCM  100  may aggregate together all the user intent vectors  594  with VP of finance job titles into a VP of finance intent vector  714 . Intent vector  714  identifies the topics of interest to VPs of finance. 
     CCM  100  may also perform searches based on job title or any other category. For example, service provider  118  may enter a query LIST VPs OF FINANCE INTERESTED IN ELECTRIC CARS? The CCM  100  identifies all of the user intent vectors  594  with associated VP finance job titles  707 . CCM  100  then segments the group of user intent vectors  594  with electric car topic relevancy values above a given threshold value. 
     CCM  100  may generate composite profiles  716 . Composite profiles  716  may contain specific information provided by a particular service provider  118  or entity. For example, a first service provider  118  may identify a user as VP of finance and a second service provider  118  may identify the same user as VP of engineering. Composite profiles  716  may include other service provider  118  provided information, such as company size, company location, company domain. 
     CCM  100  may use a first composite profile  716  when providing user segmentation for the first service provider  118 . The first composite profile  716  may identify the user job title as VP of finance. CCM  100  may use a second composite profile  716  when providing user segmentation for the second service provider  118 . The second composite profile  716  may identify the job title for the same user as VP of engineering. Composite profiles  716  are used in conjunction with user profiles  104  derived from other third party content. 
     In yet another example, CCM  100  may segment users based on event type. For example, CCM  100  may identify all the users that downloaded a particular article, or identify all of the users from a particular company that registered for a particular seminar. 
     3. Consumption Scoring Embodiments 
       FIG. 8  depicts an example consumption score generator  800  used in CCM  100  according to various embodiments. As explained above, CCM  100  may receive multiple events  108  associated with different information objects  112 . For example, users may use client apps (e.g., web browsers, or any other application) to access or view information objects  112  from different resources (e.g., on different websites). The information objects  112  may include any webpage, electronic document, article, advertisement, or any other information viewable or audible by a user such as those discussed herein. In this example, information objects  112  may include a webpage article or a document related to network firewalls. 
     CCM tag  110  may capture events  108  identifying information objects  112  accessed by a user during a network or application session. For example, events  108  may include a user identifier (userId), URL, network address (NetAdr), event type (eventType), and a timestamp (TS). The userId may be a unique identifier for a specific user on a specific client app and/or a specific user device. The userId field may carry any suitable identifier associated with a user and/or user device. As examples, the userId may be an identifier associated with a network session, an application, and app instance, an app session, an app-generated identifier, and/or a CCM tag  110  may generated identifier. Additionally or alternatively, the userId may be or include one or more of a user ID (UID) (e.g., positive integer assigned to a user by a Unix-like OS), effective user ID (euid), file system user ID (fsuid), saved user id (suid), real user id (mid), a cookie ID, a realm name, domain ID, logon user name, network credentials, social media account name, session ID, and/or any other like identifier associated with a particular user or device. The URL may be links, resource identifiers (e.g., Uniform Resource Identifiers (URIs)), or web addresses of information objects  112  accessed by the user during the session. 
     The NetAdr field includes any identifier associated with a network node. As examples, the NetAdr field may include any suitable network address (or combinations of network addresses) such as an internet protocol (IP) address in an IP network (e.g., IP version 4 (Ipv4), IP version 6 (IPv6), etc.), telephone numbers in a public switched telephone number, a cellular network address (e.g., international mobile subscriber identity (IMSI), mobile subscriber ISDN number (MSISDN), Subscription Permanent Identifier (SUPI), Temporary Mobile Subscriber Identity (TMSI), Globally Unique Temporary Identifier (GUTI), Generic Public Subscription Identifier (GPSI), etc.), an internet packet exchange (IPX) address, an X.25 address, an X.21 address, a port number (e.g., when using Transmission Control Protocol (TCP) or User Datagram Protocol (UDP)), a media access control (MAC) address, an Electronic Product Code (EPC) as defined by the EPCglobal Tag Data Standard, Bluetooth hardware device address (BD_ADDR), a Universal Resource Locator (URL), an email address, and/or the like. The NetAdr may be for a network device used by the user to access a network (e.g., the Internet, an enterprise network, etc.) and information objects  112 . 
     As explained previously, the event type may identify an action or activity associated with information objects  112 . In this example, the event type may indicate the user downloaded an electric document or displayed a webpage. The timestamp (TS) may identify a date and/or time the user accessed information objects  112 , and may be included in the TS field in any suitable timestamp format such as those defined by ISO 8601 or the like. 
     Consumption score generator (CSG)  800  may access a NetAdr-Org database  806  to identify a company/entity and location  808  associated with NetAdr  804  in event  108 . In one example, the NetAdr-Org database  806  may be a IP/company  806  when the NetAdr is a network address and the Orgs are entities such companies, enterprises, and/or the like. For example, existing services may provide databases  806  that identify the company and company address associated with network addresses. The NetAdr (e.g., IP address) and/or associated org may be referred to generally as a domain. CSG  800  may generate metrics from events  108  for the different companies  808  identified in database  806 . 
     In another example, CCM tags  110  may include domain names in events  108 . For example, a user may enter an email address into a webpage field during a web session. CCM  100  may hash the email address or strip out the email domain address. CCM  100  may use the domain name to identify a particular company and location  808  from database  806 . 
     As also described previously, event processor  244  may generate relevancy scores  802  that indicate the relevancy of information objects  112  with different topics  102 . For example, information objects  112  may include multiple words associate with topics  102 . Event processor  244  may calculate relevancy scores  802  for information objects  112  based on the number and position words associated with a selected topic. 
     CSG  800  may calculate metrics from events  108  for particular companies  808 . For example, CSG  800  may identify a group of events  108  for a current week that include the same NetAdr  804  associated with a same company and company location  808 . CSG  800  may calculate a consumption score  810  for company  808  based on an average relevancy score  802  for the group of events  108 . CSG  800  may also adjust the consumption score  810  based on the number of events  108  and the number of unique users generating the events  108 . 
     CSG  800  generates consumption scores  810  for org  808  for a series of time periods. CSG  800  may identify a surge  812  in consumption scores  810  based on changes in consumption scores  810  over a series of time periods. For example, CSG  800  may identify surge  812  based on changes in content relevancy, number of unique users, number of unique user accesses for a particular information object, a number of events over one or more time periods (e.g., several weeks), a number of particular types of user interactions with a particular information object, and/or any other suitable parameters/criteria. It has been discovered that surge  812  corresponds with a unique period when orgs have heightened interest in a particular topic and are more likely to engage in direct solicitations related to that topic. The surge  812  (also be referred to as a “surge score  812 ” or the like) informs a service provider  118  when target orgs (e.g., org  808 ) are indicating active demand for the products or services that are offered by the service provider  118 . 
     CCM  100  may send consumption scores  810  and/or any surge indicators  812  to service provider  118 . Service provider  118  may store a contact list  815  that includes contacts  818  for org ABC. For example, contact list  815  may include email addresses or phone number for employees of org ABC. Service provider  118  may obtain contact list  815  from any source such as from a customer relationship management (CRM) system, commercial contact lists, personal contacts, third parties lead services, retail outlets, promotions or points of sale, or the like or any combination thereof. 
     In one example, CCM  100  may send weekly consumption scores  810  to service provider  118 . In another example, service provider  118  may have CCM  100  only send surge notices  812  for companies on list  815  surging for particular topics  102 . 
     Service provider  118  may send information object  820  related to surge topics to contacts  818 . For example, the information object  820  sent by service provider  118  to contacts  818  may include email advertisements, literature, or banner ads related to firewall products/services. Alternatively, service provider  118  may call or send direct mailings regarding firewalls to contacts  818 . Since CCM  100  identified surge  812  for a firewall topic at org ABC, contacts  818  at org ABC are more likely to be interested in reading and/or responding to content  820  related to firewalls. Thus, content  820  is more likely to have a higher impact and conversion rate when sent to contacts  818  of org ABC during surge  812 . 
     In another example, service provider  118  may sell a particular product, such as firewalls. Service provider  118  may have a list of contacts  818  at org ABC known to be involved with purchasing firewall equipment. For example, contacts  418  may include the chief technology officer (CTO) and information technology (IT) manager at org ABC. CCM  100  may send service provider  118  a notification whenever a surge  812  is detected for firewalls at org ABC. Service provider  118  then may automatically send content  820  to specific contacts  818  at org ABC with job titles most likely to be interested in firewalls. 
     CCM  100  may also use consumption scores  810  for advertising verification. For example, CCM  100  may compare consumption scores  810  with advertising content  820  sent to companies or individuals. Advertising content  820  with a particular topic sent to companies or individuals with a high consumption score or surge for that same topic may receive higher advertising rates. 
       FIG. 9  shows in more detail how CCM  100  generates consumption scores  810 . CCM  100  may receive millions of events  108  from millions of different users associated with thousands of different domains every day. CCM  100  may accumulate the events  108  for different time periods, such as daily, weekly, monthly, or the like. Week time periods are just one example and CCM  100  may accumulate events  108  for any selectable time period. CCM  100  may also store a set of topics  102  for any selectable subject matter. CCM  100  may also dynamically generate some of topics  102  based on the content identified in events  108  as described previously. 
     Events  108  as mentioned previously may include a user ID  950 , URL  952 , network address  954 , event type  956 , and timestamp  958 . Event processor  244  identifies information objects  112  located at URL  942  and select one of topics  102  for comparing with information objects  112 . Event processor  244  may generate an associated relevancy score  802  indicating a relevancy of information objects  112  to selected topic  102 . Relevancy score  802  may alternatively be referred to as a “topic score” or the like. 
     CSG  800  generates consumption data  960  from events  108 . For example, CSG  800  may identify or determine an org  960 A (e.g., “Org ABC” in  FIG. 9 ) associated with network address  954 . CSG  800  also calculates a relevancy score  960 C between information objects  112  and the selected topic  960 B. CSG  800  also identifies or determines a location  960 D for with company  960 A and identify a date  960 E and time  960 F when event  108  was detected. 
     CSG  800  generates consumption metrics  980  from consumption data  960 . For example, CSG  800  may calculate a total number of events  970 A associated with org  960 A (e.g., Org ABC) and location  960 D (e.g., location Y) for all topics during a first time period, such as for a first week. CSG  800  also calculates the number of unique users  972 A generating the events  108  associated with org ABC and topic  960 B for the first week. For example, CSG  800  may calculate for the first week a total number of events generated by org ABC for topic  960 B (e.g., topic volume  974 A). CSG  800  may also calculate an average topic relevancy  976 A for the content accessed by org ABC and associated with topic  960 B. CSG  800  may generate consumption metrics  980 A- 980 C for sequential time periods, such as for three consecutive weeks. 
     CSG  800  may generate consumption scores  910  based on consumption metrics  980 A- 980 C. For example, CSG  800  may generate a first consumption score  910 A for week  1  and generate a second consumption score  910 B for week  2  based in part on changes between consumption metrics  980 A for week  1  and consumption metrics  980 B for week  2 . CSG  800  may generate a third consumption score  910 C for week  3  based in part on changes between consumption metrics  980 A,  980 B, and  980 C for weeks  1 ,  2 , and  3 , respectively. In one example, any consumption score  910  above as threshold value is identified as a surge  812 . 
     Additionally or alternatively, the consumption metrics  980  may include metrics such as topic consumption by interactions, topic consumption by unique users, Topic relevancy weight, and engagement. Topic consumption by interactions is the number of interactions from an org in a given time period compared to a larger time period of historical data, for example, the number of interactions in a previous three week period compared to a previous 12 week period of historical data. Topic consumption by unique users refers to the number of unique individuals from an org researching relevant topics in a given time period compared to a larger time period of historical data, for example, the number of individuals from an org researching relevant topic in a previous three week period compared to a previous 12 week period of historical data. Topic relevancy weight refers to a measure of a content piece&#39;s ‘denseness’ in a topic of interest such as whether the topic is the focus of the content piece or sparsely mentioned in the content piece. Engagement refers to the depth of an org&#39;s engagement with the content, which may be based on an aggregate of engagement of individual users associated with the org. The engagement may be measured based on the user interactions with the information object such as by measuring dwell time, scroll velocity, scroll depth, and/or any other suitable user interactions such as those discussed herein. 
       FIG. 10  depicts a process for identifying a surge in consumption scores according to various embodiments. In operation  1001 , the CCM  100  identifies all domain events for a given time period. For example, for a current week the CCM  100  may accumulate all of the events for every network address (e.g., IP address, domain, or the like) associated with every topic  102 . 
     The CCM  100  may use thresholds to select which domains to generate consumption scores. For example, for the current week the CCM  100  may count the total number of events for a particular domain (domain level event count (DEC)) and count the total number of events for the domain at a particular location (metro level event count (DMEC)). 
     The CCM  100  calculates the consumption score for domains with a number of events more than a threshold (DEC&gt;threshold). The threshold can vary based on the number of domains and the number of events. The CCM  100  may use the second DMEC threshold to determine when to generate separate consumption scores for different domain locations. For example, the CCM  100  may separate subgroups of org ABC events for the cities of Atlanta, New York, and Los Angeles that have each a number of events DMEC above the second threshold. 
     In operation  1002 , the CCM  100  determines an overall relevancy score for all selected domains for each of the topics. For example, the CCM  100  for the current week may calculate an overall average relevancy score for all domain events associated with the firewall topic. 
     In operation  1004 , the CCM  100  determines a relevancy score for a specific domain. For example, the CCM  100  may identify a group of events  108  having a same network address associated with org ABC. The CCM  100  may calculate an average domain relevancy score for the org ABC events associated with the firewall topic. 
     In operation  1006 , the CCM  100  generates an initial consumption score based on a comparison of the domain relevancy score with the overall relevancy score. For example, the CCM  100  may assign an initial low consumption score when the domain relevancy score is a certain amount less than the overall relevancy score. The CCM  100  may assign an initial medium consumption score larger than the low consumption score when the domain relevancy score is around the same value as the overall relevancy score. The CCM  100  may assign an initial high consumption score larger than the medium consumption score when the domain relevancy score is a certain amount greater than the overall relevancy score. This is just one example, and the CCM  100  may use any other type of comparison to determine the initial consumption scores for a domain/topic. 
     In operation  1008 , the CCM  100  adjusts the consumption score based on a historic baseline of domain events related to the topic. This is alternatively referred to as consumption. For example, the CCM  100  may calculate the number of domain events for org ABC associated with the firewall topic for several previous weeks. 
     The CCM  100  may reduce the current week consumption score based on changes in the number of domain events over the previous weeks. For example, the CCM  100  may reduce the initial consumption score when the number of domain events fall in the current week and may not reduce the initial consumption score when the number of domain events rises in the current week. 
     In operation  1010 , the CCM  100  further adjusts the consumption score based on the number of unique users consuming content associated with the topic. For example, the CCM  100  for the current week may count the number of unique user IDs (unique users) for org ABC events associated with firewalls. The CCM  100  may not reduce the initial consumption score when the number of unique users for firewall events increases from the prior week and may reduce the initial consumption score when the number of unique users drops from the previous week. 
     In operation  1012 , the CCM  100  identifies or determines surges based on the adjusted weekly consumption score. For example, the CCM  100  may identify a surge when the adjusted consumption score is above a threshold. 
       FIG. 11  depicts in more detail the process for generating an initial consumption score according to various embodiments. It should be understood this is just one example scheme and a variety of other schemes may also be used in other embodiments. 
     In operation  1102 , the CCM  100  calculates an arithmetic mean (M) and standard deviation (SD) for each topic over all domains. The CCM  100  may calculate M and SD either for all events for all domains that contain the topic, or alternatively for some representative (big enough) subset of the events that contain the topic. The CCM  100  may calculate the overall mean and standard deviation as follows: 
     
       
         
           
             
               Mean 
               ⁢ 
               
                 : 
               
               ⁢ 
               
                   
               
               ⁢ 
               M 
             
             = 
             
               
                 1 
                 n 
               
               * 
               
                 
                   ∑ 
                   1 
                   n 
                 
                 ⁢ 
                 
                   x 
                   i 
                 
               
             
           
         
       
       
         
           
             
               Standard 
               ⁢ 
               
                   
               
               ⁢ 
               deviation 
               ⁢ 
               
                 : 
               
               ⁢ 
               
                   
               
               ⁢ 
               SD 
             
             = 
             
               
                 
                   1 
                   
                     n 
                     - 
                     1 
                   
                 
               
               ⁢ 
               
                 
                   ∑ 
                   1 
                   n 
                 
                 ⁢ 
                 
                   
                     ( 
                     
                       
                         x 
                         i 
                       
                       - 
                       M 
                     
                     ) 
                   
                   2 
                 
               
             
           
         
       
     
     Where x i  is a topic relevancy and n is a total number of events. 
     In operation  1104 , the CCM  100  calculates a mean (average) domain relevancy for each group of domain and/or domain/metro events for each topic. For example, for the past week the CCM  100  may calculate the average relevancy for org ABC events for firewalls. 
     In operation  1106 , the CCM  100  compares the domain mean relevancy (DMR) with the overall mean (M) relevancy and over standard deviation (SD) relevancy for all domains. For example, the CMM may assign three different levels to the DMR. 
     Low: DMR&lt;M−0.5*SD ˜33% of all values 
     Medium: M−0.5*SD&lt;DMR&lt;M+0.5*SD ˜33% of all values 
     High: DMR&gt;M+0.5*SD ˜33% of all values 
     In operation  1108 , the CCM  100  calculates an initial consumption score for the domain/topic based on the above relevancy levels. For example, for the current week the CCM  100  may assign one of the following initial consumption scores to the org ABC firewall topic. Again, this just one example of how the CCM  100  may assign an initial consumption score to a domain/topic. 
     Relevancy=High: initial consumption score=100 
     Relevancy=Medium: Initial consumption score=70 
     Relevancy=Low: Initial consumption score 40. 
       FIG. 12  depicts one example of how the CCM  100  may adjust the initial consumption score according to various embodiments. These are also just examples and the CCM  100  may use other schemes for calculating a final consumption score in other embodiments. In operation  1201 , the CCM  100  assigns an initial consumption score to the domain/location/topic as described previously in  FIG. 11 . 
     The CCM  100  may calculate a number of events for domain/location/topic for a current week. The number of events is alternatively referred to as consumption. The CCM  100  may also calculate the number of domain/location/topic events for previous weeks and adjust the initial consumption score based on the comparison of current week consumption with consumption for previous weeks. 
     In operation  1202 , the CCM  100  determines if consumption for the current week is above historic baseline consumption for previous consecutive weeks. For example, the CCM  100  may determine is the number of domain/location/topic events for the current week is higher than an average number of domain/location/topic events for at least the previous two weeks. If so, the CCM  100  may not reduce the initial consumption value derived in  FIG. 11 . 
     If the current consumption is not higher than the average consumption in operation  542 , the CCM  100  in operation  1204  determines if the current consumption is above a historic baseline for the previous week. For example, the CCM  100  may determine if the number of domain/location/topic events for the current week is higher than the average number of domain/location/topic events for the previous week. If so, the CCM  100  in operation  1206  reduces the initial consumption score by a first amount. 
     If the current consumption is not above than the previous week consumption in operation  1204 , the CCM  100  in operation  1208  determines if the current consumption is above the historic consumption baseline but with interruption. For example, the CCM  100  may determine if the number of domain/location/topic events has fallen and then risen over recent weeks. If so, the CCM  100  in operation  1210  reduces the initial consumption score by a second amount. 
     If the current consumption is not above than the historic interrupted baseline in operation  1208 , the CCM  100  in operation  1212  determines if the consumption is below the historic consumption baseline. For example, the CCM  100  may determine if the current number of domain/location/topic events is lower than the previous week. If so, the CCM  100  in operation  1214  reduces the initial consumption score by a third amount. 
     If the current consumption is above the historic base line in operation  1212 , the CCM  100  in operation  1216  determines if the consumption is for a first-time domain. For example, the CCM  100  may determine the consumption score is being calculated for a new company or for a company that did not previously have enough events to qualify for calculating a consumption score. If so, the CCM  100  in operation  1218  may reduce the initial consumption score by a fourth amount. 
     In one example, the CCM  100  may reduce the initial consumption score by the following amounts. The CCM  100  may use any values and factors to adjust the consumption score in other embodiments. 
     Consumption above historic baseline consecutive weeks (operation  542 ).—0 
     Consumption above historic baseline past week (operation  544 ).—20 (first amount). 
     Consumption above historic baseline for multiple weeks with interruption (operation  548 )—30 (second amount). 
     Consumption below historic baseline (operation  552 ).—40 (third amount). 
     First time domain (domain/metro) observed (operation  556 ).—30 (fourth amount). 
     As explained above, the CCM  100  may also adjust the initial consumption score based on the number of unique users. The CCM tags  110  in  FIG. 8  may include cookies placed in web browsers that have unique identifiers. The cookies may assign the unique identifiers to the events captured on the web browser. Therefore, each unique identifier may generally represent a web browser for a unique user. The CCM  100  may identify the number of unique identifiers for the domain/location/topic as the number of unique users. The number of unique users may provide an indication of the number of different domain users interested in the topic. 
     In operation  1220 , the CCM  100  compares the number of unique users for the domain/location/topic for the current week with the number of unique users for the previous week. The CCM  100  may not reduce the consumption score if the number of unique users increases over the previous week. When the number of unique users decrease, the CCM  100  in operation  1222  may further reduce the consumption score by a fifth amount. For example, the CCM  100  may reduce the consumption score by 10. 
     The CCM  100  may normalize the consumption score for slower event days, such as weekends. Again, the CCM  100  may use different time periods for generating the consumption scores, such as each month, week, day, hour, etc. The consumption scores above a threshold are identified as a surge or spike and may represent a velocity or acceleration in the interest of a company or individual in a particular topic. The surge may indicate the company or individual is more likely to engage with a service provider  118  who presents content similar to the surge topic. The surge helps service providers  118  identify the orgs in active research mode for the service providers&#39;  118  products/services so the service providers  118  can proactively coordinate sales and marketing activities around orgs with active intent, and/or obtain or deliver better results with highly targeted campaigns that focus on orgs demonstrating intent around a certain topic. 
     4. Consumption DNA 
     One advantage of domain-based surge detection is that a surge can be identified for an org without using personally identifiable information (PII), sensitive data, or confidential data of the org personnel (e.g., company employees). The CCM  100  derives the surge data based on an org&#39;s network address without using PII, sensitive data, or confidential data associated with the users generating the events  108 . 
     In another example, the user may provide PII, sensitive data, and/or confidential data during network/web sessions. For example, the user may agree to enter their email address into a form prior to accessing content. As described previously, the CCM  100  may anonymize (e.g., hash, or the like) the PII, sensitive data, or confidential data and include the anonymized data either with org consumption scores or with individual consumption scores. 
       FIG. 13  shows an example process for mapping domain consumption data to individuals according to various embodiments. In operation  1301 , the CCM  100  identifies or determines a surging topic for an org (e.g., org ABC at location Y) as described previously. For example, the CCM  100  may identify a surge  812  for org ABC in New York for firewalls. 
     In operation  1302 , the CCM  100  identifies or determines users associated with org ABC. As mentioned above, some org ABC personnel may have entered personal, sensitive, or confidential data, such as their office location and/or job titles into fields of webpages during events  108 . In another example, a service provider  118  or other party may obtain contact information for employees of org ABC from CRM customer profiles or third party lists. 
     Either way, the CCM  100  or service provider  118  may obtain a list of employees/users associated with org ABC at location Y. The list may also include job titles and locations for some of the employees/users. The CCM  100  or service provider  118  may compare the surge topic with the employee job titles. For example, the CCM  100  or service provider may determine that the surging firewall topic is mostly relevant to users with a job title such as engineer, chief technical officer (CTO), or information technology (IT). 
     In operation  1304 , the CCM  100  or service provider  118  maps the surging topic (e.g., firewall in this example) to profiles of the identified personnel of org ABC. In another example, the CCM  100  or service provider  118  may not be as discretionary and map the firewall surge to any user associated with org ABC. The CCM  100  or service provider then may direct content associated with the surging topic to the identified users. For example, the service provider may direct banner ads or emails for firewall seminars, products, and/or services to the identified users. 
     Consumption data identified for individual users is alternatively referred to as “Dino DNA” and the general domain consumption data is alternatively referred to as “frog DNA.” Associating domain consumption and surge data with individual users associated with the domain may increase conversion rates by providing more direct contact to users more likely interested in the topic. 
     The example embodiments described herein provide improvements to the functioning of computing devices and computing networks by providing specific mechanisms of collecting network session events  118  from user devices (e.g., computers  232  and  1404  of  FIGS. 2 and 14 , and platform  2200  of  FIG. 22 ), accessing information objects  112 ,  114 , determining the amount of traffic individual websites receive from user devices at or related to a specific domain name or network addresses at specific periods of time, and identifying spikes (surges  812 ). The collected data can be used to analyze the cause of the surge (e.g., relevant topics in specific information objects  112 ,  114 ), which provides a specific improvement over prior systems, resulting in improved network/traffic monitoring capabilities and resource consumption efficiencies. The embodiments discussed herein allows for the discovery of information from extremely large amounts of data that was not previously possible in conventional computing architectures. 
     Identifying spikes (surges) in traffic in this way allows content providers to better serve their content to specific users. Serving content to numerous users (e.g., responding to network request for content and the like) without targeting can be computationally intensive and can consume large amounts of computing and network resources, at least from the perspective of content providers, service providers, and network operators. The improved network/traffic monitoring and resource efficiencies provided by the present claims is a technological improvement in that content providers, service providers, and network operators can reduce network and computational resource overhead associated with serving content to users by reducing the overall amount of content served to users by focusing on the relevant content. Additionally, the content providers, service providers, and network operators could use the improved network/traffic monitoring to better adapt the allocation of resources to serve users a peak times in order to smooth out their resource consumption over time. 
     5. Intent Measurement 
       FIG. 14  depicts how CCM  100  may calculate consumption scores based on user engagement. A computer  1400  may operate a client app  1404  (e.g., a browser, desktop/mobile app, etc.) to access information objects  112 , for example, by sending appropriate HTTP messages or the like, and in response, server-side application(s) may dynamically generate and provide code, scripts, markup documents, and/or other information object(s)  112  to the client app  1404  to render and display information objects  112  within the client app  1404 . As alluded to previously, information objects  112  may be a webpage or web app comprising a graphical user interface (GUI) including graphical control elements (GCEs) for accessing and/or interacting with a service provider (e.g., a service provider  118 ). The server-side applications may be developed with any suitable server-side programming languages or technologies, such as PHP; Java™ based technologies such as Java Servlets, JavaServer Pages (JSP), JavaServer Faces (JSF), etc.; ASP.NET; Ruby or Ruby on Rails; a platform-specific and/or proprietary development tool and/or programming languages; and/or any other like technology that renders HyperText Markup Language (HTML). The computer  1400  may be a laptop, smartphone, tablet, and/or any other device such as any of those discussed herein. In this example, a user may open the client app  1404  on a screen  1402  of computer  1400 . 
     CCM tag  110  may operate within client app  1404  and monitor user web sessions. As explained previously, CCM tag  110  may generate events  108  for the web/network session that includes an identifier (ID), a URL for information objects  112 , and an event type that identifies an action or activity associated with information objects  112 . For example, CCM tag  110  may add an event type identifier into event  108  indicating the user downloaded an information object  112 . 
     In one example, CCM tag  110  may generate a set of impressions, which is alternatively referred to as engagement metrics  1410 , indicating actions taken by the user while viewing information objects  112 . For example, engagement metrics  1410  may indicate how long the user dwelled on information objects  112  and/or how the user scrolled through information objects  112 . Engagement metrics  1410  may indicate a level of engagement or interest the user has in information objects  112 . For example, the user may spend more time on the webpage and scroll through webpage at a slower speed when the user is more interested in the information objects  112 . 
     In embodiments, the CCM  100  calculates an engagement score  1412  for information objects  112  based on engagement metrics  1410 . CCM  100  may use engagement score  1412  to adjust a relevancy score  802  for information objects  112 . For example, CCM  100  may calculate a larger engagement score  1412  when the user spends a larger amount of time carefully paging through information objects  112 . CCM  100  then may increase relevancy score  802  of information objects  112  based on the larger engagement score  1412 . CSG  800  may adjust consumption scores  910  based on the increased relevancy  802  to more accurately identify domain surge topics. For example, a larger engagement score  1412  may produce a larger relevancy  802  that produces a larger consumption score  910 . 
       FIG. 15  depicts an example process for calculating the engagement score for content according to various embodiments. In operation  1520 , the CCM  100  identifies or determines engagement metrics  1410  for information objects  112 . In embodiments, the CCM  100  may receive events  100  that include content engagement metrics  1410  for one or more information objects  112 . As examples, the engagement metrics  1410  may indicate any user interaction with information objects  112  including tab selections that switch to different pages, page movements, mouse page scrolls, mouse clicks, mouse movements, scroll bar page scrolls, keyboard page movements, touch screen page scrolls, eye tracking data (e.g., gaze locations, gaze times, gaze regions of interest, eye movement frequency, speed, orientations, etc.), touch data (e.g., touch gestures, etc.), and/or any other content movement or content display indicator(s). 
     In operation  1522 , the CCM  100  identifies or determines engagement levels based on the engagement metrics  1410 . In one example at operation  1522 , the CCM  100  identifies/determines a content dwell time. The dwell time may indicate how long the user actively views a page of content. In one example, tag  110  may stop a dwell time counter when the user changes page tabs or becomes inactive on a page. Tag  110  may start the dwell time counter again when the user starts scrolling with a mouse or starts tabbing. Additionally or alternatively at operation  1522 , the CCM  100  identifies/determines, from the events  108 , a scroll depth for the content. For example, the CCM  100  may determine how much of a page the user scrolled through or reviewed. In one example, the CCM tag  110  or CCM  100  may convert a pixel count on the screen into a percentage of the page. Additionally or alternatively at operation  1522 , the CCM  100  identifies/determines an up/down scroll speed. For example, dragging a scroll bar may correspond with a fast scroll speed and indicate the user has less interest in the content. Using a mouse wheel to scroll through content may correspond with a slower scroll speed and indicate the user is more interested in the content. Additionally or alternatively at operation  1522 , the CCM  100  identifies/determines various other aspects/levels of the engagement based on some or all of the engagement metrics  1410  such as any of those discussed herein. In some embodiments, the CCM  100  may assign higher values to engagement metrics  1410  that indicate a higher user interest and assign lower values to engagement metrics that indicate lower user interest. For example, the CCM  100  may assign a larger value in operation  1522  when the user spends more time actively dwelling on a page and may assign a smaller value when the user spends less time actively dwelling on a page. 
     In operation  1524 , the CCM  100  calculates the content engagement score  1412  based on the values derived in operations  1520 - 1522 . For example, the CCM  100  may add together and normalize the different values derived in operations  1520 - 1522 . Other operations may be performed on these values in other embodiments. 
     In operation  1526 , the CCM  100  adjusts relevancy values (e.g., relevancy scores  802 ) described previously in  FIGS. 1-14  based on the content engagement score  1412 . For example, the CCM  100  may increase the relevancy values (e.g., relevancy scores  802 ) when the information object(s)  112  has/have a high engagement score and decrease the relevancy (e.g., relevancy scores  802 ) for a lower engagement scores. 
     CCM  100  or CCM tag  110  in  FIG. 14  may adjust the values assigned in operations  1520 - 1524  based on the type of device  1400  used for viewing the content. For example, the dwell times, scroll depths, and scroll speeds, may vary between smartphone, tablets, laptops and desktop computers. CCM  100  or tag  110  may normalize or scale the engagement metric values so different devices provide similar relative user engagement results. 
     By providing more accurate intent data and consumptions scores in the ways discussed herein allows service providers  118  to conserve computational and network resources by providing a means for better targeting users so that unwanted and seemingly random content is not distributed to users that do not want such content. This is a technological improvement in that it conserves network and computational resources of service providers  118  and/or other organizations (orgs) that distribute this content by reducing the amount of content generated and sent to end-user devices. End-user devices may reduce network and computational resource consumption by reducing or eliminating the need for using such resources to obtain (download) and view unwanted content. Additionally, end-user devices may reduce network and computational resource consumption by reducing or eliminating the need to implement spam filters and reducing the amount of data to be processed when analyzing and/or deleting such content. 
     Furthermore, unlike conventional targeting technologies, the embodiments herein provide user targeting based on surges in interest with particular content, which allows service providers  118  to tailor the timing of when to send content to individual users to maximize engagement, which may include tailoring the content based on the determined locations. This allows content providers to spread out the content distribution over time. Spreading out content distribution reduces congestion and overload conditions at various nodes within a network, and therefore, the embodiments herein also reduce the computational burdens and network resource consumption on the content providers  118 , content distribution platforms, and Internet Service Providers (ISPs) at least when compared to existing/conventional mass/bulk distribution technologies. 
     6. Network Address Classification Embodiments 
       FIG. 16  shows how a network address classification system (NACS)  1600  (also referred to as “network classifier  1600 ”) according to various embodiments. The NACS  1600  identifies different types of entities associated with various network addresses  954 . To do so, the NACS  1600  leverages the fact that network addresses  954  may be associated with different physical locations. For example, a first network device  1614 A may have an associated network address  954 A (NA1) and may be associated with a private home location  1610 A; a second network device  1614 B may have network address  954 B (NA2) and may be associated with a public org location  1610 B; and a third network device  1614 C may have network address  954 C (NA3) and may be associated with a private org location  1610 C. As examples, the network devices  1614  may be routers, mesh networking devices, switches, hubs, network appliances, gateway appliances, a computing device (e.g., laptop, tablet, smartphone, etc.) acting as a WiFi or mobile hotspot, and/or any other networking device used to connect one or more other devices to a network. 
     For explanatory purposes, private home location  1610 A may refer to any location associated with a relatively small group of people, such as a private residence. In at least one example, content (information objects  112 ) accessed by users at private home location  1610 A may not necessarily be associated with a company. For example, persons living at private home location  1610 A may work for companies and may view work related content from private home location  1610 A. However, it may be unlikely that the majority of content accessed by users at private home location  1610 A are associated with a same company. 
     Public org location  1610 B may be associated with any entity, establishment, building, event, location, etc. that caters to multiple users that are not necessarily employed, or otherwise associated, with the same company, entity, establishment, etc. For example, public org location  1610 B may be a coffee shop run by a company that sells coffee to the general public. Content accessed by the different users at coffee shop location  1610 B may not necessarily be associated with the coffee company that operates the coffee shop. For example, users entering coffee shop location  1610 A may work for a variety of different companies and may view a variety of different content unrelated to the coffee company. 
     Private org location  1610 C may be associated with any entity, establishment, building, event, location, etc. where multiple users work, are employed, or are otherwise associated with the same business, entity, or establishment. For example, private org location  1610 C may be the corporate offices of the coffee company that runs coffee shop location  1610 B. In another example, private org location  1610 C may be the corporate offices of an entertainment or casino company that operates an amusement park and/or casino at public org location  1610 B. 
     In other examples, the entities associated with locations  1610 B and  1610 C are unrelated. For example, the company at private org location  1610 C may not have retail stores or facilities. In at least in one example, users at private org location  1610 C may mostly work for the same company and may mostly view content related to their jobs at the same company. 
     As described previously, tags  110  monitor information objects  112  accessed by computing devices  230  at the different network address (NA) locations  1610 . Tags  110  generate events  108  that identify different parameters of the content accessed by the users at NA locations  1610 . As mentioned previously, events  108  may include a user ID, URL, network address, event type, and timestamp. In embodiments, the events  108  may also include a device type and a time offset. 
     As shown, the network classifier  1600  includes a network feature generator  1602  and a network entity classifier  1606 . The network feature generator  1602  identifies the source network addresses  954  in network messages (e.g., IP messages, HTTP messages, etc.) sent from tags  110  to CCM  100 , and determines, generates, and/or identifies different machine learning (ML) features  1604  (or simply “features of  1604 ”) related to the events  108  generated at/by the different network address locations  1610 . For example, feature generator  1602  may determine the average amount of content each user accesses at the different locations  1610 , the average amount of time users access content at the different locations  1610 , and when users access content at the different locations  1610 . Feature generator  1602  may also determine what types of computing devices  230  are used for accessing content at the different locations  1610 . Other features  1604  may be extracted from the event data in other embodiments. 
     The entity classifier  1606  uses features  1604  to determine types of establishments associated with respective locations  1610 . For example, features  1604  may indicate a relatively small number of users access content at address location  1610 A. The entity classifier  1606  may accordingly identify network address  954 A as a home location. 
     Additionally or alternatively, the entity classifier  1606  may determine from features  1604  that a relatively large number of users access content consistently throughout the day and on weekends at location  1610 B. The entity classifier  1606  may also determine from features  1604  that most of the users at location  1610 B use smart phones to access content. Network entity classifier  1606  may determine network address  954 B is associated with a public org location. 
     Network entity classifier  1606  may determine from features  1604  that users at NA location  1610 C mostly access content during business hours Monday through Friday. Network entity classifier  1606  may also determine from features  1604  that most of the users at location  1610 C use personal computers or laptop computers to access content. Network entity classifier  1606  may determine network address  954 C is associated with a private org location. 
     Network entity classifier  1606  may generate an IP entity map  1608  that CCM  100  uses IP entity map  1608  to more efficiently and effectively generate consumption scores and identify surges for different companies. For example, CCM  100  may distinguish between multiple network addresses owned by the same company that include both public org locations and private org locations. In another example, CCM  100  may identify multiple different companies operating within in a shared office space location. 
     In some embodiments, the network classifier  1600  may be part of or otherwise operate in the CCM  100 . In other embodiments, the network classifier  1600  may be a separate network function or network element from the CCM  100  that provides the CCM  100  with entity/org predictions based on network events  118  and/or other collected or obtained data. 
     In either embodiment, the CCM  100  may generate different consumption scores  910  (see e.g.,  FIGS. 8 and 9 ) for the different network address locations  1610  or may only provide consumption scores  910  for network addresses associated with private org locations  1610 C. In another example, some service providers  118  may be more interested in consumption scores  910  for a certain demographic of users that patronize retail locations  1610 B of particular businesses. CCM  100  may generate consumption scores  910  and related surge data  412  for the events  108 B associated with public org locations  1610 B for those businesses. Thus, CCM  100  can filter out events that are less likely to indicate the current interests of associated businesses, business customers, or any other definable entity or demographic. 
     In embodiments, the NetAdr classification system  1600  generates network entity map  1608  without using personal identification information (PII), sensitive data, and/or confidential data. Events  108  may include a user identifier  950  (see e.g.,  FIG. 9 ). However, classification system  1600  can classify network address locations  1610  based only on event timestamps and/or device types. Thus, CCM  100  can generate consumption scores for particular company network addresses without using PII data. Service providers  118  are then free to use their own contact lists to send content to particular companies based on the associated company consumption scores. 
       FIG. 17  shows in more detail how NACS  1600  identifies the types of establishments associated with network address locations. As described previously, events  108  may include a user identifier (ID)  950  such as a unique cookie ID or the like, a URL  952  identifying content accessed by a user associated with user ID  950 , a network address  954 , and a timestamp  958 . Events  108  may also include device type  1759  and time offset  1761  fields that include device type data and a time offset, respectively. 
     Network address  954  (e.g., an IP address or some other network address) may be the network address of the network device  1614  at the physical location where tags  110  generate events  108 . Tags  110  may send network messages to CCM  100  on a periodic basis (e.g., every 15 seconds or the like) or in response to a trigger (e.g., when a network session event or user interaction takes place) via network device  1614 . The messages contain events  108  and include a source network address for network device  1614  that CCM  100  uses to send acknowledgement messages back to tags  110 . 
     Tags  110  may discover device type  1759  of the computing device  230  that the user uses to access information objects  112 . For example, tags  110  may identify computing device  230  as a personal computer, laptop, tablet, or smartphone based on the client app screen resolution, type of client app (e.g., web browser) used for viewing information objects  112 , or a type of user agent used by the client app (e.g., web browser). 
     Tags  110  may also add a time offset  461  corresponding with the time zone associated with events  108 . Classification system  1600  can adjust all timestamps  958  from all network address locations to correspond to a same universal time. 
     The feature generator  1602  may produce a feature dataset  1712  including a variety of different features  1604  (e.g., features F 1  to F Z  in  FIG. 17  where Z is a number) for each network address  954  based on any combination of parameters in events  108 . As described previously, feature generator  1602  may generate some features  1604  based on timestamps  958  and/or device type  1759 . In one example, feature generator  1602  may generate a new feature dataset  1712  each day, or over some other selectable time period. Several features  1604  have been described previously and additional features  1604  are described infra in more detail. 
     Entity classifier  1606  uses a network classification model  1718  to identify types of establishments associated with network addresses  954 . In one example, classification system  1600  uses a logistic regression model  1718  (also referred to as a “logit model  1718 ”) as follows: 
     
       
         
           
             
               
                 N 
                 
                   - 
                   1 
                 
               
               ⁢ 
               log 
               ⁢ 
               
                   
               
               ⁢ 
               
                 L 
                 ⁡ 
                 
                   ( 
                   
                     θ 
                     | 
                     x 
                   
                   ) 
                 
               
             
             = 
             
               
                 N 
                 
                   - 
                   1 
                 
               
               ⁢ 
               
                 
                   ∑ 
                   
                     i 
                     = 
                     1 
                   
                   N 
                 
                 ⁢ 
                 
                   log 
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     Pr 
                     ⁡ 
                     
                       ( 
                       
                         
                           
                             y 
                             i 
                           
                           | 
                           
                             x 
                             i 
                           
                         
                         ; 
                         θ 
                       
                       ) 
                     
                   
                 
               
             
           
         
       
     
     In the above equation, N is a number of observations; L is loss function; θ is parameters/coefficients used to calculate probability; Pr is probability; y i  is class (0 or 1) of the ith observation, and x i  is a vector of features representing a network address and/or network device (e.g., features  1604 ) (x 1  may be referred to as a “feature vector”). Additionally, the notation/symbol “|” indicates a conditional probability, for example, “Pr(y i |x i ; θ)” is the probability of y i  given that the event x i ; θ occurs. In some embodiments, the logistic regression model  1718  is maximized using one or more suitable optimization techniques such as gradient descent and/or the like. Other logistic regression models may be used in other embodiments. Other ML models for identifying different behavior patterns may be used in other embodiments such as any of the classification or other supervised learning ML models/algorithms discussed herein. 
     The classification system  1600  trains model  1718  with training data  1716 . In one example implementation, a first set of training data  1716 A may include features  1604  for network addresses  954  from known private org locations. For example, training data  1710 A may be produced from events  108  generated from the known corporate headquarters or known business offices of companies. In one example implementation, a second set of training data  1716 B may include features  1604  for network addresses from known public org locations or known non-org locations. For example, training data  1716 B may be generated from coffee shops, retail stores, amusement parks, internet service providers, private homes, or any other publicly accessible Internet location. 
     In one example, model  1718  uses training data  1716  to identify features  1604  associated with private org locations. However, model  1718  may be trained to identify any other type of physical location based on network address (e.g., IP address or the like), such as public org locations, private home locations, geographic locations, GPS coordinates, contextual location, and/or any other business or user demographic. 
     Classification system  1600  feeds features  1604  for a particular network address  954  into trained model  1718 . Model  1718  generates prediction values  1720  that indicate the probability of the associated network address being a private org location. For example, classification system  1700  may identify any network address  954  with a prediction score  1720  over 0.45 as a private org location. Conversely, classification system  1600  may identify any network address  954  with a prediction score  1720  less than some other threshold as a public org location or a private home location. Classification system  1600  generates network entity map  1608  in  FIG. 16  from prediction values  1720 . For example, the network entity map  1608  may include a row for each network address  954  and a column marked if the associated network address is identified as a private org location. 
       FIG. 18  shows how classification system  1600  generates consumption scores  1810  according to various embodiments. As described previously, classification system  1600  identifies the types of orgs/establishments associated with different network addresses. In this example, classification system  1600  classifies network addresses  1822  as private org locations (NA-pOrg). The classified network address are stored in NetAdr entity map  1608 . 
     As explained previously, a domain name service may provide a database  806  that identifies companies and company addresses associated with different network addresses. The network address and/or associated entity may be referred to generally as a domain. Additionally, database  806  may include multiple different network addresses associated with the same org. Some of these network addresses may be associated with public org locations that do not necessarily identify the intent or interests of the org. 
     CCM  100  may receive a group of events having the same network address  1824 . To generate more accurate consumption scores  1810 , CSG  800  may compare the network address  1824  associated with the group of events  108  with NetAdr entity map  1608 . Map  1608  indicates in output  1826  if the network address  1824  is associated with a private org location or some other entity location. If network address  1824  is not associated with a private org location, CSG  800  may not generate a consumption score  1810 . If output  1826  indicates network address  1824  is associated with a private org location (NA-pOrg), CSG  800  may generate a consumption score  1810  for the identified company and location  1808 . 
     In addition, the consumption score  1810  may also be calculated in a similar manner as discussed previously with respect to consumption score  810 . For example, the CSG  800  calculates a consumption score  1810  from events  108  that includes the network address  1824  verified as associated with a private org location. As explained previously with respect to  FIGS. 8-9 , the CSG  800  may generate consumption score  1810  for a topic  102  based on an average topic relevancy score  976  for the group of events  108 . CSG  800  may adjust consumption score  1810  based on the total number of events  970 , number of unique users  972 , and topic volume  974  as described previously in  FIG. 9 . In this example, the entity classification system  1600  and the CCM  100  as being separate entities, however, in other implementations, the entity classification system  1600  may be part of (or within) the CCM  100 . 
     Entity classification system  1600  may continuously update network entity map  1608  and CSG  800  may continuously confirm which received network addresses  1824  are associated with private org locations. GSG  800  may stop generating consumption scores  910  for any network addresses  1824  that are no longer associated with private org locations. By filtering out events from public org locations and non-org locations, CCM  100  may more accurately identify topics of interest and surges for particular types of orgs (e.g., businesses or the like). 
     As mentioned above, CCM  100  may send consumption scores  1810  and/or any surge information  1812  for an org associated with network address  1824  to service provider  118 . Service provider  118  may store a contact list  1815  including contacts  818  for org XYZ. Service provider  118  may send information object  1820  related to topic  102 A to contacts  1818  when consumption data  1810  identifies a surge  1812 . In another example, CCM  100  may tag the profiles of users associated with the identified businesses/entity  1808 . CCM  100  them may accumulate all of the user intent vectors associated with the same company as described previously. 
       FIG. 19  shows examples of features generated by feature generator  1602  from events  108  and  FIG. 20  shows the associated operations performed by feature generator  1602 . As described previously, any number of features/metrics can be generated from events  108  and then used by the classification system  1600  to classify network addresses. Feature generator  1602  may generate features  1604  over any programmable time period, such as daily. 
     Referring to  FIGS. 19 and 20 , in operation  2001  feature generator  1602  receives events  108  that include associated network addresses  954 A- 954 D. Feature generator  1602  may generate features  1604 A- 1604 E using all of the events  108  received during that day that include the same network address. Feature generator  1602  may generate some features  1604  as mean values, average values, ratios, percentages, normalized values, etc. The actual values shown in feature dataset  1712  are just examples and may vary based on the specific calculations used by feature generator  1602 . 
     In operation  2002 , feature generator  1602  calculates a feature  1604 A that identifies a mean total number of events generated at each network address  954  for a desired time period (e.g., during each day). For example, feature generator  1602  may calculate the mean total events generated by each user from the network address per day. Feature  1604 A may help distinguish network addresses associated with orgs (e.g., businesses, enterprises, etc.) from other network addresses associated with individuals or other non-org entities. 
     In operation  2003 , feature generator  1602  generates a feature  1604 B that identifies a ratio of events  108  generated during operating time periods (e.g. working hours) vs. events  108  generated during non-operating time periods (e.g. non-working hours). For example, feature generator  1602  may calculate the mean number of events generated for each user for a certain time period (e.g., between 8 am-6 pm) compared with all other hours. Feature  1604 B may help distinguish network addresses associated with private org locations where users generally access content during business hours from network addresses associated with other public org locations where users may access content any time of the day. 
     In operation  2004 , feature generator  1602  generates a feature  1604 C that identifies a percentage of events generated on weekends and/or other non-operational times/dates. Feature  1604 C also helps distinguish network addresses associated with private org locations where users generally access content during work days from other public org locations and private home locations where users may access a higher percentage of content during the weekends. 
     In operation  2005 , feature generator  1602  generates a feature  1604 D that identifies the amount of time users actively access information objects from the network address. Feature generator  1602  may identify the first time a particular user accesses information objects at the network address during the day and identify the last time particular the user accesses content at the same network address during that day. Feature  1604 D may help distinguish private org locations where users generally access different content/information objects throughout the day at the same org location vs. public org locations where users may only access content/information objects for a short amount of time while purchasing a product, such as coffee at a coffee shop. 
     Feature generator  1602  may extend the active time  1604 D as long as the user accesses some content within some time period. In another example, feature generator  1602  may terminate active time periods when the user does not access content for some amount of time. Feature generator  1602  then may identify the longest or average active time periods for each user and then calculate an average active time for all users that access content at the network address  954 . Many users at public org locations, such as a coffee shop, may have zero duration events since the user may only generate one event at that network address. 
     In operation  2006 , feature generator  1602  generates a feature  1604 E that identifies the percentage of information objects accessed by different device types. In one example, the feature generator  1602  generates a feature  1604 E that identifies the percentage of information objects accessed by users with mobile devices, such as cell phones, tablets, laptops, wearables, and/or the like. In this example, the feature  1604 E may help distinguish private org locations where users mostly use personal computers or laptops from public org locations where users may more frequently access content with cell phones. 
     In operation  2007 , feature generator  1602  generates a feature  1604 E that identifies a percentage of time users are active at a particular network address vs. other network addresses. This may also help distinguish private org locations where users generally spend more time accessing content vs. public org locations where users may spend less time accessing content. In another example, feature generator  1602  may identify the average number of users that have accessed the same network address over a week. A public org location may have a larger number of users access the network address over a week. 
     Example features used in the ML model according to the various embodiments discussed herein may include, but are not limited to, the any combination of the features in Table 1. 
     
       
         
           
               
               
             
               
                 TABLE 1 
               
               
                   
               
               
                 Feature 
                 Description 
               
               
                   
               
             
            
               
                 ip_p_during_business 
                 The percent of an IPs activity that happens during business 
               
               
                   
                 hours. “Business hours” being defined as 8am-6pm M-F. For 
               
               
                   
                 example, an IP that is active 24/7 may have a value of 0.30. 
               
               
                   
                 A business active 24 hours a day during M-F may have a 
               
               
                   
                 value of 0.42 
               
               
                 mean_profile_p_during_business_global 
                 This feature looks at the average percentage of activity during 
               
               
                   
                 business hours of the profiles that have visited this network 
               
               
                   
                 address. This feature is different than ‘ip_p_during_business’ 
               
               
                   
                 because it aggregates over the global behavior over profiles 
               
               
                   
                 at the IP rather than only the profile at the IP. 
               
               
                 mean_dow_active_global 
                 An average over the profiles at an IP of how many days of the 
               
               
                   
                 week they are active globally (i.e. across all IPs). For 
               
               
                   
                 example, if there are two profiles at an IP, and one has been 
               
               
                   
                 active 7 days (even if not at this IP for all 7 days) and another 
               
               
                   
                 active for only 2 days the value may be 4.5. 
               
               
                 mean_dow_active_at_ip 
                 An average over the profiles at an IP of how many days of the 
               
               
                   
                 week each profile is active only at the specific IP. So even if a 
               
               
                   
                 user was active 7 days globally, but only 1 day at this IP, then 
               
               
                   
                 only that 1 day would be considered 
               
               
                 mean_percent_weekday_at_ip 
                 An average over the profiles of what percentage of their 
               
               
                   
                 activity happened at the specific network address during the 
               
               
                   
                 week. For example, if all of a profile&#39;s traffic was Wednesday 
               
               
                   
                 and Friday, their individual percent weekday would be 1. This 
               
               
                   
                 feature is the mean of this metric for all profiles at a network 
               
               
                   
                 address 
               
               
                 mean_avg_start_hour_global 
                 Averages across profiles at an IP the hour, in local time, of 
               
               
                   
                 the profile&#39;s average first activity globally 
               
               
                 mean_avg_end_hour_global 
                 Averages across profiles at an IP the hour, in local time, of 
               
               
                   
                 the profile&#39;s average last activity globally 
               
               
                 mean_avg_start_hour_at_ip 
                 Averages across profiles at an IP the hour, in local time, of 
               
               
                   
                 the profile&#39;s average first activity only at the specific IP 
               
               
                 mean_avg_end_hour_at_ip 
                 Averages across profiles at an IP the hour, in local time, of 
               
               
                   
                 the profile&#39;s average last activity only at the specific IP 
               
               
                 mean_avg_duration_at_ip 
                 For each profile at the IP, it takes the average “duration” of 
               
               
                   
                 activity for each profile. The “duration” is defined as the last 
               
               
                   
                 timestamp-first timestamp. This means that a profile with a 
               
               
                   
                 single event will have a duration of 0. The duration of each 
               
               
                   
                 day for each profile is averaged, then the average of all 
               
               
                   
                 profiles is taken to provide the value for this feature 
               
               
                 mean_avg_duration_ratio 
                 this is the ratio of the ‘duration_at_ip’ and the 
               
               
                   
                 ‘duration_global’ averaged per profile then averaged across 
               
               
                   
                 all these profiles 
               
               
                 mean_pages_visited_ratio 
                 the ratio of pages viewed at this IP over the pages viewed 
               
               
                   
                 globally per profile, averaged across all profiles 
               
               
                 mean_dow_active_ratio 
                 the ratio of days of week active at this IP over the days of 
               
               
                   
                 week active globally, averaged across all profiles 
               
               
                 mean_avg_start_hour_diff 
                 the feature looks at the difference between when a profile 
               
               
                   
                 starts at the IP and globally, then averages this difference for 
               
               
                   
                 each profile for the entire period then takes the average 
               
               
                   
                 across all profiles 
               
               
                 mean_profile_p_during_business_ratio 
                 average ratio of the percentage of profile activity that 
               
               
                   
                 happens at the IP vs globally 
               
               
                 mean_avg_end_hour_diff 
                 the feature looks at the difference between when a profile 
               
               
                   
                 ends at the IP and globally, then averages this difference for 
               
               
                   
                 each profile for the entire period then takes the average 
               
               
                   
                 across all profiles 
               
               
                 mean_p_sunday_evts_at_ip 
                 Average over profiles at IP of what percentage of their hours 
               
               
                   
                 are on Sunday 
               
               
                 mean_p_monday_evts_at_ip 
                 Average over profiles at IP of what percentage of their hours 
               
               
                   
                 are on Monday 
               
               
                 mean_p_tuesday_evts_at_ip 
                 Average over profiles at IP of what percentage of their hours 
               
               
                   
                 are on Tuesday 
               
               
                 mean_p_wednesday_evts_at_ip 
                 Average over profiles at IP of what percentage of their hours 
               
               
                   
                 are on Wednesday 
               
               
                 mean_p_thursday_evts_at_ip 
                 Average over profiles at IP of what percentage of their hours 
               
               
                   
                 are on Thursday 
               
               
                 mean_p_friday_evts_at_ip 
                 Average over profiles at IP of what percentage of their hours 
               
               
                   
                 are on Friday 
               
               
                 mean_p_saturday_evts_at_ip 
                 Average over profiles at IP of what percentage of their hours 
               
               
                   
                 are on Saturday 
               
               
                 mean_avg_daily_pages_visited 
                 Looks at the average number of pages a profile visits at the 
               
               
                   
                 IP per day, then averages these across all profiles at the IP 
               
               
                 percent_mobile 
                 Percentage of traffic from IP that has the device type of 
               
               
                   
                 mobile (note: only non-null values are used for this 
               
               
                   
                 calculation). Here, mobile device types may include 
               
               
                   
                 smartphones, handheld gaming consoles, portable music 
               
               
                   
                 players, personal navigation devices, digital cameras, and/or 
               
               
                   
                 the like. 
               
               
                 percent_tablet 
                 Percentage of traffic from IP that has the device type of tablet 
               
               
                   
                 (note: only non-null values are used for this calculation) 
               
               
                 percent_wearable 
                 Percentage of traffic from IP that has the device type of 
               
               
                   
                 wearable (note: only non-null values are used for this 
               
               
                   
                 calculation). Wearable device types may include smart 
               
               
                   
                 watches, head-mounted devices (e.g., smart glasses), 
               
               
                   
                 activity/fitness trackers, and/or the like. 
               
               
                 percent_laptop 
                 Percentage of traffic from IP that has the device type of 
               
               
                   
                 laptop (note: only non-null values are used for this 
               
               
                   
                 calculation). Laptop device types may include traditional 
               
               
                   
                 laptops, laptop/tablet hybrids (e.g., 2-in-1s), netbooks, and/or 
               
               
                   
                 the like. 
               
               
                 percent_desktop 
                 Percentage of traffic from IP that has the device type of 
               
               
                   
                 desktop (note: only non-null values are used for this 
               
               
                   
                 calculation). Desktop device types may include consumer- 
               
               
                   
                 oriented personal computers, workstations, video game 
               
               
                   
                 consoles, and/or the like 
               
               
                 normalized_entropy 
                 This is a Shannon entropy of profile_atr_domain for the 
               
               
                   
                 network address. For example, it represents how much 
               
               
                   
                 confusion there is in the profile_atr_domains for the IP. The 
               
               
                   
                 Shannon entropy is then divided by the maximum possible 
               
               
                   
                 entropy yielding a value between [0.0, 1.0] which is the 
               
               
                   
                 normalized entropy. Note that this value can be NaN when 
               
               
                   
                 the Shannon entropy is 0. This has the interpretation that the 
               
               
                   
                 normalized entropy should be 0 
               
               
                 profile_events_ratio 
                 This feature compares the number of events generated by 
               
               
                   
                 each profile at an IP, on average. In one example, the IP 
               
               
                   
                 might have short-lived users, who generate an average of two 
               
               
                   
                 events, thus this feature would have a value of 0.5. In another 
               
               
                   
                 example, an IP might have many business users, who 
               
               
                   
                 generate on average 10 events, resulting in this feature 
               
               
                   
                 taking a value of 0.1. To note, the range for this feature is 
               
               
                   
                 from (0, 1] unlike more intuitive reciprocals which range from 
               
               
                   
                 [1, infty) 
               
               
                 ua_events_ratio 
                 This feature is similar to profile_events_ratio only it uses the 
               
               
                   
                 number of unique user agents instead of profiles 
               
               
                 log10_mean_ips_visited 
                 The log10 transform of the average number of network 
               
               
                   
                 addresses visited by each profile at this IP 
               
               
                 log10_mean_pages_visited_global 
                 The log10 transform of the average number of pages 
               
               
                   
                 visited/viewed globally by profiles that have been at this 
               
               
                   
                 network address 
               
               
                 log10_mean_pages_visited_at_ip 
                 The log10 transform of the average number of pages 
               
               
                   
                 visited/viewed globally by profiles that have been at this 
               
               
                   
                 network address 
               
               
                 log10_mean_avg_daily_ips_visited 
                 This is the same as log10_mean_ips_visited only it first 
               
               
                   
                 averages over the daily IPs visited per profile 
               
               
                   
               
            
           
         
       
     
     The features described by Table 1 may correspond to the features  1604  of the feature dataset  1712 . Feature generator  1602  may identify any other feature  1604  that indicates how users may access content at different network address locations. As explained previously, NACS  1600  uses feature dataset  1712  to then identify the different types of establishments associated with different network addresses. 
     Beyond predicting whether or not a network address behaves like a business, NACS  1600  can make other inferences about the type of physical location (e.g., hotel, coffee shop, hospital, etc.) or underlying application or process (e.g., mobile network operator, university, botnet, proxy) the network address supports. For instance, NACS  1600  may infer additional firmographic attributes, such as industry, company size, etc. 
     NACS  1600  may also predict other organization characteristics associated with network addresses  954 . In the example above, NACS  1600  generated prediction values  820  that indicate the probability of network address  954  being associated with a org location (IS-BIZ). 
       FIG. 21  depicts example org characteristics or org features (F ORG ) generated by the NACS  1600 , according to various embodiments. Referring to  FIGS. 16 and 21 , the NACS  1600  may predict organization types  2140  associated with an external-facing network address  954 . Examples of different org types  2140  are described by Table Y. 
     
       
         
           
               
               
               
             
               
                 TABLE Y 
               
               
                   
               
               
                 Org Type 
                 Org Code 
                 Description 
               
               
                   
               
             
            
               
                 Enterprise 
                 ENT 
                 A network address of an enterprise such as a corporate office or the like, 
               
               
                   
                   
                 where an enterprise may be defined as an org with a predefined number of 
               
               
                   
                   
                 employees such as equal to or more than 100 employees. 
               
               
                 Small-medium 
                 SMB 
                 A network address of a small-medium org location, where a small-medium 
               
               
                 business 
                   
                 org is defined as an org with a smaller number of employees than an 
               
               
                   
                   
                 enterprise, such as less than 100 employees. 
               
               
                 Co-Workspaces 
                 COW 
                 A network address of a co-working environment shared by multiple 
               
               
                   
                   
                 organization entities. The individual orgs in a co-working environment may 
               
               
                   
                   
                 be small-medium business orgs or enterprise level orgs. 
               
               
                 Residential 
                 RES 
                 A network address of a home or residence. 
               
               
                 Educational 
                 EDU 
                 A network address associated with an educational institution, such as 
               
               
                   
                   
                 schools, colleges, or universities. 
               
               
                 Hotel 
                 HOTL 
                 A network address of a hotel. 
               
               
                 Airport 
                 AIRP 
                 A network address of an airport. 
               
               
                 Military 
                 MIL 
                 A network address associated with a military installation, such as a military 
               
               
                   
                   
                 base, command center, air station, and/or the like 
               
               
                 Mobile Network 
                 MNO 
                 A network address of a network to support mobile device internet 
               
               
                 Operators 
                   
                 connectivity 
               
               
                 Internet Service 
                 ISP 
                 A network address of an internet service provider or other network to 
               
               
                 Provider 
                   
                 support device internet connectivity. 
               
               
                 BOT and PROXY 
                 B&amp;P 
                 A network address of a network that supports non-human Internet traffic. 
               
               
                   
                   
                 For example, bots may access websites when crawling for content, and 
               
               
                   
                   
                 proxies may fetch data on behalf of users when navigating on webpages. 
               
               
                   
                   
                 This category may also include Internet of Things (IoT) devices and/or 
               
               
                   
                   
                 autonomous sensors. 
               
               
                 Social Hubs 
                 SHUB 
                 A network address of a public place where social gatherings are likely to 
               
               
                   
                   
                 take place, e.g., café, bar, restaurant, park, or other public/social org 
               
               
                   
                   
                 location. 
               
               
                   
               
            
           
         
       
     
     NetAdr classification model  1618  may generate single prediction values  2144  for a group of F ORG    2140 , such as predicting a network address located at either an IS-BIZ or an IS-SMB. For example, a multiclass classification model  1618  may generate separate prediction values  2144  for each different organization type  2140  in F ORG  vector  2142 . In ML, multiclass or multinominal classification refers to classifying instances into one of three or more classes, and binary classification refers to classifying instances into two classes. 
     As mentioned previously, CCM  100  may selectively process events  108  with network addresses associated with particular organization characteristics  2140 . Network address classification substantially improves the performance of computer systems by allowing CCM  100  to filter out and reduce associated computer processing for events  108  associated with certain organization characteristics  2140 . CCM  100  can also more accurately calculate consumption scores and detect surge events based on the F ORG    2140  associated with events  108 . 
     The embodiments discussed herein allow the CCM  100  to generate more accurate intent data than existing/conventional solutions by distinguishing the locations or location types of various events  108 , such as by distinguishing company events  108  from general public or user/customer events  108 . The CCM  100  uses processing resources more efficiently by generating consumption scores for different types of locations, such as by generating certain consumption scores only for business related intent data and/or other types of consumption scores for events sent from public locations. The CCM  100  may also provide more secure network analytics by generating consumption scores for network addresses without using PII, sensitive data, and/or confidential data, thereby improving information security for end-users. 
     The more accurate intent data and consumptions scores allow service providers  118  to conserve computational and network resources by providing a means for better targeting users so that unwanted and seemingly random content is not distributed to users that do not want such content. This is a technological improvement in that it conserves network and computational resources of service providers  118  that distribute this content by reducing the amount of content generated and sent to end-user devices. Network resources may be reduced and/or conserved at end-user devices by reducing or eliminating the need for using resources to receive unwanted content, and computational resources may be reduced and/or conserved at end-user devices by reducing or eliminating the need to implement spam filters and/or reducing the amount of data to be processed when analyzing and/or deleting such content. 
     7. Example Hardware and Software Configurations and Implementations 
       FIG. 22  illustrates an example of an computing system  2200  (also referred to as “computing device  2200 ,” “platform  2200 ,” “device  2200 ,” “appliance  2200 ,” “server  2200 ,” or the like) in accordance with various embodiments. The computing system  2200  may be suitable for use as any of the computer devices discussed herein and performing any combination of processes discussed above. As examples, the computing device  2200  may operate in the capacity of a server or a client machine in a server-client network environment, or as a peer machine in a peer-to-peer (or distributed) network environment. Additionally or alternatively, the system  2200  may represent the CCM  100 , NACS  1600 , user computer(s)  230 ,  530 ,  1400 , network devices  1614 , application server(s) (e.g., owned/operated by service providers  118 ), a third party platform or collection of servers that hosts and/or serves information objects  112 , and/or any other system or device discussed previously. Additionally or alternatively, various combinations of the components depicted by  FIG. 22  may be included depending on the particular system/device that system  2200  represents. For example, when system  2200  represents a user or client device, the system  2200  may include some or all of the components shown by  FIG. 22 . In another example, when the system  2200  re NACS  1600  presents the CCM  100  or a server computer system, the system  2200  may not include the communication circuitry  2209  or battery  2224 , and instead may include multiple NICs  2216  or the like. As examples, the system  2200  and/or the remote system  2255  may comprise desktop computers, workstations, laptop computers, mobile cellular phones (e.g., “smartphones”), tablet computers, portable media players, wearable computing devices, server computer systems, web appliances, network appliances, an aggregation of computing resources (e.g., in a cloud-based environment), or some other computing devices capable of interfacing directly or indirectly with network  2250  or other network, and/or any other machine or device capable of executing instructions (sequential or otherwise) that specify actions to be taken by that machine. 
     The components of system  2200  may be implemented as an individual computer system, or as components otherwise incorporated within a chassis of a larger system. The components of system  2200  may be implemented as integrated circuits (ICs) or other discrete electronic devices, with the appropriate logic, software, firmware, or a combination thereof, adapted in the computer system  2200 . Additionally or alternatively, some of the components of system  2200  may be combined and implemented as a suitable System-on-Chip (SoC), System-in-Package (SiP), multi-chip package (MCP), or the like. 
     The system  2200  includes physical hardware devices and software components capable of providing and/or accessing content and/or services to/from the remote system  2255 . The system  2200  and/or the remote system  2255  can be implemented as any suitable computing system or other data processing apparatus usable to access and/or provide content/services from/to one another. The remote system  2255  may have a same or similar configuration and/or the same or similar components as system  2200 . The system  2200  communicates with remote systems  2255 , and vice versa, to obtain/serve content/services using, for example, Hypertext Transfer Protocol (HTTP) over Transmission Control Protocol (TCP)/Internet Protocol (IP), or one or more other common Internet protocols such as File Transfer Protocol (FTP); Session Initiation Protocol (SIP) with Session Description Protocol (SDP), Real-time Transport Protocol (RTP), or Real-time Streaming Protocol (RTSP); Secure Shell (SSH), Extensible Messaging and Presence Protocol (XMPP); WebSocket; and/or some other communication protocol, such as those discussed herein. 
     As used herein, the term “content” refers to visual or audible information to be conveyed to a particular audience or end-user, and may include or convey information pertaining to specific subjects or topics. Content or content items may be different content types (e.g., text, image, audio, video, etc.), and/or may have different formats (e.g., text files including Microsoft® Word® documents, Portable Document Format (PDF) documents, HTML documents; audio files such as MPEG-4 audio files and WebM audio and/or video files; etc.). As used herein, the term “service” refers to a particular functionality or a set of functions to be performed on behalf of a requesting party, such as the system  2200 . As examples, a service may include or involve the retrieval of specified information or the execution of a set of operations. In order to access the content/services, the system  2200  includes components such as processors, memory devices, communication interfaces, and the like. However, the terms “content” and “service” may be used interchangeably throughout the present disclosure even though these terms refer to different concepts. 
     Referring now to system  2200 , the system  2200  includes processor circuitry  2202 , which is configurable or operable to execute program code, and/or sequentially and automatically carry out a sequence of arithmetic or logical operations; record, store, and/or transfer digital data. The processor circuitry  2202  includes circuitry such as, but not limited to one or more processor cores and one or more of cache memory, low drop-out voltage regulators (LDOs), interrupt controllers, serial interfaces such as serial peripheral interface (SPI), inter-integrated circuit (I 2 C) or universal programmable serial interface circuit, real time clock (RTC), timer-counters including interval and watchdog timers, general purpose input-output (I/O), memory card controllers, interconnect (IX) controllers and/or interfaces, universal serial bus (USB) interfaces, mobile industry processor interface (MIPI) interfaces, Joint Test Access Group (JTAG) test access ports, and the like. The processor circuitry  2202  may include on-chip memory circuitry or cache memory circuitry, which may include any suitable volatile and/or non-volatile memory, such as DRAM, SRAM, EPROM, EEPROM, Flash memory, solid-state memory, and/or any other type of memory device technology, such as those discussed herein. Individual processors (or individual processor cores) of the processor circuitry  2202  may be coupled with or may include memory/storage and may be configurable or operable to execute instructions stored in the memory/storage to enable various applications or operating systems to run on the system  2200 . In these embodiments, the processors (or cores) of the processor circuitry  2202  are configurable or operable to operate application software (e.g., logic/modules  2280 ) to provide specific services to a user of the system  2200 . In some embodiments, the processor circuitry  2202  may include special-purpose processor/controller to operate according to the various embodiments herein. 
     In various implementations, the processor(s) of processor circuitry  2202  may include, for example, one or more processor cores (CPUs), graphics processing units (GPUs), Tensor Processing Units (TPUs), reduced instruction set computing (RISC) processors, Acorn RISC Machine (ARM) processors, complex instruction set computing (CISC) processors, digital signal processors (DSP), programmable logic devices (PLDs), field-programmable gate arrays (FPGAs), Application Specific Integrated Circuits (ASICs), SoCs and/or programmable SoCs, microprocessors or controllers, or any suitable combination thereof. As examples, the processor circuitry  2202  may include Intel® Core™ based processor(s), MCU-class processor(s), Xeon® processor(s); Advanced Micro Devices (AMD) Zen® Core Architecture processor(s), such as Ryzen® or Epyc® processor(s), Accelerated Processing Units (APUs), MxGPUs, or the like; A, S, W, and T series processor(s) from Apple® Inc., Snapdragon™ or Centrig™ processor(s) from Qualcomm® Technologies, Inc., Texas Instruments, Inc.® Open Multimedia Applications Platform (OMAP)™ processor(s); Power Architecture processor(s) provided by the OpenPOWER® Foundation and/or IBM®, MIPS Warrior M-class, Warrior I-class, and Warrior P-class processor(s) provided by MIPS Technologies, Inc.; ARM Cortex-A, Cortex-R, and Cortex-M family of processor(s) as licensed from ARM Holdings, Ltd.; the ThunderX2® provided by Cavium™, Inc.; GeForce®, Tegra®, Titan X®, Tesla®, Shield®, and/or other like GPUs provided by Nvidia®; or the like. Other examples of the processor circuitry  2202  may be mentioned elsewhere in the present disclosure. 
     In some implementations, the processor(s) of processor circuitry  2202  may be, or may include, one or more media processors comprising microprocessor-based SoC(s), FPGA(s), or DSP(s) specifically designed to deal with digital streaming data in real-time, which may include encoder/decoder circuitry to compress/decompress (or encode and decode) Advanced Video Coding (AVC) (also known as H.264 and MPEG-4) digital data, High Efficiency Video Coding (HEVC) (also known as H.265 and MPEG-H part 2) digital data, and/or the like. 
     In some implementations, the processor circuitry  2202  may include one or more hardware accelerators. The hardware accelerators may be microprocessors, configurable hardware (e.g., FPGAs, programmable ASICs, programmable SoCs, DSPs, etc.), or some other suitable special-purpose processing device tailored to perform one or more specific tasks or workloads, for example, specific tasks or workloads of the subsystems of the CCM  100 , IP2D resolution system  850 , and/or some other system/device discussed herein, which may be more efficient than using general-purpose processor cores. In some embodiments, the specific tasks or workloads may be offloaded from one or more processors of the processor circuitry  2202 . In these implementations, the circuitry of processor circuitry  2202  may comprise logic blocks or logic fabric including and other interconnected resources that may be programmed to perform various functions, such as the procedures, methods, functions, etc. of the various embodiments discussed herein. Additionally, the processor circuitry  2202  may include memory cells (e.g., EPROM, EEPROM, flash memory, static memory (e.g., SRAM, anti-fuses, etc.) used to store logic blocks, logic fabric, data, etc. in LUTs and the like. 
     In some implementations, the processor circuitry  2202  may include hardware elements specifically tailored for machine learning functionality, such as for operating the subsystems of the CCM  100  discussed previously with regard to  FIG. 2 . In these implementations, the processor circuitry  2202  may be, or may include, an AI engine chip that can run many different kinds of AI instruction sets once loaded with the appropriate weightings and training code. Additionally or alternatively, the processor circuitry  2202  may be, or may include, AI accelerator(s), which may be one or more of the aforementioned hardware accelerators designed for hardware acceleration of AI applications, such as one or more of the subsystems of CCM  100 , IP2D resolution system  850 , and/or some other system/device discussed herein. As examples, these processor(s) or accelerators may be a cluster of artificial intelligence (AI) GPUs, tensor processing units (TPUs) developed by Google® Inc., Real AI Processors (RAPs™) provided by AlphaICs®, Nervana™ Neural Network Processors (NNPs) provided by Intel® Corp., Intel® Movidius™ Myriad™ X Vision Processing Unit (VPU), NVIDIA® PX™ based GPUs, the NM500 chip provided by General Vision®, Hardware 3 provided by Tesla®, Inc., an Epiphany™ based processor provided by Adapteva®, or the like. In some embodiments, the processor circuitry  2202  and/or hardware accelerator circuitry may be implemented as AI accelerating co-processor(s), such as the Hexagon 685 DSP provided by Qualcomm®, the PowerVR 2NX Neural Net Accelerator (NNA) provided by Imagination Technologies Limited®, the Neural Engine core within the Apple® A11 or A12 Bionic SoC, the Neural Processing Unit (NPU) within the HiSilicon Kirin 970 provided by Huawei®, and/or the like. 
     In some implementations, the processor(s) of processor circuitry  2202  may be, or may include, one or more custom-designed silicon cores specifically designed to operate corresponding subsystems of the CCM  100 , IP2D resolution system  850 , and/or some other system/device discussed herein. These cores may be designed as synthesizable cores comprising hardware description language logic (e.g., register transfer logic, verilog, Very High Speed Integrated Circuit hardware description language (VHDL), etc.); netlist cores comprising gate-level description of electronic components and connections and/or process-specific very-large-scale integration (VLSI) layout; and/or analog or digital logic in transistor-layout format. In these implementations, one or more of the subsystems of the CCM  100 , IP2D resolution system  850 , and/or some other system/device discussed herein may be operated, at least in part, on custom-designed silicon core(s). These “hardware-ized” subsystems may be integrated into a larger chipset but may be more efficient that using general purpose processor cores. 
     The system memory circuitry  2204  comprises any number of memory devices arranged to provide primary storage from which the processor circuitry  2202  continuously reads instructions  2282  stored therein for execution. In some embodiments, the memory circuitry  2204  is on-die memory or registers associated with the processor circuitry  2202 . As examples, the memory circuitry  2204  may include volatile memory such as random access memory (RAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), etc. The memory circuitry  2204  may also include nonvolatile memory (NVM) such as high-speed electrically erasable memory (commonly referred to as “flash memory”), phase change RAM (PRAM), resistive memory such as magnetoresistive random access memory (MRAM), etc. The memory circuitry  2204  may also comprise persistent storage devices, which may be temporal and/or persistent storage of any type, including, but not limited to, non-volatile memory, optical, magnetic, and/or solid state mass storage, and so forth. 
     In some implementations, some aspects (or devices) of memory circuitry  2204  and storage circuitry  2208  may be integrated together with a processing device  2202 , for example RAM or FLASH memory disposed within an integrated circuit microprocessor or the like. In other implementations, the memory circuitry  2204  and/or storage circuitry  2208  may comprise an independent device, such as an external disk drive, storage array, or any other storage devices used in database systems. The memory and processing devices may be operatively coupled together, or in communication with each other, for example by an I/O port, network connection, etc. such that the processing device may read a file stored on the memory. 
     Some memory may be “read only” by design (ROM) by virtue of permission settings, or not. Other examples of memory may include, but may be not limited to, WORM, EPROM, EEPROM, FLASH, etc. which may be implemented in solid state semiconductor devices. Other memories may comprise moving parts, such a conventional rotating disk drive. All such memories may be “machine-readable” in that they may be readable by a processing device. 
     Storage circuitry  2208  is arranged to provide persistent storage of information such as data, applications, operating systems (OS), and so forth. As examples, the storage circuitry  2208  may be implemented as hard disk drive (HDD), a micro HDD, a solid-state disk drive (SSDD), flash memory cards (e.g., SD cards, microSD cards, xD picture cards, and the like), USB flash drives, on-die memory or registers associated with the processor circuitry  2202 , resistance change memories, phase change memories, holographic memories, or chemical memories, and the like. 
     The storage circuitry  2208  is configurable or operable to store computational logic  2280  (or “modules  2280 ”) in the form of software, firmware, microcode, or hardware-level instructions to implement the techniques described herein. The computational logic  2280  may be employed to store working copies and/or permanent copies of programming instructions, or data to create the programming instructions, for the operation of various components of system  2200  (e.g., drivers, libraries, application programming interfaces (APIs), etc.), an OS of system  2200 , one or more applications, and/or for carrying out the embodiments discussed herein. The computational logic  2280  may be stored or loaded into memory circuitry  2204  as instructions  2282 , or data to create the instructions  2282 , which are then accessed for execution by the processor circuitry  2202  to carry out the functions described herein. The processor circuitry  2202  accesses the memory circuitry  2204  and/or the storage circuitry  2208  over the interconnect (IX)  2206 . The instructions  2282  to direct the processor circuitry  2202  to perform a specific sequence or flow of actions, for example, as described with respect to flowchart(s) and block diagram(s) of operations and functionality depicted previously. The various elements may be implemented by assembler instructions supported by processor circuitry  2202  or high-level languages that may be compiled into instructions  2284 , or data to create the instructions  2284 , to be executed by the processor circuitry  2202 . The permanent copy of the programming instructions may be placed into persistent storage devices of storage circuitry  2208  in the factory or in the field through, for example, a distribution medium (not shown), through a communication interface (e.g., from a distribution server (not shown)), or over-the-air (OTA). 
     The operating system (OS) of system  2200  may be a general purpose OS or an OS specifically written for and tailored to the computing system  2200 . For example, when the system  2200  is a server system or a desktop or laptop system  2200 , the OS may be Unix or a Unix-like OS such as Linux e.g., provided by Red Hat Enterprise, Windows 10™ provided by Microsoft Corp.®, macOS provided by Apple Inc.®, or the like. In another example where the system  2200  is a mobile device, the OS may be a mobile OS, such as Android® provided by Google Inc.®, iOS® provided by Apple Inc.®, Windows 10 Mobile® provided by Microsoft Corp.®, KaiOS provided by KaiOS Technologies Inc., or the like. 
     The OS manages computer hardware and software resources, and provides common services for various applications (e.g., one or more loci/modules  2280 ). The OS may include one or more drivers or APIs that operate to control particular devices that are embedded in the system  2200 , attached to the system  2200 , or otherwise communicatively coupled with the system  2200 . The drivers may include individual drivers allowing other components of the system  2200  to interact or control various I/O devices that may be present within, or connected to, the system  2200 . For example, the drivers may include a display driver to control and allow access to a display device, a touchscreen driver to control and allow access to a touchscreen interface of the system  2200 , sensor drivers to obtain sensor readings of sensor circuitry  2221  and control and allow access to sensor circuitry  2221 , actuator drivers to obtain actuator positions of the actuators  2222  and/or control and allow access to the actuators  2222 , a camera driver to control and allow access to an embedded image capture device, audio drivers to control and allow access to one or more audio devices. The OSs may also include one or more libraries, drivers, APIs, firmware, middleware, software glue, etc., which provide program code and/or software components for one or more applications to obtain and use the data from other applications operated by the system  2200 , such as the various subsystems of the CCM  100 , IP2D resolution system  850 , and/or some other system/device discussed previously. 
     The components of system  2200  communicate with one another over the interconnect (IX)  2206 . The IX  2206  may include any number of IX technologies such as industry standard architecture (ISA), extended ISA (EISA), inter-integrated circuit (I 2 C), an serial peripheral interface (SPI), point-to-point interfaces, power management bus (PMBus), peripheral component interconnect (PCI), PCI express (PCIe), Intel® Ultra Path Interface (UPI), Intel® Accelerator Link (IAL), Common Application Programming Interface (CAPI), Intel® QuickPath Interconnect (QPI), Intel® Omni-Path Architecture (OPA) IX, RapidIO™ system interconnects, Ethernet, Cache Coherent Interconnect for Accelerators (CCIA), Gen-Z Consortium IXs, Open Coherent Accelerator Processor Interface (OpenCAPI), and/or any number of other IX technologies. The IX  2206  may be a proprietary bus, for example, used in a SoC based system. 
     The communication circuitry  2209  is a hardware element, or collection of hardware elements, used to communicate over one or more networks (e.g., network  2250 ) and/or with other devices. The communication circuitry  2209  includes modem  2210  and transceiver circuitry (“TRx”)  812 . The modem  2210  includes one or more processing devices (e.g., baseband processors) to carry out various protocol and radio control functions. Modem  2210  may interface with application circuitry of system  2200  (e.g., a combination of processor circuitry  2202  and CRM  860 ) for generation and processing of baseband signals and for controlling operations of the TRx  2212 . The modem  2210  may handle various radio control functions that enable communication with one or more radio networks via the TRx  2212  according to one or more wireless communication protocols. The modem  2210  may include circuitry such as, but not limited to, one or more single-core or multi-core processors (e.g., one or more baseband processors) or control logic to process baseband signals received from a receive signal path of the TRx  2212 , and to generate baseband signals to be provided to the TRx  2212  via a transmit signal path. In various embodiments, the modem  2210  may implement a real-time OS (RTOS) to manage resources of the modem  2210 , schedule tasks, etc. 
     The communication circuitry  2209  also includes TRx  2212  to enable communication with wireless networks using modulated electromagnetic radiation through a non-solid medium. TRx  2212  includes a receive signal path, which comprises circuitry to convert analog RF signals (e.g., an existing or received modulated waveform) into digital baseband signals to be provided to the modem  2210 . The TRx  2212  also includes a transmit signal path, which comprises circuitry configurable or operable to convert digital baseband signals provided by the modem  2210  to be converted into analog RF signals (e.g., modulated waveform) that will be amplified and transmitted via an antenna array including one or more antenna elements (not shown). The antenna array may be a plurality of microstrip antennas or printed antennas that are fabricated on the surface of one or more printed circuit boards. The antenna array may be formed in as a patch of metal foil (e.g., a patch antenna) in a variety of shapes, and may be coupled with the TRx  2212  using metal transmission lines or the like. 
     The TRx  2212  may include one or more radios that are compatible with, and/or may operate according to any one or more of the following radio communication technologies and/or standards including but not limited to: a Global System for Mobile Communications (GSM) radio communication technology, a General Packet Radio Service (GPRS) radio communication technology, an Enhanced Data Rates for GSM Evolution (EDGE) radio communication technology, and/or a Third Generation Partnership Project (3GPP) radio communication technology, for example Universal Mobile Telecommunications System (UMTS), Freedom of Multimedia Access (FOMA), 3GPP Long Term Evolution (LTE), 3GPP Long Term Evolution Advanced (LTE Advanced), Code division multiple access 2000 (CDM2000), Cellular Digital Packet Data (CDPD), Mobitex, Third Generation (3G), Circuit Switched Data (CSD), High-Speed Circuit-Switched Data (HSCSD), Universal Mobile Telecommunications System (Third Generation) (UMTS (3G)), Wideband Code Division Multiple Access (Universal Mobile Telecommunications System) (W-CDMA (UMTS)), High Speed Packet Access (HSPA), High-Speed Downlink Packet Access (HSDPA), High-Speed Uplink Packet Access (HSUPA), High Speed Packet Access Plus (HSPA+), Universal Mobile Telecommunications System-Time-Division Duplex (UMTS-TDD), Time Division-Code Division Multiple Access (TD-CDMA), Time Division-Synchronous Code Division Multiple Access (TD-CDMA), 3rd Generation Partnership Project Release 8 (Pre-4th Generation) (3GPP Rel. 8 (Pre-4G)), 3GPP Rel. 9 (3rd Generation Partnership Project Release 9), 3GPP Rel. 10 (3rd Generation Partnership Project Release 10), 3GPP Rel. 11 (3rd Generation Partnership Project Release 11), 3GPP Rel. 12 (3rd Generation Partnership Project Release 12), 3GPP Rel. 8 (3rd Generation Partnership Project Release 8), 3GPP Rel. 14 (3rd Generation Partnership Project Release 14), 3GPP Rel. 15 (3rd Generation Partnership Project Release 15), 3GPP Rel. 16 (3rd Generation Partnership Project Release 16), 3GPP Rel. 17 (3rd Generation Partnership Project Release 17) and subsequent Releases (such as Rel. 18, Rel. 19, etc.), 3GPP 5G, 3GPP LTE Extra, LTE-Advanced Pro, LTE Licensed-Assisted Access (LAA), MuLTEfire, UMTS Terrestrial Radio Access (UTRA), Evolved UMTS Terrestrial Radio Access (E-UTRA), Long Term Evolution Advanced (4th Generation) (LTE Advanced (4G)), cdmaOne (2G), Code division multiple access 2000 (Third generation) (CDM2000 (3G)), Evolution-Data Optimized or Evolution-Data Only (EV-DO), Advanced Mobile Phone System (1st Generation) (AMPS (1G)), Total Access Communication System/Extended Total Access Communication System (TACS/ETACS), Digital AMPS (2nd Generation) (D-AMPS (2G)), Push-to-talk (PTT), Mobile Telephone System (MTS), Improved Mobile Telephone System (IMTS), Advanced Mobile Telephone System (AMTS), OLT (Norwegian for Offentlig Landmobil Telefoni, Public Land Mobile Telephony), MTD (Swedish abbreviation for Mobiltelefonisystem D, or Mobile telephony system D), Public Automated Land Mobile (Autotel/PALM), ARP (Finnish for Autoradiopuhelin, “car radio phone”), NMT (Nordic Mobile Telephony), High capacity version of NTT (Nippon Telegraph and Telephone) (Hicap), Cellular Digital Packet Data (CDPD), Mobitex, DataTAC, Integrated Digital Enhanced Network (iDEN), Personal Digital Cellular (PDC), Circuit Switched Data (CSD), Personal Handy-phone System (PHS), Wideband Integrated Digital Enhanced Network (WiDEN), iBurst, Unlicensed Mobile Access (UMA), also referred to as also referred to as 3GPP Generic Access Network, or GAN standard), Bluetooth®, Bluetooth Low Energy (BLE), IEEE 802.15.4 based protocols (e.g., IPv6 over Low power Wireless Personal Area Networks (6LoWPAN), WirelessHART, MiWi, Thread, I600.11a, etc.) WiFi-direct, ANT/ANT+, ZigBee, Z-Wave, 3GPP device-to-device (D2D) or Proximity Services (ProSe), Universal Plug and Play (UPnP), Low-Power Wide-Area-Network (LPWAN), LoRaWAN™ (Long Range Wide Area Network), Sigfox, Wireless Gigabit Alliance (WiGig) standard, mmWave standards in general (wireless systems operating at 10-300 GHz and above such as WiGig, IEEE 802.11ad, IEEE 802.1 lay, etc.), technologies operating above 300 GHz and THz bands, (3GPP/LTE based or IEEE 802.11p and other) Vehicle-to-Vehicle (V2V) and Vehicle-to-X (V2X) and Vehicle-to-Infrastructure (V2I) and Infrastructure-to-Vehicle (I2V) communication technologies, 3GPP cellular V2X, DSRC (Dedicated Short Range Communications) communication systems such as Intelligent-Transport-Systems and others, the European ITS-G5 system (i.e. the European flavor of IEEE 802.11p based DSRC, including ITS-G5A (i.e., Operation of ITS-G5 in European ITS frequency bands dedicated to ITS for safety related applications in the frequency range 5,875 GHz to 5,905 GHz), ITS-G5B (i.e., Operation in European ITS frequency bands dedicated to ITS non-safety applications in the frequency range 5,855 GHz to 5,875 GHz), ITS-G5C (i.e., Operation of ITS applications in the frequency range 5,470 GHz to 5,725 GHz)), etc. In addition to the standards listed above, any number of satellite uplink technologies may be used for the TRx  2212  including, for example, radios compliant with standards issued by the ITU (International Telecommunication Union), or the ETSI (European Telecommunications Standards Institute), among others, both existing and not yet formulated. 
     Network interface circuitry/controller (NIC)  2216  may be included to provide wired communication to the network  2250  or to other devices using a standard network interface protocol. The standard network interface protocol may include Ethernet, Ethernet over GRE Tunnels, Ethernet over Multiprotocol Label Switching (MPLS), Ethernet over USB, or may be based on other types of network protocols, such as Controller Area Network (CAN), Local Interconnect Network (LIN), DeviceNet, ControlNet, Data Highway+, PROFIBUS, or PROFINET, among many others. Network connectivity may be provided to/from the system  2200  via NIC  2216  using a physical connection, which may be electrical (e.g., a “copper interconnect”) or optical. The physical connection also includes suitable input connectors (e.g., ports, receptacles, sockets, etc.) and output connectors (e.g., plugs, pins, etc.). The NIC  2216  may include one or more dedicated processors and/or FPGAs to communicate using one or more of the aforementioned network interface protocols. In some implementations, the NIC  2216  may include multiple controllers to provide connectivity to other networks using the same or different protocols. For example, the system  2200  may include a first NIC  2216  providing communications to the cloud over Ethernet and a second NIC  2216  providing communications to other devices over another type of network. In some implementations, the NIC  2216  may be a high-speed serial interface (HSSI) NIC to connect the system  2200  to a routing or switching device. 
     Network  2250  comprises computers, network connections among various computers (e.g., between the system  2200  and remote system  2255 ), and software routines to enable communication between the computers over respective network connections. In this regard, the network  2250  comprises one or more network elements that may include one or more processors, communications systems (e.g., including network interface controllers, one or more transmitters/receivers connected to one or more antennas, etc.), and computer readable media. Examples of such network elements may include wireless access points (WAPs), a home/business server (with or without radio frequency (RF) communications circuitry), a router, a switch, a hub, a radio beacon, base stations, picocell or small cell base stations, and/or any other like network device. Connection to the network  2250  may be via a wired or a wireless connection using the various communication protocols discussed infra. As used herein, a wired or wireless communication protocol may refer to a set of standardized rules or instructions implemented by a communication device/system to communicate with other devices, including instructions for packetizing/depacketizing data, modulating/demodulating signals, implementation of protocols stacks, and the like. More than one network may be involved in a communication session between the illustrated devices. Connection to the network  2250  may require that the computers execute software routines which enable, for example, the seven layers of the OSI model of computer networking or equivalent in a wireless (or cellular) phone network. 
     The network  2250  may represent the Internet, one or more cellular networks, a local area network (LAN) or a wide area network (WAN) including proprietary and/or enterprise networks, Transfer Control Protocol (TCP)/Internet Protocol (IP)-based network, or combinations thereof. In such embodiments, the network  2250  may be associated with network operator who owns or controls equipment and other elements necessary to provide network-related services, such as one or more base stations or access points, one or more servers for routing digital data or telephone calls (e.g., a core network or backbone network), etc. Other networks can be used instead of or in addition to the Internet, such as an intranet, an extranet, a virtual private network (VPN), an enterprise network, a non-TCP/IP based network, any LAN or WAN or the like. 
     The external interface  2218  (also referred to as “I/O interface circuitry” or the like) is configurable or operable to connect or coupled the system  2200  with external devices or subsystems. The external interface  2218  may include any suitable interface controllers and connectors to couple the system  2200  with the external components/devices. As an example, the external interface  2218  may be an external expansion bus (e.g., Universal Serial Bus (USB), FireWire, Thunderbolt, etc.) used to connect system  2200  with external (peripheral) components/devices. The external devices include, inter alia, sensor circuitry  2221 , actuators  2222 , and positioning circuitry  2245 , but may also include other devices or subsystems not shown by  FIG. 22 . 
     The sensor circuitry  2221  may include devices, modules, or subsystems whose purpose is to detect events or changes in its environment and send the information (sensor data) about the detected events to some other a device, module, subsystem, etc. Examples of such sensors  621  include, inter alia, inertia measurement units (IMU) comprising accelerometers, gyroscopes, and/or magnetometers; microelectromechanical systems (MEMS) or nanoelectromechanical systems (NEMS) comprising 3-axis accelerometers, 3-axis gyroscopes, and/or magnetometers; level sensors; flow sensors; temperature sensors (e.g., thermistors); pressure sensors; barometric pressure sensors; gravimeters; altimeters; image capture devices (e.g., cameras); light detection and ranging (LiDAR) sensors; proximity sensors (e.g., infrared radiation detector and the like), depth sensors, ambient light sensors, ultrasonic transceivers; microphones; etc. 
     The external interface  2218  connects the system  2200  to actuators  2222 , which allow system  2200  to change its state, position, and/or orientation, or move or control a mechanism or system. The actuators  2222  comprise electrical and/or mechanical devices for moving or controlling a mechanism or system, and/or converting energy (e.g., electric current or moving air and/or liquid) into some kind of motion. The actuators  2222  may include one or more electronic (or electrochemical) devices, such as piezoelectric biomorphs, solid state actuators, solid state relays (SSRs), shape-memory alloy-based actuators, electroactive polymer-based actuators, relay driver integrated circuits (ICs), and/or the like. The actuators  2222  may include one or more electromechanical devices such as pneumatic actuators, hydraulic actuators, electromechanical switches including electromechanical relays (EMRs), motors (e.g., DC motors, stepper motors, servomechanisms, etc.), wheels, thrusters, propellers, claws, clamps, hooks, an audible sound generator, and/or other like electromechanical components. The system  2200  may be configurable or operable to operate one or more actuators  2222  based on one or more captured events and/or instructions or control signals received from a service provider and/or various client systems. In embodiments, the system  2200  may transmit instructions to various actuators  2222  (or controllers that control one or more actuators  2222 ) to reconfigure an electrical network as discussed herein. 
     The positioning circuitry  2245  includes circuitry to receive and decode signals transmitted/broadcasted by a positioning network of a global navigation satellite system (GNSS). Examples of navigation satellite constellations (or GNSS) include United States&#39; Global Positioning System (GPS), Russia&#39;s Global Navigation System (GLONASS), the European Union&#39;s Galileo system, China&#39;s BeiDou Navigation Satellite System, a regional navigation system or GNSS augmentation system (e.g., Navigation with Indian Constellation (NAVIC), Japan&#39;s Quasi-Zenith Satellite System (QZSS), France&#39;s Doppler Orbitography and Radio-positioning Integrated by Satellite (DORIS), etc.), or the like. The positioning circuitry  2245  comprises various hardware elements (e.g., including hardware devices such as switches, filters, amplifiers, antenna elements, and the like to facilitate OTA communications) to communicate with components of a positioning network, such as navigation satellite constellation nodes. In some embodiments, the positioning circuitry  2245  may include a Micro-Technology for Positioning, Navigation, and Timing (Micro-PNT) IC that uses a master timing clock to perform position tracking/estimation without GNSS assistance. The positioning circuitry  2245  may also be part of, or interact with, the communication circuitry  2209  to communicate with the nodes and components of the positioning network. The positioning circuitry  2245  may also provide position data and/or time data to the application circuitry, which may use the data to synchronize operations with various infrastructure (e.g., radio base stations), for turn-by-turn navigation, or the like. 
     The input/output (I/O) devices  2256  may be present within, or connected to, the system  2200 . The I/O devices  2256  include input device circuitry and output device circuitry including one or more user interfaces designed to enable user interaction with the system  2200  and/or peripheral component interfaces designed to enable peripheral component interaction with the system  2200 . The input device circuitry includes any physical or virtual means for accepting an input including, inter alia, one or more physical or virtual buttons (e.g., a reset button), a physical keyboard, keypad, mouse, touchpad, touchscreen, microphones, scanner, headset, and/or the like. The output device circuitry is used to show or convey information, such as sensor readings, actuator position(s), or other like information. Data and/or graphics may be displayed on one or more user interface components of the output device circuitry. The output device circuitry may include any number and/or combinations of audio or visual display, including, inter alia, one or more simple visual outputs/indicators (e.g., binary status indicators (e.g., light emitting diodes (LEDs)) and multi-character visual outputs, or more complex outputs such as display devices or touchscreens (e.g., Liquid Chrystal Displays (LCD), LED displays, quantum dot displays, projectors, etc.), with the output of characters, graphics, multimedia objects, and the like being generated or produced from the operation of the system  2200 . The output device circuitry may also include speakers or other audio emitting devices, printer(s), and/or the like. In some embodiments, the sensor circuitry  2221  may be used as the input device circuitry (e.g., an image capture device, motion capture device, or the like) and one or more actuators  2222  may be used as the output device circuitry (e.g., an actuator to provide haptic feedback or the like). In another example, near-field communication (NFC) circuitry comprising an NFC controller coupled with an antenna element and a processing device may be included to read electronic tags and/or connect with another NFC-enabled device. Peripheral component interfaces may include, but are not limited to, a non-volatile memory port, a universal serial bus (USB) port, an audio jack, a power supply interface, etc. 
     A battery  2224  may be coupled to the system  2200  to power the system  2200 , which may be used in embodiments where the system  2200  is not in a fixed location, such as when the system  2200  is a mobile or laptop client system. The battery  2224  may be a lithium ion battery, a lead-acid automotive battery, or a metal-air battery, such as a zinc-air battery, an aluminum-air battery, a lithium-air battery, a lithium polymer battery, and/or the like. In embodiments where the system  2200  is mounted in a fixed location, such as when the system is implemented as a server computer system, the system  2200  may have a power supply coupled to an electrical grid. In these embodiments, the system  2200  may include power tee circuitry to provide for electrical power drawn from a network cable to provide both power supply and data connectivity to the system  2200  using a single cable. 
     Power management integrated circuitry (PMIC)  2226  may be included in the system  2200  to track the state of charge (SoCh) of the battery  2224 , and to control charging of the system  2200 . The PMIC  2226  may be used to monitor other parameters of the battery  2224  to provide failure predictions, such as the state of health (SoH) and the state of function (SoF) of the battery  2224 . The PMIC  2226  may include voltage regulators, surge protectors, power alarm detection circuitry. The power alarm detection circuitry may detect one or more of brown out (under-voltage) and surge (over-voltage) conditions. The PMIC  2226  may communicate the information on the battery  2224  to the processor circuitry  2202  over the IX  2206 . The PMIC  2226  may also include an analog-to-digital (ADC) convertor that allows the processor circuitry  2202  to directly monitor the voltage of the battery  2224  or the current flow from the battery  2224 . The battery parameters may be used to determine actions that the system  2200  may perform, such as transmission frequency, mesh network operation, sensing frequency, and the like. 
     A power block  2228 , or other power supply coupled to an electrical grid, may be coupled with the PMIC  2226  to charge the battery  2224 . In some examples, the power block  2228  may be replaced with a wireless power receiver to obtain the power wirelessly, for example, through a loop antenna in the system  2200 . In these implementations, a wireless battery charging circuit may be included in the PMIC  2226 . The specific charging circuits chosen depend on the size of the battery  2224  and the current required. 
     The system  2200  may include any combinations of the components shown by  FIG. 22 , however, some of the components shown may be omitted, additional components may be present, and different arrangement of the components shown may occur in other implementations. In one example where the system  2200  is or is part of a server computer system, the battery  2224 , communication circuitry  2209 , the sensors  2221 , actuators  2222 , and/or POS  2245 , and possibly some or all of the I/O devices  2256  may be omitted. 
     Furthermore, the embodiments of the present disclosure may take the form of a computer program product or data to create the computer program, with the computer program or data embodied in any tangible or non-transitory medium of expression having the computer-usable program code (or data to create the computer program) embodied in the medium. For example, the memory circuitry  2204  and/or storage circuitry  2208  may be embodied as non-transitory computer-readable storage media (NTCRSM) that may be suitable for use to store instructions (or data that creates the instructions) that cause an apparatus (such as any of the devices/components/systems described with regard to  FIGS. 1-35 ), in response to execution of the instructions by the apparatus, to practice selected aspects of the present disclosure. As shown, NTCRSM may include a number of programming instructions  2284 ,  2282  (or data to create the programming instructions). Programming instructions  2284 ,  2282  may be configurable or operable to enable a device (e.g., any of the devices/components/systems described with regard to  FIGS. 1-35 ), in response to execution of the programming instructions  2284 ,  2282 , to perform various programming operations associated with operating system functions, one or more applications, and/or aspects of the present disclosure (including various programming operations associated with  FIGS. 1-35 ). In various embodiments, the programming instructions  2284 ,  2282  may correspond to any of the computational logic  2280 , instructions  2282  and  2284  discussed previously with regard to  FIG. 22 . 
     In alternate embodiments, programming instructions  2284 ,  2282  (or data to create the instructions  2284 ,  2282 ) may be disposed on multiple NTCRSM. In alternate embodiments, programming instructions  2284 ,  2282  (or data to create the instructions  2284 ,  2282 ) may be disposed on computer-readable transitory storage media, such as, signals. The programming instructions  2284 ,  2282  embodied by a machine-readable medium may be transmitted or received over a communications network using a transmission medium via a network interface device (e.g., communication circuitry  2209  and/or NIC  2216  of  FIG. 22 ) utilizing any one of a number of transfer protocols (e.g., HTTP, etc.). 
     Any combination of one or more computer usable or computer readable media may be utilized as or instead of the NTCRSM. The computer-usable or computer-readable medium may be, for example but not limited to, one or more electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatuses, devices, or propagation media. For instance, the NTCRSM may be embodied by devices described for the storage circuitry  2208  and/or memory circuitry  2204  described previously. More specific examples (a non-exhaustive list) of a computer-readable medium may include the following: an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM, Flash memory, etc.), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device and/or optical disks, a transmission media such as those supporting the Internet or an intranet, a magnetic storage device, or any number of other hardware devices. In the context of the present disclosure, a computer-usable or computer-readable medium may be any medium that can contain, store, communicate, propagate, or transport the program (or data to create the program) for use by or in connection with the instruction execution system, apparatus, or device. The computer-usable medium may include a propagated data signal with the computer-usable program code (e.g., including programming instructions  2284 ,  2282 ) or data to create the program code embodied therewith, either in baseband or as part of a carrier wave. The computer usable program code or data to create the program may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc. 
     In various embodiments, the program code (or data to create the program code) described herein may be stored in one or more of a compressed format, an encrypted format, a fragmented format, a packaged format, etc. Program code (e.g., programming instructions  2284 ,  2282 ) or data to create the program code as described herein may require one or more of installation, modification, adaptation, updating, combining, supplementing, configuring, decryption, decompression, unpacking, distribution, reassignment, etc. in order to make them directly readable and/or executable by a computing device and/or other machine. For example, the program code or data to create the program code may be stored in multiple parts, which are individually compressed, encrypted, and stored on separate computing devices, wherein the parts when decrypted, decompressed, and combined form a set of executable instructions that implement the program code or the data to create the program code, such as those described herein. In another example, the program code or data to create the program code may be stored in a state in which they may be read by a computer, but require addition of a library (e.g., a dynamic link library), a software development kit (SDK), an application programming interface (API), etc. in order to execute the instructions on a particular computing device or other device. In another example, the program code or data to create the program code may need to be configured (e.g., settings stored, data input, network addresses recorded, etc.) before the program code or data to create the program code can be executed/used in whole or in part. In this example, the program code (or data to create the program code) may be unpacked, configured for proper execution, and stored in a first location with the configuration instructions located in a second location distinct from the first location. The configuration instructions can be initiated by an action, trigger, or instruction that is not co-located in storage or execution location with the instructions enabling the disclosed techniques. Accordingly, the disclosed program code or data to create the program code are intended to encompass such machine readable instructions and/or program(s) or data to create such machine readable instruction and/or programs regardless of the particular format or state of the machine readable instructions and/or program(s) when stored or otherwise at rest or in transit. 
     The computer program code for carrying out operations of the present disclosure, including for example, programming instructions  2284 ,  2282 , computational logic  2280 , instructions  2282 , and/or instructions  2284 , may be implemented as software code to be executed by one or more processors using any suitable computer language such as, for example, Python, PyTorch, NumPy, Ruby, Ruby on Rails, Scala, Smalltalk, Java™, C++, C#, “C”, Kotlin, Swift, Rust, Go (or “Golang”), ECMAScript, JavaScript, TypeScript, Jscript, ActionScript, Server-Side JavaScript (SSJS), PHP, Pearl, Lua, Torch/Lua with Just-In Time compiler (LuaJIT), Accelerated Mobile Pages Script (AMPscript), VBScript, JavaServer Pages (JSP), Active Server Pages (ASP), Node.js, ASP.NET, JAMscript, Hypertext Markup Language (HTML), extensible HTML (XHTML), Extensible Markup Language (XML), XML User Interface Language (XUL), Scalable Vector Graphics (SVG), RESTful API Modeling Language (RAML), wiki markup or Wikitext, Wireless Markup Language (WML), Java Script Object Notion (JSON), Apache® MessagePack™, Cascading Stylesheets (CSS), extensible stylesheet language (XSL), Mustache template language, Handlebars template language, Guide Template Language (GTL), Apache® Thrift, Abstract Syntax Notation One (ASN.1), Google® Protocol Buffers (protobuf), Bitcoin Script, EVM® bytecode, Solidity™, Vyper (Python derived), Bamboo, Lisp Like Language (LLL), Simplicity provided by Blockstream™ Rholang, Michelson, Counterfactual, Plasma, Plutus, Sophia, Salesforce® Apex®, Salesforce® Lightning®, and/or any other programming language, markup language, script, code, etc. In some implementations, a suitable integrated development environment (IDE) or software development kit (SDK) may be used to develop the program code or software elements discussed herein such as, for example, Android® Studio™ IDE, Apple® iOS® SDK, or development tools including proprietary programming languages and/or development tools. Furthermore, some or all of the software components or functions described herein can utilize a suitable querying language to query and store information in one or more databases or data structures, such as, for example, Structure Query Language (SQL), noSQL, and/or other query languages. The software code can be stored as a computer- or processor-executable instructions or commands on a physical non-transitory computer-readable medium. The computer program code for carrying out operations of the present disclosure may also be written in any combination of the programming languages discussed herein. The program code may execute entirely on the system  2200 , partly on the system  2200  as a stand-alone software package, partly on the system  2200  and partly on a remote computer (e.g., remote system  2255 ), or entirely on the remote computer (e.g., remote system  2255 ). In the latter scenario, the remote computer may be connected to the system  2200  through any type of network (e.g., network  2250 ). 
     While only a single computing device  2200  is shown, the computing device  2200  may include any collection of devices or circuitry that individually or jointly execute a set (or multiple sets) of instructions to perform any one or more of the operations discussed above. Computing device  2200  may be part of an integrated control system or system manager, or may be provided as a portable electronic device configurable or operable to interface with a networked system either locally or remotely via wireless transmission. 
     Some of the operations described previously may be implemented in software and other operations may be implemented in hardware. One or more of the operations, processes, or methods described herein may be performed by an apparatus, device, or system similar to those as described herein and with reference to the illustrated figures. 
     8. Example Implementations 
     Additional examples of the presently described embodiments include the following, non-limiting example implementations. Each of the non-limiting examples may stand on its own, or may be combined in any permutation or combination with any one or more of the other examples provided below or throughout the present disclosure. 
     Example A01 includes a method for analyzing events associated with a network address, the method comprising: receiving events associated with users accessing content from the network address; generating features from the events, the features identifying how the users access the content at a physical location associated with the network address; and identifying a type of entity associated with the network address based on the features. 
     Example A02 includes the method of example A01 and/or some other example(s) herein, further comprising: identifying the type of entity associated with the network address based on when the users access the content. 
     Example A03 includes the method of examples A01-A02 and/or some other example(s) herein, further comprising: identifying a time range associated with working hours; identifying a ratio of the events generated during the working hours vs. non-working hours; and identifying the type of entity associated with the network address based on the ratio. 
     Example A04 includes the method of example A03 and/or some other example(s) herein, further comprising: identifying the type of entity as a private org location when the ratio of events during business hours vs. non-business hours is above a threshold; and identifying the type of entity as a public org location or a non-org location when the ratio of events during business hours vs. non-business hours is below the threshold. 
     Example A05 includes the method of examples A01-A04 and/or some other example(s) herein, further comprising: identifying the type of entity associated with the network address based on a number of the events generated during a work week vs. a number of the events generated during a weekend. 
     Example A06 includes the method of examples A01-A05 and/or some other example(s) herein, further comprising: identifying the type of entity associated with the network address based on one of the features identifying durations of time the users are accessing the content at the network address. 
     Example A07 includes the method of examples A01-A06 and/or some other example(s) herein, further comprising: identifying the type of entity associated with the network address based on one of the features identifying types of computing devices used for accessing the content at the network address. 
     Example A08 includes the method of example A07 and/or some other example(s) herein, further comprising: identifying the type of entity as a private org location when a ratio of computing devices including laptop and personal computers (PCs) compared with smart phones is above a threshold; and identifying the type of entity as a public org location when the ratio is below the threshold. 
     Example A09 includes the method of examples A01-A08 and/or some other example(s) herein, further comprising: identifying a domain for the network address when the type of entity associated with the network address is identified as a private org location; and generating a consumption score for the domain when the type of entity associated with the network address is identified as a private org location. 
     Example A09.5 includes the method of examples A01-A09 and/or some other example(s) herein, wherein any one or more of examples A01-A09 are combinable with any one or more of the following examples and/or some other example(s) herein. 
     Example A10 includes a method comprising: receiving events identifying how users access content; identifying network addresses for the events, the network addresses associated with locations where the users access the content; using time stamps in the events to determine when users access the content at the locations associated with the network addresses; and identifying types of establishments associated with the network addresses based on when the users access the content at the locations associated with the network addresses. 
     Example A11 includes the method of example A10 and/or some other example(s) herein, further comprising: identifying network addresses where a particular percentage of the events occur during working business hours; and identifying the types of establishments for the identified network addresses as private org locations. 
     Example A12 includes the method of examples A10-A11 and/or some other example(s) herein, further comprising: identifying network addresses where the users access the content over a particular duration of time; and identifying the types of establishments for the identified network addresses as private org locations. 
     Example A13 includes the method of examples A10-A12 and/or some other example(s) herein, further comprising: identifying from the events types of computing devices used for accessing the content; identifying network addresses where a particular percentage of the computing devices are smart devices; and identifying the types of establishments for the identified network addresses as public org locations. 
     Example A14 includes the method of examples A10-A13 and/or some other example(s) herein, further comprising: identifying the network addresses where a number of the events during a specified time period is below a threshold; and identifying the types of establishments for the identified network addresses as non-org locations. 
     Example A15 includes the method of examples A10-A14 and/or some other example(s) herein, further comprising: identifying the network addresses associated with private org locations; identifying companies associated with the identified network addresses; and generating consumption scores from the events with the identified network addresses associated with the companies. 
     Example A15.5 includes the method of examples A10-A15 and/or some other example(s) herein, wherein any one or more of examples A10-A15 are combinable with any one or more of examples A01-A09 and/or some other example(s) herein. 
     Example A16 includes a method, comprising: identifying events associated with an entity; identifying content associated with the events; identifying network addresses associated with the events; identifying types of locations associated with the network addresses based on how users at the network addresses access the content; filtering the network addresses based on the types of locations associated with the network addresses; and calculating consumption scores for the filtered network addresses 
     Example A17 includes the method of example A16 and/or some other example(s), further comprising: identify some of the network addresses as private org locations based on when the users access the content at the network addresses. 
     Example A18 includes the method of examples A16-A17 and/or some other example(s), further comprising: identifying the number of events associated with the network addresses over a series of time periods; and adjusting the consumption scores based on changes in the number of events over the series of time periods. 
     Example A19 includes the method of example A18 and/or some other example(s), further comprising: identifying a number of users generating the events over the series of time periods; and adjusting the consumption scores based on changes in the number of users over the series of time periods. 
     Example A20 includes the method of examples A16-A19 and/or some other example(s), further comprising: identifying service providers; identifying some of the content provided by the service providers; generating relevancy values of the content to a topic; weighting the relevancy values based on the content being provided by the service providers; and generating the consumption scores for the filtered network addresses based on the weighted relevancy values. 
     Example A21 includes the method of examples A16-A20 and/or some other example(s) herein, wherein any one or more of examples A16-A20 are combinable with any one or more of examples A01-A09, A10-A15.5, and/or some other example(s) herein. 
     Example B01 includes a method for analyzing network events associated with a network address, the method comprising: obtaining network events including information about users accessing information objects from the network address; generating a set of machine learning (ML) features from the information about the users accessing the information objects; and determining an organization (org) type associated with the network address based on the set of ML features. 
     Example B02 includes the method of example B01 and/or some other example(s) herein, further comprising: identifying the org type associated with the network address based on when and how the users access the information objects. 
     Example B03 includes the method of example B01 and/or some other example(s) herein, wherein generating the set of ML features comprises: identifying a time range associated with operation of each org type of a set of org types; and determine, for each org type, a ratio of a number of the network events generated within the identified time range to a number of the network events generated outside of the identified time range, wherein the ratio is generated to be at least one ML feature of the set of ML features. 
     Example B04. includes the method of example B03 and/or some other example(s) herein, further comprising: determining the org type to be a private org location when the ratio is above a threshold; and determining the org type to be a public org location or a non-org location when the ratio is below the threshold. 
     Example B05 includes the method of example B01 and/or some other example(s) herein, wherein generating the set of ML features comprises: identifying one or more days associated with operation of each org type of a set of org types; and determining, for each org type, a ratio of a number of the network events generated on the one or more days to a number of the network events generated on other days different than the one or more days, wherein the ratio is generated to be at least one ML feature of the set of ML features. 
     Example B06 includes the method of example B01 and/or some other example(s) herein, wherein at least one ML feature of the set of ML features indicates a duration of the user accesses of the information objects, and the method further comprises: identifying the org type associated with the network address based on the at least one ML feature indicating the duration of the user accesses. 
     Example B07 includes the method of example B01 and/or some other example(s) herein, wherein at least one ML feature of the set of ML features indicates device types used to access the information objects from the network address, and the method further comprises: identifying the org type based on the at least one ML feature indicating the device types. 
     Example B08 includes the method of example B07 and/or some other example(s) herein, further comprising: determining a number of laptop computers used to access the information objects from the network address, a number of desktop computers used to access the information objects from the network address, and a number of mobile devices used to access the information objects from the network address; determining the org type to be a private org location when a ratio of the number of laptop computers and the number of desktop computers to the number of mobile devices is at or above a threshold; and determining the org type to be a public org location when the ratio is below the threshold. 
     Example B09 includes the method of example B01 and/or some other example(s) herein, further comprising: identifying a domain for the network address when the org type associated with the network address is identified as a private org location; and generating a consumption score for the domain when the org type associated with the network address is identified as a private org location. 
     Example B10 includes a method for operating a network address classification system (NACS), the method comprising: operating a feature generator to generate a set of machine learning (ML) features based on aspects of user accesses to information objects indicated by obtained network session events, the network session events indicating network addresses associated with locations from which the information objects are accessed by the users; and operating an entity classifier to determine organization (org) types associated with the locations from which the information objects are accessed based on the ML features. 
     Example B11 includes the method of example B10 and/or some other example(s) herein, wherein the network session events include timestamps indicating a time at which the users accessed the information objects, and the method comprises: operating the feature generator to generate the set of ML features to include one or more time-based features, the one or more time-based features indicating a time of day when individual users accessed the information objects at the respective locations based on the timestamps and percentages of the events that occur at different time periods at the respective locations; and operating the entity classifier to determine the org types associated with the network addresses based on the one or more time-based features. 
     Example B12 includes the method of example B11 and/or some other example(s) herein, further comprising: operating the entity classifier to determine the org type associated with the network addresses to be private org locations when the one or more time-based features indicate that some or all of the information objects were accessed outside of a specified time period. 
     Example B13 includes the method of examples B10-B12 and/or some other example(s) herein, further comprising: operating the feature generator to generate the set of ML features to include one or more duration-based features, the one or more duration-based features indicating an average amount of time the individual users access the information objects at the respective locations; and operating the entity classifier to determine the org types associated with the network addresses based on the one or more duration-based features. 
     Example B14 includes the method of example B13 and/or some other example(s) herein, further comprising: operating the entity classifier to determine the org type associated with the network addresses to be private org locations when the one or more duration-based features indicate that some or all of the information objects were accessed for a threshold amount of time. 
     Example B15 includes the method of examples B10-B14 and/or some other example(s) herein, further comprising: operating the feature generator to generate the set of ML features to include one or more event-based features, the one or more event-based features indicating an average amount of events generated by individual users at the respective locations; and operating the entity classifier to determine the org types associated with the network addresses based on the one or more event-based features. 
     Example B16 includes the method of examples B10-B15 and/or some other example(s) herein, further comprising: operating the feature generator to generate the set of ML features to include one or more device-based features, the one or more device-based features indicating types of computing devices used for accessing the information objects at the respective locations; and operating the entity classifier to determine the org types associated with the network addresses based on the one or more device-based features. 
     Example B17 includes the method of example B16 and/or some other example(s) herein, further comprising: operating the entity classifier to determine the org type associated with the network addresses to be private org locations when the one or more device-based features indicate that a majority of computing devices that accessed the information objects are laptop computers or desktop computers; and operating the entity classifier to determine the org type associated with the network addresses to be public org locations when the one or more device-based features indicate that a majority of computing devices that accessed the information objects are tablet computers or mobile devices. 
     Example B18 includes the method of examples B10-B17 and/or some other example(s) herein, further comprising: operating the entity classifier to identify some of the network addresses as being associated with private org locations or not private org locations. 
     Example B19 includes the method of example B18 and/or some other example(s) herein, wherein operating the entity classifier to determine the org types comprises: operating the entity classifier to use a logistic regression model to determine the org types. 
     Example B20 includes the method of examples B10-B19 and/or some other example(s) herein, further comprising: operating a content consumption monitor to: filter the network addresses based on the types of locations associated with the network addresses; calculate consumption scores for the filtered network addresses; identify the number of events associated with the network addresses over a series of time periods; adjust the consumption scores based on changes in the number of events over the series of time periods; and determine surge scores based on an increase in respective consumption scores within a predefined period of time. 
     Example B21 includes the method of examples B10-B20 and/or some other example(s) herein, wherein any one or more of examples B10-B20 are combinable with any one or more of examples A01-A09, A10-A15.5, A16-A21, B01-B09, and/or some other example(s) herein. 
     Example B22 includes the method of examples A01-A21, B01-B21 and/or some other example(s) herein, wherein the network addresses is/are internet protocol (IP) addresses, telephone numbers in a public switched telephone number, a cellular network addresses, internet packet exchange (IPX) addresses, X.25 addresses, X.21 addresses, Transmission Control Protocol (TCP) or User Datagram Protocol (UDP) port numbers, media access control (MAC) addresses, Electronic Product Codes (EPCs), Bluetooth hardware device addresses, a Universal Resource Locators (URLs), and/or email addresses. 
     Example Z01 includes one or more computer readable media comprising instructions, wherein execution of the instructions by processor circuitry is to cause the processor circuitry to perform the method of any one of examples A01-A21, B01-B22 and/or some other example(s) herein. Example Z02 includes a computer program comprising the instructions of example Z01. Example Z03a includes an Application Programming Interface defining functions, methods, variables, data structures, and/or protocols for the computer program of example Z02. Example Z03b includes an API or specification defining functions, methods, variables, data structures, protocols, etc., defining or involving use of any of examples A01-A21, B01-B22 or portions thereof, or otherwise related to any of examples A01-A21, B01-B22 or portions thereof. Example Z04 includes an apparatus comprising circuitry loaded with the instructions of example Z01. Example Z05 includes an apparatus comprising circuitry operable to run the instructions of example Z01. Example Z06 includes an integrated circuit comprising one or more of the processor circuitry of example Z01 and the one or more computer readable media of example Z01. 
     Example Z07 includes a computing system comprising the one or more computer readable media and the processor circuitry of example Z01. Example Z08 includes a computing system of example Z07 and/or one or more other example(s) herein, wherein the computing system is a System-in-Package (SiP), Multi-Chip Package (MCP), a System-on-Chips (SoC), a digital signal processors (DSP), a field-programmable gate arrays (FPGA), an Application Specific Integrated Circuits (ASIC), a programmable logic device (PLD), a complex PLD (CPLD), a Central Processing Unit (CPU), a Graphics Processing Unit (GPU), and/or the computing system comprises two or more of SiPs, MCPs, SoCs, DSPs, FPGAs, ASICs, PLDs, CPLDs, CPUs, GPUs interconnected with one another 
     Example Z09 includes an apparatus comprising means for executing the instructions of example Z01. Example Z10 includes a signal generated as a result of executing the instructions of example Z01. Example Z11 includes a data unit generated as a result of executing the instructions of example Z01. Example Z12 includes the data unit of example Z11 and/or some other example(s) herein, wherein the data unit is a datagram, network packet, data frame, data segment, a Protocol Data Unit (PDU), a Service Data Unit (SDU), a message, or a database object. Example Z13 includes a signal encoded with the data unit of examples Z11 and/or Z12. Example Z14 includes an electromagnetic signal carrying the instructions of example Z01. Example Z15 includes an apparatus comprising means for performing the method of any one of examples A01-A21, B01-B22 and/or some other example(s) herein. 
     Any of the above-described examples may be combined with any other example (or combination of examples), unless explicitly stated otherwise. Implementation of the preceding techniques may be accomplished through any number of specifications, configurations, or example deployments of hardware and software. It should be understood that the functional units or capabilities described in this specification may have been referred to or labeled as components or modules, in order to more particularly emphasize their implementation independence. Such components may be embodied by any number of software or hardware forms. For example, a component or module may be implemented as a hardware circuit comprising custom very-large-scale integration (VLSI) circuits or gate arrays, off-the-shelf semiconductors such as logic chips, transistors, or other discrete components. A component or module may also be implemented in programmable hardware devices such as field programmable gate arrays, programmable array logic, programmable logic devices, or the like. Components or modules may also be implemented in software for execution by various types of processors. An identified component or module of executable code may, for instance, comprise one or more physical or logical blocks of computer instructions, which may, for instance, be organized as an object, procedure, or function. Nevertheless, the executables of an identified component or module need not be physically located together, but may comprise disparate instructions stored in different locations which, when joined logically together, comprise the component or module and achieve the stated purpose for the component or module. 
     Indeed, a component or module of executable code may be a single instruction, or many instructions, and may even be distributed over several different code segments, among different programs, and across several memory devices or processing systems. In particular, some aspects of the described process (such as code rewriting and code analysis) may take place on a different processing system (e.g., in a computer in a data center), than that in which the code is deployed (e.g., in a computer embedded in a sensor or robot). Similarly, operational data may be identified and illustrated herein within components or modules, and may be embodied in any suitable form and organized within any suitable type of data structure. The operational data may be collected as a single data set, or may be distributed over different locations including over different storage devices, and may exist, at least partially, merely as electronic signals on a system or network. The components or modules may be passive or active, including agents operable to perform desired functions. 
     9. Terminology 
     The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the disclosure. The present disclosure has been described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and/or computer program products according to embodiments of the present disclosure. In the drawings, some structural or method features may be shown in specific arrangements and/or orderings. However, it should be appreciated that such specific arrangements and/or orderings may not be required. Rather, in some embodiments, such features may be arranged in a different manner and/or order than shown in the illustrative figures. Additionally, the inclusion of a structural or method feature in a particular figure is not meant to imply that such feature is required in all embodiments and, in some embodiments, may not be included or may be combined with other features. 
     As used herein, the singular forms “a,” “an” and “the” are intended to include plural forms as well, unless the context clearly indicates otherwise. It will be further understood that the terms “comprises” and/or “comprising,” when used in this specification, specific the presence of stated features, integers, steps, operations, elements, and/or components, but do not preclude the presence or addition of one or more other features, integers, steps, operation, elements, components, and/or groups thereof. The phrase “A and/or B” means (A), (B), or (A and B). For the purposes of the present disclosure, the phrase “A, B, and/or C” means (A), (B), (C), (A and B), (A and C), (B and C), or (A, B and C). The description may use the phrases “in an embodiment,” or “In some embodiments,” which may each refer to one or more of the same or different embodiments. Furthermore, the terms “comprising,” “including,” “having,” and the like, as used with respect to embodiments of the present disclosure, are synonymous. 
     The terms “coupled,” “communicatively coupled,” along with derivatives thereof are used herein. The term “coupled” may mean two or more elements are in direct physical or electrical contact with one another, may mean that two or more elements indirectly contact each other but still cooperate or interact with each other, and/or may mean that one or more other elements are coupled or connected between the elements that are said to be coupled with each other. The term “directly coupled” may mean that two or more elements are in direct contact with one another. The term “communicatively coupled” may mean that two or more elements may be in contact with one another by a means of communication including through a wire or other interconnect connection, through a wireless communication channel or ink, and/or the like. 
     The term “circuitry” refers to a circuit or system of multiple circuits configurable or operable to perform a particular function in an electronic device. The circuit or system of circuits may be part of, or include one or more hardware components, such as a logic circuit, a processor (shared, dedicated, or group) and/or memory (shared, dedicated, or group), an ASIC, a FPGA, programmable logic controller (PLC), SoC, SiP, multi-chip package (MCP), DSP, etc., that are configurable or operable to provide the described functionality. In addition, the term “circuitry” may also refer to a combination of one or more hardware elements with the program code used to carry out the functionality of that program code. Some types of circuitry may execute one or more software or firmware programs to provide at least some of the described functionality. Such a combination of hardware elements and program code may be referred to as a particular type of circuitry. 
     The term “processor circuitry” as used herein refers to, is part of, or includes circuitry capable of sequentially and automatically carrying out a sequence of arithmetic or logical operations, or recording, storing, and/or transferring digital data. The term “processor circuitry” may refer to one or more application processors, one or more baseband processors, a physical CPU, a single-core processor, a dual-core processor, a triple-core processor, a quad-core processor, and/or any other device capable of executing or otherwise operating computer-executable instructions, such as program code, software modules, and/or functional processes. The terms “application circuitry” and/or “baseband circuitry” may be considered synonymous to, and may be referred to as, “processor circuitry.” 
     The term “memory” and/or “memory circuitry” as used herein refers to one or more hardware devices for storing data, including RAM, MRAM, PRAM, DRAM, and/or SDRAM, core memory, ROM, magnetic disk storage mediums, optical storage mediums, flash memory devices or other machine readable mediums for storing data. The term “computer-readable medium” may include, but is not limited to, memory, portable or fixed storage devices, optical storage devices, and various other mediums capable of storing, containing or carrying instructions or data. “Computer-readable storage medium” (or alternatively, “machine-readable storage medium”) may include all of the foregoing types of memory, as well as new technologies that may arise in the future, as long as they may be capable of storing digital information in the nature of a computer program or other data, at least temporarily, in such a manner that the stored information may be “read” by an appropriate processing device. The term “computer-readable” may not be limited to the historical usage of “computer” to imply a complete mainframe, mini-computer, desktop, wireless device, or even a laptop computer. Rather, “computer-readable” may comprise storage medium that may be readable by a processor, processing device, or any computing system. Such media may be any available media that may be locally and/or remotely accessible by a computer or processor, and may include volatile and non-volatile media, and removable and non-removable media. 
     The term “interface circuitry” as used herein refers to, is part of, or includes circuitry that enables the exchange of information between two or more components or devices. The term “interface circuitry” may refer to one or more hardware interfaces, for example, buses, I/O interfaces, peripheral component interfaces, network interface cards, and/or the like. 
     The term “element” refers to a unit that is indivisible at a given level of abstraction and has a clearly defined boundary, wherein an element may be any type of entity including, for example, one or more devices, systems, controllers, network elements, modules, etc., or combinations thereof. The term “device” refers to a physical entity embedded inside, or attached to, another physical entity in its vicinity, with capabilities to convey digital information from or to that physical entity. The term “entity” refers to a distinct component of an architecture or device, or information transferred as a payload. The term “controller” refers to an element or entity that has the capability to affect a physical entity, such as by changing its state or causing the physical entity to move. 
     The term “computer system” as used herein refers to any type interconnected electronic devices, computer devices, or components thereof. Additionally, the term “computer system” and/or “system” may refer to various components of a computer that are communicatively coupled with one another. Furthermore, the term “computer system” and/or “system” may refer to multiple computer devices and/or multiple computing systems that are communicatively coupled with one another and configurable or operable to share computing and/or networking resources. 
     The term “architecture” as used herein refers to a computer architecture or a network architecture. A “network architecture” is a physical and logical design or arrangement of software and/or hardware elements in a network including communication protocols, interfaces, and media transmission. A “computer architecture” is a physical and logical design or arrangement of software and/or hardware elements in a computing system or platform including technology standards for interacts therebetween. 
     The term “appliance,” “computer appliance,” or the like, as used herein refers to a computer device or computer system with program code (e.g., software or firmware) that is specifically designed to provide a specific computing resource. A “virtual appliance” is a virtual machine image to be implemented by a hypervisor-equipped device that virtualizes or emulates a computer appliance or otherwise is dedicated to provide a specific computing resource. 
     The term “cloud computing” or “cloud” refers to a paradigm for enabling network access to a scalable and elastic pool of shareable computing resources with self-service provisioning and administration on-demand and without active management by users. Cloud computing provides cloud computing services (or cloud services), which are one or more capabilities offered via cloud computing that are invoked using a defined interface (e.g., an API or the like). The term “computing resource” or simply “resource” refers to any physical or virtual component, or usage of such components, of limited availability within a computer system or network. Examples of computing resources include usage/access to, for a period of time, servers, processor(s), storage equipment, memory devices, memory areas, networks, electrical power, input/output (peripheral) devices, mechanical devices, network connections (e.g., channels/links, ports, network sockets, etc.), operating systems, virtual machines (VMs), software/applications, computer files, and/or the like. A “hardware resource” may refer to compute, storage, and/or network resources provided by physical hardware element(s). A “virtualized resource” may refer to compute, storage, and/or network resources provided by virtualization infrastructure to an application, device, system, etc. The term “network resource” or “communication resource” may refer to resources that are accessible by computer devices/systems via a communications network. The term “system resources” may refer to any kind of shared entities to provide services, and may include computing and/or network resources. System resources may be considered as a set of coherent functions, network data objects or services, accessible through a server where such system resources reside on a single host or multiple hosts and are clearly identifiable. 
     The term “workload” refers to an amount of work performed by a computing system, device, entity, etc., during a period of time or at a particular instant of time. A workload may be represented as a benchmark, such as a response time, throughput (e.g., how much work is accomplished over a period of time), and/or the like. Additionally or alternatively, the workload may be represented as a memory workload (e.g., an amount of memory space needed for program execution to store temporary or permanent data and to perform intermediate computations), processor workload (e.g., a number of instructions being executed by a processor during a given period of time or at a particular time instant), an I/O workload (e.g., a number of inputs and outputs or system accesses during a given period of time or at a particular time instant), database workloads (e.g., a number of database queries during a period of time), a network-related workload (e.g., a number of network attachments, a number of mobility updates, a number of radio link failures, a number of handovers, an amount of data to be transferred over an air interface, etc.), and/or the like. Various algorithms may be used to determine a workload and/or workload characteristics, which may be based on any of the aforementioned workload types. 
     As used herein, the term “cloud service provider” (or CSP) indicates an organization which operates typically large-scale “cloud” resources comprised of centralized, regional, and edge data centers (e.g., as used in the context of the public cloud). In other examples, a CSP may also be referred to as a Cloud Service Operator (CSO). References to “cloud computing” generally refer to computing resources and services offered by a CSP or a CSO, at remote locations with at least some increased latency, distance, or constraints relative to edge computing. 
     As used herein, the term “data center” refers to a purpose-designed structure that is intended to house multiple high-performance compute and data storage nodes such that a large amount of compute, data storage and network resources are present at a single location. This often entails specialized rack and enclosure systems, suitable heating, cooling, ventilation, security, fire suppression, and power delivery systems. The term may also refer to a compute and data storage node in some contexts. A data center may vary in scale between a centralized or cloud data center (e.g., largest), regional data center, and edge data center (e.g., smallest). 
     The terms “instantiate,” “instantiation,” and the like as used herein refers to the creation of an instance. An “instance” also refers to a concrete occurrence of an object, which may occur, for example, during execution of program code. 
     The term “information object” refers to a data structure that includes one or more data elements. each of which includes one or more data values. Examples of information objects include electronic documents, database objects, data files, resources, webpages, web forms, applications (e.g., web apps), services, web services, media, or content, and/or the like. 
     Information objects may be stored and/or processed according to a data format. Data formats define the content/data and/or the arrangement of data elements for storing and/or communicating the information objects. Each of the data formats may also define the language, syntax, vocabulary, and/or protocols that govern information storage and/or exchange. Examples of the data formats that may be used for any of the information objects discussed herein may include Accelerated Mobile Pages Script (AMPscript), Abstract Syntax Notation One (ASN.1), Backus-Naur Form (BNF), extended BNF, Bencode, BSON, ColdFusion Markup Language (CFML), comma-separated values (CSV), Control Information Exchange Data Model (C2IEDM), Cascading Stylesheets (CSS), DARPA Agent Markup Language (DAML), Document Type Definition (DTD), Electronic Data Interchange (EDI), Extensible Data Notation (EDN), Extensible Markup Language (XML), Efficient XML Interchange (EXI), Extensible Stylesheet Language (XSL), Free Text (FT), Fixed Word Format (FWF), Cisco® Etch, Franca, Geography Markup Language (GML), Guide Template Language (GTL), Handlebars template language, Hypertext Markup Language (HTML), Interactive Financial Exchange (IFX), Keyhole Markup Language (KML), JAMscript, Java Script Object Notion (JSON), JSON Schema Language, Apache® MessagePack™, Mustache template language, Ontology Interchange Language (OIL), Open Service Interface Definition, Open Financial Exchange (OFX), Precision Graphics Markup Language (PGML), Google® Protocol Buffers (protobuf), Quicken® Financial Exchange (QFX), Regular Language for XML Next Generation (RelaxNG) schema language, regular expressions, Resource Description Framework (RDF) schema language, RESTful Service Description Language (RSDL), Scalable Vector Graphics (SVG), Schematron, Tactical Data Link (TDL) format (e.g., J-series message format for Link 16; JREAP messages; Multifunction Advanced Data Link (MADL), Integrated Broadcast Service/Common Message Format (IBS/CMF), Over-the-Horizon Targeting Gold (OTH-T Gold), Variable Message Format (VMF), United States Message Text Format (USMTF), and any future advanced TDL formats), VBScript, Web Application Description Language (WADL), Web Ontology Language (OWL), Web Services Description Language (WSDL), wiki markup or Wikitext, Wireless Markup Language (WML), extensible HTML (XHTML), XPath, XQuery, XML DTD language, XML Schema Definition (XSD), XML Schema Language, XSL Transformations (XSLT), YAML (“Yet Another Markup Language” or “YANL Ain′t Markup Language”), Apache® Thrift, and/or any other data format and/or language discussed elsewhere herein. 
     Additionally or alternatively, the data format for the information objects may be document and/or plain text, spreadsheet, graphics, and/or presentation formats including, for example, American National Standards Institute (ANSI) text, a Computer-Aided Design (CAD) application file format (e.g., “.c3d”, “.dwg”, “.dft”, “.iam”, “.iaw”, “.tct”, and/or other like file extensions), Google® Drive® formats (including associated formats for Google Docs®, Google Forms®, Google Sheets®, Google Slides®, etc.), Microsoft® Office® formats (e.g., “.doc”, “.ppt”, “.xls”, “.vsd”, and/or other like file extension), OpenDocument Format (including associated document, graphics, presentation, and spreadsheet formats), Open Office XML (OOXML) format (including associated document, graphics, presentation, and spreadsheet formats), Apple® Pages®, Portable Document Format (PDF), Question Object File Format (QUOX), Rich Text File (RTF), TeX and/or LaTeX (“.tex” file extension), text file (TXT), TurboTax® file (“.tax” file extension), You Need a Budget (YNAB) file, and/or any other like document or plain text file format. 
     Additionally or alternatively, the data format for the information objects may be archive file formats that store metadata and concatenate files, and may or may not compress the files for storage. As used herein, the term “archive file” refers to a file having a file format or data format that combines or concatenates one or more files into a single file or information object. Archive files often store directory structures, error detection and correction information, arbitrary comments, and sometimes use built-in encryption. The term “archive format” refers to the data format or file format of an archive file, and may include, for example, archive-only formats that store metadata and concatenate files, for example, including directory or path information; compression-only formats that only compress a collection of files; software package formats that are used to create software packages (including self-installing files), disk image formats that are used to create disk images for mass storage, system recovery, and/or other like purposes; and multi-function archive formats that can store metadata, concatenate, compress, encrypt, create error detection and recovery information, and package the archive into self-extracting and self-expanding files. For the purposes of the present disclosure, the term “archive file” may refer to an archive file having any of the aforementioned archive format types. Examples of archive file formats may include Android® Package (APK); Microsoft® Application Package (APPX); Genie Timeline Backup Index File (GBP); Graphics Interchange Format (GIF); gzip (.gz) provided by the GNU Project™; Java® Archive (JAR); Mike O&#39;Brien Pack (MPQ) archives; Open Packaging Conventions (OPC) packages including OOXML files, OpenXPS files, etc.; Rar Archive (RAR); Red Hat® package/installer (RPM); Google® SketchUp backup File (SKB); TAR archive (“.tar”); XPInstall or XPI installer modules; ZIP (.zip or .zipx); and/or the like. 
     The term “data element” refers to an atomic state of a particular object with at least one specific property at a certain point in time, and may include one or more of a data element name or identifier, a data element definition, one or more representation terms, enumerated values or codes (e.g., metadata), and/or a list of synonyms to data elements in other metadata registries. Additionally or alternatively, a “data element” may refer to a data type that contains one single data. Data elements may store data, which may be referred to as the data element&#39;s content (or “content items”). Content items may include text content, attributes, properties, and/or other elements referred to as “child elements.” Additionally or alternatively, data elements may include zero or more properties and/or zero or more attributes, each of which may be defined as database objects (e.g., fields, records, etc.), object instances, and/or other data elements. An “attribute” may refer to a markup construct including a name-value pair that exists within a start tag or empty element tag. Attributes contain data related to its element and/or control the element&#39;s behavior. 
     The term “database object”, “data structure”, or the like may refer to any representation of information that is in the form of an object, attribute-value pair (AVP), key-value pair (KVP), tuple, etc., and may include variables, data structures, functions, methods, classes, database records, database fields, database entities, associations between data and/or database entities (also referred to as a “relation”), blocks and links between blocks in block chain implementations, and/or the like. The term “information element” refers to a structural element containing one or more fields. The term “field” refers to individual contents of an information element, or a data element that contains content. The term “data frame” or “DF” may refer to a data type that contains more than one data element in a predefined order. 
     The term “personal data,” “personally identifiable information,” “PII,” or the like refers to information that relates to an identified or identifiable individual. Additionally or alternatively, “personal data,” “personally identifiable information,” “PII,” or the like refers to information that can be used on its own or in combination with other information to identify, contact, or locate a person, or to identify an individual in context. The term “sensitive data” may refer to data related to racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data, data concerning health, and/or data concerning a natural person&#39;s sex life or sexual orientation. The term “confidential data” refers to any form of information that a person or entity is obligated, by law or contract, to protect from unauthorized access, use, disclosure, modification, or destruction. Additionally or alternatively, “confidential data” may refer to any data owned or licensed by a person or entity that is not intentionally shared with the general public or that is classified by the person or entity with a designation that precludes sharing with the general public. 
     The term “pseudonymization” or the like refers to any means of processing personal data or sensitive data in such a manner that the personal/sensitive data can no longer be attributed to a specific data subject (e.g., person or entity) without the use of additional information. The additional information may be kept separately from the personal/sensitive data and may be subject to technical and organizational measures to ensure that the personal/sensitive data are not attributed to an identified or identifiable natural person. 
     The term “application” may refer to a complete and deployable package, environment to achieve a certain function in an operational environment. The term “AI/ML application” or the like may be an application that contains some AI/ML models and application-level descriptions. The term “machine learning” or “ML” refers to the use of computer systems implementing algorithms and/or statistical models to perform specific task(s) without using explicit instructions, but instead relying on patterns and inferences. ML algorithms build or estimate mathematical model(s) (referred to as “ML models” or the like) based on sample data (referred to as “training data,” “model training information,” or the like) in order to make predictions or decisions without being explicitly programmed to perform such tasks. Generally, an ML algorithm is a computer program that learns from experience with respect to some task and some performance measure, and an ML model may be any object or data structure created after an ML algorithm is trained with one or more training datasets. After training, an ML model may be used to make predictions on new datasets. Although the term “ML algorithm” refers to different concepts than the term “ML model,” these terms as discussed herein may be used interchangeably for the purposes of the present disclosure. The term “session” refers to a temporary and interactive information interchange between two or more communicating devices, two or more application instances, between a computer and user, or between any two or more entities or elements. 
     The term “network address” refers to an identifier for a node or host in a computer network, and may be a unique identifier across a network and/or may be unique to a locally administered portion of the network. Examples of network addresses include telephone numbers in a public switched telephone number, a cellular network address (e.g., international mobile subscriber identity (IMSI), mobile subscriber ISDN number (MSISDN), Subscription Permanent Identifier (SUPI), Temporary Mobile Subscriber Identity (TMSI), Globally Unique Temporary Identifier (GUTI), Generic Public Subscription Identifier (GPSI), etc.), an internet protocol (IP) address in an IP network (e.g., IP version 4 (Ipv4), IP version 6 (IPv6), etc.), an internet packet exchange (IPX) address, an X.25 address, an X.21 address, a port number (e.g., when using Transmission Control Protocol (TCP) or User Datagram Protocol (UDP)), a media access control (MAC) address, an Electronic Product Code (EPC) as defined by the EPCglobal Tag Data Standard, Bluetooth hardware device address (BD_ADDR), a Universal Resource Locator (URL), an email address, and/or the like. 
     The term “session” refers to a temporary and interactive information interchange between two or more communicating devices, two or more application instances, between a computer and user, or between any two or more entities or elements. A “network session” may refer to a session between two or more communicating devices over a network, and a “web session” may refer to a session between two or more communicating devices over the Internet. A “session identifier,” “session ID,” or “session token” refers to a piece of data that is used in network communications to identify a session and/or a series of message exchanges. 
     The term “organization” or “org” refers to an entity comprising one or more people and/or users and having a particular purpose, such as, for example, a company, an enterprise, an institution, an association, a regulatory body, a government agency, a standards body, etc. Additionally or alternatively, an “org” may refer to an identifier that represents an entity/organization and associated data within an instance and/or data structure. 
     The term “intent data” may refer to data that is collected about users&#39; observed behavior based on web content consumption, which provides insights into their interests and indicates potential intent to take an action. 
     The term “engagement” refers to a measureable or observable user interaction with a content item or information object. The term “engagement rate” refers to the level of user interaction that is generated from a content item or information object. For purposes of the present disclosure, the term “engagement” may refer to the amount of interactions with content or information objects generated by an organization or entity, which may be based on the aggregate engagement of users associated with that organization or entity. 
     It should be understood that the functional units or capabilities described in this specification may have been referred to or labeled as components or modules, in order to more particularly emphasize their implementation independence. Such components may be embodied by any number of software or hardware forms. For example, a component or module may be implemented as a hardware circuit comprising custom very-large-scale integration (VLSI) circuits or gate arrays, off-the-shelf semiconductors such as logic chips, transistors, or other discrete components. A component or module may also be implemented in programmable hardware devices such as field programmable gate arrays, programmable array logic, programmable logic devices, or the like. Components or modules may also be implemented in software for execution by various types of processors. An identified component or module of executable code may, for instance, comprise one or more physical or logical blocks of computer instructions, which may, for instance, be organized as an object, procedure, or function. Nevertheless, the executables of an identified component or module need not be physically located together but may comprise disparate instructions stored in different locations which, when joined logically together, comprise the component or module and achieve the stated purpose for the component or module. 
     Indeed, a component or module of executable code may be a single instruction, or many instructions, and may even be distributed over several different code segments, among different programs, and across several memory devices or processing systems. In particular, some aspects of the described process (such as code rewriting and code analysis) may take place on a different processing system (e.g., in a computer in a data center) than that in which the code is deployed (e.g., in a computer embedded in a sensor or robot). Similarly, operational data may be identified and illustrated herein within components or modules and may be embodied in any suitable form and organized within any suitable type of data structure. The operational data may be collected as a single data set or may be distributed over different locations including over different storage devices, and may exist, at least partially, merely as electronic signals on a system or network. The components or modules may be passive or active, including agents operable to perform desired functions. 
     Although the various example embodiments and example implementations have been described with reference to specific exemplary aspects, it will be evident that various modifications and changes may be made to these aspects without departing from the broader scope of the present disclosure. Many of the arrangements and processes described herein can be used in combination or in parallel implementations to provide greater bandwidth/throughput and to support edge services selections that can be made available to the edge systems being serviced. Accordingly, the specification and drawings are to be regarded in an illustrative rather than a restrictive sense. The accompanying drawings that form a part hereof show, by way of illustration, and not of limitation, specific aspects in which the subject matter may be practiced. The aspects illustrated are described in sufficient detail to enable those skilled in the art to practice the teachings disclosed herein. Other aspects may be utilized and derived therefrom, such that structural and logical substitutions and changes may be made without departing from the scope of this disclosure. This Detailed Description, therefore, is not to be taken in a limiting sense, and the scope of various aspects is defined only by the appended claims, along with the full range of equivalents to which such claims are entitled. 
     Such aspects of the inventive subject matter may be referred to herein, individually and/or collectively, merely for convenience and without intending to voluntarily limit the scope of this application to any single aspect or inventive concept if more than one is in fact disclosed. Thus, although specific aspects have been illustrated and described herein, it should be appreciated that any arrangement calculated to achieve the same purpose may be substituted for the specific aspects shown. This disclosure is intended to cover any and all adaptations or variations of various aspects. Combinations of the above aspects and other aspects not specifically described herein will be apparent to those of skill in the art upon reviewing the above description. 
     For the sake of convenience, operations may be described as various interconnected or coupled functional blocks or diagrams. However, there may be cases where these functional blocks or diagrams may be equivalently aggregated into a single logic device, program or operation with unclear boundaries. Having described and illustrated the principles of a preferred embodiment, it should be apparent that the embodiments may be modified in arrangement and detail without departing from such principles. Claim is made to all modifications and variation coming within the spirit and scope of the following claims.