Abstract: A method includes acquiring first aggregate event data for a first sub-publisher. The first aggregate event data indicates aggregate user activity across a plurality of applications associated with the first sub-publisher. The method further includes acquiring second aggregate event data for a plurality of additional sub-publishers. The method further includes determining a plurality of anomaly metric values for the first sub-publisher based on the first aggregate event data and the second aggregate event data. The method further includes determining an anomaly function value for the first sub-publisher based on the anomaly metric values for the first sub-publisher. The anomaly function value indicates a likelihood that the first sub-publisher is associated with fraudulent user activity.

Abstract: A user device stores a local application including initial search records and an initial search function. Each initial search record includes an application link that opens an application page and search data that describes the application page. The initial search function is configured to select from the initial search records. The user device executes the local application to request and receive search update data from a remote system. The search update data includes updated search records and an updated search function. The user device updates the initial search records and the initial search function with the updated search records and the updated search function. The user device receives a search query from a requesting application, selects a set of updated search records based on the search query and the updated search function, and provides a response to the requesting application including application links from the set of updated search records.