A duct mating assembly includes first and second ducts having side surfaces connected along their edges to define an interior air space. The closure devices may take a number of different forms and may be retrievable. The method described compares features associated with a plurality of known anomalous user accounts stored in a database to features present in the unknown account.