To reply to my own question .
Can we find a way to create a "signature" of an account's pattern of
editing? Perhaps it might be a set of signatures, maybe one for the
categories that the account appears to be active in, another for the type of
edit, etc. Then if these signatures were calculated for all banned accounts
or currently blocked accounts (or at least ones with a long enough
contribution history to make it worthwhile - we're not interested in
one-edit vandals), then we could have a tool that could be run to quickly
compare one account against the signatures of banned/blocked accounts as
well as the cumulative edits of a set of known sockpuppets (i.e. treat them
as a single account) to determine if this may be a sockpuppet case meriting
further investigation. I imagine that it would be too expensive
computationally to actually run comparisons of the contribution histories of
all "bad guy" accounts against the suspicious account which is why I propose
a "signature" approach (but I'm happy to be told otherwise).
If we had such a tool and it proves reasonably reliable in identifying
likely sockpuppets (not asking for guarantees but close enough not to be a
waste of time to investigate), then we could routinely use it on new
accounts or reactivating accounts (i.e. possible sleeper accounts) once they
have a long enough editing history to enable the tool to operate effectively
to provide automated early warning of new/reactivating accounts appearing
suspiciously similar to "bad guy" accounts.
But this is a hard problem, both technically and socially (Assume Good
Faith, Privacy, etc), so I welcome the thoughts of others.
Kerry