Time Distortion Anonymization for the Publication of Mobility Data with High Utility

Transcription

1 Time Distortion Anonymization for the Publication of Mobility Data with High Utility Vincent Primault, Sonia Ben Mokhtar, Cédric Lauradoux and Lionel Brunie

2 Mobility data usefulness Real-time traffic, traffic prediction Companies collecting data Long-term place prediction 2

3 and threats Gambs et al. Show Me How You Move and I Will Tell You Who You Are. Transactions on Data Privacy,

4

5 Privacy-preserving data publication Attacker Raw mobility traces Protection mechanism Anonymized mobility traces Public maps Clustering White pages Data mining Partially re-identified mobility traces Machine learning Researcher Simulations Useful analysis results 5

6 Outline Introduction State of the art Making a PROMESSE Experimental evaluation Conclusion 6

7 A mobility trace A trace is a temporally ordered list of records belonging to a same user. A record is a triplet (user, location, timestamp). 7

8 Extraction of points of interest (POIs) Done by using, e.g., an appropriate clustering algorithm. Points of interest convey semantic information about habits and can lead to usersre-identification. 8

9 Location privacy protection mechanisms for data publication k-anonymity Differential privacy Wait For Me [Abul et al., 2010] Geo-Indistinguishability [Andrés et al., 2013] Abul et al. Anonymization of moving objects databases by clustering and perturbation. Information Systems, Andrés et al. Geo-indistinguishability: Differential privacy for Location-based Systems. CCS,

10 Wait For Me represents the incertitude that comes from GPS measurements. Wait For Me enforces (k, )-anonymity, i.e., there is always at least k users in a cylinder of radius /2. Abul et al. Anonymization of moving objects databases by clustering and perturbation. Information Systems,

11 Geo-Indistinguishability Level of privacy l i within r i proportional to an ε Real location Protected location l4, r4 l3, r3 l1, r1 l2, r2 Andrés et al. Geo-indistinguishability: Differential privacy for Location-based Systems. CCS,

12 Outline Introduction State of the art Making a PROMESSE Experimental evaluation Conclusion 12

13 Intuition behind our work No state-of-the-art mechanism is both privacypreserving and usefulfor data scientists. Almost all of them alter the geographical information in some way. We believe geographical information is the most important one, so we propose a new mechanism that minimally distort the location. 13

14 Hiding POIs with speed smoothing The idea To guarantee a constant speed along a trace. More challengingto identify where a user stops, and therefore her POIs. How? Dividetraces intosmaller trajectories, typically one day long. Enforce an equal duration and length between two consecutive records. 14

15 Speed smoothing 10:05 10:05 epsilon Point of interest 10:06 10:06 10:07 10h08 10:07 10:08 15

16 Outline Introduction State of the art Making a PROMESSE Experimental evaluation Conclusion 16

17 Experimenting with three real-life datasets Cabspotting Geolife MDC Records 8,9M 3,8M 1,1M Traces 5,5k 2,4k 4,6k Avg trace duration 32 h 3 h 3 h Avg sampling rate 72 s 7 s 32 s 17

18 POIs retrieval POIs with maximum diameter of 200 meters and minimum duration of 15 minutes. Two POIs match if their centroids are within 100 meters. 18

19 Lower is better 60% POIs retrieval (F-score) 50% 40% 30% 20% 10% Cabspotting Geolife MDC 0% 19

20 Average spatial error Real trace Protected trace 20

21 Lower is better (log scale) Average spatial error Spatial error, in meters Cabspotting Geolife MDC 0,1 21

22 Range queries distortion From 2 to 8 hours 1,000 different queries Distortion is Q(D) Q(D ) /Q(D) 22

23 Lower is better 120% Range queries distortion 100% 80% 60% 40% 20% Cabspotting Geolife MDC 0% 23

24 Outline Introduction State of the art Making a PROMESSE Experimental evaluation Future work Conclusion 24

25 Summary Introduced time distortion, opened a new research direction. Implemented a new protection mechanism for data publishing, addressing a severe threat while maintaining high utility. Evaluated against three real-life datasets. 25

26 Questions 26