Differentially Private Multi- Dimensional Time Series Release for Traffic Monitoring

Transcription

1 DBSec 13 Differentially Private Multi- Dimensional Time Series Release for Traffic Monitoring Liyue Fan, Li Xiong, Vaidy Sunderam Department of Math & Computer Science Emory University

2 9/4/2013 DBSec'13: Privacy Preserving Traffic Monitoring 2 Outline Traffic Monitoring User Privacy Challenges Proposed Solutions Temporal Estimation Spatial Estimation Empirical Evaluation

3 9/4/2013 DBSec'13: Privacy Preserving Traffic Monitoring 3 Monitoring Traffic Congestions/Trending places/everyday life How many cars are there? Where are they? Monital Metropol, Brazil Google Traffic View

4 9/4/2013 DBSec'13: Privacy Preserving Traffic Monitoring 4 Traffic Monitoring Real-time GPS data At any timestamp: traffic histogram Real-time user location Aggregate 2D Histogram

5 9/4/2013 DBSec'13: Privacy Preserving Traffic Monitoring 5 User Privacy User privacy should be protected when releasing their data! Real-time location data is sensitive pleaserobme.com GPS traces are identifying We study fifteen months of human mobility data for one and a half million individuals and find that human mobility traces are highly unique. in a dataset where the location of an individual is specified hourly, and with a spatial resolution equal to that given by the carrier's antennas, four spatio-temporal points are enough to uniquely identify 95% of the individuals. De Montjoye, Yves-Alexandre, Cesar A. Hidalgo, Michel Verleysen, and Vincent D. Blondel. "Unique in the Crowd: The Privacy Bounds of Human Mobility." Scientific Reports 3 (2013)

6 9/4/2013 DBSec'13: Privacy Preserving Traffic Monitoring 6 Differentially Private Data Sharing

7 9/4/2013 DBSec'13: Privacy Preserving Traffic Monitoring 7 Differential Privacy (in a nutshell) Rigorous definition Doesn t stipulate the prior knowledge of the attacker Upon seeing the published data, an attacker should gain little knowledge about any specific individual. α-differential Privacy[BLR08] Smaller α values (α < 1) indicate stronger privacy guarantee Privacy Budget

8 9/4/2013 DBSec'13: Privacy Preserving Traffic Monitoring 8 Static α-differential Privacy Laplace perturbation Dataset D Query f A D = f D + Lap( f α )d Global Sensitivity f = max D,D f D f(d ) 1 strong privacy high perturbation noise f(d): c 1 :2 c 2 :1 c 3 :3 c 4 :4 Laplace Perturbation ci=c i + Lap( 1 α ) A(D): c1:1 c2:0 c3:5 c4:3 Δf = 1

9 9/4/2013 DBSec'13: Privacy Preserving Traffic Monitoring 9 Composability of Differential Privacy Sequential Composition [McSherry10] Let A k each provide α k -differential privacy. A sequence of A k (D) over dataset D provides α k -differential privacy. Timestamp k = 0, T 1 f k (D): 2D cell histogram at time k A k (D): released 2D histogram that satisfies α -DP T A 0 D,, A T 1 (D) satisfies α-dp

10 9/4/2013 DBSec'13: Privacy Preserving Traffic Monitoring 10 Baseline Solution: LPA Laplace Perturbation Algorithm For each timestamp k: Release A k D = f k (D) + Lap( T α )d High perturbation noise for long time-series, i.e. when T is large Low utility output since data is sparse c 1 :2 c 2 :1 c 3 :3 c 4 :4 c1:1 c2:0 c3:5 c4:3 Relative error c 1 : 50% c 2 : 100% Fact: location data is VERY sparse.

11 9/4/2013 DBSec'13: Privacy Preserving Traffic Monitoring 11 Two Proposed Solutions Temporal Estimation for each cell Utilize time series model and posterior estimation to reduce perturbation error. c 1 c 2 c 3 c 4 Spatial Estimation within each partition Group similar cells together to overcome data sparsity

12 9/4/2013 DBSec'13: Privacy Preserving Traffic Monitoring 12 Framework Domain knowledge: known Sparse or Dense label for each cell. Raw Series Modeling/Partitioning Differentially Private Series Laplace Perturbation Estimation Doesn t incur extra differential privacy cost

13 9/4/2013 DBSec'13: Privacy Preserving Traffic Monitoring 13 Temporal Estimation For each cell, its count series {x k }, k = 0, T 1 e.g. {3,3,4,5,4,3,2, } Process Model Measurement Model x k+1 = x k + ω ω~n(0, Q) z k = x k + ν ν~lap( T α ) Goal: given z k and the above models, estimate x k. Small value for Sparse cells; Large value for Dense cells.

14 9/4/2013 DBSec'13: Privacy Preserving Traffic Monitoring 14 Temporal Estimation(cont.) Estimation algorithm based on the Kalman filter Gaussian approx ν~n(0, R), R T2 α 2 O(1) computation per timestamp Model-based Prediction Posterior Estimate/Output Linearly combine prediction and measurement Fan and Xiong CIKM 12, TKDE 13

15 9/4/2013 DBSec'13: Privacy Preserving Traffic Monitoring 15 Temporal Estimation Example For cell c, at time k: Suppose x k = 4 Prediction x k, e.g. 2 Measurement/Laplace perturbed value z k, e.g. 8 Posterior estimation x k, e.g. 3 Impact of perturbation noise is reduced by taking into account of the process model and prediction!

16 9/4/2013 DBSec'13: Privacy Preserving Traffic Monitoring 16 Spatial Estimation Goal: group cells to overcome data sparsity. First partition the space until each partition contains Sparse or Dense cells only Topdown algorithm based on QuadTree Data independency and efficiency For each timestamp k: f k D : partition counts A k D = f k (D) + Lap( T α )d Release f k (D) estimated from A k D Δf k = 1 Each cell is visited O(1) times at each timestamp. S S S S S S S S S S S S S S D D

17 9/4/2013 DBSec'13: Privacy Preserving Traffic Monitoring 17 Spatial Estimation Example At time k Original Cell Histogram f k D : Perturbation noise is evenly distributed to every cell within the partition Partition Histogram f k D Laplace Perturbed A k D Estimated Cell Histogram f k (D)

18 9/4/2013 DBSec'13: Privacy Preserving Traffic Monitoring 18 Evaluation: Data Generated moving objects on a road network City of Oldenburg, Germany 500K objects at the beginning 25K new objects at every timestamp total time: 100 timestamps Two-dimensional 1024 by 1024 grid over the city map Each cell represents 400 m 2 Record object locations at cell resolution 95% cells are labeled Sparse!

19 cell count 9/4/2013 DBSec'13: Privacy Preserving Traffic Monitoring 19 Temporal Estimation orig Laplace Kalman time

20 9/4/2013 DBSec'13: Privacy Preserving Traffic Monitoring 20 Spatial Partitions Oldenburg Road Network Partitions by QuadTree

21 9/4/2013 DBSec'13: Privacy Preserving Traffic Monitoring 21 Evaluation: Utility vs. Privacy Utility of each cell: Average Relative Error of released series For each α value, median utility among each class is plotted DFT: Rastogi and Nath, SIGMOD 10

22 9/4/2013 DBSec'13: Privacy Preserving Traffic Monitoring 23 Evaluation: Range Queries How many objects are in the area of m by m cells at every timestamp? For each m, 100 areas are randomly selected and evaluated.

23 9/4/2013 DBSec'13: Privacy Preserving Traffic Monitoring 24 Evaluation: Runtime Overall runtime is plotted in millisecond.

24 9/4/2013 DBSec'13: Privacy Preserving Traffic Monitoring 25 Conclusion Difficult when time series is long and data is sparse! Domain knowledge can be used for temporal modeling as well as spatial partitioning. Output utility is improved with same privacy guarantee. We don t observe extra time cost by our solutions. Ongoing work: Utilize rich information in spatio-temporal data. Model learning and parameter learning. Contact: liyue.fan@emory.edu AIMS Group:

25 9/4/2013 DBSec'13: Privacy Preserving Traffic Monitoring 26 Q&A