Privacy-Preserving. Introduction to. Data Publishing. Concepts and Techniques. Benjamin C. M. Fung, Ke Wang, Chapman & Hall/CRC. S.

Transcription

1 Chapman & Hall/CRC Data Mining and Knowledge Discovery Series Introduction to Privacy-Preserving Data Publishing Concepts and Techniques Benjamin C M Fung, Ke Wang, Ada Wai-Chee Fu, and Philip S Yu CRC Press Taylor & Francis Croup Boca Raton London New York CRC Press is an imprint of the Taylor & Francis Group, an informa business A CHAPMAN & HALL BOOK

2 Contents List of Figures xv List of Tables xvii List of Algorithms xxi Preface xxiii Acknowledgments xxix About the Authors xxxi I The Fundamentals 1 1 Introduction 3 11 Data Collection and Data Publishing 4 12 What Is Privacy-Preserving Data Publishing? 7 13 Related Research Areas 9 2 Attack Models and Privacy Models Record Linkage Model k-anonymity (X, Y)-Anonymity Dilemma on Choosing QID Attribute Linkage Model ^-Diversity Confidence Bounding (X, y)-linkability (X, Y)-Privacy {a, fc)-anonymity LiTC-Privacy (k, e)-anonymity i-closeness Personalized Privacy i^-anonymity Table Linkage Model Probabilistic Model (c, t)-isolation 30 vii

3 viii Contents 242 e-differential Privacy (d, 7)-Privac,y Distributional Privacy Modeling Adversary's Background Knowledge Skyline Privacy Privacy-MaxEnt Skyline (B, ^-Privacy 33 Anonymization Operations Generalization and Suppression Anatomization and Permutation Random Perturbation Additive Noise Data Swapping Synthetic Data Generation 42 Information Metrics General Purpose Metrics Minimal Distortion ILoss Discernibility Metric Distinctive Attribute Special Purpose Metrics Trade-Off Metrics 47 Anonymization Algorithms Algorithms for the Record Linkage Model Optimal Auonyinization Locally Minimal Anonymization Perturbation Algorithms Algorithms for the Attribute Linkage Model ^-Diversity Incognito and ^-Optimize InfoGain Mondrian Top-Down Disclosure Anatomize (k, e)-anonymity Permutation Personalized Privacy Algorithms for the Table Linkage Model (5-Preseuce Algorithms SPALM and MPALM Algorithms for the Probabilistic Attack Model e-differential Additive Noise afs Algorithm Attacks on Anonymous Data Minimality Attack definetti Attack 63

4 Contents ix 553 Corruption Attack 64 II Anonymization for Data Mining Anonymization for Classification Analysis Introduction G9 62 Anonymization Problems for Red Cross BTS Privacy Model Information Metrics Problem Statement High-Dimensional Top-Down Specialization (HDTDS) 631 Find the Best Specialization Perform the Best Specialization Update Score and Validity Discussion Workload-Aware Mondrian Single Categorical Target Attribute Single Numerical Target Attribute Multiple Target Attributes Discussion Bottom-Up Generalization The Anonymization Algorithm Data Structure Discussion Genetic Algorithm The Anonymization Algorithm Discussion Evaluation Methodology Data Utility Efficiency and Scalability Summary and Lesson Learned Anonymization for Cluster Analysis Introduction Anonymization Framework for Cluster Analysis Anonymization Problem for Cluster Analysis Overview of Solution Framework Anonymization for Classification Analysis Evaluation Discussion Dimensionality Reduction-Based Transformation Dimensionality Reduction The DRBT Method Related Topics Summary 126

5 X Contents III Extended Data Publishing Scenarios Multiple Views Publishing Introduction Checking Violations of A'-Anonymity on Multiple Views Violations by Multiple Selection-Project Views 822 Violations by Functional Dependencies Discussion 13C 83 Checking Violations with Marginals MultiRelational fc-anonymity Multi-Level Perturbation Summary Anonymizing Sequential Releases with New Attributes Introduction Motivations Anonymization Problem for Sequential Releases MonotoniaLy of Privacy Anonymization Algorithm for Sequential Releases Overview of the Anonymization Algorithm Information Metrics OY, Y>Lmkability (X, V)-Anonymity Extensions Summary Anonymizing Incrementally Updated Data Records Introduction Continuous Data Publishing Data Model Correspondence Attacks Anonymization Problem for Continuous Publishing Detection of Correspondence Attacks Anonymization Algorithm for Correspondence Attacks Beyond Two Releases Beyond Anonymity Dynamic Data Republishing Privacy Threats m-invariance I-ID-Composition Summary 190

6 Contents xi 11 Collaborative Anonymization for Vertically Partitioned Data Introduction Privacy-Preserving Data Mashup Anonymization Problem for Data Mashup Information Metrics Architecture and Protocol Anonymization Algorithm for Semi-Honest Model Anonymization Algorithm for Malicious Model Discussion Cryptographic Approach Secure Multiparty Computation Minimal Information Sharing Summary and Lesson Learned Collaborative Anonymization for Horizontally Partitioned Data Introduction Privacy Model Overview of the Solution Discussion 224 IV Anonymizing Complex Data Anonymizing Transaction Data Introduction Motivations The Transaction Publishing Problem Previous Works on Privacy-Preserving Data Mining Challenges and Requirements Cohesion Approach Coherence Item Suppression A Heuristic Suppression Algorithm Itemset-Based Utility Discussion Band Matrix Method Band Matrix Representation Constructing Anonymized Groups Reconstruction Error Discussion fem-anonymization fcm-anonymity Apriori Anonymization Discussion 250

7 xii Contents 135 Transactional k-anonymity fc-anonymity for Set Valued Data Top-Down Partitioning Anonymization Discussion Anonymizing Query Logs Token-Based Hashing G2 Secret Sharing Split Personality Other Related Works Summary Anonymizing Trajectory Data Introduction Motivations Attack Models on Trajectory Data LA'C-Privacy Trajectory Anonymity for Maximal Frequent Sequences Anonymization Algorithm for LA'C-Privacy Discussion (M)-Anonymity Trajectory Anonymity for Minimal Distortion The Never Walk Alone Anonymization Algorithm Discussion MOB fc-anonymity Trajectory Anonymity for Minimal Information Loss Anonymization Algorithm for MOB fc-anonymity Other Spatio-Tcmporal Anonymization Methods Summary Anonymizing Social Networks Introduction Data Models Attack Models Utility of the Published Data General Privacy-Preserving Strategies Graph Modification Equivalence Classes of Nodes Anonymization Methods for Social Networks Edge Insertion and Label Generalization Clustering Nodes for fc-anonymity Supergraph Generation Randomized Social Networks Releasing Subgraphs to Users: Link Recovery Not Releasing the Network Data Sets 303

8 Contents xiii 155 Summary Sanitizing Textual Data Introduction ERASE 30G 1621 Sanitization Problem for Documents Privacy Model: /^-Safety Problem Statement Sanitization Algorithms for A'-Safety Health Information DE-identification (HIDE) De-Identification Models The HIDE Framework Summary Other Privacy-Preserving Techniques and Future Trends Interactive Query Model Privacy Threats Caused by Data Mining Results Privacy-Preserving Distributed Data Mining Future Directions 317 References 319 Index 341