PRIVACY CRITERIA
Roadmap Privacy in Data mining Mobile privacy (k-e) – anonymity (c-k) – safety Privacy skyline
Privacy in data mining Random Perturbation (quantitative data) Given value x, return value x + r, r is a random value from a distribution Construct decision-tree classifier on perturbed data s.t. accuracy is comparable to classifiers of original data Randomized Response (categorical data) Basic idea: disguise data by probabilistically changing the value of sensitive attribute to another value Distribution of original data can be reconstructed using the disguised data
Roadmap Privacy in Data mining Mobile privacy (k-e) – anonymity (c-k) – safety Privacy skyline
Mobile privacy Spatial cloaking: Cloaked region Contains location q and at least k-1 other user locations Circular region of location q Contains location q and number of dummy locations generated by client Transformation based matching Transform region through Hilbert curves by using Hilbert keys Casper: user registers with (k, A min ) profile k: user is k-anonymous A min : minimum acceptable resolution of the cloaked spatial region
Roadmap Privacy in Data mining Mobile privacy (k-e) – anonymity (c-k) – safety Privacy skyline
(k-e) - anonymity Privacy protection for numerical sensitive attributes GOAL: group sensitive attribute values s.t. No less than k distinct values Range of group larger than threshold e Permutation-based technique to support aggregate queries Constructing help table Aggregate Query Answering on Anonymized ICDE2007
(k-e) - anonymity Original Table Table after Permutation
(k-e) - anonymity Table after Permutation Help Table
Roadmap Privacy in Data mining Mobile privacy (k-e) – anonymity (c-k) – safety Privacy skyline
(c-k) – safety Goal: quantify background knowledge k of attacker maximum disclosure w.r.t. k is less than threshold c Express background knowledge through a language Worst –Case Background Knowledge for Privacy –Preserving Data ICDE2007
(c-k) – safety Create buckets, where randomly permute sensitive attribute values within each bucket Original TableBucketized Table
(c-k) – safety Bound background knowledge i.e., attacker knows k basic implications Atom: t p [S] = s, s S, p Person e.g. t Jack [Disease] = flu Basic implication: For some m, n and A i, B i atoms e.g. t Jack [Disease] = flu t Charlie [Disease] = flu is the language consisting of conjunctions of k basic implications
(c-k) – safety Find bucketization B of original table s.t. B is (c-k) – safe The maximum disclosure of B w.r.t is less than threshold c
Roadmap Privacy in Data mining Mobile privacy (k-e) – anonymity (c-k) – safety Privacy skyline
Original data transformed in Generalized or Bucketized data Quantify external knowledge through skyline for each sensitive value External knowledge for each individual Having single sensitive value Having multiple sensitive values Privacy Skyline: Privacy with Multidimensional Adversarial VLDB 2007
Privacy skyline Three types of knowledge (l, k, m) e.g.(2, 3, 1) l: Knowledge about target individual t flue Tom[S] and cancer Tom[S] (obtained from Tom.s friend) k: Knowledge about individuals (u 1,..u k ) other than t flue Bob[S] and flue Cary[S] and cancer Frank[S] (obtained from another hospital) m: Knowledge about the relationship between t and other individuals (v 1, …v m ) AIDS Ann[S] AIDS Tom[S] (because Ann is Tom’s wife)
Privacy skyline Example: knowledge threshold (1, 5, 2) and confidence c=50% for sensitive value AIDS Adversary knows l≤1 sensitive values that t does not have Adversary knows sensitive values of k≤5 others Adversary knows m≤2 members in t’s same-value family Adversary cannot predict individual t to have AIDS with confidence 50% when the above hold
Privacy skyline If transformed data D* is safe for (1, 5, 2) it is safe for any (l, k, m) with l≤1, k≤5, m≤2 i.e., the shaded region
Privacy skyline Skyline for set of incomparable points {(1, 1, 5), (1, 3, 4), (1, 5, 2)}
Privacy skyline Given a skyline {(l 1, k 1, m 1, c 1 ), …,(l r, k r, m r, c r )} release candidate D* is safe for sensitive value iff, for i =1 to r max {Pr( t[S] | L t, (l i, k i, m i ), D*)} < c i maximum probability of a sensitive value to be for individual t w.r.t external knowledge and release candidate is below confidence threshold c i
Original TableGeneralize Table Bucketized Table