PRIVACY-PRESERVING DATA ANALYSIS AND DATA SHARING

Transcription

1 PRIVACY-PRESERVING DATA ANALYSIS AND DATA SHARING Chih-Hua Tai Dept. of Computer Science and Information Engineering, National Taipei University New Taipei City, Taiwan

2 BENEFIT OF DATA ANALYSIS Many fields such as marketing, business, healthcare, software engineering, government, to new a few, has received great benefit through data analysis Marketing / Retail Helps marketing Understand customers behaviors Predict what their customers want Finance / Banking Predict the risk of a loan Detect fraudulent credit card transactions 2

3 BENEFIT OF DATA SHARING The volume of data effects the quality of the results of data analysis The release of data brings more chance of better data analysis 3

4 PRIVACY-PRESERVING DATA SHARING

5 PRIVACY ISSUES IN DATA SHARING (EX1) DOB Sex Zipcode Disease 1/21/76 Male Heart Disease 4/13/86 Female Hepatities 2/28/76 Male Brochitis 1/21/76 Male Broken Arm 4/13/86 Female Flu 2/28/76 Female Hang Nail 5

6 PRIVACY ISSUES IN DATA SHARING (EX1) Name DOB Sex Zipcode Alice 1/21/76 Male Bob 1/10/81 Female Carol 10/1/44 Female Dan 2/21/84 Male Ellen 4/19/72 Female

7 DOB Sex Zipcode Disease 1/21/76 Female Heart Disease 4/13/86 Female Hepatities 2/28/76 Male Brochitis 1/21/76 Male Broken Arm 4/13/86 Female Flu 2/28/76 Female Hang Nail Record Linkage Name DOB Sex Zipcode Alice 1/21/76 Female Bob 1/10/81 Female Carol 10/1/44 Female Dan 2/21/84 Male Ellen 4/19/72 Female

8 PRIVACY ISSUES IN DATA SHARING (EX2) Attribute Linkage 8

9 PRIVACY ISSUES IN DATA SHARING (EX3) Attributes: Name, Salary, Links: Friends, Neighborhood, Communities: Interests, Activities, 9

10 PRIVACY ISSUES ON SOCIAL NETWORKS Personal information leaked, even if the vertex identifies are hidden Many information can be used to re-associate the vertex with its identity. Vertex degree: k-degree anonymity, Neighborhood configuration: k-neighborhood anonymity, k-automorphism anonymity, k-isomorphism anonymity, grouping-and- collapsing, 10

11 FRIENDSHIP ATTACK Still there are another type of information for vertex re-identification friendship attack 11

12 PRIVACY CONCERNS IN DATA SHARING Personal information leaked, even if the vertex identifies are hidden E.g., Friendship attacks C.-H. Tai, P. S. Yu, D.-N. Yang and M.-S. Chen, "Privacypreserving Social Network Publication Against Friendship Attacks," In KDD, E.g., Community Identification C.-H. Tai, P. S. Yu, D.-N. Yang, and M.-S. Chen, Structural diversity for privacy in publishing social networks, In SDM, 2011; Structural Diversity for Resisting Community Identification in Published Social Networks, IEEE Trans. Knowl. Data Eng. 26(1): (2014). C.-H. Tai, P.-J. Tseng, P. S. Yu and M.-S. Chen, "Identities Anonymization in Dynamic Social Networks," In ICDM,

13 ENFORCING STRUCTURAL DIVERSITY FOR PRIVACY-PRESERVING RELEASE OF SOCIAL NETWORKS

14 ATTRIBUTE LINKAGE 14

15 L-DIVERSITY Distinct l diversity At least l distinct values associated with a sensitive attribute within a group of records, which share the same set of Quasi Identifier QI: attributes that could potentially re-identify records. 15

16 L-DIVERSITY 16

17 COMMUNITY IDENTIFICATION Vertex identification is considered to be an important privacy issue in publishing social networks. k-degree anonymity, k-neighborhood anonymity, In addition to a vertex identity, each individual is also associated with a community identity. Could be used to infer the political party affiliation or disease information sensitive to the public. Is a kind of structural information 17

18 COMMUNITY IDENTIFICATION Community information is explicitly given: Ex. Alice knows recently Mark is sick Mark participates in this social network Mark makes 3 friends. (vertex degree attack) 18

19 COMMUNITY IDENTIFICATION Community information is not given: Ex. Alice knows Mark participates in this social network and has 3 friends. (vertex degree attack) è Alice can know the approximation of Bob s neighborhood. 19

20 NEW PRIVACY MODEL AGAINST COMMUNITY IDENTIFICATION L-Structural Diversity To protect against vertex degree attack, for each vertex, there should be other vertices with the same degree located in at least L-1 other communities. 20

21 PRIVACY MODEL: K W -STRUCTURAL DIVERSITY ANONYMITY G A release of a social network satisfies L-structural diversity, if for every node, there exists a l-shielding group.??? A group θ d, consisting of all vertices of degree d, is a l-shielding group if there is a vertex subset θ θ d s. t. (1) θ L, and (2) any two vertices u and v in θ, C v C v = ø, where C is the community identity. Ex. Mary has four friends. 21

22 THE ANONYMIZATION Problem formulation: Given a graph G(V, E, C) and an integer k, 1 L C, the problem is to anonymize G to satisfy L-structural diversity such that information distortion is minimized. The challenges: Trade off between data utility and data privacy Scalability of anonymization techniques 22

23 THE PROBLEM IN DYNAMIC SCENARIOS A dynamic social network will be sequentially released. G 1 G 2 An attacker can monitor a victim for a period w. Therefore, the adversary knowledge includes: The releases G t-w+1, G t-w+2,, G t during w A degree sequence Δ vw =(d v t-w+1, d v t-w+2,, d vt ) of a victim v during w Ex. John has two friends at time 1, and makes a new friend at time 2. 23

24 PRIVACY MODEL: K W -STRUCTURAL DIVERSITY ANONYMITY Dynamic scenarios of w>1 A consistent group Θ Δ is the set of vertices The adversary knowledge of includes: 1. The releases G t-w +1, G t-w+2,, G t during w 2. A degree sequence Δ vw =(d v t-w+1, d v t-w+2,, d vt ) of a victim v during w that always share the same degree during w. A consistent group Θ Δ is a l-shielding if at each time instant t in w, there is a vertex subset Θ t Θ Δ s. t. (1) Θ t L, and (2) any two vertices u and v in Θ t, C v t C v t = ø, where C t is the community identity at time t. 24

25 THE ANONYMIZATION Problem formulation: Suppose that every vertex in a series of sequential releases G t-w+1, G t-w+2,, G t-1 is protected. Given G t-w+1, G t-w+2,, G t-1 and L, anonymize the current social network G t s. t. every vertex is protected in a L-shielding consistent group. The challenges: The anonymization is depended on not only the current social network but also previous w-1 releases. Searching through all the w-1 releases to eliminate privacy leak is time consuming. 25

26 PRIVACY-PRESERVING DATA ANALYSIS

27 DATA PRIVACY VS. DATA ANALYSIS Data mining has shown its great promise in various fields. Business, Medical treatment, Networks, Bioinformatics,... For those who lack of expertise in data analysis and/or computing resources... Data Owner Mining Services Provider (Cloud Computing) 27

28 DATA PRIVACY VS. DATA ANALYSIS Data Is Money!!! Data Owner Privacy?! Mining Services Provider (Cloud Computing) 28

29 29

30 PRIVACY CONCERNS IN DATA SHARING Privacy-preserving outsourcing techniques without sacrificing data utility E.g., Mining patterns C.-H. Tai, P. S. Yu, and M.-S. Chen, "k-support Anonymity based on Pseudo Taxonomy for Outsourcing of Frequent Itemset Mining," In KDD, C.-H. Tai, J.-W. Huang, M.-H. Chung, "Privacy Preserving Frequent Pattern Mining on Multi-Cloud Environment, In SBAST, E.g., Similarity measurement Y.-W. Chu, C.-H. Tai, M.-S. Chen and P. S. Yu, "Privacypreserving SimRank over Distributed Information Network," In ICDM,

31 PRIVACY-PRESERVING OUTSOURCING OF FREQUENT ITEM SET MINING

32 FREQUENT ITEMSET MINING (FIM) Discover what happened frequently Trans. ID Items wine cigar, wine cigar, tea beer, cigar, wine beer, tea, wine When threshold set as 3 (=60%), {wine} and {cigar} are frequent. When threshold set as 2 (=40%), {wine}, {cigar}, {tea}, {beer}, {wine, cigar}, and {wine, beer} are frequent. 32

33 THE RISKS OF OUTSOURCING FIM Encryption/decryption method is believed as the possible solution. How to Data achieve Owner the encryption and decryption? Privacy protected Mining Services Provider (Cloud Computing) Correct mining results Reasonable overhead 33

34 THE RISKS OF OUTSOURCING FIM Trans. ID Items Trans. ID Items 1 wine 1 a 2 3 cigar, wine cigar, tea Encrypt 2 3 a, c c, d 4 beer, cigar, wine 4 a, b, c 5 beer, tea, wine 5 a, b, d 34

35 THE RISKS OF OUTSOURCING FIM Top frequency attack Wine is the most frequent item à a is wine Approximate support attack The support of cigar is about 55%~60% à c is cigar Trans. ID Items Trans. ID Items 1 wine 1 a 2 cigar, wine Encrypt 2 a, c 3 cigar, tea 3 c, d 4 beer, cigar, wine 4 a, b, c 5 beer, tea, wine 5 a, b, d 35

36 THE RISKS OF OUTSOURCING FIM The support information about the frequent itemsets can be utilized to effectively reveal the raw data as well as the sensitive Wine information is the most from frequent the anonymized item à a is transactions. wine Top frequency attack Approximate support attack T. Mielik ainen. Privacy problems with anonymized The support of cigar is about 55%~60% à c is cigar transaction databases. In Proc. of Discovery Science, The Risks of Outsourcing FIM Trans. ID Items wine cigar, wine cigar, tea Encrypt Trans. ID Items a a, c c, d 4 beer, cigar, wine 4 a, b, c 5 beer, tea, wine 5 a, b, d 36

37 RELATED WORKS Encrypt each real items by a one-many mapping function. Wong, W. K., Cheung, D. W., Hung, E., Kao, B., Mamoulis, N.: Security in Outsourcing of Association Rule Mining. In: Proc. of VLDB, However, it does not try to anonymize the support information. Recently it is cracked. Molloy, I., Li, N., Li, T.: On the (In)Security and (Im)Practicality of Outsourcing Precise Association Rule Mining. In: Proc. of ICDM,

38 K-SUPPORT ANONYMITY & ANONYMIZATION For every sensitive item, there are at least k-1 other items of the same support. The probability of an item being correctly re-identified is limited to 1/k, even when the precise support information is known. Given a transactional database T, encrypt T into E(T) such that There exist a decryption function D such that MiningResult(T, Δ)= D(MiningResult(E(T), Δ)), for any minimal support Δ. E(T) is k-support anonymous. 38

39 ANONYMIZATION EXAMPLE: ENCRYPTION k Trans. ID Items wine cigar, wine cigar, tea a beer e b cigar i c f wine d g j h tea 4 5 beer, cigar, wine beer, tea, wine Encrypt with k=3 Trans. ID Items 1 c, d, g 2 b, d, g 3 b, h 4 a, b, c 5 a, c, d, h 39

40 SUMMARY Many fields such as marketing, business, healthcare, software engineering, government, to new a few, has received great benefit through data analysis While enjoying the benefit of data analysis, it is also important to take care of privacy issues in both data analysis process and the release of data pieces. 40

41 THANK YOU~!