Privacy Preserving Data Mining: An Extensive Survey

Transcription

1 Proc. of Int. Conf. on Multimedia Processing, Communication and Info. Tech., MPCIT Privacy Preserving Data Mining: An Extensive Survey Jisha Jose Panackal 1 and Dr Anitha S Pillai 2 1 Associate Professor Department of Computer Applications, Vidya Academy of Science and Technology, Thrissur, Kerala, India jishapanackal@gmail.com 2 Professor and Head Department of Computer Applications, Hindustan Institute of Science and Technology, Padur, Chennai, Tamil Nadu, India mca@hindustanuniv.ac.in Abstract Proper integration of privacy into data mining operations is so crucial for the wide-spread acceptance of knowledge-based applications. The data mining applications involve data rich environments such as Biomedicine in terms of electronic health records, Internet in terms of web usage logs and Wireless Networks in terms of mobility data from sensors and a lot more. Privacy in data mining can be obtained by various techniques like Perturbation, Anonymization and Cryptographic. This paper tries to reiterate various Privacy Preserving Data Mining (PPDM) techniques currently developed to meet the privacy issues in the process of data mining. Studies show that trade off between privacy and information loss creates a bottleneck while developing generic solutions. This paper explores various PPDM techniques based on proposed PPDM classification hierarchy and finally conclude with some future research directions. Index Terms PPDM, Anonymization, Perturbation, Randomization, Condensation, SMC, Pseudonymization I. INTRODUCTION The tremendous growth in Information and Communications technology increases the need for electronic data to be stored and shared securely. The huge amount of data, if publicly available can be utilized for many research purposes. Data Mining can be one of the technologies used to extract knowledge from massive collection of data. On the other hand, being published, the sensitive information about individuals may be disclosed which create ethical or privacy issues. Due to privacy issues many individuals are reluctant to share their data to the public which leads to data unavailability. Thus, privacy should be an important concern in the field of Data Mining. Privacy Preserving Data Mining (PPDM) is becoming a popular research area to address various privacy issues. This paper provides an extensive study of various literatures and gives some conclusions based on certain parameters. The rest of the paper is organized in such a way that Section II provides basic understandings regarding PPDM. Section III classifies PPDM techniques based on two basic scenarios such as centralized and distributed. And section IV explores various studies related to privacy issues. Next, by section V we provide a brief comparison of different PPDM techniques and finally through Section VI, we conclude the paper with future research directions. DOI: 03.AETS Association of Computer Electronics and Electrical Engineers, 2013

2 II. PRIVACY REQUIREMENTS Privacy is an important concern while disclosing various categories of electronic data including business data and medical data for data mining. Privacy can be interpreted in two ways. For instance, privacy is so crucial with respect to medical data, since it contains sensitive information like type of disease. Especially for doing medical data mining the original data should be available for making accurate predictions otherwise lead to impractical solutions. Any kind of disclosure related to the person- specific information leads to many problems including ethical issues. Therefore extra care should be taken to protect privacy of individuals before publishing such data. On the other hand, the privacy can be interpreted as preventing unwanted disclosure of information while performing data mining on aggregate results. Thus, privacy can be addressed at various levels in the process of data mining. For entire database security both privacy and security measures are needed. For better understanding of the concept of privacy, we would like to distinguish between the two related issues security and privacy according to HealthCare data. And the remaining sub sections provide an introduction to privacy issues and privacy policies. A. Security Vs Privacy Even though the two terms, security and privacy are synonymously used, these can be treated as two related, but separate issues: i) Security is defined as the mechanism for protecting the entire HealthCare data including the ability to control access to patient information, safeguard from unauthorized disclosure, alteration, loss or destruction of patient information. Security is typically accomplished through operational and technical controls. The three fundamental security goals are Confidentiality, Integrity and Availability [28]. And ii) Privacy is a more specific term which is defined as the right of an individual to keep his/her individual health information from being disclosed. Privacy is typically accomplished though policies and procedures. With this understanding it is clear that security is necessary, but not sufficient for addressing privacy. Today several known PPDM techniques are available and these are extensively studied in literatures. B. Privacy Issues The privacy issue varies according to the data in use and the context it is used. But, the most important issue is how to provide privacy while preserving information (that is without loss of information).the methods like attribute removal, data hiding, and data compression can be applied on the data set to provide privacy, but will lead to information loss. Another important issue is regarding the computational overhead. Complex procedures like cryptographic techniques create additional overhead both technical and computational. The main parameter that affects the feasibility of implementing a secure protocol based on the generic constructions is the size of the best combinatorial circuit that computes the function that is evaluated [11]. For a distributed environment, when the number of parties becomes bigger, the communication and computational cost grow exponentially [19]. The PPDM algorithm that addresses all these issues is still a myth. Even though no such generic solutions are available to address all privacy issues, some research has focused on finding efficient protocols for specific problems that balance privacy, data utility and computational feasibility. C. Privacy Policies To ensure privacy the researcher has to address various privacy breaches (attacks) which need a high level of attention. Privacy breach happens when one s exact privacy information are directly linked to him. Since it is difficult to identify all types of attacks periodically, the privacy providers can follow certain kind of policies provided by different countries such as HIPAA of US, Data Protection Act of UK. Federal Health Insurance Portability and Accountability Act (HIPAA) of US sets the floor on privacy rights which means states are free to adopt more stringent medical privacy laws but states cannot pass any law that takes away HIPAA rights. On April 11, 2011, India s Ministry of Communications and Information Technology notified the Information Technology Rules, 2011 under the Information Technology Act, These include reasonable security practices and procedures for sensitive personal data or information. India now has a privacy law, brought into force with immediate effect

3 III. PRIVACY PRESERVING DATA MINING (PPDM) To protect privacy of individual, several methods can be applied on data before or along the process of mining. The branch of study which include these privacy concerns are referred as Privacy Preserving Data Mining. Privacy can be achieved through any one of the methods such as data hiding/masking, suppression, generalization, anonymization, perturbation, encryption, randomization, condensation, fuzzification, secure multi-party computation etc. PPDM techniques can be classified according to current studies, which are described in detail in this section. A. Classification of PPDM The PPDM techniques can be broadly classified as illustrated by fig.1, based on two scenarios: Central Server and Distributed. Since, the implementation of Soft Computing techniques like Neural Networks, Fuzzy Logic [14,20], Rough Sets, Genetic algorithms in the field of PPDM need further exploration, these are excluded from the major classification hierarchy described here. i) Central Server Scenario: In this Scenario, the PPDM techniques deal with how data is protected before publishing it for data mining task. It is also referred as Data Publishing scenario. Here data owners/data miners are independent of handling privacy issues. Any number of miners can be involved in the process of mining with respect to the published data. Here, the data mining task can be of independent nature and provide more flexible way to utilize the available information. Anonymization and Perturbation are the best suitable methods under this scenario. ii) Distributed Scenario: In distributed scenario, PPDM techniques deal with the protection against private databases involved in the process of mining. Here the data owners can also be the miners and get aggregate results on the union of their databases. This is a situation where the privacy is ensured on results of data mining. Most of the works in this regard have specific goals in data mining and involve more complex procedures like Cryptographic based on Secure Multi-party Computation (SMC) principle. Perturbation based techniques are also widely used in distributed scenario. Due to the inefficiency of generic protocols, some research has focused on finding efficient protocols for specific problems or goals of data mining like classification, clustering, pattern matching, association rule etc. Some of these studies are based on Central server scenario and some of them are based on Distributed scenario. Figure 1.PPDM Classification Hierarchy IV. PPDM TECHNIQUES In this section, the PPDM algorithms can be interpreted in detail according to the technique/mechanism it uses to achieve privacy. The techniques can be listed under three major classical PPDM techniques: 299

4 Anonymization, Perturbation and Cryptographic. This paper explores various PPDM algorithms based on the above classification hierarchy. A. Anonymization Based Sometimes the data must be publically published in its original form. Even though it is not encrypted and perturbed, some sort of precaution should be implemented before releasing the data in terms of anonymization. This is a kind of generalization of some attributes which protects against identity disclosure. Anonymization can be obtained through methods such as generalization, suppression, data removal, permutation, swapping etc [21]. k-anonymity method is treated as the classical anonymization method and most of the studies are based on k-anonymity. The others are based on its improved methods like l-diversity, t-closeness, k m -anonymization, (α,k) anonymity, p-sensitive k-anonymity, (k,e) anonymity, which are described in [29]. They provide a detailed survey of anonymization methods and also point out pitfalls in k- anonymity. Previous works by Samarati and Sweeney [3,4] shows that the removal of the personally identifying information from data is insufficient for the data protection, rather it is better to use k anonymity method for publishing data. The quasi identifier (QI), which is the combination of person specific identifiers are considered here for the process of anonymization. One of the common methods to achieve k anonymity is to generalize identifiers (for example date of birth can be generalized to month of birth). The [5] proposes a novel, more flexible generalization scheme. The experimental results of their study indicate that their approaches produce k anonymization with less generalization compared to previous approaches. They conclude that a bottom-up approach for k anonymization is preferable for small number of quasiidentifying attributes. A task independent technique based on anonymization which preserves information, privacy and utility of data is introduced in [13].Their algorithm is applied on the original data table to alter only the sensitive raw data before applying any mining methods. In most of the Privacy preserving generalization methods, loss of information is due to generalization (transformation) of QI attributes and sensitive attributes. They demand both privacy and no information loss by only transforming part of the QI and sensitive attributes. The [22] proposes a modified entropy l-diversity model in order to address privacy of medical data. Here, more detailed attacking conditions and characteristic of medical information are taken into consideration. Approaches which address specific problems are also developed using anonymization method. The k- anonymity based method is illustrated in [31] is used to search for optimal feature set partitioning and [34] for cluster analysis. And [33] proposes a data reconstruction approach to achieve k-anonymity protection in predictive data mining. In this approach the potentially identifying attributes are first mapped using aggregation for numeric data and swapping for nominal data. A genetic algorithm technique is then applied to the masked data to find a good subset of it. This subset is then replicated to form the released dataset that satisfies the k-anonymity constraint. Another anonymization technique known, as Condensation is a statistical approach which constructs constrained clusters in dataset and then generates pseudo data from the statistics of these clusters [9]. This method is called as condensation because of its approach of using condensed statistics of the clusters to generate pseudo data. It constructs groups of non-homogeneous size from the whole data, such that it is guaranteed that each record lies in a group whose size is at least equal to its anonymity level. Here, pseudo data is generated from each group so as to create a synthetic data set with the same aggregate distribution as the original data. This approach also can be effectively used for the problem of classification.the pseudodata provides an additional layer of protection, as it becomes difficult to perform adversarial attacks on synthetic data. Since the aggregate behaviour of the data is preserved, it becomes useful for a variety of data mining problems. B. Perturbation Based Disclosing a perturbed version of a data before releasing it for data mining is one of the data distortion method for privacy protection. Adding noise from a known distribution is one of the perturbation technique widely accepted. Before conducting a data mining operation, the miner should reconstruct the perturbed version to obtain the original data distribution. This approach is discussed in [1]. The paper proposes a perturbation technique developed for decision tree classification. The paper [2] depicts an individually adaptable perturbation model. This model enables each individual data to specify a different level privacy. Their paper demonstrates with experiments on data sets that the new approach is effective at satisfying 300

5 personal privacy preferences. The [15] proposes a study against diversity attacks. Their solution allows a data owner to generate perturbed copies of data for arbitrary trust levels on demand. This feature offers data owners maximum flexibility. Perturbation methods can be used in both scenarios, central server as well as in distributed scenario. These methods use some sort of data distortion techniques like adding noise, randomization or condensation. Studies in distributed scenario include [18,19,41].An approach based on geometric data perturbation and a data mining service oriented framework is introduced in[18].the paper [19] propose a perturbation based technique which modifies the data mining algorithm, so that they can be directly used on the perturbed data. They directly build a classifier for the original dataset from the perturbed training dataset by skipping the steps of reconstructing the original data distribution. The study [41] deals with clustering problem in the distributed environment. Their approach is based on Principal Component Analysis (PCA) technique instead of Geometrical Data Transformation Methods (GDTM) used traditionally. Even though, Perturbation techniques can be used for achieving privacy in data publishing and also in the process of data mining these have certain limitations: i) Since this model uses distributions instead of original records, it restricts the range of algorithmic techniques that can be used on the data. ii) And another limitation is the loss of implicit information available in multidimensional records. A variation of classical perturbation technique known, as Randomization is a data distortion technique that masks the data by randomly modifying the data values. Randomized response is one of the statistical techniques introduced by Warner to solve a survey problem. In Randomized response [9], the data is scrambled in such a way that the central place cannot tell with probabilities better than a pre-defined threshold, whether the data contains truthful information or false information. The information received from each individual user is scrambled and if the number of users is significantly large, the aggregate information of these users can be estimated with good accuracy. This aggregate information is very useful for decision-tree classification because decision-tree classification is based on aggregate values of a dataset, rather than individual data items. C. Cryptography Based The approaches discussed in the previous sections are applicable when data can be disclosed beyond the control of the data collection process. If the data is distributed across multiple sites which are legally prohibited from sharing their collections with each other, it is still possible to construct a data mining model. The paper [6] illustrated this scenario. It also addresses the problem of reconstructing missing values of building an accurate data mining model. They propose a cryptographic protocol based on decision-tree classification on horizontally partitioned databases. They assume that there are two data source and allows each data source to compute missing values without sharing any information about their data providing complete privacy preservation. Cryptographic techniques are extensively studied in distributed environment.the Oblivious Transfer is used as the basic building block in [11]. Another efficient privacy preserving protocol is described in [12] which provide a solution for the specific problem of distributed ID3. The implementation of these protocols is by using hard-wired circuits. Secure multiparty computation (SMC) is a technique that can be used to maintain privacy in different distributed data mining environments. SMC can be based on three general types of techniques: homomorphic encryption, circuit evaluation and secret sharing [16]. SMC protocols deals with two types of adversaries: semi-honest and malicious. The majority of applications are based on semi-honest types, in which the adversaries follow the protocol specification but try to learn information exchanged more than the results of the protocol. The paper [7] illustrates that SMC protocols with malicious adversary model have high complexities. They also claim that these models are not suitable for data mining application in its current form. The authors propose an Accountable Computing (AC) framework which assigns liability for privacy to the responsible party. The paper [17] includes an analysis of the accuracy and efficiency of protocols based on SMC. The [27] provides a privacy preserving framework for SMC, based on Gaussian mixture models. The protocol mentioned in [30] is based on encryption which protects the privacy of each distributed database. The protocol needs only two communications between each data site and the mixer in one round of data collection. The [32, 36] introduce a cryptographic approach for privacy preservation for classification problem. The protocol mentioned in [35] is based on homomorphic encryption for association rule mining. Pseudonymization is an approach that breaks the link between personal and medical information. It provides a form of traceable anonymity of health records. Instead of completely removing personal identification information from the medical data, identification information is transferred into a piece of information (i.e., a pseudonym) which cannot be mapped to a patient without knowing a certain secret. Encryption is a well 301

6 established technique for building pseudonyms [25].The encryption can be performed either at the databaselevel or at the application-level. Their work is based on the application-level encryption. V. COMPARISON OF PPDM TECHNIQUES TABLE I. COMPARISON OF PPDM TECHNIQUES Data Mining Task Technique Method/s Scenario/s Classificati on Clustering Association rule mining Outlier Detection Anonymizati on Perturbation Randomizati on Condensation SMC Pseudonymiz ation Generalizati on, Suppression, Permutation Adding Noise, Swapping Adding Noise, Scrambling Aggregatio n Cryptograp hic Cryptograp hic Data Publishing Data Publishing, Distributed Data Publishing, Distributed Data Publishing Distributed Distributed Using Tab.1, we present a preliminary comparison of various PPDM techniques, to provide an insight into, which technique is suitable for which scenario. It also illustrates the methods that are normally used by different techniques and suggests a number of techniques that can be implemented for solving particular problems in Data Mining. VI. CONCLUSIONS The main intension of this paper is accomplished through reiterating various PPDM techniques in literatures for handling privacy issues in data mining. Most of the studies show that there exist tradeoffs between privacy, information loss and computational overhead. Maximizing the data utility by preserving information is the critical challenge while protecting privacy. To provide accurate results in data mining, many PPDM techniques are task based. Since, no such technique exists which overcomes all privacy issues, research in this direction can make significant contributions. The study can be carried out using any one of the existing techniques or using a combination of these as illustrated in [24] or by developing entirely a new technique. Some interesting PPDM frameworks are illustrated in [8, 23, 38, 40, and 42] which can be further utilized. This survey will definitely help the researchers to set their own privacy goals according to specific demands. REFERENCES [1] Agrawal and Srikant, Privacy Preserving Data mining, Proceedings of the ACM SIGMOD International Conference on Management of data, [2] Li Liu, Murat Kantarcioglu and Bhavani Thuraisingham, The applicability of the perturbation based privacy preserving data mining for real-world data, Data & Knowledge Engineering 65 (2008) [3] Samarati P, Protecting respondent s privacy in Microdata release, IEEE Transactions on Knowledge and Data Engineering, 13: [4] Sweeney L, k-anonymity: A model for protecting Privacy, International Journal on Uncertainty, Fuzziness and Knowledge-based Systems, 10(5): [5] Tiancheng Li, Ninghui Li, Towards Optimal k-anonymization, Data & Knowledge Engineering, 2008 Elsevier. 302

7 [6] Geetha Jagannathan, Rebecca N. Wright, Privacy-Preserving Imputation of Missing Data, Data & Knowledge Engineering, 2008 Elsevier. [7] Jiang, Clifton and Kantarcıoğlu, Transforming Semi-Honest Protocols to Ensure Accountability, Data & Knowledge Engineering, 2008 Elsevier. [8] Bhavani Thuraisingham, Privacy constraint processing in a privacy-enhanced database management system, Data & knowledge Engineering, [9] Majid Bashir Malik, M. Asger Ghazi, Rashid Ali, Privacy Preserving Data Mining Techniques: Current Scenario and Future Prospects, Third International Conference on Computer and Communication Technology, [10] Jian Wang, Yongcheng Luo, Yan Zhao, Jiajin Le, A Survey on Privacy Preserving Data Mining, First International Workshop on Database Technology and Applications, [11] Benny Pinkas, Cryptographic techniques for privacy preserving data mining, http// [12] Yehuda Lindell, Benny Pinkas, Privacy Preserving Data Mining, [13] E. Poovammal and M. Ponnavaikko, Task Independent Privacy Preserving Data Mining on Medical Dataset, International Conference on Advances in Computing, Control and Telecommunication Technologies, [14] E.Poovammal and Dr. M. Ponnavaikko, An Improved Method for Privacy Preserving Data Mining, IEEE International Advance Computing Conference (IACC 2009) Patiala, India, 6-7 March [15] Yaping Li, Minghua Chen, Qiwei Li, and Wei Zhang, Enabling Multilevel Trust in Privacy Preserving Data Mining, IEEE Transactions On Knowledge And Data Engineering, Vol. 24, No. 9, September [16] Marina Blanton, Achieving Full Security in Privacy-Preserving Data Mining, IEEE International Conference on Privacy, Security, Risk, and Trust, and IEEE International Conference on Social Computing, [17] Sin G Teo, Vincent Lee, Shuguo Han, A Study of Efficiency and Accuracy of Secure Multiparty Protocol in Privacy-Preserving Data Mining, 26th International Conference on Advanced Information Networking and Applications Workshops, [18] Keke Chen and Ling Liu, Privacy-Preserving Multiparty Collaborative Mining with Geometric Data Perturbation, IEEE Transactions on Parallel and Distributed Systems, Vol. 20, No. 12, December [19] Li Liu, Murat Kantarcioglu and Bhavani Thuraisingham, Privacy Preserving Decision Tree Mining from Perturbed Data, Proceedings of the 42 nd Hawaii International Conference on System Sciences [20] R. Mukkamala and V.G. Ashok, Fuzzy-based Methods for Privacy-Preserving Data Mining, Eighth International Conference on Information Technology: New Generations, [21] Asmaa H.Rashid and Prof.dr. Abd-Fatth Hegazy, Protect Privacy of Medical Informatics using K-Anonymization Model, IEEE Explore. [22] Yan ZHU and Lin PENG, Study on K-anonymity Models of Sharing Medical Information, /07/$ IEEE. [23] Jitao Zhao and Ting Wang, A General Framework for Medical Data Mining, International Conference on Future Information Technology and Management Engineering, [24] Syed Zahid Hassan and Brijesh Verma, A Hybrid Data Mining Approach for Knowledge Extraction and Classification in Medical Databases, Seventh International Conference on Intelligent Systems Design and Applications. [25] Yun Ding and Karsten Klein, Model-Driven Application-Level Encryption for the Privacy of E-Health Data, International Conference on Availability, Reliability and Security, [26] Jinfei Liu, Jun Luo and Joshua Zhexue Huang, Rating: Privacy Preservation for Multiple Attributes with Different Sensitivity Requirements, 11 th IEEE International Conference on Data Mining Workshops, [27] Madhusudana Shashanka, A Privacy Preserving Framework for Gaussian Mixture Models, IEEE International Conference on Data Mining Workshops, [28] José Luis Fernández-Alemán,Inmaculada Carrión Señor, Pedro Ángel Oliver Lozoya, Ambrosio Toval, Methodological Review-Security and Privacy in electronic health records: A systematic literature review, Journal of Biomedical Informatics(2013). [29] Yan Zhao, Ming Du, Jiajin Le, Yongcheng Luo, A Survey on Privacy Preserving Approaches in Data Publishing, First International Workshop on Database Technology and Applications, [30] Xun Yi, Yanchun Zhang, Privacy-preserving distributed association rule mining via semi-trusted mixer, Data & Knowledge Engineering 63 (2007) [31] Nissim Matatov, Lior Rokach, Oded Maimon, Privacy-preserving data mining: A feature set partitioning approach, Information Sciences 180 (2010) [32] XunYi, YanchunZhang, Privacy-preserving naive Bayes classification on distributed data via semi-trusted mixers, Information Systems 34 (2009) [33] Dan Zhu, Xiao-Bai Li, Shuning Wu, Identity disclosure protection: A data reconstruction approach for privacypreserving data mining, Decision Support Systems 48 (2009) [34] Benjamin C. M. Fung, Ke Wang, Lingyu Wang, Patrick C.K. Hung, Privacy-preserving data publishing for cluster analysis, Data & Knowledge Engineering 68 (2009)

8 [35] Justin Zhan, Stan Matwin, Li Wu Chang, Privacy-preserving collaborative association rule mining, Journal of Network and Computer Applications 30 (2007) [36] F. Emekci, O.D. Sahin, D. Agrawal, A. El Abbadi, Privacy preserving Decision tree learning over multiple parties, Data & Knowledge Engineering 63 (2007) [37] Alper Bilge, Huseyin Polat, A comparison of clustering-based privacy- preserving collaborative filtering Schemes, Applied Soft Computing 13 (2013) [38] Gerardo Canfora, Elisa Costante, Igino Pennino, Corrado Aaron Visaggio, A three layered model to implement data privacy policies, Computer Standards & Interfaces 30 (2008) [39] Weijia Yang, Sanzheng Qiao, A novel anonymization algorithm: Privacy protection and knowledge preservation, Expert Systems with Applications 37 (2010) [40] Sergio Martínez, David Sánchez, Aida Valls, A semantic framework to protect the privacy of electronic health records with non-numerical attributes, Journal of Biomedical Informatics 46 (2013) [41] R. Vidya Banu, N.Nagaveni, Evaluation of a perturbation-based Technique for privacy preservation in a multiparty clustering scenario, Information Sciences 232 (2013) [42] Jimmy Secretan, Michael Georgiopoulos, Anna Koufakou, Kel Cardona, APHID: An architecture for private, highperformance integrated data mining, Future Generation Computer Systems 26 (2010) 891_