Neighborhood-Privacy Protected Shortest Distance Computing in Cloud

Transcription

1 Neigboroo-Priacy Protecte Sortest Distance Computing in Clou Jun Gao Jeery Yu Xu Ruoming Jin Jiasuai Zou Tengjiao Wang Dongqing Yang Key Laboratory o Hig Conience Sotware Tecnologies, EECS, Peking Uniersity Department o systems engineering & Engineering Management,Cinese Uniersity o Hong Kong Department o Computer Science,Kent State Uniersity {gaojun,jszou,tjwang,qyang}@pku.eu.cn, [email protected], [email protected] ABSTRACT Wit te aent o clou computing, it becomes esirable to utilize clou computing to eiciently process complex operations in large graps witout compromising teir sensitie inormation. Tis paper stuies sortest istance computing in te clou, wic aims at te ollowing goals: i) preenting outsource graps rom neigboroo attack, ii) presering sortest istances in outsource graps, iii) minimizing oerea on te client sie. Te basic iea o tis paper is to transorm an original grap G into a link grap G l kept locally an a set o outsource graps G o. Eac outsource grap soul meet te requirement o a new security moel calle -neigboroo--raius. In aition, te sortest istance query can be equialently answere using G l an G o. Our objectie is to minimize te space cost on te client sie wen bot security an utility requirements are satisie. We eise a greey meto to prouce G l an G o, wic can exactly answer te sortest istance queries. We also eelop an eicient transormation meto to support approximate sortest istance answering uner a gien aitie error boun. Te inal experimental results illustrate te eectieness an eiciency o our meto. Categories an Subject Descriptors H.. [Database management]: Database Applications General Terms Algoritms Keywors Sortest Distance, Grap Transormation, Outsource, Priacy.. INTRODUCTION Grap structure ata are use in numerous applications, e.g., web graps, social networks, ontology graps, biological an cemical patways, transportation networks. Hig eiciency is essential or requent an basic grap operations. Howeer, een basic operations on a grap can be ery time-consuming ue to te complexity Permission to make igital or ar copies o all or part o tis work or personal or classroom use is grante witout ee proie tat copies are not mae or istribute or proit or commercial aantage an tat copies bear tis notice an te ull citation on te irst page. To copy oterwise, to republis, to post on serers or to reistribute to lists, requires prior speciic permission an/or a ee. SIGMOD, June,, Atens, Greece. Copyrigt ACM 7----//...$.. o structural connectiities an grap size []. Moreoer, real grap atasets are growing rapily in size, making te attainment o ig eiciency een arer. Te paraigm sit o clou computing oers a new approac or storage- an compute- intensie tasks [,,, ], allowing users to migrate teir buren (e.g., ata maintenance an computing utilities) to an outsource serer (or clou serer). Te outsource serer typically as suicient resources to maintain ery large atasets an proies quick response to users requests wit its powerul istribute an parallel arcitecture. Tus, it becomes esirable (an een ineitable) to employ clou computing to manage large graps an particularly to eiciently process complex grap operations. Te biggest problem wit tis approac is tat client companies may be unwilling to outsource teir aluable atasets. Take te outsourcing o a social network as an example. Een i its owner remoes te ientiier o eac ertex beore sening te network to te clou serer, te structural relationsips can still possibly be recoere [, ], wic will surely ealue te outsourcing. Gien tis, te unamental callenge is: How can we utilize clou computing to eiciently process complex operations in large graps witout compromising teir sensitie inormation? In tis paper, we ocus on computing te sortest istance between two arbitrary ertices in a large ege-weigte grap. Tis operation is one o te most important an wiely-use grap operations [, 7,, ], yet its irect online computation is expensie on large graps []. Te straigtorwar way to process sortest istance queries using clou computing requires outsourcing te entire grap. Tus, te solution to tis problem (by aoiing outsourcing sensitie inormation but still utilizing te ig computational power o te clou) will not only irectly beneit grap istance computation an oter relate operations [], but more importantly se ligt on te principles an unamental tecniques or presering priacy in clou computing.. Relate Work In te ollowing, we reiew te current state-o-te-art tecniques an point out wy tey cannot ully aress te priacy-in-clou callenge. Priacy-Presering Grap Publising: Priacy protection or grap publising as been stuie recently. Most o te existing work on grap publising ocuses on certain structural anonymizations, suc as -neigboroo [], k-egree [], k-automorpism [7], k-isomorpism [], cluster base ertex anonymity [, ], as well as many oters. Tese tecniques typically ocus on using te least amount o moiications o te original grap (minimal inormation loss) to make it satisy te targete security requirement. Unortunately, te anonymize graps prouce rom tese priacy

2 protection tecniques generally o not necessarily maintain te statistical an grap teoretical caracteristics o te original [,, 7, ]. In particular, or any pair o ertices, tere is no guarantee o te egree o similarity or preseration o sortest istances between te anonymize grap an te original grap. For example, k-isomorpism is propose recently to partition a grap into k isjoint, isomorpic subgraps, wic unortunately cannot be use to compute sortest istances in te original grap []. In aition, most o te exiting works eal wit priacy on unweigte graps, an o not consier te impact o ege weigts. A ew recent works [7,,, ] notice te importance o presering grap teoretical caracteristics uring grap publising. Ying an Wu propose to presere te eigenalue o a grap, wic relates to aerage sortest istance an oter topological eatures, uring grap transormation [7]. Liu et al. stuy ege weigt perturbation by Guassian ranom or euristic rules []. Das et al. propose a linear programming (LP) meto to cange ege weigts wile presering sortest pats []. In bot [] an [], te topological structure o te anonymize grap remains uncange. Tus, een wit te minimal topological knowlege, suc as te ertex egree [], some sensitie inormation can be re-ientiie. Furtermore, te greey perturbation [] relies on an expensie matrix operation, an te LP approac can be easily oerwelme by te number o inequality rules (sortest pat preseration conitions) []. For example, or a connecte grap wit only one tousan ertices, tere are one million rules or LP, wic is clearly too expensie. Recently, ierential priacy [] as emerge as a powerul moel to protect against unknown aersaries wit guarantee probabilistic accuracy. Hay, Li et al. perorme some o te irst stuies to support ierential priacy in analyzing networks [, ]. Speciically, tey esign an eicient meto or releasing a proably priate estimate o te egree istribution o a network. Howeer, it is still an open problem on ow to publis a grap wit respect to te ierential priacy [], an tus it is also not clear weter te tecniques eelope in [] can be applie to more complicate queries, suc as te sortest-pat istance query. Security Issues in Outsource Serer: Sensitie ata protection an eriication o query results in te outsource serer ae attracte muc attention recently [, ]. A work closely relate to tis paper stuies te eriication issue in outsourcing graps or sortest pat iscoery []. In teir solution, te original grap ata are outsource along wit eriication objects, an te client sie will aliate te correctness o te results wit te eriication objects. Howeer, tey o not consier ow to protect te sensitie inormation o te original grap. Sortest Pat Discoery: Sortest pat iscoery is one unamental problem in grap teory. Dijkstra s algoritm[] is a wellknown approac to in te single-source sortest pat. Tere is also some work to exploit pre-compute inices to spee up te running time o sortest pat iscoery. HEPV [] an HiTi [] can be iewe as multiple-leel inices. Te combination o te A* algoritm wit te lanmark inex is stuie in []. -HOP inex [7] assigns eac ertex wit two ertex label sets (L out an L in), an ins te sortest istance between two noes wit an intersection o teir label sets. In aition, te inices wit ierent error bouns an arious construction metos or approximate istance answering ae also been stuie in [,, ]. Howeer, we cannot simply outsource suc inices as tey will also isclose sensitie inormation o te grap. For instance, in te -op inex, eac ertex is ery likely to recor its istance to its immeiate neigbors. Suc inormation oten nees to be protecte []. Data owner Original Grap Query Results Grap transormation LinkGrap Query Ealuation Client Sie Rewritten Queries Results Figure : An Oeriew Outsource Grap(s) Query Ealuation Outsource Serer Attacker. Oeriew Gien tis, our goal is to searc or a computational sceme wic can compute sortest istances wile also protecting priate inormation in te original grap. Te key issues unerlying tis problem are i) wat inormation soul be protecte an wat can be expose, an ii) ow can we employ clou computing wile minimizing client sie oerea an satisying priacy constraints? In aition, recall tat te goal in grap publising is to generate an anonymize grap wic soul be similar to te original one in orer to minimize inormation loss [,, 7, ]. Here, te inormation wic we sen to te clou serer is or computing sortest istances. Tus, it oes not ae to be a grap or een a subgrap; it can be any ormat as long as it oes not isclose te priate inormation o te original grap. Tis goes back to te core problem: wat inormation soul we protect? Inee, most grap publising tecniques are esigne to protect speciic types o priate inormation. Te most common type o attack is a neigboroo attack []. For example, outsiers to a social network can easily collect some users neigboroo inormation. Howeer, it generally becomes increasingly iicult or attackers to learn knowlege beyon te irect neigboroo []. Tus, in tis paper, we ocus on protecting priate inormation against neigboroo attacks. Te oerall ramework o our approac is illustrate in Fig.. Gien an original ege-weigte grap G, we represent it in two parts or bot priacy protection an sortest istance computation: i) an outsource grap(s) G o is a ig leel abstraction o te original grap, wic recors te key inormation or online sortest istance answering, but oes not contain sensitie neigboroo inormation; ii) a link grap, G l, wic inclues te local priate inormation an te relationsips between ertices in G an ertices in an outsource grap(s) G o or sortest istance computation. Te grap(s) G o is on te clou serer an te link grap G l is on te client sie. Note tat tis grap representation bears a certain similarity to te -leel inex or sortest pats [, ]. Howeer, te existing multiple inices suc as HEPV an HiTi mainly target planar graps, since iscoering goo grap separators in inexing is iicult on non-planar graps. More importantly, te present work as a ierent ocus: to construct an outsource grap wic eliminates te priate local neigboroo knowlege an makes ull use o te clou serer. Te main contributions are summarize below. We ormulate a new grap transormation problem as minimizing te size o te link grap G l on te client sie on te conition tat te priacy o outsource graps G o is protecte an sortest istances can be answere using G o an G l. We propose a new security moel, name -neigboroo-raius, wic ies local etails in irect eges or a - raius or eac ertex to counter neigboroo attacks. We propose a greey approac to generate outsource graps an a link grap or exact sortest istance answering wit protecte neigboroo priacy. We stuy ow to answer approximate sortest istances in te same context wit an aerage aitie istance error boun.

3 a b c e 7 g i 7 j k l o u p (a) Original Grap w x y z (b) Unweigte Query Pattern w x y z (c) Weigte Query Pattern Figure : Sample Grap G(V, E) G l (V l, E l ) G o(v o, E o) G o n/m n o n l Te original grap Te link grap An outsource grap Outsource graps Te number o ertices/eges in G Te number o ertices in G o Te number o ertices in cluster Table : Symbols By allowing approximate sortest istance to be answere, we sow tat G o can be constructe eiciently. We also iscuss te euristic rules use in G o construction. We conuct extensie experiments on bot real an syntetic atasets. Te results sow tat te client sie aciees signiicant cost saing in sortest istance computing wit te ai o outsource graps compare to beore. We conirm tat our meto scales well wen it is use to answer approximate sortest istances witin a speciie error boun. Te remainer o tis paper is organize as ollows. In section, we ormulate te transormation problem taking bot security an utility into account. Section an section present metos to transorm graps wit te exact an approximate istance answering respectiely. Section reports experimental results. Section conclues te paper an iscusses uture works.. PROBLEM STATEMENT In tis section, we irst eine our grap-relate notation an ten iscuss security issues or outsource graps an teir utilization in sortest istance answering. Finally, we ormulate our optimization problem.. Notation Let G = (V, E) be an ege-weigte unirecte grap, were V an E are its ertex set an ege set, respectiely. Eac e E takes te orm o e = (u, ), u, V, an is associate wit a weigt enote as w(e) or w(u, ) (All weigts are assume to be nonnegatie integers in a inite range). Wen te ege (u, ) oes not exist, we can assume w(u, ) =. A pat is a sequence o eges (u, u )(u, u )... (u x, u x), were u i V ( i x). Te cost o a pat p is te sum o ege weigts in p, enote as len(p). A sortest istance query in grap G computes te minimal cost δ G(u, ) o any pat rom u to in G. Figure (a) sows a sample grap, wic will be use as te running example in tis paper. Te caracter insie te circle represents te ertex s ientiier, an te number annotate on te ege is its weigt. Te symbols use trougout te paper are liste in Table. A grap pattern query can be use in re-ientiication oer te transorme grap [,,, 7, ]. I an attacker as some knowlege about a ragment o te original grap, e can compose a grap pattern query to in exact matces oer te transorme grap, an use te query results to iner oter inormation. We illustrate a weigte grap pattern query in Fig. (c). Its result is te inuce subgrap wit te ertex set {i, l,, p} in G, since we can buil a ertex mapping rom te query pattern to tis subgrap, uner wic te weigt o eac ege is te same as tat o te mappe ege. Note, te result o te unweigte grap pattern in Fig. (b) contains subgraps.. Protecting Neigboroo Priacy In tis work, we target at protecting te sensitie local neigboroo inormation. Basically, te inormation o ow an iniiual ertex links to its neigbors an wat are te ege weigts or tese links are eeme sensitie an nee to be protecte. In particular, we ocus on -neigboroo attacks since it tens to be more iicult to collect inormation beyon tat []. In aition, wen two ertices are ery close to eac oter (witin a tresol ), een witout a irect link, teir relationsip can also be consiere important. Formally, te outsource grap soul meet te requirement o te -neigboroo--raius grap. DEFINITION. -Neigboroo--Raius Grap. Let G = (V, E) be an original grap an G o = (V o, E o) an outsource grap, V o V. For a ertex u V, its appearance in V o can be enote as u. G o is a -neigboroo--raius grap o G, i G o meets te ollowing conitions:. or any ertex pair u an V o, (u, ) / E. (-neigboroo);. or any ertex pair u an V o, δ G(u, ). (-raius). For breity, we sorten te name to -raius grap. Simply speaking, we o not allow any two ertices, wic are ajacent or wit teir istance smaller tan, to appear in te same -raius grap. Figure (a) sows a -raius grap, G o(v o, E o), or G(V, E) in Fig. (a). As sown in te igure, te ertex u in V o is an appearance o a ertex u in V. O te ertices in G, appear in G o. For any two ertices u an in V o, u an are not ajacent in te original grap, an te sortest istance δ G(u, ). We cannot a oter ertices into G o. For example, we cannot a a since δ G(a, b) = is less tan =. Notice tat te eges in G o sow te connections between ertices in a global manner, an te weigt associate wit an ege (u, ) is te sortest istance δ G(u, ) in te unerlying original grap G. We sow ierences between our meto an tat use in a ata publising scenario. Figure (b) sows a -isomorpism result rom a recent stuy []. It buils isjoint, isomorpic subgraps wit grap splitting an structural anonymization. Gien a grap pattern query as in Fig. (b), it can get results rom te transorme grap in Fig. (b), but te number o matce subgraps is. Our work supports ege weigts. In aition, te ertices in a -raius grap are a proper subset o tose in te original grap, an no original eges are allowe in a -raius grap. Tereore, te irect ealuation o any pattern query cannot in meaningul results, an a subsequent noe re-ientiication is preente. Most importantly, te operations to aciee structural anonymization in existing works [,, 7, ], incluing arbitrary aition/remoal o eges an grap splitting, make te sortest istance computing oer te transorme grap iicult or een impossible. An interesting an important question is weter enorcing te -raius property on eac outsource grap is too strict. For instance, can we simply remoe all eges in te original grap an

4 b o i (a) -raius a b e c j u k o l i (b) -isomorpism g p j a u 7 b e i k o l (c) non -raius c Figure : Transorme Grap or Outsourcing an Publising ten only connect tose pairs o ertices wose sortest istance is no smaller tan? Te answer is negatie. We emonstrate a successul attack on suc as grap. Suppose an outsource grap G o is constructe by te remoal o all irect eges an aition o eges rom ertex u to i δ G(u, ). We sow te eges relate wit ertices e an k in G o in Fig.(c). Tis grap is a non- -raius grap since two ajacent ertices e an k in te original grap co-exist in te same -raius outsource grap, wic iolates te irst conition o a -raius grap. Attackers can obsere tat te grap is strongly connecte, tus, tey can know tat tere is a irect ege (wit any weigt) or a pat wit cost no larger tan between e an k in te original grap. Base on te triangle inequality oer G o, attackers een iner tat te ege weigt is no smaller tan!. Sortest Distance Computation using - Raius Grap We transorm an original ege-weigte grap G into a set o outsource -raius graps G o = {G o,..., G Go o } wic will be eploye on te clou serer, togeter wit a link grap G l on te client sie. An ege in G l takes te orm o (u, ), wic maintains te relationsip between ertices in G to an appearance o in an outsource grap. Te ege can be also expresse in te orm o (u, G o.) to speciy tat te appearance is in te outsource grap G o. Te weigt o an ege (u, ), w(u, ), in G l is equal to δ G(u, ). In particular, w(u, u) =. We may use u, u an G o.u intercangeably in te ollowing. Now, we gie an important property to caracterize te outsource graps G o an te link grap G l. DEFINITION. ( )-Sortest Distance Equialent Grap. Let G = (V, E) an G = (V, E ) be two graps, V V. G is a ( )-sortest istance equialent grap o G i δ G(u, ) = δ G (u, ) or any ertex pair (u, ) wit δ G(u, ), u, V. In orer to use outsource graps G o an te link grap G l = (V l, E l ) to compute sortest istances, we require te union o G o an G l to be a ( )-sortest istance equialent grap o te original grap G. For graps G = (V, E ) an G = (V, E ), teir union result is G = (V V, E E ). Gien two ertices u an in G, te outsource grap G o an te link grap G l = (V l, E l ), te sortest istance can be compute as ollows: len = min x,y V o,g o=(v o,e o) G o (u,x), (,y) E l w(u, x) + δ Go (x, y) + w(y, ) δ G(u, ) = min{len, w}, were w is w(u, ) in G l () Notice tat we only utilize te outsource graps an te link grap to compute te sortest istance rom u to wit δ G(u, ). For te sortest istance less tan, we can compute it in te g p original grap G. Tus, te complete sortest istance computing can be escribe as ollows: gien two ertices u an, Dijkstra s algoritm runs on te original grap to in weter u can reac witin. I no pat can be oun, we begin to rewrite te istance query rom u to into multiple istance queries against te outsource graps G o. We locate u.eges or u s eges an.eges or s eges in te link grap G l. For eac pair o eges e u = (u, x) u.eges an e = (, y).eges, i x an y are in te same outsource grap G o G o, a istance query rom x to y is issue in G o. We ten combine te returne results rom te outsource serer wit te istance inormation (w(u, x), w(y, )) in G l to yiel len in Equation (). Due to te security reason or te optimization purpose, or two ertices wit istance no less tan, te link grap G l may materialize teir relationsip by irectly linking tem wit an ege. Tus, te sortest istance is compute by coosing te minimum between len an w(u, ) in G l (i exists), as illustrate in Equation ().. Optimization Problem To sum up, gien a grap G = (V, E) an, te grap transormation prouces outsource graps G o = {G o,..., G Go o } an a local link grap G l wic aciee te ollowing objecties:. Eac outsource grap G o G o is a -raius grap;. Te union o G o an G l is a ( )-sortest istance equialent grap o G;. Te space cost o G l an te cost o te sortest istance computation on te client sie are minimize. In te ollowing sections, we stuy ow to sole tis problem eiciently.. GRAPH TRANSFORMATION WITH EX- ACT DISTANCE ANSWERING In tis section, we irst gie a naïe approac to sow te problem complexity, ten we gie a greey algoritm to transorm a grap or exact sortest istance answering. Finally we analyze our meto.. A Naïe Approac We obsere tat te two optimization targets (in Objectie ) are along te same line wit one anoter an not in conlict. For instance, i we minimize te space cost G l, te computational cost oer G l tens to be minimize. In te ollowing, we will ocus on minimizing te space cost o G l. In aition, as iscusse aboe, or any pair o ertices (u, ) wit istance less tan, its istance can be iscoere on te original grap. Tus, only tose ertex pairs wose istances are no less tan nee to be consiere in te transormation. Formally, our grap transormation can be reuce to a problem on minimizing G l as ollows: DEFINITION. Minimizing G l. Gien a grap G = (V, E) an, we seek a set o -raius graps G o rom G an a link grap G l suc tat or eac pair o ertices (u, ) in grap G = (V, E) wit δ G(u, ),. tere exists an outsource grap G o G o, (u, G o.x) E l an (G o.y, ) E l, were δ G(u, ) = δ G(u, x) + δ G(x, y) + δ G(y, );. or tere exists an ege (u, ) E l in G l. Our objectie is to minimize G l, or te number o eges in G l.

5 In orer to sole tis problem (minimizing G l ), we may consier a straigtorwar brute-orce approac. Basically, we can try to enumerate all caniate conigurations, were eac caniate coniguration consists o a set o outsource graps an a link grap, an can answer any istance query rom u to wit δ G(u, ) (Equation ()); ten we compute te space cost o G l in eac caniate coniguration. Finally, te optimal solution is te coniguration (a set o outsource graps wit a link grap) wit te minimal G l. Now, let us look at te number o caniate conigurations in te brute-orce approac. We note tat te ertices in an outsource grap are actually te sub-set o te ertices in te original grap. Altoug not all sub-sets o ertices o original grap can prouce ali -raius graps, te total number o ierent outsource graps (-raius graps) can still be O( n ) in te worst case. In aition, te maximal ertices in te sortest pat rom u to will be O(n) in te worst case, wic inicates tat eac outsource grap rom te total O( n ) ones as te potential to be use in te istance presering or (u, ). Base on tese actors, we can obsere te total number o ierent conigurations is exponential in terms o te number o ertices in te original grap. Tis clearly makes te brute-orce approac too expensie to be easible. We can also obsere te relationsip between te minimizing G l problem an te set coer problem [?]. Te set coer problem is escribe as: gien a groun set U, an a caniate amily S consisting o te subsets o U, te goal is to in te minimal number o caniate sets, enote as C S, wose union is U. We can transorm an outsource grap G o into a caniate set S in S an transorm a ertex pair p into an element e in te groun set U. Speciically, te caniate set S consists o all ertex pairs wose istance can be answere ia G o. Gien tis, we may be incline to aopt a set-coer approac [?] to sole our problem. Howeer, te iiculty is tat in our problem, te outsource graps an consequently te caniate sets are not gien in aance. An te ertices in an outsource grap must satisy te -raius constraint. Moreoer, te optimization target in our problem is to minimize te space cost o G l, wic is ar to be coe as te goal in te set coer problem.. Fast Greey Meto Te naïe solution aboe reeals te massie searc space in te optimal solution to our grap transormation problem. In tis part, we esign a ast greey meto to prouce a reasonable grap transormation plan. Basic Iea. Te main problem wit te naïe approac lies in te act tat we ae to enumerate all possible outsource graps. To aoi proucing all outsource graps, we wis to construct only te neee ones. Intuitiely, te outsource grap wic can answer more istance queries will be constructe irst, since in suc a case, te eges in te link grap ae iger cances to be reuse an tus te space cost o te link grap can be reuce. Tis iea is similar to te greey iea use in te set coer problem, wic selects te sub-set wit te maximal number o elements irst. We ten make a euristic restriction on eges in G l in orer to reuce te searc space or te outsource graps. Recalling Equation (), te sortest istance rom u to can be compute ia a sub-pat rom x to y in an outsource -raius grap. Taking te sub-pat rom u to x as an example, we require eiter te istance rom u to x to be less tan a tresol or u to be ajacent to x in te original grap. Tis restriction can rule out te cases were eges in te link grap ae large weigts. Note tat te restriction oes not contraict our aboe intuitions. A sub-pat rom u to x wic can be use in more istance queries always as a lower weigt. For simplicity, te tresol on te maximal ege weigt a b c g 7 b c e 7 e g 7 b c g (a) Sampling Sortest Pats a b g 7 e g b c (b) outsource ertex pairs b c (c) Outsource graps(part) Figure : Outsource Grap Generation in te local grap as te same setting as in -raius grap in te ollowing. Uner te restriction, we gie te ollowing notation on te caniate outsource ertex pairs. Te irst conition is te same as Equation (), wic means te sortest istance rom u to can be answere ia x an y. Te secon conition is te restriction on eges in te link grap. Te tir conition correspons to te requirements o -raius. DEFINITION. Caniate Outsource Vertex Pair. Gien a pair o ertices (u, ) in grap G = (V, E) wit δ G(u, ) an (u, ) / E, i tere exists anoter pair o ertices (x, y):. δ G(u, ) = δ G(u, x) + δ G(x, y) + δ G(y, );. δ G(u, x) < or (u, x) E, δ G(y, ) < or (y, ) E;. δ G(x, y) an (x, y) / E. ten (x, y) is te caniate outsource ertex pair or pair (u, ). We illustrate caniate outsource ertex pairs or te sortest pats in Fig.(a). Take te sortest pat between noe a an noe g as an example. For =, te caniate outsource ertex pairs inclue (a, ), (a, g), (b, ), an (b, g). We also note tat some ertex pairs, suc as (b, ) in Fig.(b), lie on te sortest pats between multiple ertex pairs an tus can be use to answer multiple istance queries. In orer to make te outsource grap answer more istance queries, we preer to select suc ertex pairs or te outsource grap. Also, note tat (c, ) cannot be put in te - raius grap wic alreay contains (b, ), since δ G(b, c) <. In suc a case, we ae to put tem into ierent outsource graps. Anoter problem wit te naïe approac is te large intermeiate space require. We nee to presere te istance or O(n ) ertex pairs in te grap transormation. On a relatiely large grap, te representation o tese ertex pairs alone will easily excee te memory limit. Tus, we nee to exten te greey ramework to use a pipeline approac to generate te outsource graps an teir link grap. Tat is, we iteratiely enumerate ertex pairs until te number o ertex pairs reaces a tresol, an ten use tese partial ertex pairs to guie te construction o one outsource grap. Once te outsource grap is constructe, te ertex pairs wic ae been presere will be remoe rom memory. Ten we loa a new set o ertex pairs or te next outsource grap, until all istances between ertex pairs ae been presere. Greey Grap Transormation. We present our algoritm in Algoritm. We initialize te sortest pat set, outsource graps an te link grap in line. Ten we attempt to presere te istances o tese sortest pats wit newly constructe outsource graps. In te iteration rom line to line, wen te total pats in memory excee MPMem in line, we buil a ertex sequence L wit a beneit unction an inoke Algoritm to generate an outsource grap accoring to L in line 7. MPMem is use to control te maximal space cost use in te grap transormation. Te pats wic ae been presere are remoe rom P in line.

6 Algoritm : Greey Grap Transormation 7 Input: grap G = (V, E),, MPMem or tresol on maximal pats in memory Output: outsource graps G o an link grap G l. Initialize an empty sortest pat set P, G o, an G l ; wile tere remains sortest pats not anle o Locate a remaining sortest pat p wit len(p), a p into P ; Enumerate all caniate outsource ertex pairs or p; i sizeo(p) > MPMem ten Buil a ertex sequence L wit te pair base beneit unction; G o OutGrap(G,, L); G o G o G o; Buil eges in G l rom ertices in G to tese in G o; Remoe te pats rom P exactly answere by G o; Re-enumerate caniate ertex pairs in P ; remoe ; wile remoe > G o o Generate G o as line to line ; remoe te number o remoe pats by G o; For eac p P, buil an ege e wit ening ertices o p, an a e into G l ; 7 return G o an G l. Now we iscuss te beneit unction use in te greey meto. For eac sortest pat, we enumerate all possible caniate outsource ertex pairs. We ae two kins o beneit unctions. Te irst unction is base on te ertex requency. Tat is, we simply count te occurrences o x an y or eac caniate outsource ertex pair (x, y) separately. Te secon one is base on ertex pair requency. We recor te requency o all possible ertex pairs, an sort ertex pairs in terms o teir requency. Note tat L may contain uplicate ertices in suc a case. Since two ertices x an y aing ig requencies oes not imply tat (x, y) can be use to compute more sortest istance queries, Algoritm applies te ertex pair base beneit unction in line. Our experimental results sow tat te latter unction works better tan te ormer. As or te termination conition o te greey meto, we can continue generating new outsource graps an pruning pat set P until P is empty. Te algoritm will stop since eac outsource grap can be use to presere at least one remaining istance. Howeer, wen te iteration rom line to line stops, tose ertex pairs wose istances can be easily answere by outsource graps ae been remoe. In orer to reuce te transormation cost, we can terminate te construction o outsource graps wen te number o noes in a newly generate outsource grap G o is larger tan te number o remaining ertex pairs wose istances can be answere ia G o. Since te remaining pats are recore in G l in line, te union o G an G l is still a ( )-sortest istance equialent grap o te original grap. Discoering Single Outsource Grap. Te next key problem is ow to use te euristic inormation collecte rom te greey meto to guie te construction o a outsource grap. We now sow tat eac -raius grap can be easily constructe rom a istance aware cluster coer. DEFINITION. Distance Aware Cluster Coer. Let G = (V, E) be an original grap. A cluster coer C is a set o clusters, eac cluster C (x) C aing a center x V. A istance aware cluster coer meets te ollowing requirements: Outsource grap Link Grap a Original grap u j b b o o e 7 k i l i c g 7 p Figure : Link Grap an One Outsource Grap. For any ertex u V, u belongs to at least one cluster C (x) were u is irectly connecte to x or δ G(u, x) < ;. For any two clusters C (x) an C (y), δ G(x, y) an (x, y) / E. Intuitiely, te centers o clusters can be use as te outsource ertices in a -raius grap. For example, te ertices in Fig.(a) are te cluster centers in a cluster coer. For a ertex u in a cluster C (x), we buil an ege rom u to its cluster center x, an suc an ege is actually in te link grap G l. Gien a grap G,, an a ertex sequence L wic encoes te euristic knowlege, an outsource grap can be constructe eiciently wit Algoritm. Algoritm : OutGrap(G,, L) Input: grap G = (V, E),, a ertex sequence L. Output: Outsource Grap G o = (V o, E o). Initialize empty G o = (V o, E o); wile tere exists uncoere ertex in L o Pick te top uncoere ertex x rom L as a cluster center, an V o V o {x}; Create a cluster C (x) containing -neigbor o x an ertex u wit δ G(u, x) < wit Dijkstra s searc, an mark tem coere; For any two cluster centers x an y, buil te necessary ege between tem; Return G o. In Algoritm, we select te irst uncoere ertex rom L as te cluster center an buil its cluster, since L is sorte in terms o noe beneit an te ertices closer to te ea o L ae iger beneits. Te cluster centers will be te ertices in te outsource grap G o. Te oter ertices in a cluster can be iscoere wit Dijkstra s algoritm an are labele as coere so tey will not be selecte as cluster centers. Notice tat tis strategy also ensures tat te minimal istance between cluster centers is no smaller tan. In line, we buil eges between any two ertices in te outsource grap. Te ege weigt equals teir sortest istance in te original grap iscoere by Dijkstra s algoritm. Gien tree ertices x, y, an z, i δ G(x, y) + δ G(y, z) =δ G(x, z), te ege rom x an z nee not be constructe. Figure sows one outsource grap an its link grap prouce by Algoritm on te grap (Fig.(a)). Te outsource grap is te same as Fig.(a). It can be constructe by Algoritm. Lines wit re color are te eges in te link grap G l. In orer to make te igure clear, we omit te weigt o tese eges.. Analysis o Grap Transormation

7 In tis part, we analyze te time cost an correctness o te grap transormation algoritm, te impact o, an te oerea istribution between te clou serer an client sie. We use te ollowing symbols. Te meanings o n o, n l, n, m are gien in Table. x is te total number o outsource graps, wic is relate to an te grap s eatures. b is te maximal number o a ertex s eges to an outsource grap. Te time cost o grap transormation in Algoritm inclues te enumeration o all sortest pats, te sorting o caniate outsource ertex pairs, an te generation o all outsource graps. Te enumeration o all sortest pats requires O(n(m+nlog n)). Since we nee to sort at most O(n ) caniate outsource ertex pairs in te beneit computation beore te construction o eac o x outsource graps, te total sorting cost is O(xn log n). Te single outsource grap generation in Algoritm inclues te ertex selection cost an ege builing cost. Te ertex selection requires O(n on l ), since tere are O(n o) clusters an eac requires O(n l ) or local sortest pat iscoery. In te ege builing or an outsource grap, we nee O(n o) times sortest istance iscoery in te original grap in te worst case. Tus, a single outsource grap construction takes O(n o(m+nlog n)+n on l )=O(n o(m+ nlog n)). Wit all actors consiere, te total time cost o grap transormation in Algoritm is O(n(m+n log n)+xn log n+ xn o(m + nlog n)). A minor extension to Algoritm is to cace te compute sortest istances wic can be use in te ege builing in outsource graps. In tis way, te time complexity can be reuce to O(n(m + nlog n) + xn log n). Now, we sow tat Equation () can yiel correct sortest istances oer te union o G o an G l prouce by Algoritm. Algoritm as enumerate all sortest pats P wit teir istances no smaller tan. From te construction rules, we know tat a sortest pat p P can be remoe rom P only wen p can be exactly answere by one outsource grap in G o or p is store in te link grap G l. Tereore, te union o G o an G l rom Algoritm is a ( )-sortest istance equialent grap o te original grap. At te same time, Equation () enumerates all possible pats rom u to using G o an G l. Tereore, Equation () can prouce te correct results. From te aboe iscussion, we can notice tat is a key actor to ajust te security strengt an oerea on te client sie. A larger leas to ewer outsource ertices, wic inicates more inormation is ien in a coarser outsource grap. At te same time, a larger results in more ertices in one cluster in te cluster coer, wic sows tat te client sie requires more space cost to store te link grap an more time cost in te local pat searcing. In aition, since a single coarser outsource grap preseres ewer sortest istances tan a iner one, it nees more outsource graps along wit te link grap to meet te requirement o ( )-sortest istance equialent grap, wic also results in a iger grap transormation time cost. Client Sie Clou Serer Space O(m + xn on l ) O(xn o) Query Time O(n l + xb ) O(xb n o) Table : Oerea Distribution wit Grap Outsourcing Now we iscuss te oerea istribution ater graps are outsource in Table. As or te space cost, te client sie nees O(m+xn on l ) to store te original grap an te link grap, wile te clou serer requires O(xn o) space to store all outsource graps. As or te time cost o sortest istance query answering, te client sie nees time O(n l ) or te local searc an time O(xb ) or result merging wit Equation (). Te clou serer takes O(xb n o) time to compute te rewritten queries. Note tat te clou serer can buil inices [,, 7] an perorm parallel processing oer x graps to lower te query ealuation cost signiicantly. Compare wit O(m + nlog n) time cost witout grap outsourcing, te client sie saes muc time cost wit te ai o te clou serer. Te inal experimental results also sow te eectieness o grap outsourcing.. GRAPH TRANSFORMATION WITH AP- PROXIMATE DISTANCE ANSWERING In tis section, we relax te -n objectie on ( ) equialent sortest istance grap to anle large graps. We irst propose a meto to transorm grap wit approximate istance answering, an ten iscuss euristic metos in te outsource grap construction.. Aerage Aitie Error Guie Grap Transormation Altoug te grap transormation meto iscusse aboe can answer sortest istances exactly, te transormation requires enumerating all sortest pats an computing te eges insie outsource graps, wic makes te meto unsuitable or large graps. Grap transormation wit approximate istance answering on large graps tus becomes an important researc problem, since approximate sortest istances are goo enoug in many applications [,, ]. Tis ten raises te issue o ow many outsource graps are neee to aciee goo istance alues, i we use ranom ertex sequences or Algoritm. Te quality o te approximate istance rom u to can be measure by αδ G(u, ) + β [], were α is te multiplicatie error, an β is te aitie error. Tere are many stuies on approximate istance answering. A pre-compute ata structure is propose to aciee α in [, k ], were k can ajust te space an time cost in pre-computation []. Kleinberg et al. aciee α = + φ an β =, gien enoug ranom beacons an te triangle inequality rule []. In tis part, we attempt to aciee α = an a gien aerage aitie error β or all sortest istance queries. For any istance query q Q rom u an, a pat p q is iscoere or q using P q Q βq Q, G o an G l. Aerage aitie error β can be eine as were β q = len(p q) δ G(u, ). Te rationale o aerage aition error is to get acceptable results wit a limite number o outsource graps. Te aerage aitie error can be useul wen a large number o sortest istance queries are ealuate in grap analysis. In aition, since our outsource grap is generate ranomly, te worst case o aitie error can be lowere along wit te aerage one simultaneously wit a ig possibility. We present our grap transormation meto in Algoritm to aciee te gien aitie error β. Te basic iea is to repeately construct ranomize outsource graps until te estimate aitie error ag is less tan β. Te estimate aitie error ag is initialize in line an is ajuste ater a new outsource grap is constructe in te iteration rom line to line. In line, we buil an outsource grap wit Algoritm. Since te exact ege weigt computation between outsource ertices takes O(n o) times Dijkstra s searc, were n o is te number o ertices in an outsource grap, we relax te exact ege builing as ollows. We select l ertices rom n o total outsource ertices, an we buil te ull sortest pat trees or tese l ertices in te original grap wit Dijkstra s algoritm. Te sortest pat tree can

8 Algoritm : Aerage Aitie Error Guie Outsource Grap Construction Input: Grap G,, aitie error tresol β, s or te number o sampling queries, l or te number o ull sortest pat trees. Output: Outsource Graps G o. Initialize tree empty query lists Q, Q an Q wit lengt s; ag ; wile ag > β o G o OutGrap(G,, L) wit moiie ege builing base on l ull sortest pat trees; G o G o {G o}; Collect te aerage number n o o ertices in G o an te aerage number n l o ertices in cluster; 7 Remoe queries rom Q an Q wic o not meet te requirement o Q an Q ; A new queries into Q an Q wit total s queries; Ealuate queries oer G wit Dijkstra s algoritm an Equation () to obtain l, l an l ; ag pct(q )l +pct(q )l +pct(q )l ; Return G o. x u y (a) QQuery ensure tat te pat in te tree is also te sortest pat in te original grap. Ten, we buil eges or any two outsource ertices x an y wen x is te lowest ancestor o y in te sortest pat tree. We obsere tat our relaxe ege builing meto is similar to tat o te lanmark inex []. Howeer, te lanmark inex only recors relationsips rom ertices to te root o te sortest pat tree. Hence, te outsource grap wit tis relaxe ege builing strategy can yiel results more precisely tan te lanmark inex wen using te same number o sortest pat trees. Wen outsource graps G o are generate ranomly an te relaxe ege builing strategy is use, te result o Equation () may be not te sortest istance. Gien two ertices u an, te aitie error o istance compute by Equation () comes rom te error in te sortest istance between cluster centers in te outsource grap (ue to relaxe ege builing strategy) an te eiation o teir cluster centers rom teir sortest pat. Te next key problem is ow to estimate te aerage aitie error ag rom existing outsource graps. In orer to compute ag more precisely, we put a sortest istance query rom u to into one o categories, namely Q l, Q, Q, an Q, accoring to te relationsips rom u an to current outsource graps G o. Ten ag can be calculate wit te proportion an aerage aitie error o eac category. Speciically, i te sortest istance δ G(u, ) is smaller tan, q belongs to Q l. q can be answere exactly wit local Dijkstra s searc in te original grap. I neiter u or as been outsource into any G o G o, q is in Q, as illustrate in Fig.(a). Een i te outsource grap returns te correct istance between x an y, were x is te cluster center or u an y is te cluster center or, te maximal aitie error or a query in Q is m, were m = max(, w max), an w max is te maximal ege weigt. I eiter u or as been selecte into an outsource G o G o, q belongs to Q, as illustrate in Fig.(b). Suppose tat te outsource grap returns te correct istance, te maximal aitie error or a query in Q is m. I bot u an are selecte in one G o G o, q is in Q, as illustrate in Fig.(c). Te aitie error o q now comes rom te error in te istance computation in outsource graps. From te aboe iscussion, we know tat te aitie error or a query in Q l is, an te aerage aitie eru x (b) Q Query Figure : Query Categories u (c) Q Query ror or queries in Q is larger tan tat or queries in Q, wic is larger tan tat or queries in Q. Te proportion o eac query category can be compute wit two statistics. Te aerage number o ertices in a cluster, n l, an te aerage number o ertices in an outsource grap, n o, are collecte in line in Algoritm. Suppose tat te total number o outsource graps is x. Te proportion pct(q l ) or Q l is n l. Te increase o x oes not aect pct(q V l). Te proportion pct(q ) or Q is ( n V )x ( n l ). A ertex is not V selecte as te cluster center or outsourcing uner te probability ( n ). pct(q) reeals te probability tat neiter o two V ertices is selecte ater x times. As te number o outsource graps increases, pct(q ) ecreases ramatically. Te proportion pct(q ) or Q is ( ( n ) x )( n l ), were ( n ) is V V V te probability tat two ertices are not selecte as cluster centers simultaneously. pct(q ) increases wit te increase o te number o outsource graps. Wit tree o te our proportions eine, te proportion or Q is simply te remainer: pct(q )=- pct(q l )-pct(q )-pct(q ). Now, we compute l, l, an l, wic are te aerage aitie errors or queries in Q, Q, an Q respectiely. It is not a triial task, since tese alues are relate to te local structure insie te cluster an te global structure between clusters. We can know tat tese aitie istance errors ecrease monotonically wit te increase o outsource graps. In tis paper, we employ a sampling meto to estimate tese aitie istance errors. Tat is, we ranomly buil tree query lists or query categories Q, Q, an Q. Tese query lists are initialize in line, an te queries in te list or Q an Q may be ajuste ater a new outsource grap is generate in line 7 an line. l, l, l are ten compute as te aerage ierence between te exact sortest istances rom Dijkstra s algoritm an te istance wit Equation () or all queries in corresponing query categories. Finally, te aerage aitie error can be compute in line wit pct(q )l + pct(q )l + pct(q )l, () were l, l, an l are aerage aitie errors or queries in Q, Q, an Q respectiely. We o not mention te query category Q l since te aitie error or te query in Q l is. One may woner wy we cannot prouce te aerage aitie error irectly rom te sampling queries. Tis is ue to te act tat te proportions o query categories are cange wit more outsource graps. In aition, l < l, l < l. Tus, Equation () can estimate te aitie error more precisely. Te time cost o te client sie in Algoritm mainly consists o te ealuation cost o sampling queries an te generation cost o outsource graps. Let n, m, n l, n o ae te meanings illustrate in Table. l is te number o ull sortest pat trees constructe or eac outsource grap. x is te number o outsource graps, wic is relate wit, te aitie error boun β, an te grap s eatures. s is te number o sampling queries. Te ealuation o sampling queries takes O(xs(m + nlog n)) time cost in te worst case, an te outsource grap generation takes

9 O(x(l(m+nlog n)+n on l )) time cost, were O(l(m+nlog n)) is te cost or l times Dijkstra s algoritm in ege builing, an O(n on l ) is te cost in outsource ertex selection. Ten te time complexity in Algoritm is O(x(t(m+n log n)+n on l )), were t = max(s, l).. Heuristic Construction Rules Algoritm aciees te esire aitie error wit outsource graps constructe ranomly. Anoter extension is to introuce euristic rules in te outsource grap construction. From Equation (), it is easible or outsource graps to prouce more precise results wen tey contain more sare sortest sub-pats. Existing work on lanmark inices also sows tat te euristic rules work better tan te ranom ones []. Te basic iea bein euristic construction is to make it more probable or a ertex to be selecte as a cluster center i it is locate on more sortest pats. Tus more sortest istance queries can be answere ia outsource graps generally. In our paper, we esign two euristic rules. Te egree base outsource grap construction attempts to select ertices wit te iger egree as te cluster centers; te cluster base meto selects te ertex x wit te largest number o ertices in cluster C (x) eac time. In orer to make te outsource grap construction in Algoritm be aware o tese euristic alues, we sort te ertices in sequence L wit te euristic alues, since te ertices nearer to te top o L ae more cances to be outsource in Algoritm. Te uplication o ertices in ierent outsource graps is anoter important concern in te euristic construction meto. Te same ertex sequence will prouce te same outsource grap using Algoritm. In orer to aoi constructing uplicate graps, we make an extension to te outsource grap construction meto in Algoritm wit an introuction o a percentage k( < k < ) an a unction (x), were x is te number o outsource graps, () = k an (i) < (i + ). In te irst outsource grap construction, rater tan always coosing te ertex wit te maximal beneit alue among te uncoere ones in ertex sequence L, we select a ertex ranomly rom uncoere ertices wit top-k beneit alues. In te ollowing x-t outsource grap generation, k is enlarge by (x) suc as (x + ) = (x) until k. Tus ater multiple rouns o outsource grap construction, te euristic alues ae been extensiely exploite, an te outsource grap construction retreats to te ranom meto, wic ocuses on te istribution o te outsource ertices in outsource graps.. EXPERIMENTAL RESULTS In tis section, we implement te grap transormation wit te exact an approximate istance answering, an conuct extensie experiments on bot real an syntetic atasets.. Experimental Setup Measures. We ocus on te ollowing measures relate to te grap transormation: te transormation time cost, te space cost o te link grap G l (te number o eges in G l ), an te aerage aitie error aciee by outsource graps. In aition, in orer to sow te eectieness o grap outsourcing in sortest istance computing, we eine a local oerea ratio r l = t l /t, were t l is te time cost to iscoer te sortest istance wit Equation () on te client sie, an t is te time cost use by Dijkstra s algoritm on te client sie. Implementation Details an Competitors. We implement our metos in Jaa wit JDK.. Te maximal runtime memory o JVM is set to.gb. All experiments are carrie out on. GHz AMD processor running Winows Serer. Te sortest istance computation in te outsource serer is simulate in te same macine. Wen one outsource grap is constructe, we store it into a relational atabase so we can support multiple outsource graps. Te time cost in accessing te relational atabase is not inclue in te time reporte. In aition, we implement te ege anonymization meto wit all-pair sortest pat presering (enote as LP) in te tecnical report ersion or []. As iscusse aboe, LP only anonymizes ege weigts, an ten te transorme grap cannot counter te structural attack. Here, we want to compare teir work in terms o te grap transormation time cost, te space cost an te local oerea ratio. Just as in [], we also use LPsoler. to sole te rules generate. Datasets. We use ie grap atasets to test our metos, incluing tree real graps name Gnut, DBLP an Bay, an two syntetic graps name Ranom an Power. Gnut is a irecte gnutella PP network. DBLP is extracte rom a recent snapsot o DBLP ataset. We select te recors ater. Bay ataset escribes te roa network in te San Francisco Bay Area. Te ege weigts in Gnut an DBLP grap are assigne ranomly in te range [,]. Eac ege weigt in Bay is iie by so tat te aerage ege weigt in Bay is similar to tat o te oter graps. Dataset # o Vertices # o Eges Gnut,,777 DBLPk,, DBLPk, 7, Bay,7, RanomxkNy k-k yk-yk PowerxkNy k-k yk-yk Table : Statistics o Grap Datasets Te Ranom ataset o graps are generate as ollows. Let n an m be te number o ertices an eges respectiely, we ranomly select te source an target ertex or m times among n ertices. Te Power grap set is generate using Barabasi Grap Generator.. It can create graps in wic te istribution o outegrees obeys a power law. Te weigts o eges in Ranom an Power grap are assigne ranomly in [,]. Some statistics about tese graps are summarize in Table. Our syntetic graps ae te suix xny, were x is te number o ertices an y is te aerage egree. For example, RanomkN represents a Ranom grap wit k ertices an an aerage egree o.. Grap Transormation wit Exact Answer In tis section, we stuy te impact o ierent actors on te measures o grap transormation wit exact sortest istance answering. Speciically, we are intereste in: i) Wat is te impact o on te transormation oerea, te size o te link grap an local oerea ratio? ii) We ae iscusse two beneit unctions. Can te ertex-pair base unction ByPair reuce te oerea compare to te ertex base unction ByVertex? iii) Does ttp://lpsole.sourceorge.net/./ ttp://snap.stanor.eu/ata/pp-gnutella.tml ttp://blp.uni-trier.e/xml/ ttp:// callenge/ata/ ttp:// reier/barabasi.tml

10 Time Cost(ks) = Dataset=RanomxkN = MPMem=M = Beneit=ByPair = LP (a) Transormation Time s. Time Cost(ks) MPMem=M Beneit=ByPair = = = = Gnut Dblpk Data Set (b) Transormation Time s. Time Cost(ks) MPMem=.M MPMem=.M MPMem=.M MPMem=.M Gnut Data Set = Beneit=ByPair Dblpk (c) Transormation Time s. memory limitation Time Cost(ks) Dataset=RanomxkN = MPMem=M ByPair ByVertex () Transormation Time s. beneit unctions Space Cost(k) Dataset=RanomxkN = MPMem=M ByPair ByVertex LP Space Cost(K) 7 Gnut = MPMem=M ByPair ByVertex Dblpk Pkn Rkn Data Set Space Cost(k) MPMem=.m MPMem=.m MPMem=.m MPMem=.m Dataset=PowerxkN = Beniit=ByPair Local Oerea Ratio(%) Dataset=RanomxkN MPMem=M Beneit=ByPair = = = = LP (e) G l s. grap scale () G l s. beneit unctions (g) G l s. memory limitation () Local Oerea Ratio s. Figure 7: Experimental Results on Grap Transormation wit Exact Answers te tresol MPMem on maximal pats in memory in Algoritm impact on te eectieness o te greey meto? Transormation Time Cost. Figure 7(a) an Figure 7(b) sow te transormation time cost wit respect to on Ranom graps an real ata respectiely. Te grap ata use in Fig.7(a) is RanomxkN, were x is te number o ertices in X-axis. We obsere tat te time cost o grap transormation also increases wit te increase o. Te main reason lies in te act tat wen is larger, tere are ewer ertices in eac -raius outsource grap, an tus more outsource graps are require to aciee ( )-sortest istance equialent grap. We also in LP meto oes not scale well. LP prouces O(n ) rules or a grap to aciee all-pairs sortest pat preseration, were is te aerage egree, an n is te number o ertices. For example, a Ranom grap wit only ertices an aerage egree generates,7, rules. LPSoler cannot anle tis many rules an terminates. On smaller graps wit te number o ertices less tan, we also notice tat te time use by LP rises rapily. Figure 7(c) stuies te impact o te tresol MPMem (maximal pats in memory) on te transormation time cost oer two real graps. Our algoritm introuces MPMem to control te total intermeiate space use in te greey meto. Intuitiely, te greey meto can prouce more reasonable outsource graps base on more sortest pats wit a larger MPMem. In aition, wen te number o sortest pats excees MPMem, anoter new outsource grap as to be generate ineitably. Tus, te increase o MPMem will reuce te grap transormation time cost in general. We also notice tat wen MPMem is large enoug, its increase is not eectie any more, since all compute sortest pats can be put into te memory in suc a case. Figure 7() compares te eects o te two beneit unctions, ByVertex an ByPair, on te transormation time cost on Ranom graps. As iscusse beore, te case tat two ertices x an y ae a iger requency oes not inicate tat te ertex pair (x, y) can answer more sortest istances. Tus, ByPair meto is a more reasonable unction wic can prouce ewer outsource graps an ten lower te transormation time cost, as sown in Fig.7(). We also notice tat te reuction o transormation time wit te ByPair unction is not signiicant. Tis is because we nee to enumerate all sortest pats in two cases, wic ominates te entire time cost. Size o Link Grap. Figure 7(e) summarizes te space cost o te link grap on Ranom graps, or arious grap sizes. Obiously, a larger original grap results in a larger link grap. We also obtain te size o te link grap generate by LP. Actually, te LP meto nees to recor te anonymize ege weigt or eac ege in space cost O(m), were m is number o eges. Altoug LP consumes less space cost tan our meto, te main rawback o LP lies in its scalability. We cannot run it on a large grap. Figure 7() presents te impact o ierent beneit unctions on te space cost o te link grap across real graps, Power graps (P) an Ranom graps (R). All atasets clearly sow te eectieness o te ByPair unction. Te space cost o link graps wit ByPair is nearly / to / tat o link grap using ByVertex. As explaine aboe, ByPair is a more eectie beneit unction tan ByVertex to prouce ewer outsource graps. Figure 7(g) sows te space cost o link grap on Power graps arying MPMem rom.m (M is or million) to M. It also eriies our earlier claim. Wen MPMem is suicient to store sortest pats, suc as in graps wit ewer tan k ertices, te ajustment o MPMem is not eectie. Wen te grap is larger an only a smaller proportion o all pats can be loae into memory, MPMem is more useul in reucing te space cost o te link grap. Local Oerea Ratio. Figure 7() illustrates te local oerea ratio or arious alues on te Ranom grap set. We ranomly generate sortest istance queries, an compute te aerage local oerea ratio. As sown in te igure, te local oerea ratio is lower tan. in all test cases. In oter wors, te outsource serer carries out te bulk o te computational work or sortest istance iscoery. Te client sie anles te local sortest istance searc or istances smaller tan an te merging o results in Equation (). Tereore, te ecrease o can urter reuce te time cost on te client sie. We beliee te cure in te igure is ue to te ranomization in te time recoring, since all local time cost is nearly zero. As or te LP meto, it takes O(l) time cost to recoer te sortest istance, were l is te total eges in te sortest pat. Te time cost o LP oer small graps is also nearly zero.

11 Time Cost(ks) Dataset=PowerxkN Error= = = = Time Cost(ks) = Bay Dblpk Aitie Error Space Cost(M) 7 Dataset=PowerxkN Error= = = = Space Cost(M) 7 = Dblpk Data Set Error= Error= Error= Error= Error= Error= Error= Bay (a) Transormation Time s. (b) Transormation Time s. aitie error (c) G l s. () G l s. aitie error Obtaine Error Dataset=PowerxkN = Error= Error= Error= Error= Aerage Aitie Error Dataset=RanomkN = Ranom DegreeBase ClusterBase 7 # o outsource graps construc- (g) Local Oerea Ratio Vs. Aitie Error () Aitie Error s. tion Rules Local Oerea Ratio(%) = 7 # o outsource graps Bay Dblpk (e) Aitie Error s. aitie error Local Oerea Ratio(%). Dataset=PowerxkN. Error=. =. = =.. () Local Oerea Ratio s. Figure : Experimental Results on Grap Transormation wit Approximate Answers. Grap Transormation wit Approximate Answer In tis section, we stuy te impact o ierent actors on te measures o grap transormation wit approximate sortest istance answering. Speciically, we are intereste in: i) Wat is te impact o on te transormation oerea an local oerea ratio? ii) Can te gien aitie error boun be aciee wit our meto? iii) Wat is te impact o ierent euristic construction rules on te aitie error? In all experiments, te number o ull sortest pat trees in eac outsource grap is set to, an te number o sampling queries or eac category is. Transormation Time Cost. Figure (a) illustrates te transormation time cost across te Power grap set, arying rom to, wen te aerage aitie error β is set to. Outsource graps are generate in a ranom way (enote by Ranom). A larger inicates eac outsource grap preserers ewer sortest pats. In orer to meet te requirement o te gien aitie error, more outsource graps are neee, wic leas to more transormation time. Figure (b) presents te impact o ierent aitie errors on te transormation time cost across two real atasets. We still use te ranom meto to construct outsource graps. From Fig.(b), we can see tat a larger aitie error leas to less transormation time cost, since in suc a case, ewer outsource graps are neee. Size o Link Grap. Figure (c) summarizes te size o te link grap or arious on te Power graps wit te gien aerage aitie error. It is no surprise tat te size o te link grap goes up wit te increase o. As we ae explaine in te transormation time cost, a larger correspons to more outsource graps an ten more eges in te link grap to outsource graps. Figure () illustrates te space cost on te real atasets wit ierent aitie errors. It clearly sows tat te increase o aitie error results in a ecrease in te size o te link grap. Te reason is similar to te explanation we gae along wit Fig.(b). A larger aitie error reuces te number o te outsource graps use, inicating ewer eges in te link grap. Aitie Error. Figure (e) stuies weter we can aciee te aitie error as expecte. Ater we generate te outsource graps wit Algoritm, we ealuate sortest pat queries wit Equation () an Dijkstra s algoritm, an test weter teir aerage aitie error is te same as tat speciie. We obsere tat te two alues (in X an Y axis) are ery close. In oter wors, our grap transormation meto can aciee te speciie aitie error quite well, wic also illustrates te eectieness o te aerage aitie error estimation strategy in Algoritm. Figure () compares te aerage aitie errors on te same number o outsource graps constructe wit ierent euristic rules oer Ranom graps. We implement te egree base (enote by DegreeBase ) an te cluster base (enote by ClusterBase ) meto or constructing outsource graps. Te aerage aitie errors are obtaine wit queries on outsource graps. Te results in Fig.() sow tat among all euristic construction rules, te cluster base meto can prouce outsource graps wit lowest aitie error wen te number o outsource graps is relatiely small, or example, less tan. Wen more outsource graps are generate, tree construction metos prouce te similar answers, since te istribution o outsource ertices is more important in suc a case. Local Oerea Ratio. Figure (g) an Figure () illustrate te local oerea ratio on te real atasets an Power graps. We obtain te local oerea ratio as tat in Fig.7(). In all cases, te local time cost use in sortest istance answering is nearly zero. By combining te results in Fig.7(), we can know tat te local oerea ratio scales ery well in terms o te grap size. As sown in Table, te client sie requires O(n l + xb ) time cost or sortest istance computation, wile n l, x an b are nearly constant wit respect to te grap size. At te same time, te grap size as a signiicant impact on Dijkstra s algoritm in te istance iscoery. Tereore, te local oerea ratio eclines sarply wit te increase o grap size.. Summary To sum up, rom te experimental results, we can raw te ollowing conclusions: i) Te increase o, altoug strengtening security o outsource graps, ries up te transormation time cost, te space cost o te link grap an oerea o te query

12 answering on te client sie; ii) Our grap transormation wit exact istance answering scales muc better tan te existing meto. Our grap transormation wit approximate istance answering aciees te gien aitie error quite well an can anle large graps. iii) In all test cases, te local oerea ratio is ery low an een goes own wit te increase o grap size. Suc results illustrate te eectieness o grap outsourcing.. CONCLUSION AND FUTURE WORKS In tis paper, we stuy ow to utilize clou computing to eiciently compute sortest istance in large graps witout compromising teir sensitie inormation. We eine a new security moel calle -neigboroo--raius. Our purpose is to reuce te space cost an sortest istance ealuation cost on te client sie wile satisying bot security an utility requirements. We eise a greey meto to transorm graps wit exact sortest istance answering, an eelop a ast transormation meto to support approximate istance answering witin te gien aerage aitie error boun. Tis work can be extene in seeral interesting irections. First, we will stuy ow oter grap queries suc as reacability query can be compute in te clou witin our ramework. In general, our ramework can be useul or grap operations wose ealuation cost mainly comes rom a global searc, yet local inormation can be easily merge into te results. Secon, we will inestigate stronger security stanars oer outsource graps. For instance, we can a noise on te ege weigt or noe egree on te conition tat te sortest pats can be presere in te outsource grap. Tir, incremental grap outsourcing is esirable or ynamic graps. At te same time, incremental outsourcing soul not lea to inormation leakage in outsource graps. ACKNOWLEDGMENTS We woul like to tank te anonymous reiewers or teir elpul comments. We woul like to tank Victor E. Lee or elping wit te paper reision. Te NSFC supporte Gao ia 7 an 7, an supporte Jin ia 7. Te researc grants Council o te Hong Kong supporte Yu ia an. Te NSF supporte Jin ia IIS-. National science an tecnology major program supporte Wang ia ZX-- - an ZX REFERENCES [] A.V.Golberg an C.Harrelson. Computing te sortest pat: searc meets grap teory. In SODA, pages,. [] B.Zou an J.Pei. Presering priacy in social networks against neigboroo attacks. In ICDE, pages,. [] C.Li, M.Hay, V.Rastogi, G.Miklau, an A.McGrego. Optimizing linear counting queries uner ierential priacy. In PODS, pages,. [] E.W. Dijkstra. A note on two problems in connexion wit graps. Numerisce Matematik, pages 7,. [] D.J.Abai. Data management in te clou: Limitations an opportunities. IEEE Data Eng. Bull. (DEBU), ():-,. [] Cyntia Dwork, Frank Mcserry, Kobbi Nissim, an Aam Smit. Calibrating noise to sensitiity in priate ata analysis. In Teory o Cryptograpy Conerence,. [7] E.Coen, E.Halperin, H.Kaplan, an U.Zwick. Reacability an istance queries ia -op labels. In SODA, pages 7,. [] G.Cormoe, D.Sriastaa, S.Bagat, an B.Krisnamurty. Class-base grap anonymization or social network ata. PVLDB, ():7-777,. [] G.Cormoe, D.Sriastaa, T.Yu, an Q.Zang. Anonymizing bipartite grap ata using sae groupings. PVLDB, ():-,. [] H.Hacigümüs, B.R.Iyer, an S.Merotra. Proiing atabase as a serice. In ICDE, pages,. [] J.Ceng, A.W.Fu, an J.Liu. K-isomorpism: priacy presering network publication against structural attacks. In SIGMOD, pages 7,. [] J.M.Kleinberg, A.Slikins, an T.Wexler. Triangulation an embeing using small sets o beacons.. J. ACM (JACM), (),. [] K.Liu an E.Terzi. Towars ientity anonymization on graps. In SIGMOD, pages,. [] L.Backstrom, C.Dwork, an J.M.Kleinberg. Wereore art tou r7x?: anonymize social networks, ien patterns, an structural steganograpy. In WWW, pages, 7. [] L.Liu, J.Wang, J.Liu, an J.Zang. Priacy preseration in social networks wit sensitie ege weigts. In SDM, pages,. [] L.Zou, L.Cen, an M. TamerÖzsu. Distancejoin: Pattern matc query in a large grap atabase. PVLDB, ():-7,. [7] L.Zou, L.Cen, an M. TamerÖzsu. K-automorpism: A general ramework or priacy presering network publication. PVLDB, ():-7,. [] M.Hay, C.Li, G.Miklau, an D.Jensen. Accurate estimation o te egree istribution o priate networks. In ICDM, pages 7,. [] M.Hay, G.Miklau, D.Jensen, D.F.Towsley, an P.Weis. Resisting structural re-ientiication in anonymize social networks. PVLDB, ():-,. [] M.L.Yiu, Y.Lin, an K.Mouratiis. Eicient eriication o sortest pat searc ia autenticate ints.. In ICDE, pages 7,. [] M.Potamias, F.Bonci, an C.Castillo. Fast sortest pat istance estimation in large networks. In CIKM, pages 7 7,. [] M.Torup an U.Zwick. Approximate istance oracles. In STOC, pages,. [] N.Jing, Y.Huang, an E.A.Runensteiner. Hierarcical encoe pat iews or pat query processing: An optimal moel an its perormance ealuation. TKDE, ():,. [] S.Das, M.Egecioglu, an A.E.Abbai. Anonymizing weigte social network graps. In ICDE, pages 7,. [] S.Jung an S.Pramanik. An eicient pat computation moel or ierarcically structure topograpical roa maps. TKDE, ():-,. [] S.Nat, H.Yu, an H.Can. Secure outsource aggregation ia one-way cain. In SIGMOD, pages,. [7] X.Ying an X.Wu. Ranomizing social networks: a spectrum presering approac. In SDM, pages 7 7,.