Fast Data Anonymization with Low Information Loss Gabriel

Fast Data Anonymization with Low Information Loss Gabriel Ghinita 1 Panagiotis Karras 2 Panos Kalnis 1 Nikos Mamoulis 2 National University of Singapore {ghinitag, kalnis}@comp. nus. edu. sg 2 Hong Kong University {pkarras, nikos}@cs. hku. hk 1

Privacy-Preserving Data Publishing p p Large amounts of public data n Research or statistical purposes n e. g. distribution of disease for age, city Data may contain sensitive information n Ensure data privacy

Privacy Violation Example Age Zip. Code 42 47 51 55 62 67 52000 43000 32000 27000 41000 55000 Disease Ulcer Pneumonia Flu Gastritis Dyspepsia (a) Microdata Name Age Zip. Code Andy Bill Ken Nash Mike Sam 42 47 51 55 62 67 52000 43000 32000 27000 41000 55000 Disease Ulcer Pneumonia Flu Gastritis Dyspepsia (b) Voting Registration List (public)

k-anonymity[Sam 01] p QID generalization or suppression Age 42 -47 51 -55 62 -67 Zip. Code Disease 43000 -52000 Ulcer 43000 -52000 Pneumonia 27000 -32000 Flu 27000 -32000 Gastritis 41000 -55000 Dyspepsia (a) 2 -anonymous microdata Name Age Zip. Code Andy Bill Ken Nash Mike Sam 42 47 51 55 62 67 Disease 52000 Ulcer or 43000 Pneumonia 32000 Flu or Gastritis 27000 41000 Dyspepsia 55000 (b) Voting Registration List (public) Privacy Violation! [Sam 01] P. Samarati, "Protecting Respondent's Privacy in Microdata Release, " in IEEE TKDE, vol. 13, n. 6, November/December 2001, pp. 1010 -1027.

ℓ-diversity[MGKV 06] p At least ℓ sensitive attribute (SA) values “well-represented” in each group n e. g. freq. of an SA value in a group < 1/ℓ [MGKV 06] A. Machanavajjhala et al. ℓ-diversity: Privacy Beyond k-anonymity, Proceedings of the 22 nd International Conference on Data Engineering (ICDE), 2006

Problem Statement p Find k-anonymous/ℓ-diverse transformation p Minimize information loss p Incur reduced anonymization overhead

Contributions p 1 D QID n n n p Linear, optimal k-anonymous partitioning Polynomial, optimal ℓ-diverse partitioning Linear heuristic for ℓ-diverse partitioning Generalization to multi-dimensional QID n Multi-to-1 D mapping Hilbert Space-Filling Curve p i-Distance p n Apply 1 D algorithms

Multi-dimensional QID p Dimensionality Mapping

State-of-the-art: Mondrian[FWR 06] k=2 Generalization-based n n data-space partitioning similar to k-d-trees p split recursively as long as privacy condition holds 20 Age 40 60 40 Weight p 60 80 100 [FWR 06] K. Le. Fevre et al. Mondrian Multidimensional k-anonymity, Proceedings of the 22 nd International Conference on Data Engineering (ICDE), 2006

Motivating Example k-anonymity, k = 4 35 40 22 50 55 Weight 60 65 Age 45 50 55 24 Mondrian 60 65 42 70 40 30 31 35 33 70 75 55 56 63 80 85 61

Motivating Example k-anonymity, k = 4 35 40 22 50 55 Weight 60 65 Age 45 50 55 24 Our Method 60 65 42 70 40 30 31 35 33 70 75 55 56 63 80 85 61

Motivating Example ℓ -diversity, ℓ = 3 50 Performs 55 NO SPLIT! 60 Weight Mondrian 65 35 22 40 Age 45 50 55 24 60 65 42 70 40 30 31 35 33 70 75 55 56 63 80 85 61

Motivating Example ℓ -diversity, ℓ = 3 50 55 Weight 60 65 35 22 40 Age 45 50 55 24 Our Method 60 65 42 70 40 30 31 35 33 70 75 55 56 63 80 85 61

State-of-the-art: Anatomy[XT 06] p Permutation-based method n n discloses exact QID values vulnerable to presence attacks “Anatomized” table |G|! permutations Age 42 47 51 55 62 67 Zip. Code Disease 52000 Ulcer 43000 Pneumonia 32000 Flu 27000 Gastritis 41000 Dyspepsia 55000 Dyspepsia Age 42 47 51 62 55 67 Zip. Code 52000 43000 32000 41000 27000 55000 Disease Ulcer(1) Pneumonia(1) Flu(1) Dyspepsia(1) Gastritis(1) Dyspepsia(1) [XT 06] X. Xiao and Y. Tao. Anatomy: simple and effective privacy preservation, Proceedings of the 32 nd international conference on Very Large Data Bases (VLDB), 2006

Limitation of Anatomy SA: QID: 20 D 3 D 2 40 D 1 60 Alzheimer 80 100

Information Loss (Numerical Data) Age 50 55 Weight 60 65 35 22 40 45 50 55 24 60 65 42 70 40 30 31 35 G 2 33 70 75 55 56 63 80 85 61

Information Loss (Categorical Data) IL = IL({Italy, Spain}) = 3/5

Optimal 1 D k-anonymity p Properties of optimal solution n n p Groups do not overlap in QID space Group size bounded by 2 k-1 DP Formulation O(k. N) j: end record of previous group i: end record candidates for current group

Optimal 1 D ℓ-diversity p Properties of optimal solution n n p Group size bounded by 2ℓ-1 But groups MAY overlap in QID space SA Domain Representation

Group Order Property Optimal grouping violation of group order Order of groups in each domain is THE SAME

Border Order Property Optimal grouping violation of border “begin” and “end” records in each group follow the same order

Cover Property Optimal grouping violation of cover order record r that can be added to two groups should belong to the “closest” group to r

1 D ℓ-diversity Heuristic p Optimal algorithm is polynomial n p But may be costly in practice Linear heuristic algorithm n n Considers single “frontier of search” Frontier consists of first non-assigned record in each domain

1 D ℓ-diversity Heuristic p p use “frontier” of search check “eligibility condition” (for termination) G 1 G 2 G 3 ℓ=3 G 4

Experimental Setting p Census dataset n p General purpose information loss metric n p Data about 500, 000 individuals Based on group extent in QID space OLAP query accuracy n KL-divergence pdf distance

k-anonymity

ℓ-diversity: General Info. Loss

OLAP Queries p Distance between actual and approximate OLAP cubes SELECT QT 1, QT 2, . . . , QTi, COUNT(*) FROM Data WHERE SA = val GROUP BY QT 1, QT 2, . . . , QTi

OLAP Query Accuracy

Conclusions p Framework for k-anonymity and ℓ-diversity n n p Transform the multi-D QID problem to 1 -D Apply linear optimal/heuristic 1 D algorithms Results n n Clearly superior utility to Mondrian, with comparable execution time Similar (or better) utility as Anatomy for aggregate queries, where Anatomy excels