Walking in the Crowd Anonymizing Trajectory Data for

Walking in the Crowd: Anonymizing Trajectory Data for Pattern Analysis Noman Mohammed, Benjamin C. M. Fung, Mourad Debbabi Concordia University, Montreal, Canada Introduction Recently, trajectory data mining has received a lot of attention in both the industry and the academic research. Anonymization Algorithm Empirical Study • Privacy Model: Let L be the maximum length of the background knowledge. Let S be a set of sensitive values. A trajectory database T satisfies LKCprivacy if and only if for any sequence q with |q|<=L, |T(q)|>=K, where K > 0 is an integer anonymity threshold, and P(s|T(q))<=C, where 0 < C <=1 is a real number confidence threshold. • Utility Measure: We aim at preserving the maximal frequent sequences (MFS) because MFS often serves as the information basis for different primitive data mining tasks on sequential data, such as trajectory pattern mining [4]. • Identifying Violating Sequences: Any non-empty sequence q with |q|<=L in T is a violating sequence if its group T(q) does not satisfy both the conditions of LKC-privacy. We enumerate all the minimal violating sequences(MVS) by our MVS-generator algorithm. Publication of these trajectories for data analysis purposes threatens individuals' privacy since these raw trajectory data provide location information that identifies individuals and, potentially, their sensitive information. • Eliminating Violating Sequences: Figure 1 depicts both an MVS-tree and an MFS-tree generated from Table 1, where minimal violating sequences, V (T) = {b 2 d 3; b 2 c 4; b 2 f 6; c 4 c 7; c 4 e 8} and maximal frequent sequences, U(T) = {b 2 c 5 c 7; b 2 f 6 c 7; b 2 c 7 e 8; d 3 c 4 f 6; f 6 c 7 e 8; c 5 f 6; c 5 e 8; d 3 c 7; d 3 e 8} with L = 2, K = 2, C = 50%, and K’ = 2. Example: Privacy threats of publishing trajectory data Conclusions We proposed a new LKC-privacy model based on the assumption that an adversary has limited background knowledge about the victim. We also presented an efficient algorithm for achieving LKC -privacy with the goal of preserving maximal frequent sequences, which serves as the basis of many data mining tasks on trajectory data. References Figure 1: MVS-tree and MFS-tree for efficient Score updates • Identity linkage: ID#1 is the only record that contains b 2 and d 3. Sensitive value (AIDS in this case) is easily identifiable. • Attribute linkage: Two out of the three records (ID#1, 7, 8) containing b 2 and f 6 have sensitive value AIDS, the adversary can infer that the victim has AIDS with 2/3 = 67% confidence. Table 2: Initial Score 1. O. Abul, F. Bonchi, and M. Nanni. Never walk alone: Uncertainty for anonymity in moving objects databases. In ICDE, 2008. 2. M. Terrovitis and N. Mamoulis. Privacy preservation in the publication of trajectories. In MDM, 2008. 3. R. Yarovoy, F. Bonchi, L. V. S. Lakshmanan, and W. H. Wang. Anonymizing moving objects: How to hide a MOB in a crowd? In EDBT, 2009. 4. F. Giannotti, M. Nanni, D. Pedreschi, and F. Pinelli. Trajectory pattern mining. In ACM SIGKDD, 2007.