Quasi-identifier Attributes Research Articles

A Vulnerability Assessment Framework for Privacy-preserving Record Linkage

The linkage of records to identify common entities across multiple data sources has gained increasing interest over the last few decades. In the absence of unique entity identifiers, quasi-identifying attributes such as personal names and addresses are generally used to link records. Due to privacy concerns that arise when such sensitive information is used, privacy-preserving record linkage (PPRL) methods have been proposed to link records without revealing any sensitive or confidential information about these records. Popular PPRL methods such as Bloom filter encoding, however, are known to be susceptible to various privacy attacks. Therefore, a systematic analysis of the privacy risks associated with sensitive databases as well as PPRL methods used in linkage projects is of great importance. In this article we present a novel framework to assess the vulnerabilities of sensitive databases and existing PPRL encoding methods. We discuss five types of vulnerabilities: frequency, length, co-occurrence, similarity, and similarity neighborhood, of both plaintext and encoded values that an adversary can exploit in order to reidentify sensitive plaintext values from encoded data. In an experimental evaluation we assess the vulnerabilities of two databases using five existing PPRL encoding methods. This evaluation shows that our proposed framework can be used in real-world linkage applications to assess the vulnerabilities associated with sensitive databases to be linked, as well as with PPRL encoding methods.

Anonymous Methods Based on Multi-Attribute Clustering and Generalization Constraints

The dissemination and sharing of data sheets in IoT applications presents privacy and security challenges that can be addressed using the k-anonymization algorithm. However, this method needs improvement, for example, in areas related to its overgeneralization and its insufficient attribute diversity constraints during the anonymization process. To address these issues, this study proposes a multi-attribute clustering and generalization constraints (k,l)-anonymization method that can be applied to multidimensional data tables. The algorithm first used a greedy strategy to rank the attributes by width first, derived the division into dimensions to construct a multidimensional generalization hierarchy, and then selected the attributes with the most significant width values as the priority generalization attributes. Next, the k-nearest neighbor (KNN) clustering method was introduced to determine the initial clustering center by the width-first results, divide the quasi-identifier attributes into KNN clusters according to a distance metric, and generalize the quasi-identifier attributes in the equivalence class using a hierarchical generalization structure. Then, the proposed method re-evaluated the attributes to be generalized before each generalization operation. Finally, the algorithm employed an improved frequency–diversity constraint to generalize sensitive attributes in order to ensure that there were at least l records that were mutually dissimilar and closest in the equivalence class. While limiting the frequency threshold for the occurrence of sensitive attributes, the sensitive attribute values remained similar within the group, thus achieving protection of anonymity for all the attributes.

K-Anonymity Privacy Protection Algorithm for Multi-Dimensional Data against Skewness and Similarity Attacks.

Currently, a significant focus has been established on the privacy protection of multi-dimensional data publishing in various application scenarios, such as scientific research and policy-making. The K-anonymity mechanism based on clustering is the main method of shared-data desensitization, but it will cause problems of inconsistent clustering results and low clustering accuracy. It also cannot defend against several common attacks, such as skewness and similarity attacks at the same time. To defend against these attacks, we propose a K-anonymity privacy protection algorithm for multi-dimensional data against skewness and similarity attacks (KAPP) combined with t-closeness. Firstly, we propose a multi-dimensional sensitive data clustering algorithm based on improved African vultures optimization. More specifically, we improve the initialization, fitness calculation, and solution update strategy of the clustering center. The improved African vultures optimization can provide the optimal solution with various dimensions and achieve highly accurate clustering of the multi-dimensional dataset based on multiple sensitive attributes. It ensures that multi-dimensional data of different clusters are different in sensitive data. After the dataset anonymization, similar sensitive data of the same equivalence class will become less, and it eventually does not satisfy the premise of being theft by skewness and similarity attacks. We also propose an equivalence class partition method based on the sensitive data distribution difference value measurement and t-closeness. Namely, we calculate the sensitive data distribution's difference value of each equivalence class and then combine the equivalence classes with larger difference values. Each equivalence class satisfies t-closeness. This method can ensure that multi-dimensional data of the same equivalence class are different in multiple sensitive attributes, and thus can effectively defend against skewness and similarity attacks. Moreover, we generalize sensitive attributes with significant weight and all quasi-identifier attributes to achieve anonymous protection of the dataset. The experimental results show that KAPP improves clustering accuracy, diversity, and anonymity compared to other similar methods under skewness and similarity attacks.

Accurate privacy-preserving record linkage for databases with missing values

Privacy-preserving record linkage is the process of matching records that refer to the same entity across sensitive databases held by different organisations. This process is often challenging because no unique entity identifiers, such as social security numbers, are available in the databases to be linked. Therefore, quasi-identifying attributes such as names and addresses, are required to identify records that are similar and likely refer to the same entity. Such quasi-identifiers are however often not allowed to be shared between organisations due to privacy and confidentiality concerns. Besides variations and errors in the values used for linking, quasi-identifiers can have missing values. A popular approach to link sensitive data in a privacy-preserving way is to encode quasi-identifying values into Bloom filters, bit vectors that allow approximate similarities between values to be calculated. However, with existing Bloom filter encoding approaches missing values can lead to missed true matches because they affect the similarities calculated between Bloom filters. In this paper we propose a novel approach to consider missing values in privacy-preserving record linkage by adapting Bloom filter encoding based on the patterns of missingness identified in the databases to be linked. We build a lattice structure of missingness patterns, and then generate partitions of Bloom filters over this lattice. In each partition the non-missing encoded quasi-identifying attributes are assigned different weights during the Bloom filter generation process. This results in more accurate similarity calculation and better linkage quality. To improve the privacy of our approach, each partition is encoded independently which prevents both dictionary and frequency-based attacks. We evaluate our approach on large databases that contain different amounts and patterns of missing values, showing that it can substantially outperform both Bloom filter encoding that does not consider missing values, and an earlier Bloom filter based approach for linking sensitive databases that do contain missing values.

Classification utility aware data stream anonymization

Data streams are continuous, infinite and ordered sequences of data. In comparison to static dataset anonymization, data stream anonymization confront with a number of constraints and difficulties due to the dynamic nature of data flow. The literature already addressed the k-anonymization of data streams which contain quasi-identifier attributes. However, today most data streams contain sensitive and classification target attributes as well. This work’s main motivation is to develop a k-anonymization method for data streams which additionally protects the sensitivity and enables effective classification models. The k-anonymization, as a result, is formulated as a weighted multi-objective optimization problem. There are three objectives with respective weights as user parameters. A clustering based k-anonymization algorithm is developed as the solution. An extensive experimental evaluation on three real datasets shows the effectiveness of our proposal in various configurations. Moreover, the experimental results also confirm that our proposal attains better classification accuracies in comparison to popular data stream anonymization techniques.

Evaluating Binary Encoding Techniques in The Presence of Missing Values in Privacy-Preserving Record Linkage

IntroductionApplications in domains ranging from healthcare to national security increasingly require records about individuals in sensitive databases to be linked in privacy-preserving ways. Missing values make the linkage process challenging because they can affect the encoding of attribute values. No study has systematically investigated how missing values affect the outcomes of different encoding techniques used in privacy-preserving linkage applications.
 Objectives and ApproachBinary encodings, such as Bloom filters, are popular for linking sensitive databases. They are now employed in real-world linkage applications. However, existing encoding techniques assume the quasi-identifying attributes used for encoding to be complete. Missing values can lead to incomplete encodings which can result in decreased or increased similarities and therefore to false non-matches or false matches. In this study we empirically evaluate three binary encoding techniques using real voter databases, where pairs of records that correspond to the same voter (with name or address changes) resulted in files of 100,000 and 500,000 records containing from 0% to 50% missing values.
 ResultsWe encoded between two and four of the attributes first and last name, street, and city into three record-level binary encodings: Cryptographic long-term key (CLK) [Schnell et al. 2009], record-level Bloom filter (RBF) [Durham et al. 2014], and tabulation Min-hashing (TBH) [Smith 2017]. Experiments showed a 10% to 25% drop on average in both precision and recall for all encoding techniques when missing values are increasing. CLK resulted in the highest decrease in precision, while TBH resulted in the highest decrease in recall compared to the other encoding techniques.
 ConclusionBinary encodings such as Bloom filters are now used in practical applications for linking sensitive databases. Our evaluation shows that such encoding techniques can result in lower linkage quality if there are missing values in quasi-identifying attributes. This highlights the need for novel encoding techniques that can overcome the challenge of missing values.

Associated Attribute-Aware Differentially Private Data Publishing via Microaggregation

Releasing raw data sets with sensitive personal information will leak privacy. Therefore, various differential privacy methods have been proposed for efficient data sharing while preserving privacy. However, they focus on noise processing of all quasi-identifier attributes, which results in high time-space complexity and low data utility. In this paper, we propose a Differential Privacy Protection model considering the Correlations between Attributes, denoted DPPCA. DPPCA first computes the degree of correlations between the quasi-identifier attributes and the sensitive attributes, and determines the pair of attributes with maximal degree of correlation. Then based the attributes with the maximal degree of correlations, it uses microaggregation to partition the data set into clusters of size $k$ ( $k\geq 2$ ) according to three types of attributes, i.e., numerical, non-numerical, and hybrid attributes, such that there are $l$ ( $l ) values of sensitive attributes in a cluster. Finally, noise is added to each cluster separately such that each cluster satisfies $\varepsilon $ -differential privacy. While keeping the same degree of preserving privacy, our experimental results demonstrate that DPPCA substantially reduces the amount of added noise to 11% for the Census data set and the Adult data set. Therefore, DPPCA greatly improve the data utility while reaching the same degree of differential privacy.

Efficient Recommendation of De-Identification Policies Using MapReduce

Many data owners are required to release the data in a variety of real world application, since it is of vital importance to discovery valuable information stay behind the data. However, existing re-identification attacks on the AOL and ADULTS datasets have shown that publish such data directly may cause tremendous threads to the individual privacy. Thus, it is urgent to resolve all kinds of re-identification risks by recommending effective de-identification policies to guarantee both privacy and utility of the data. De-identification policies is one of the models that can be used to achieve such requirements, however, the number of de-identification policies is exponentially large due to the broad domain of quasi-identifier attributes. To better control the trade off between data utility and data privacy, skyline computation can be used to select such policies, but it is yet challenging for efficient skyline processing over large number of policies. In this paper, we propose one parallel algorithm called SKY-FILTER-MR, which is based on MapReduce to overcome this challenge by computing skylines over large scale de-identification policies that is represented by bit-strings. To further improve the performance, a novel approximate skyline computation scheme was proposed to prune unqualified policies using the approximately domination relationship. With approximate skyline, the power of filtering in the policy space generation stage was greatly strengthened to effectively decrease the cost of skyline computation over alternative policies. Extensive experiments over both real life and synthetic datasets demonstrate that our proposed SKY-FILTER-MR algorithm substantially outperforms the baseline approach by up to four times faster in the optimal case, which indicates good scalability over large policy sets.

Secure Data Protection Using Slicing as a Confusion Technique

Data Mining deals with automatic extraction of previously unknown patterns from large amounts of data sets. These data sets typically contain sensitive individual information or critical business information, which consequently get exposed to the other parties during Data Mining activities. Secure data protection has been one of the greater concerns in data mining. Several anonymization techniques, such as generalization and bucketization, have been designed for privacy protective microdata publishing. The generalization loses considerable amount of information, especially for high dimensional data. Bucketization, on the other hand, does not prevent membership disclosure and does not apply for data that do not have a clear separation between quasi-identifying attributes and sensitive attributes. Solution to this problem is provided by we introduce a novel data anonymization technique called slicing to improve the current state of the art.

A K-anonymous clustering algorithm based on the analytic hierarchy process

To protect the privacy of users, tables generally must be anonymized before publication. All existing anonymous methods have deficiencies. They do not consider the differences in attributes, or the optimization of information loss and time efficiency. his paper proposes a new method called KACM to realize k-anonymity. This method is mainly used for hybrid tables. The calculation of the distance between records considers the connection between quasi-identifier attributes and sensitive attributes, their effect on the sensitive privacy, and the information loss during the anonymity process. In the clustering process, the records with the minimum distance are always selected to add, and the clustering is individually controlled according to k to realize the equalization division of the equivalence class and reduce the total amount of distance calculation. Finally, the validity and practicability of the method are proved using theory and experiment.

Privacy-Preserving Algorithms for Multiple Sensitive Attributes Satisfying t-Closeness

Although k-anonymity is a good way of publishing microdata for research purposes, it cannot resist several common attacks, such as attribute disclosure and the similarity attack. To resist these attacks, many refinements of kanonymity have been proposed with t-closeness being one of the strictest privacy models. While most existing t-closeness models address the case in which the original data have only one single sensitive attribute, data with multiple sensitive attributes are more common in practice. In this paper, we cover this gap with two proposed algorithms for multiple sensitive attributes and make the published data satisfy t-closeness. Based on the observation that the values of the sensitive attributes in any equivalence class must be as spread as possible over the entire data to make the published data satisfy t-closeness, both of the algorithms use different methods to partition records into groups in terms of sensitive attributes. One uses a clustering method, while the other leverages the principal component analysis. Then, according to the similarity of quasiidentifier attributes, records are selected from different groups to construct an equivalence class, which will reduce the loss of information as much as possible during anonymization. Our proposed algorithms are evaluated using a real dataset. The results show that the average speed of the first proposed algorithm is slower than that of the second proposed algorithm but the former can preserve more original information. In addition, compared with related approaches, both proposed algorithms can achieve stronger protection of privacy and reduce less.

A new technique ensuring privacy in big data: K-anonymity without prior value of the threshold k

Big data has become omnipresent and crucial for many application domains. Big data makes reference to the explosive quantity of data generated in today’s society that might contain personally identifiable information (PII). That’s why the challenge from the point of view of data privacy is one of the major hurdles for the application of big data. In that situation, several techniques were exposed in order to ensure privacy in big data including generalization, randomization and cryptographic techniques as well. It is well known that there exist two main types of attributes in the literature, quasi identifier and sensitive attributes. In this paper, we are going to focus on quasi identifier attributes. Over the years, k-anonymity has been treated with great interest as an anonymization technique ensuring privacy in big data when we are dealing with quasi identifier attributes. Despite the fact that many algorithms of k-anonymity have been proposed, most of them admit that the threshold k of k-anonymity has to be known before anonymizing the data set. Here, a novel way in applying k-anonymity for quasi identifier attributes is presented. It’s a new algorithm called “k-anonymity without prior value of the threshold k”. Our proposed algorithm was experimentally evaluated using a test table of quasi identifier attributes. Furthermore, we highlight all the steps of our proposed algorithm with detailed comments.

Full autonomy: A novel individualized anonymity model for privacy preserving

An important principle in privacy preservation is individualized privacy autonomy which means individual has the freedom to decide and choose privacy constraints. Currently, many individualized anonymous models which have been proposed unite privacy autonomy, and most of the individualized models are focused on autonomy of sensitive attributes. As the autonomy of quasi-identifier (QI) attributes are neglected, it is unfully autonomous showed in these individualized models. In order to achieve full privacy autonomy, an individualized (α, ω)-anonymity model is proposed in this paper, where α and ω which respectively represent the constraint value of the sensitive attributes and the QI attributes are both set by providers. The model doesn't need to set the constraint value k. Furthermore, it is combined with the granular computing and the top–down local recoding to process the providers' datasets in different intervals and then to achieve differential protection for different granular spaces. Moreover, the performance analysis shows that this model not only satisfies the individualized privacy requirements, but also brings higher efficiency and lower information loss.

An Evaluation Framework for Privacy-Preserving Record Linkage

Privacy-preserving record linkage (PPRL) addresses the problem of identifying matching records from different databases that correspond to the same real-world entities using quasi-identifying attributes (in the absence of unique entity identifiers), while preserving privacy of these entities. Privacy is being preserved by not revealing any information that could be used to infer the actual values about the records that are not reconciled to the same entity (non-matches), and any confidential or sensitive information (that is not agreed upon by the data custodians) about the records that were reconciled to the same entity (matches) during or after the linkage process. The PPRL process often involves three main challenges, which are scalability to large databases, high linkage quality in the presence of data quality errors, and sufficient privacy guarantees. While many solutions have been developed for the PPRL problem over the past two decades, an evaluation and comparison framework of PPRL solutions with standard numerical measures defined for all three properties (scalability, linkage quality, and privacy) of PPRL has so far not been presented in the literature. We propose a general framework with normalized measures to practically evaluate and compare PPRL solutions in the face of linkage attack methods that are based on an external global dataset. We conducted experiments of several existing PPRL solutions on real-world databases using our proposed evaluation framework, and the results show that our framework provides an extensive and comparative evaluation of PPRL solutions in terms of the three properties.

A probabilistic approach to mitigate composition attacks on privacy in non-coordinated environments

Organizations share data about individuals to drive business and comply with law and regulation. However, an adversary may expose confidential information by tracking an individual across disparate data publications using quasi-identifying attributes (e.g., age, geocode and sex) associated with the records. Various studies have shown that well-established privacy protection models (e.g., k-anonymity and its extensions) fail to protect an individual’s privacy against this “composition attack”. This type of attack can be thwarted when organizations coordinate prior to data publication, but such a practice is not always feasible. In this paper, we introduce a probabilistic model called (d,α)-linkable, which mitigates composition attack without coordination. The model ensures that d confidential values are associated with a quasi-identifying group with a likelihood of α. We realize this model through an efficient extension to k-anonymization and use extensive experiments to show our strategy significantly reduces the likelihood of a successful composition attack and can preserve more utility than alternative privacy models, such as differential privacy.

Data Anonymization Approach for Incomplete Microdata

在数据发布过程中，为了防止隐私泄露，需要对数据的准标识符属性进行匿名化，以降低链接攻击风险，实现对数据所有者敏感属性的匿名保护.现有数据匿名方法都建立在数据无缺失的假设基础上，在数据存在缺失的情况下会直接丢弃相关的记录，造成了匿名化前后数据特性不一致.针对缺失数据匿名方法进行研究，基于k-匿名模型提出面向缺失数据的数据匿名方法KAIM(k-anonymity for incomplete mircrodata)，在保留包含缺失记录的前提下，使在同一属性上缺失的记录尽量被分配到同一分组参与泛化.该方法将分组泛化前后的信息熵变化作为距离，基于改进的k-member 算法对数据进行聚类分组，最后通过基于泛化层次的局部泛化算法对组内数据进行泛化.实际数据集的大量实验结果表明，KAIM 造成信息缺损仅为现有算法的43.8%，可以最大程度地保障匿名化前后数据特性不变.;To protect privacy against linking attacks, quasi-identifier attributes of microdata should be anonymized in privacy preserving data publishing. Although lots of algorithms have been proposed in this area, few of them can handle incomplete microdata. Most existing algorithms simply delete records with missing values, causing large information loss. This paper proposes a novel data anonymization approach called KAIM (k-anonymity for incomplete microdata), for incomplete microdata based on k-member algorithm and information entropy distance. Instead of deleting any records, KAIM effectively clusters records with similar characteristics together to minimize information loss, and then generalizes all records with local recording scheme. Results of extensive experiments base on real dataset show that KAIM causes only 43.8% information loss compared with previous algorithms for incomplete microdata, validating that KAIM performs much better than existing algorithms on the utility of anonymized dataset.

An Approach to Achieving K-partition for Preserving Privacy by Using Multi-constraint Anonymous Parameter Based on Rough Sets

We propose an approach to achieving different K -partition for preserving privacy by using the multi-constraint anonymous parameter design method based on the attribute significance of rough set, in order to reduce the imbalance phenomenon between the privacy protection and data availability caused by adopting the same anonymous intensity. In this approach, taking into account the significance of quasi-identifier attributes, we carry out the dimension division automatically and obtain multi-constraint anonymous parameters. After that an anonymous algorithm is executed on the separate partition. Experimental results show that the proposed method can obtain a better balance between the privacy protection degree and data availability.

Anatomy: Uncertain Data <i>k</i>-Anonymity Privacy Protection Algorithm

Uncertain data management has become an important research direction and a hot area of research. This paper proposes an UDAK-anonymity algorithm via anatomy for relational uncertain data. Uncertain data influence matrix based on background knowledge is built in order to describe the influence degree of sensitive attribute and Quasi-identifier (QI) attributes. We use generalization and BK(L,K)-clustering to present equivalent class, L makes sensitive attributes diversity in one equivalent class. Experimental results show that UDAK-anonymity algorithm are utility, effective and efficient, and can make anonymous uncertainty data effectively resist background knowledge attack and homogeneity attack.

Protecting Attribute Disclosure for High Dimensionality and Preserving Publishing of Microdata

Generalization and Bucketization, have been designed for privacy preserving microdata publishing. Recent work has shown that generalization loses considerable amount of information, especially for high-dimensional data. Bucketization, on the other hand, does not prevent membership disclosure and does not apply for data that do not have a clear separation between quasiidentifying attributes and sensitive attributes. In this paper, we present a novel technique called slicing, which partit ions the data both horizontally and vertically. We show that slicing preserves better data utility than generalization and can be used for membership disclosure protect ion. Another important advantage of slicing is that it can handle high-dimensional data. We show how slicing can be used for attribute disclosure protection and develop an efficient algorithm for computing the sliced data that obey the l-diversity requirement.Our workload experiments confirm that slicing preserves better utility than generalization and is more effective than bucketization in workloads involving the sensitive attribute. Our e xpe ri me nt s also demonstrate that slicing can be used to prevent membership disclosure.

The [formula omitted]-Diversity problem: Tractability and approximability

Publishing personal data without giving up privacy is becoming an increasingly important problem in different fields. In the last years, different interesting approaches have been proposed, i.e. k-Anonymity and l-Diversity. Given an input table, these approaches partition its rows so that the computed partition satisfies some constraint, in order to prevent the inference of the individuals the data belong to. Then, the rows in a same set of the partition are related to the same rows by suppressing some of their entries. Here we focus on the l-Diversity problem, where the attributes of the input table are distinguished in sensitive attributes and quasi-identifier attributes. The goal is to partition the rows of the input table, so that each set C of the partition contains at most 1l|C| rows having a specific value in the sensitive attribute, and the number of suppressions is minimized.In this paper we investigate the approximation and parameterized complexity ofl-Diversity. First, we prove that the problem is not approximable within factor clnl, for some constant c>0, even if the input table consists of only two columns, and that the problem is APX-hard, even if l=4 and the input table contains exactly three columns. Then we give an approximation algorithm of factor m (where m+1 is the number of columns in the input table), when the sensitive attribute ranges over an alphabet of constant size.Concerning the parameterized complexity, we prove that the problem is W[1]-hard when parameterized by the cost-bound, by l, and by the size of the alphabet. Then we prove that the problem admits a fixed-parameter algorithm when both the maximum number of different values in a column and the number of columns are parameters.