Privacy-preserving Anonymization of Set Value Data

1. Privacy-preserving Anonymization of Set Value Data ManolisTerrovitis Institute for the Management of Information Systems (IMIS), RC Athena Nikos Mamoulis University of Hong Kong (HKU) PanosKalnis King Abdullah University of Science and Technology (KAUST)

2. Motivation Helen • Attacker can see up to m items • Any m items • No distinction between sensitive and non-sensitive items 0% Milk Beer Pregnancy test

3. Motivation (cont.) Helen: Beer, 0%Milk, Pregnancy test John: Cola, Cheese Tom: 2% Milk, Coffee …. Mary: Wine, Beer, Full-fat Milk Database Attacker Find all transactions that contain Beer & 0% Milk Published t1: Beer, Milk, Pregnancy test t2: Cola, Cheese t3: Milk, Coffee …. tn: Wine, Beer, Milk t1: Beer, 0%Milk, Pregnancy test t2: Cola, Cheese t3: 2% Milk, Coffee …. tn: Wine, Beer, Full-fat Milk

4. km-anonymity Set of items Transaction Query terms Database km-anonymity:

5. Related Work: K-Anonymity [Swe02] NOT suitable for high-dimensionality Quasi-identifier (a) Microdata • 2-anonymous microdata [Swe02] L. Sweeney. k-Anonymity: A Model for Protecting Privacy. Int. J. of Uncertainty, Fuzziness and Knowledge-Based Systems, 10(5):557-570, 2002.

6. Related Work: L-diversity in Transactions Requires knowledge of (non)-sensitive attributes [GTK08] G. Ghinita, Y. Tao, P. Kalnis, “On the Anonymization of Sparse High-Dimensional Data”, ICDE, 2008

7. Our Approach: Employs Generalization Information loss Generalization Hierarchy k=2 m=2

8. Lattice of Generalizations

9. Optimal Algorithm  Q:    Q:  Q:      

10. Count Tree 1 1 1 1 1 1 1 1 1 1 1 • All generalized forms of the paths reside in the tree • We can find easily which anonymizations are needed

11. Apriori-based Anonymization • Global Optimal vs Local Optimal • Solution for each path • We examine the paths • By size (A priori principle) • Paths with invalid nodes are skipped

12. Apriori-based Anonymization • Initialize gen_map • Fori := 1 to mdo • For all t  Ddo • Extend t acccording to gen_map • Add all i-subsets of extended t to count-tree • Check all paths in count tree and update gen_map

13. Small Datasets (2-15K, BMS-WebView2) • |I|=40..60, k=100, m=3

14. Small Datasets (BMS-WebView2) • |D|=10K, k=100, m=1..4

15. Apriori Anonymization for Large Datasets 500sec 100sec 10sec k=5 m=3

16. Points to Remember • Anonymization of Transactional Data • Attacker knows m items • Any m items can be the quasi-identifier • Global recoding method • Optimal solution: too slow • AprioriAnonymization: fast and low information loss • Extensions (VLDBJ 2010) • Local recoding (sort by Gray order and partition) • Global recoding (by partitioning the data domain)