1. Suppose I learn that Garth has 3 friends. Then I know he must be one of {v 1,v 2,v 3 } in Figure 1 above. If I also learn the degrees of his neighbors, e.g. he has a friend of degree 5, then I can id him as v 3. Degree-Based Adversary: 1-Hop Degree-Based Adversary: Social network data can help uncover latent social trends and assist in scientific research. Publishing may violate privacy of individuals. Removing labels is not sufficient – vertices can be re-identified using structural information! k-anonymous: Each vertex in the graph is indistinguishable from at least k-1 others. Social role: The purpose something serves in the context of its social environment. Social Role-Preserving Graph Anonymization Using Clustering Motivation Adversary Models Clustering Anonymization Analysis Conclusions The Generalized Graph model of Hay et. al. [VLDB08] provides k-anonymity, but fails to preserve social roles. Through experimental results, we show that the ICMM and SPAA algorithms along with Union-Split clustering outperform state-of-the-art anonymization methods in guaranteeing privacy while preserving social roles. Future Work: Run experiments on real-world social network graphs. Extend our methods to prevent link disclosure attacks. Study the effect of social role preservation on diversity. Garth Alice Bob Chris Dan Eva Fred Heidi Joe Isabelle Kate Leo Fig. 1: Naive Anonymization. Vertices can be re-identified using information about the local structure of the graph. ? ? ? 2 1 5 v3v3 v1v1 v2v2 Brian Thompson, Danfeng (Daphne) Yao Department of Computer Science, Rutgers University bthom@cs.rutgers.edu, danfeng@cs.rutgers.edu Fig. 2: Two measures of clustering quality. Greedy algorithm is inconsistent, but Union-Split consistently performs on par with unconstrained t-means. With clustering done, we can k-anonymize the graph while trying to preserve underlying graph structure. Fig. 5: Analysis of anonymization methods on a simulated social network graph RMAT(512,9). Union-Split is used for clustering, with k = 10. We compare our algorithms to the Generalized Graph model using several utility measures: Our Cluster First, Anonymize Later paradigm searches for a global solution, a significant improvement over existing greedy methods. Union-Split Algorithm for min-size clustering. Two novel anonymization algorithms: the Inter- Cluster Matching Method and the Similarity- Proximity Anonymization Algorithm Contributions Existing algorithms allow empty or small-sized clusters, so don’t satisfy the k-anonymity requirement. We introduce the Union-Split Clustering Algorithm, which satisfies the min-size constraint, and out- performs greedy algorithms used in recent papers. Inter-Cluster Matching Method (ICMM) Similarity-Proximity Anonymization Alg. (SPAA) Original Graph Clustered GraphGeneralized Graph Anonymization 5 5 5 5 5 2 2 6 2 32 1 2 ICMM takes a global perspective, introducing only as much change as necessary to the original graph. SPAA provides statistical anonymity while preserving local and global trends in graph structure. SPAA allows the flexibility to tune parameters to meet application-specific privacy and utility demands. v w neighbor degrees: {1,1,2,3,3} w neighbor degrees: {3,4,5} v α : how much v needs w as a neighbor β : how much w needs v as a neighbor γ : how close w is to v in the original graph affinity(v,w) = α·β·γ Parameters can be tuned to achieve the desired privacy/utility trade-off. Idea: Using cluster information, match up vertices and perform edge additions and deletions in a way that is mutually beneficial. Idea: Start with an empty graph, adding edges probabilistically until all degree requirements are satisfied. At each step, potential edges are weighted based on the endpoints’ affinities for each other. Experiments