Privacy-preserving Anonymization of Set Value Data Manolis Terrovitis, Nikos Mamoulis University of Hong Kong Panos Kalnis National University of Singapore

2 Motivation  Attacker can see up to m items Any m items No distinction between sensitive and non-sensitive items 0% Milk Pregnancy test Beer Helen

3 Motivation (cont.) Helen: Beer, 0% Milk, Pregnancy test John: Cola, Cheese Tom: 2% Milk, Coffee …. Mary: Wine, Beer, Full-fat Milk Database t1: Beer, 0%Milk, Pregnancy test t2: Cola, Cheese t3: 2% Milk, Coffee …. tn: Wine, Beer, Full-fat Milk Published Attacker Find all transactions that contain Beer & 0% Milk t1: Beer, Milk, Pregnancy test t2: Cola, Cheese t3: Milk, Coffee …. tn: Wine, Beer, Milk

4 k m -anonymity Set of items Transaction Database Query terms k m -anonymity:

5 Related Work: K-Anonymity [Swe02] AgeZipCodeDisease Flu AIDS Cancer Gastritis Dyspepsia Bronchitis [Swe02] L. Sweeney. k-Anonymity: A Model for Protecting Privacy. Int. J. of Uncertainty, Fuzziness and Knowledge-Based Systems, 10(5): , (a) Microdata Quasi-identifier AgeZipCodeDisease Flu AIDS Cancer Gastritis Dyspepsia Bronchitis (a) 2-anonymous microdata NOT suitable for high-dimensionality

6 Related Work: L-diversity in Transactions [GTK08] G. Ghinita, Y. Tao, P. Kalnis, “On the Anonymization of Sparse High-Dimensional Data”, ICDE, 2008 Requires knowledge of (non)-sensitive attributes

7 Our Approach: Employs Generalization Generalization Hierarchy Information loss k=2 m=2

8 Lattice of Generalizations

9 Count Tree

10 Optimal Algorithm      Q:    Q:    Q: 

11 “Direct” Anonymization      COUNT({a 1,a 2 })=1  Solves each “problem” independently

12 “Apriori-based” Anonymization  Construct the count-tree incrementally  Prune unnecessary branches

13 Small Datasets (2-15K, BMS-WebView2)  |I|=40..60, k=100, m=3

14 Small Datasets (BMS-WebView2)  |D|=10K, k=100, m=1..4

15 Apriori Anonymization for Large Datasets 500sec 10sec 100sec |D||D||I||I| 515K K497 77K3340  k=5  m=3

16 Points to Remember  Anonymization of Transactional Data Attacker knows m items Any m items can be the quasi-identifier  Global recoding method Optimal solution: too slow Apriori Anonymization: fast and low information loss  On-going work Local recoding (sort by Gray order and partition) Transactional data in streaming environments

17 Bibliography on LBS Privacy