1 Preserving Privacy in GPS Traces via Uncertainty-Aware Path Cloaking by: Baik Hoh, Marco Gruteser, Hui Xiong, Ansaf Alrabady ACM CCS '07 Presentation: Martin Azizyan ECE 256, Spring 09 Duke University

2 Overview Introduction Problem Previous work Proposed methods Evaluation Discussion

3 Introduction Emerging use for aggregate location traces Automotive traffic monitoring City planning Privacy a big issue Individuals can be “followed” with their traces Existing techniques have drawbacks Either sacrifice data accuracy, or anonymity

4 Traffic monitoring Goal: estimate travel time for routes “Probe vehicles” report real-time position and speed Data stored in central database for analysis  Both real-time and historical

5 Traffic monitoring Requires high spacial accuracy Parallel roads may be only 10m apart Thus, individuals can be tracked with high accuracy In area of high density traffic, not an issue Can't track one person in a crowd Privacy must also be guaranteed in low density Though data from low-traffic routes not as important

6 Existing privacy algorithms (1) K-anonymity Guarantees degree of anonymity Very low accuracy

7 Existing privacy algorithms (2) Best effort Exploit confusion from multiple crossing paths

8 Existing privacy algorithms (2) Best effort Tang et al. Subsampling

9 Existing privacy algorithms (2) Best effort Tang et al. Subsampling

10 Existing privacy algorithms (2) Best effort Tang et al. Subsampling Non-uniform subsampling also explored Suppress information in high-density areas Unclear worst-case privacy guarantees Individual users still at risk

11 Trace privacy metric Given trace, determine degree of privacy Mean Time To Confusion (MTTC) Time adversary can correctly follow a trace Need Adversary model Last position + heading ~ current position Calculate Tracking Uncertainty H due to confusion If H > a threshold, then assume trace lost MTTC depends on threshold for H

12 Proposed algorithm Parameter: maximum time to confusion Longest time interval a trace can be followed Also need to set maximum uncertainty level Divide into time slots For each sample in a time slot, check: Time since last point of confusion < max Tracking uncertainty > min If either satisfied, release sample (make available)

13 Possible modifications Algorithm not specific to one adversary model Independent tracking uncertainty calculation Reacquisition tracking model Adversary can skip over some points of confusion Minor modifications to algorithm necessary

14 Experimental setup Data Collected GPS traces from 233 vehicles  Sample includes timestamp, coordinates, velocity and heading Experiments performed on 24 hour traces  With 500 and 2000 probe vehicles  One vehicle's traces from 24 hour periods simulate multiple vehicles

15 Experimental setup Evaluation metrics Maximum and median time to confusion (TTC) Relative weighted road coverage  Each sample assigned weight based on number of samples in its area  Quality of sample set = sum of sample weights

16 Results High-density scenario (2000 vehicles) Without reacquisition

17 Results High-density scenario (2000 vehicles) With reacquisition

18 Results Low density scenario (500 vehicles) Without reacquisition With reacquisition

19 QoS analysis Samples kept: uncertainty-aware algorithm v.s. random sampling

20 QoS analysis Relative weighted road coverage No significant change after executing algorithm

21 QoS analysis Maximum TTC vs. weighted road coverage Without reacquisition With reacquisition

22 Discussion Map-based tracking Roads not a continuous 2D space Adversary can assign probabilities more intelligently A priori knowledge Tracking select individual easier than data mining Trust in central location server Fully distributed approach seems infeasible Hybrid approach more likely Inform vehicle of probe density in their area

23 The End

snapshots:

25 Proposed algorithm Processes with time slots Reveals sample if confusion

26 Existing privacy algorithms (2) Best effort Exploit confusion from multiple crossing paths