1. Data Warehousing Data Mining Privacy

2. Reading Bhavani Thuraisingham, Murat Kantarcioglu, and Srinivasan Iyer. 2007. Extended RBAC-design and implementation for a secure data warehouse. Int. J. Bus. Intell. Data Min. 2, 4 (December 2007), 367- 382., https://www.utdallas.edu/~bxt043000/Publications/ Technical-Reports/UTDCS-35-07.pdf Bhavani Thuraisingham, Murat Kantarcioglu, and Srinivasan Iyer. 2007. Extended RBAC-design and implementation for a secure data warehouse. Int. J. Bus. Intell. Data Min. 2, 4 (December 2007), 367- 382., https://www.utdallas.edu/~bxt043000/Publications/ Technical-Reports/UTDCS-35-07.pdf https://www.utdallas.edu/~bxt043000/Publications/ Technical-Reports/UTDCS-35-07.pdf https://www.utdallas.edu/~bxt043000/Publications/ Technical-Reports/UTDCS-35-07.pdf Sweeney L, Abu A, and Winn J. Identifying Participants in the Personal Genome Project by Name. Harvard University. Data Privacy Lab. White Paper 1021-1. April 24, 2013. http://dataprivacylab.org/projects/pgp/1021-1.pdf http://dataprivacylab.org/projects/pgp/1021-1.pdf FarkasCSCE 824 - Spring 2015 2

3. Data Warehousing Repository of data providing organized and cleaned enterprise- wide data (obtained form a variety of sources) in a standardized format Repository of data providing organized and cleaned enterprise- wide data (obtained form a variety of sources) in a standardized format –Data mart (single subject area) –Enterprise data warehouse (integrated data marts) –Metadata FarkasCSCE 824 - Spring 2015 3

4. OLAP Analysis Aggregation functions Aggregation functions Factual data access Factual data access Complex criteria Complex criteria Visualization Visualization FarkasCSCE 824 - Spring 2015 4

5. Warehouse Evaluation Enterprise-wide support Enterprise-wide support Consistency and integration across diverse domain Consistency and integration across diverse domain Security support Security support Support for operational users Support for operational users Flexible access for decision makers Flexible access for decision makers FarkasCSCE 824 - Spring 2015 5

6. Data Integration Data access Data access Data federation Data federation Change capture Change capture Need ETL (extraction, transformation, load) Need ETL (extraction, transformation, load) FarkasCSCE 824 - Spring 2015 6

7. Data Warehouse Users Internal users Internal users –Employees –Managerial External users External users –Reporting and auditing –Research FarkasCSCE 824 - Spring 2015 7

8. Data Mining Databases to be mined Knowledge to be mined Techniques Used Applications supported FarkasCSCE 824 - Spring 2015 8

9. Data Mining Task DM: mostly automated DM: mostly automated Prediction Tasks Prediction Tasks –Use some variables to predict unknown or future values of other variables Description Tasks Description Tasks –Find human-interpretable patterns that describe the data FarkasCSCE 824 - Spring 2015 9

10. Common Tasks Classification [Predictive] Classification [Predictive] Clustering [Descriptive] Clustering [Descriptive] Association Rule Mining [Descriptive] Association Rule Mining [Descriptive] Regression [Predictive] Regression [Predictive] Deviation Detection [Predictive] Deviation Detection [Predictive] FarkasCSCE 824 - Spring 2015 10

11. Security for Data Warehousing Establish organizations security policies and procedures Establish organizations security policies and procedures Implement logical access control Implement logical access control Restrict physical access Restrict physical access Establish internal control and auditing Establish internal control and auditing FarkasCSCE 824 - Spring 2015 11

12. Data Warehousing Issues: Integrity Poor quality data: inaccurate, incomplete, missing meta-data Poor quality data: inaccurate, incomplete, missing meta-data Loss of traditional consistency, e.g., keys Loss of traditional consistency, e.g., keys Source data quality vs. derived data quality Source data quality vs. derived data quality –Trust in the result of analysis? FarkasCSCE 824 - Spring 2015 12

13. Big Data Security and Privacy Amount of data being considered Amount of data being considered Privacy-preserving analytics Privacy-preserving analytics Granular Access Control Granular Access Control –Flat, two dimensional tables Transaction logs and auditing Transaction logs and auditing Real time monitoring Real time monitoring FarkasCSCE 824 - Spring 201513

14. Big Data Integrity Data Accuracy Data Accuracy Source provenance Source provenance End-point filtering and validation End-point filtering and validation FarkasCSCE 824 - Spring 201514

15. Access Control Layered defense: Layered defense: –Access to processes that extract operational data –Access to data and process that transforms operational data –Access to data and meta-data in the warehouse FarkasCSCE 824 - Spring 2015 15

16. Access Control Issues Mapping from local to warehouse policies Mapping from local to warehouse policies How to handle “new” data How to handle “new” data Scalability Scalability Identity Management Identity Management FarkasCSCE 824 - Spring 2015 16

17. Inference Problem Data Mining: discover “new knowledge”  how to evaluate security risks? Data Mining: discover “new knowledge”  how to evaluate security risks? Example security risks: Example security risks: –Prediction of sensitive information –Misuse of information Assurance of “discovery” Assurance of “discovery” FarkasCSCE 824 - Spring 2015 17

18. Privacy and Sensitivity Large volume of private (personal) data Large volume of private (personal) data Need: Need: –Proper acquisition, maintenance, usage, and retention policy –Integrity verification –Control of analysis methods (aggregation may reveal sensitive data) FarkasCSCE 824 - Spring 2015 18

19. Privacy What is the difference between confidentiality and privacy? What is the difference between confidentiality and privacy? Identity, location, activity, etc. Identity, location, activity, etc. Anonymity vs. accountability Anonymity vs. accountability FarkasCSCE 824 - Spring 2015 19

20. FarkasCSCE 824 - Spring 2015 20 Legislations Privacy Act of 1974, U.S. Department of Justice (http://www.usdoj.gov/oip/04_7_1.html ) Privacy Act of 1974, U.S. Department of Justice (http://www.usdoj.gov/oip/04_7_1.html )http://www.usdoj.gov/oip/04_7_1.html Family Educational Rights and Privacy Act (FERPA), U.S. Department of Education, (http://www.ed.gov/policy/gen/guid/fpco/ferpa/in dex.html ) Family Educational Rights and Privacy Act (FERPA), U.S. Department of Education, (http://www.ed.gov/policy/gen/guid/fpco/ferpa/in dex.html )http://www.ed.gov/policy/gen/guid/fpco/ferpa/in dex.htmlhttp://www.ed.gov/policy/gen/guid/fpco/ferpa/in dex.html Health Insurance Portability and Accountability Act of 1996 (HIPAA), (http://en.wikipedia.org/wiki/Health_Insurance_Por tability_and_Accountability_Act ) Health Insurance Portability and Accountability Act of 1996 (HIPAA), (http://en.wikipedia.org/wiki/Health_Insurance_Por tability_and_Accountability_Act )http://en.wikipedia.org/wiki/Health_Insurance_Por tability_and_Accountability_Acthttp://en.wikipedia.org/wiki/Health_Insurance_Por tability_and_Accountability_Act Telecommunications Consumer Privacy Act (http://www.answers.com/topic/electronic- communications-privacy-act ) Telecommunications Consumer Privacy Act (http://www.answers.com/topic/electronic- communications-privacy-act )http://www.answers.com/topic/electronic- communications-privacy-acthttp://www.answers.com/topic/electronic- communications-privacy-act

21. Online Social Network Social Relationship Social Relationship Communication context changes social relationships Communication context changes social relationships Social relationships maintained through different media grow at different rates and to different depths Social relationships maintained through different media grow at different rates and to different depths No clear consensus which media is the best No clear consensus which media is the best FarkasCSCE 824 - Spring 2015 21

22. Internet and Social Relationships Internet Bridges distance at a low cost Bridges distance at a low cost New participants tend to “like” each other more New participants tend to “like” each other more Less stressful than face-to-face meeting Less stressful than face-to-face meeting People focus on communicating their “selves” (except a few malicious users) People focus on communicating their “selves” (except a few malicious users) FarkasCSCE 824 - Spring 2015 22

23. Social Network Description of the social structure between actors Description of the social structure between actors Connections: various levels of social familiarities, e.g., from casual acquaintance to close familiar bonds Connections: various levels of social familiarities, e.g., from casual acquaintance to close familiar bonds Support online interaction and content sharing Support online interaction and content sharing FarkasCSCE 824 - Spring 2015 23

24. Social Network Analysis The mapping and measuring of relationships and flows between people, groups, organizations, computers or other information processing entities The mapping and measuring of relationships and flows between people, groups, organizations, computers or other information processing entities Behavioral Profiling Behavioral Profiling Note: Social Network Signatures Note: Social Network Signatures –User names may change, family and friends are more difficult to change FarkasCSCE 824 - Spring 2015 24

25. Interesting Read: M. Chew, D. Balfanz, B. Laurie, (Under)mining Privacy in Social Networks, http://citeseer.ist.psu.edu/viewd oc/summary?doi=10.1.1.149.446 8 M. Chew, D. Balfanz, B. Laurie, (Under)mining Privacy in Social Networks, http://citeseer.ist.psu.edu/viewd oc/summary?doi=10.1.1.149.446 8 http://citeseer.ist.psu.edu/viewd oc/summary?doi=10.1.1.149.446 8 http://citeseer.ist.psu.edu/viewd oc/summary?doi=10.1.1.149.446 8 FarkasCSCE 824 - Spring 2015 25

26. Next Web application insecurity: risk to databases Web application insecurity: risk to databases FarkasCSCE 824 - Spring 2015 26