具有差分隐私的多用户位置关联保护资源-CSDN文库

103 浏览量 2021-03-03 19:12:36 上传评论收藏 184KB PDF 举报

本文讨论了在大数据时代，随着基于位置的应用、GPS 设备和大数据机构的迅速发展，位置关联隐私问题引起了广泛关注。因为攻击者可能会结合位置关联信息和他们的背景知识来猜测用户隐私，因此需要保护这种关联以维护用户隐私。为了解决位置信息泄露问题，研究者提出了位置扰动和泛化的方法。然而，目前大多数提议的方法依赖于没有严格隐私保证的语法隐私模型。此外，许多方法只考虑扰动一个用户的位置，没有考虑多用户位置关联，所以这些技术不能很好地防止各种推断攻击。目前，差分隐私被视为隐私保护的标准，但在应用于位置关联保护时存在新的挑战。隐私保护不仅要满足请求基于位置服务的用户的需求，而且还应保护多个用户之间的位置关联。本文提出了一个系统的解决方案来保护多个用户之间的位置关联隐私，并有严格的隐私保证。我们提出了一个新的定义，即通过隐马尔可夫模型获得的私有候选集。然后，我们使用隐马尔可夫模型的相似性来量化两个用户之间的位置关联。我们提出了一个隐私轨迹发布机制，它可以保留用户在一段时间内在隐马尔可夫模型下移动时的位置关联。在现实世界数据集上的实验也表明，多用户位置关联保护是有效的。关键词包括差分隐私（differential privacy）、基于位置的服务（location-based services）等。知识点总结： 1. 位置隐私和大数据：随着位置服务和GPS技术的普及，用户的位置信息变得越来越容易获取。同时，大数据技术的发展使得存储和分析位置数据变得更为高效，位置隐私问题因而备受关注。 2. 位置关联隐私：位置关联隐私指的是攻击者通过用户的多个位置信息或者与其他用户的位置信息相结合，推测出用户的敏感信息，例如活动轨迹、居住地、工作地点等隐私信息。 3. 差分隐私：差分隐私是一种隐私保护方法，目的是在统计数据库查询结果中提供对个体数据的保护，以防止通过数据分析推断出个体的具体信息。差分隐私通过添加一定量的噪声来实现，使得单个个体的加入或删除对查询结果的影响是微不足道的。 4. 隐私模型：文章中提到的“没有严格隐私保证”的语法隐私模型，可能指的是非差分隐私模型，这类模型在隐私保护方面存在理论上的不足，容易受到推断攻击。 5. 多用户隐私保护：多用户隐私保护强调在保护个体隐私的同时，需要考虑用户之间的交互关系和信息共享。在这种情况下，单一用户的隐私保护措施可能不足以防御针对用户群体的推断攻击。 6. 隐马尔可夫模型（Hidden Markov Models, HMM）：这是一种统计模型，用于描述一个含有隐含未知参数的马尔可夫过程。HMM 通常用于处理时间序列数据，在本文中用于定义私有候选集和量化用户之间的位置关联。 7. 位置扰动与泛化：位置扰动是对用户位置数据进行随机化处理，以达到隐私保护的目的；而泛化则指将具体的位置信息抽象化为更一般的类别信息，以降低泄露具体位置的风险。 8. 推断攻击：即使在位置数据被扰乱或泛化后，攻击者仍可能利用数据的统计特征、与其他数据的关联等手段进行推断，从而破解隐私保护，推断出用户的个人信息。 9. 隐私保证：指的是隐私保护方案能够在理论上提供确凿的隐私保护标准，确保即便在面对复杂和智能的攻击者时，用户的隐私信息也能得到有效的保护。 10. 位置轨迹发布机制：这是一个具体的隐私保护技术，它能够在保护用户位置信息不被外泄的前提下，合理地发布用户的位置信息。这一机制需要平衡隐私保护与服务需求之间的关系。 11. 现实世界数据集实验：通过在现实世界的数据集上进行实验，验证所提出的隐私保护方案的实际效果，以确保这些技术能够在真实环境中提供有效的保护。

资源推荐

资源详情

资源评论

Multi-user Location Correlation Protection with

Differential Privacy

Lu Ou

†

, Zheng Qin

†

, Yonghe Liu

⊤

,HuiYin

†§

, Yupeng Hu

†

, Hao Chen

†

College of Information Science and Engineering, Hunan University, Changsha 410082, China

⊤

Department of Computer Science and Engineering, University of Texas at Arlington, Arlington 76013, USA

Department of Mathematics and Computer Science, Changsha University, Changsha 410022, China

Abstract—In the big data era, with the rapid development of

location-based applications, GPS enabled devices and big data

institutions, location correlation privacy raises more and more

people’s concern. Because adversaries may combine location

correlations with their background knowledge to guess users’

privacy, such correlation should be protected to preserve users’

privacy. In order to deal with the location disclosure problem,

location perturbation and generalization have been proposed.

However, most proposed approaches depend on syntactic privacy

models without rigorous privacy guarantee. Furthermore, many

approaches only consider perturbing the locations of one user

without considering multi-user location correlations, so these

techniques cannot prevent various inference attacks well. Cur-

rently, differential privacy has been regarded as a standard for

privacy protection, but there are new challenges for applying

differential privacy in the location correlations protection. The

privacy protection not only should meet the needs of users who

request location-based services, but also should protect location

correlation among multiple users.

In this paper, we propose a systematic solution to protect

location correlations privacy among multiple users with rigorous

privacy guarantee. First of all, we propose a novel deﬁnition,

private candidate sets which are obtained by hidden Markov

models. Then, we quantify the location correlation between two

users by using the similarity of hidden Markov models. Finally,

we present a private trajectory releasing mechanism which can

preserve the location correlations among users who move under

hidden Markov models in a period of time. Experiments on

real-world datasets also show that multi-user location correlation

protection is efﬁcient.

Keywords—differential privacy, hidden Markov models,

location-based services, location correlation, the similarity of

hidden Markov models, private trajectory releasing

I. INTRODUCTION

In the big data era, with the popularity of smart phones

and other GPS enabled devices, the Location Based Service

(LBS) is an integral part of our life. This service can bring

convenience in our life. Therefore, in order to improve quality

of our life, big data institutions may improve the quality of

LBSs. At the same time, big data institutions will achieve

location information about each user and other related infor-

mation from location-based servers such as trajectories and the

user’s interest to improve the quality of LBSs. However, the

big data institutions are honest and curious. They may mine

some sensitive information about users, such as a location

correlation. For instance, there is a big data institution of

catering who wants to analyze restaurant interests for different

occupational groups. Through data mining, they may ﬁnd that

users who are in the same occupational group are often at

the same location at the same time or the different time (as

shown in Figure 1). Furthermore, they may use this location

correlation to mine social correlations among the users. If

social correlations among multiple users are exposed, some

sensitive information may be inferred. Now we give a scenario

to explain this problem. As we can see in Figure 1, Betty

and Jerry are students (i.e., they are in the same occupational

group). Simultaneously, they are at same location (i.e., the

location correlation between Betty and Jerry) twice. Therefore,

adversaries may consider that Jerry and Betty are classmates

according to their background knowledge. Then if Jerry’s age

is leaked, Betty’s age will be known by adversaries too. Thus,

location correlation should be hidden to preserve the user’s

privacy.

Jerry

Betty

Mia

Andy

Student

Doctor

Fig. 1. User Location Trace about Different Occupational Groups

There are several works on location privacy protection.

But most of these existing approaches and solutions focus on

a single user’s privacy. Although a few works also consider

temporal correlations of one user, no location correlations

among multiple users.

To protect location correlations privacy among multiple

users with rigorous privacy guarantee, we propose a novel pri-

vate trajectory releasing mechanism which is based on hidden

Markov models (HMMs) to deal with this location correlation

disclosure problem. By using HMMs, a probable trajectory

set can be generated to cover every eventuality (trajectory).

And by using a similarity of HMMs, we can quantify the

locations correlation between two users in a period of time.

Then, based on the probable trajectories and the correlated

trajectories, we calculate a private candidate set which is used

to achieve differential privacy. Finally, an extended differential

privacy approach is proposed to protect the privacy.

We implement our approach on real-world datasets, and

the experimental results show that our approach could protect

the multi-user location correlation efﬁciently.

The main contributions of this paper are organized as

following.

∙ By using HMMs, we can achieve the probable tra-

jectories of each user, preparing for extending the

differential privacy on private candidate sets to protect

the location correlations.

∙ We quantify the location correlation between two users

through the similarity measurement of two hidden

Markov Models. Through such measurement, we can

not only analyze the historical multi-user location

correlations, but also predict the potential correlations.

∙ We propose a private trajectory releasing mechanism

which satisﬁes the differential privacy and can protect

the location correlations.

∙ The evaluations demonstrate that our approach can

achieve differentially private location correlation re-

leasing with high efﬁciency and utility.

The remainder of this paper is organized as follows. In

Section II, we review the related works in the literature. In Sec-

tion III, we give some basic concepts, such as HMMs, as well

as similarity of HMMs and the bounded differential privacy.

Then, we formulate an adversary model and discuss motivation

and basic idea to protect multi-user location correlation priva-

cy. In Section IV, we present the details of multi-user location

correlation protection and a trajectory releasing mechanism.

Furthermore, the security analysis, the utility analysis and the

analysis on the adversary’s knowledge are depicted in Section

V. The experimental performance evaluation is shown Section

VI. Finally, Section VII concludes the paper.

II. R

ELATED WORK

In the literature, most research works on location privacy

protection and be summarized into two categories, i.e., location

privacy and correlation protection with differential privacy.

A. Location Privacy

There are a lot of works about location privacy protection.

In order to protect users’ privacy, early solutions are proposed

to remove users’ identities or replace them with pseudonyms

[1]. However, such solutions cannot meet requirements of

privacy protection in the context of LBSs. Actually, adversaries

can use users’ published locations and related data with

background knowledge to de-anonymized users. As a result,

pseudonymizing is not good enough to preserve users’ privacy.

Furthermore, 𝑘-anonymity is also used to protect location

privacy. To achieve that a record of one user in the context

databases cannot be distinguished from 𝑘 − 1 other users. A

concept of “hide locations of users inside a crowd” is proposed

and adapted to preserving users’ locations by capacitating users

to request the LBSs using a spatial area called a “cloak” instead

of their precise locations. There are some works dealing with

this solution [2], [3]. And they also try to balance the trade-off

between the resulting utility and the offered privacy guarantee.

The resulting utility and privacy guarantee are qualiﬁed by the

cloak size and 𝑘 respectively. For example, the performance of

a 𝑘-anonymity approach depends on the quadtrees that produce

the smallest cloak. What’s more, researchers extend this model,

to allow users to customize their desired privacy levels.

In addition, to protect online distributed LBSs, the

𝑘-anonymity is also introduced. For instance, a privacy-aware

query processing framework is proposed, called Casper [4].

It disposes the users’ queries based on their cloak location,

i.e., anonymous location. The critical disadvantage of the

spatio-temporal variant 𝑘-anonymity is that the third party is

trusted undesirably and it plays a role of anonymity server.

When users request an LBS, the third party will obtain users’

location information and obfuscate it. If adversaries have the

background knowledge and the prior knowledge about users,

the 𝑘-anonymity may not prevent adversaries analysing the

users’ privacy.

In order to eliminate this drawback, location privacy quan-

tifying is proposed. Under this approach, when adversaries per-

forms inference attacks, the estimation error will be measured

[5], [6]. For example, the main intention of the inference attack

is to infer the observed users’ true locations or re-identify the

users based on published locations. But a strong assumption

should be made on the knowledge available to the adversaries

in this approach.

Also, some approaches are propose for preserving location

privacy with differential privacy [7], [8], [15], [16]. The ﬁrst

approach is proposed to deal with the differentially private

computation of the points of interest from a geographical

database populated with the mobility traces of users based on

a quadtree algorithm [7]. And then a database is considered as

a containing commuting patterns one. In this database, each

record represents a user and there are origin and destination

for each user. A synthetic location information is generated

simulating the original location information, instead of re-

leasing the original location information. Recently, a concept

of geo-indistinguishability [11] was proposed, and it expands

differential privacy. But this technology does not consider

correlations among multiple users. And Markov models are

used to build users mobility and infer user location or trajectory

[12], [13]. There are several works that consider temporal

correlations of multiple locations about only one user [10],

[14], [15]. These technologies can protect location privacy in

some extent, but they still do not consider correlations among

multiple users. However, these technologies cannot protect

location privacy well [9], [10]. Most of them do not consider

the correlation among multiple users and this correlation will

be exposed by inference attacks.

B. Correlation Protection with Differential Privacy

Differential privacy has been studied for several years,

and there many variants or generalizations are proposed. But

applying differential privacy for protecting location privacy has

not been studied in depth. Recently there are several works ap-

plying differential privacy for releasing aggregate information

from a huge amount of locations, trajectories or spatiotemporal

data [17]–[20]. Also, a location protection extended differential

privacy is proposed [15]. This method proposed 𝛿-location set

of continual location of only one user and the user’s locations

are temporally correlated. And in order to protect correlated

data, there are several works about correlation protection with

剩余7页未读，继续阅读

评论收藏

内容反馈

weixin_38683195

粉丝: 3
资源: 881

具有差分隐私的多用户位置关联保护

基于差分隐私的混合位置隐私保护.pdf

基于差分隐私的连续位置隐私保护机制.docx

论文研究-基于差分隐私机制的位置数据隐私保护策略.pdf

释放相关轨迹：朝着高实用性和最佳差分隐私方向发展

数据挖掘中的隐私保护技术研究.pdf

融合语义信息的时空关联位置隐私保护方法.docx

社交网络环境下的隐私保护问题研究.pdf

面向时空大数据的隐私保护理论基础研究.docx

边缘计算下的定位服务隐私保护.pptx

社交网络环境下的隐私保护问题研究.docx

十六进制数据的隐私保护技术.pptx

大数据环境下图书馆用户的隐私保护研究.zip

信息安全工程师考点—隐私保护.pdf

基于隐私保护的数据挖掘技术研究.docx

大数据时代的个人隐私保护_刘雅辉.pdf

大数据时代用户数据信息隐私保护路径.zip

物联网隐私保护问题.pdf

社交网络环境下的隐私保护问题研究.doc

探索基于大数据的分布式隐私保护聚类挖掘算法.zip

数据挖掘中的隐私保护策略

隐私保护关联规则挖掘研究

隐私保护数据挖掘技术研究综述.pdf

网络游戏-社会网络数据发布的隐私保护技术研究.zip

最新资源