Methods for creating avatars that protect sensitive data

Abstract

The present invention relates to a method for creating an avatar from an initial sensitive data set stored in a database of a computer system, the initial data containing attributes related to a plurality of individuals, the method comprising: a) selecting the number {k} of nearest neighbors to be used from all individuals in the initial data set, b) for an attribute related to a given individual, identifying k nearest neighbors from other individuals in the data set, c) for at least one attribute related to the individual, generating a new attribute value from a quantity characterized by the attributes in the identified k nearest neighbors and weighted by a coefficient, and d) creating avatar data containing the new attribute value to ensure that sensitive data related to the individual is unrecognizable.

Description

[0001] The present invention relates to a method for creating an avatar from an initial sensitive data set containing attributes related to a plurality of individuals. Technical Field

[0002] The protection of sensitive data is a crucial issue, especially personal data placed online or transmitted to third parties for their use. Current solutions aim to allow access to sensitive data sets to third parties interested in their information potential, by ensuring at a high level the possibility of processing files without knowing their content. Therefore, while the need to control access to data is not excluded, it needs to be protected at the source through true anonymization.

[0003] Anonymization can be defined as the act of removing all information contained in a document or database that could directly or indirectly identify an individual. There are different ways to do this. Background Art

[0004] This method, called substitution or pseudonymization, consists of replacing the initial personal identifier with another arbitrary identifier or pseudonym. In order to guarantee the traceability and updating of information in the database and prevent data related to one individual from being associated with another, in the absence of a permanent identifier, this pseudonym must be unique for each person.

[0005] Thus, it is possible to generate a secret correlation table that once and for all associates all identifiers with the pseudonyms that have been associated with them. This anonymization technique has a lower level of security, since the operation is reversible, since the identifiers can be recovered from the pseudonyms, and whoever possesses the table can easily read the database.

[0006] It is also possible to use functions called hashing, which have a specific feature compared to standard cryptographic algorithms, which are not reversible: even if the hashing function used is known, the original identifier cannot be simply restored from the pseudonym alone. However, despite being irreversible in principle, this technique can be compromised by repeatedly reconstructing the relevant table.

[0007] The security of the anonymization can be enhanced by pre-adding an arbitrary key to the initial identifier, which is then hashed. Thus, anyone who wishes to reconstruct the relevant table must not only test all possible first and last names (which is relatively easy), but also all modifications of the identifier that could be affected by the unknown keyword. However, the security of the device again relies on the confidentiality of the tools used: the key on the one hand and the hash function on the other.

[0008] Anonymization can also be strengthened by double hashing with a key, which consists of performing the operation a first time and performing a second hashing function on the pseudonym obtained using the key. To ensure complete confidentiality, the key can be updated regularly.

[0009] Suppression, masking or noise addition methods consist of reducing the quality of the initial information by suppressing specific data or, alternatively, by adding information that disturbs the initial data. The disadvantage of such methods is that the data are distorted from the outset, which makes them less relevant for any use other than the original data. Patent application FR 3 047 586 discloses a method of adding noise to sensitive data divided into subsets, applying different noise levels depending on the level of sensitivity determined for each subset.

[0010] In international application WO 2017 / 093736, data anonymization is performed using one or more techniques that perturb the original data, such as using tagging, generalization, data obfuscation, synthetic record insertion, record suppression, or reorganization. In both applications, anonymization is achieved by continuously transforming individual items of sensitive data.

[0011] Aggregation is a method consisting of combining several values ​​in one category. For example, individuals initially aged 25, 27 and 30 will be grouped in the same age group 25-30. The higher the level of aggregation, the lower the risk of re-identification, but at the same time the less precise the information. Therefore, the institution responsible for the database must find a satisfactory balance between the robustness of the anonymization guaranteed by the level of aggregation and the authorized data accuracy. International application WO 2018 / 028783 describes a method that allows all data containing sensitive information to be anonymized using this type of aggregation method.

[0012] Moreover, in the context of the exponential spread of all types of data, public or private, on all possible objects (sometimes called "big data"), information cross-checking techniques are a very effective means of breaking the anonymity of sensitive databases. According to the recommendations of the French data protection enforcement authority [Commission Nationale de l'Informatique et des Libertés] (CNIL), some data, more sensitive than others, also require special attention, such as data related to health conditions, family life, legal affairs or wealth. There is no solution that can preserve all the signals contained in a data set while eliminating all risks of identification. However, anonymization techniques have many drawbacks.

[0013] Disclosure of the Invention

[0014] Therefore, there is a need to further improve the protection of sensitive data by rendering said data irreversibly unidentifiable while preserving maximum data utility for analytical purposes.

[0015] The purpose of the present invention is to meet this demand. Summary of the invention

[0016] The object of the present invention is therefore a method for creating an avatar from an initial set of sensitive data stored in a database of a computer system, said initial data comprising attributes relating to a plurality of individuals, said method comprising:

[0017] a) For an attribute associated with a given individual, select the number k of nearest neighbors to use from all individuals in the initial dataset,

[0018] b) For this individual, identify the k nearest neighbors from other individuals in the dataset,

[0019] c) for at least one attribute associated with the individual, generating a new attribute value from the feature quantities of the attribute in the identified k nearest neighbors and weighting it by a coefficient, and

[0020] d) Creating avatar data containing new attribute values ​​to ensure that sensitive data associated with the individual is not identifiable.

[0021] The present invention achieves true anonymization in the sense that the ability to re-identify the individual from whom the data originated is lost. The purpose of creating an avatar corresponding to a virtual, synthetic individual is to prevent any direct or indirect re-identification, which is called "avatarization".

[0022] The invention is centered around individual observations (i.e., data-driven and patient-centered) rather than around a large group of individuals who are similar to each other. The invention differs from some known methods that are based on grouped observations. The invention always uses the individual's environment to create the avatar. It allows processing of large amounts of data while maintaining existing links between variables.

[0023] Unlike the known methods described below, the present invention generates completely new synthetic records: avatars. The invention takes a step forward that is not achieved by current technology in the sense that it proposes to generate synthetic data items completely from the local environment of the original data items. The avatar is the result of a local generalization of its environment. For example, in the case of medical data, an avatar of a patient is created from similar individuals, the number of which can be parameterized.

[0024] The invention helps to ensure that the usefulness of the dataset is maintained, providing the possibility to perform the same analysis (eg statistical analysis or analysis using artificial intelligence methods) and obtain comparable results between the initial dataset and the avatar.

[0025] It is possible to preserve the structure of the original data (in other words, their granularity), whereas known solutions using aggregation or generalization offer good security but at the expense of signal preservation. For example, the method according to the invention allows continuous values ​​to be preserved for 30, 32 or 35 years instead of a single 30-35 year category.

[0026] The present invention facilitates data access and provides a complete solution, making the method accessible to non-experts. This allows users to save time by providing a turnkey solution rather than a tool that requires the intervention of data scientists, legal experts and data sharing solution providers.

[0027] Initial data and nearest neighbor number k

[0028] According to the CNIL, “sensitive data items” are understood to be information concerning racial or ethnic origin, political, philosophical or religious opinions, trade union membership, health or sex life. Sensitive data includes personal data, in particular health data.

[0029] The initial data set, also called "microdata", contains attributes related to multiple individuals. Such data are, for example, records containing information about patients who have been in an emergency room or used a healthcare entity, or records forming part of a research group for a given disease, a clinical trial, or various items of information related to the inhabitants of a city, or profiles of users of a given service.

[0030] The initial data set may be downloaded via an interface with a database of a computer system implementing the method according to the invention or with a database of a remote computer system.

[0031] The initial data may include at least one attribute having a numerical value, called a continuous variable, and / or at least one attribute belonging to a category representing a characteristic of an individual, called a categorical variable or a categorical attribute.

[0032] Logical constraints associated with the properties of an attribute may be specified by the user.

[0033] In a particular principal component analysis (PCA), the initial data are advantageously subjected to a multivariate analysis before the identification of the k nearest neighbors of the individuals. This mathematical method allows the dimensionality of the data set to be reduced by identifying the most important axes of variance, discrimination and information content, and to reveal the essence of a data set with N dimensions in a more limited number of dimensions, while respecting the parameters defined by the user, in particular by the parameters for assigning weights to each variable.

[0034] The values ​​of the attributes thus modified can then be projected into the same geometric space.

[0035] Multivariate analysis (especially principal component analysis) can be performed on both categorical and continuous attributes.

[0036] Each attribute can also be defined as more or less sensitive. Thus, for some specific attributes, the user can choose to perturb the dataset more deeply. In multivariate analysis, different weights can be assigned to each attribute, which modifies the projection of the data used to identify the nearest neighbors.

[0037] For example, if a significant weight is assigned to the "size" attribute, this will lead to a deterioration and distortion of the projection in the Euclidean space. Therefore, the distance between points is particularly affected by the "size" attribute compared to other attributes: small differences in size have a more significant impact on the projection and the patient environment.

[0038] Nearest Neighbor

[0039] The number k of nearest neighbors may be a function of the initial data of the individual under consideration. For the same initial data set, the number k of nearest neighbors may be variable, different for some individuals, or different from one individual to another.

[0040] This parameter may be chosen depending on a sensitivity factor of the initial data and / or a confidence factor among the intended recipients of the avatar data: the higher the sensitivity factor and / or the lower the confidence factor, the higher the number k, and the lower the sensitivity factor and / or the higher the confidence factor, the lower the number k.

[0041] The sensitivity factor and confidence factor can be between 0 and 1.

[0042] The choice of the number of nearest neighbors k depends on the desired balance between protecting the initial data and preserving the signal. The initial datasets may have different levels of sensitivity, in other words, the consequences of knowing them are different. For example, in the case of medical data, knowing a person's body mass index may be less damaging than knowing whether the person has cancer.

[0043] It is also important to assess the level of trust that users have in the recipients of their avatar data. For example, for data exchanged within the same hospital, this level of trust is higher than if the data were publicly available online.

[0044] The present invention is based on generating local modeling from the nearest neighbors corresponding to each record of an individual. For example, for medical data, this consists of identifying for each patient k patients that are similar to him or her. Thus, the applied processing is performed based on the nearest neighbors that are unique to each individual. Thus, the present invention is centered on the individual, rather than on a group of individuals that are similar to each other, and thus differs from known methods based on group observations.

[0045] Avatar Data

[0046] In case the initial data contains at least one attribute with a numerical value, the new attribute value preferably corresponds to a randomly weighted centroid calculated from the values ​​of the same attribute of the k nearest neighbors, each value weighted by a coefficient randomly selected from a uniform or exponential distribution.

[0047] For each of the k nearest neighbors, a different coefficient can be randomly chosen for each value of the attribute.

[0048] If the attributes are projected in the same Euclidean space, for any point M, G advantageously exists, a weighted randomly weighted centroid of a polygon with k vertices, corresponding to the k nearest neighbors:

[0049] [Mathematics 1]

[0050]

[0051] α i : Random weighting coefficient

[0052] A i : vertices of the polygon (neighbors),

[0053] Make

[0054] [Mathematics 2]

[0055]

[0056] The randomly weighted centroid G is advantageously calculated in a number N of dimensions corresponding to the number of attributes having values.

[0057] The method according to the invention allows marginal records to be more fully re-centered to eliminate the risk of re-identification, partly because the calculation of new attribute values ​​does not use the original value directly, but only its neighbors to produce a local summary.

[0058] If the initial data contain at least one attribute belonging to a category representing characteristics of an individual, a new attribute value is advantageously randomly selected based on a weighted representation of said category in the k nearest neighbors, which weighted representation is calculated based on the number of values ​​belonging to said category in the k nearest neighbors, which value is weighted by the number of values ​​belonging to said category in the entire initial data set.

[0059] For example, for an attribute indicating whether a patient is pregnant, the proportion of the "pregnant" or "not pregnant" class is calculated among the k nearest neighbors and then weighted by the representation of those same classes in the entire dataset. New attribute values ​​are then randomly drawn based on this weighted representation.

[0060] This approach allows for randomness in the random drawings, which ensures that re-identification is difficult combined with guaranteeing that the drawings are biased by representation of each class among the nearest neighbors.

[0061] Uniform, lognormal, or exponential distributions can be used to compute random weighting coefficients for numeric attributes and for random selection of new categorical attribute values.

[0062] New numerical and class attribute values ​​are advantageously generated together to create the avatar data. The present invention culminates in the creation of avatar data which is advantageously a vector transformation of the initial data of an individual.

[0063] Thus, the dataset is advantageously reconstructed from both continuous and categorical variables. The invention ensures preservation of the original attribute types. For example, if age is an integer-valued attribute in the initial dataset, it will have the same form after creating the incarnation. This result differs from known generalization methods, where multiple patients of similar age appear in the same age group after the data are anonymized, so that locking information is lost.

[0064] At least one constraint function may be applied to the avatar data in order to limit outliers or variations in the relationships between attributes associated with the same individual, in particular to constrain the distribution of numerical attributes or to respect logical relationships between categorical attributes. If necessary, the resulting avatar attributes may be modified using minimum and maximum values ​​of the initial numerical attributes, in particular to ensure that no age below the minimum age of the initial data set occurs. Constraint functions based on different, previously established rules for logical relationships between attributes, such as the fact that men cannot get pregnant, may be applied. This further increases the similarity between the initial data set and the avatar data and allows data consistency to be maintained.

[0065] The dataset consisting of avatars advantageously has the same dimensionality as the initial dataset.

[0066] The processing applied to the initial data set remains valid on the avatar data.

[0067] Recording and accessing avatar data

[0068] The avatar data are advantageously recorded in a database of the same computer system and / or a remote server.

[0069] The avatar data set may be recorded in file form on a local workstation, for example for internal use. In a variant or combination, the avatar data set may be recorded on a remote server, in particular by uploading via a transmission channel such as the Internet or an intranet.

[0070] Restricted access may be created for a recipient of the avatar data. The recipient may be notified that the data has become available via a hybrid authentication system comprising at least two steps, in particular based on the generation and transmission of a unique download link, e.g. by email, followed by the transmission of a limited lifetime key, e.g. by text message. The user may also decide to restrict access to specific attributes or individuals, or set a maximum number of queries that a recipient may make.

[0071] The recipient can access the avatar data in different ways, such as downloading the avatar file directly from a unique personalized link (e.g., in CSV, XML, or XLS format), browsing and downloading files using a secure protocol such as SFTP, performing secure queries on a database on a remote server, or an application programming interface (API) allowing the recipient to interface one of his or her applications directly with the data.

[0072] In the last case, the user is advantageously able to provide a version of the avatar dataset that has been updated in real time. This is particularly useful in situations where access to sensitive data may be revoked, for example after the implementation of the General Data Protection Regulation (GDPR), or if the number of records in a cohort does not stop increasing, for example in the case of patients currently recruited for medical research.

[0073] A report containing details of the creation of the avatar data can be automatically generated, containing in particular the parameters of the multivariate analysis used, the number of individuals and the numerical and categorical attributes, and the number of nearest neighbors k. This report allows tracking the operations performed and is useful for archiving or legal requirements. Obviously, the report does not contain any information that would allow restoring the original data. Please note that the report does not in any case allow reversing the avatarization operation, since the report does not preserve traces of the randomly generated values ​​inherent to the operation of the method.

[0074] All steps of the present invention are advantageously automatically implemented by a computer.

[0075] Computer program product

[0076] According to another aspect of the invention, another object of the invention is a computer program product for implementing the method according to the invention to create an avatar from an initial set of sensitive data stored in a database of a computer system, said initial data containing attributes related to a plurality of individuals, the computer program product comprising a support and instructions recorded on said support readable by a processor so as to:

[0077] a) For an attribute associated with a given individual, select the number k of nearest neighbors to use from all individuals in the initial dataset,

[0078] b) for the individual, identifying the k nearest neighbors from the other individuals in the initial data set,

[0079] c) for at least one attribute associated with the individual, generating a new attribute value from the feature quantities of the attribute in the identified k nearest neighbors and weighting it by a coefficient, and

[0080] d) Creating avatar data containing new attribute values ​​to ensure that sensitive data associated with the individual is not identifiable.

[0081] Features of the method described above apply to the computer program product, and vice versa.

[0082] Avatar Creation Device

[0083] According to another aspect of the invention, another object of the invention is a device for creating an avatar from an initial set of sensitive data stored in a database of a computer system, the initial data comprising attributes related to a plurality of individuals, the device comprising:

[0084] a) a selection module configured to select, for an attribute associated with a given individual, a number k of nearest neighbors to use from among all individuals in the initial dataset,

[0085] b) an identification module configured to identify, for the individual, k nearest neighbors from other individuals in the data set,

[0086] c) a generation module configured to generate, for at least one attribute associated with the individual, a new attribute value from feature quantities of the attribute in the identified k nearest neighbors and weighted by a coefficient, and

[0087] d) An avatar creation module configured to create avatar data containing new attribute values ​​to ensure that sensitive data related to the individual is not identifiable.

[0088] The device according to the invention may also comprise a recording module which records the avatar data in a database of the same computer system and / or a remote server.

[0089] The avatar creation apparatus may include a module for specifying logical constraints that are specific to a data set and linked to properties of an attribute.

[0090] The apparatus may also include means for selecting a number k of nearest neighbors.

[0091] The avatar creation device may include a module for evaluating the characteristics of the avatar according to the risk of re-identification and the risk of information loss.

[0092] The avatar creation device may comprise a notification module configured to notify a recipient of the avatar data that said data have been made available via a hybrid authentication system comprising at least two steps, in particular based on generating and transmitting a unique download link, for example by email, followed by transmitting a limited lifetime key, for example by text message.

[0093] Features of the method and computer program product described above apply to the device, and vice versa. BRIEF DESCRIPTION OF THE DRAWINGS

[0094] The invention may be better understood by reading the following detailed description of non-limiting examples of its implementation and by viewing the accompanying drawings, in which:

[0095] [ Figure 1 ] shows the steps of creating avatar data from initial sensitive data according to the present invention,

[0096] [ Figure 2 ] is an instance that creates avatar data for primitive numeric attributes.

[0097] [ Figure 3 ] shows that for Figure 2 The probability density distribution of the avatar attribute values ​​relative to the nearest neighbors in the instance,

[0098] [ Figure 4 ] shows the position of the avatar data and the initial data in space,

[0099] [ Figure 5 ] shows the difference in correlation between different attributes of the original and avatar datasets,

[0100] [ Figure 6 ] shows the variation of the distance between the avatar created according to the invention and the original nearest individual according to the number of nearest neighbors k, and

[0101] [ Figure 7 ] shows the variation of the distance between the nearest neighbors and individuals in the initial dataset according to the number of nearest neighbors k. DETAILED DESCRIPTION

[0102] Figure 1 An example of the steps of creating avatar data from initial sensitive data according to the present invention is shown.

[0103] In this example, in step 11, an initial data set is downloaded through an interface with a database of a computer system implementing the method according to the invention or with a database of a remote computer system. This initial data set contains attributes related to a plurality of individuals, which attributes may be numerical attributes and / or attributes belonging to categories representing characteristics of the individuals. Logical constraints associated with the properties of the attributes may be specified by the user.

[0104] In step 12, as described above, a sensitivity factor and a confidence factor are established to facilitate the selection of the number k of nearest neighbors in step 13. The number k of nearest neighbors may be selected independently for each individual item of sensitive data, and may therefore also be determined locally and may vary from one individual to the next for the same data set.

[0105] In step 14, a multivariate analysis, in particular a principal component analysis, is performed on the initial data, and in step 14 bis a weight is assigned to each attribute. Thus, in step 15, the k nearest neighbors of the individual are identified from the modified data. For example, if a weight of 0.1 is assigned to age, 0.2 to BMI and 0.75 to the number of pregnancies, the last attribute is stipulated to be particularly sensitive, which will distort the projection of the data in the multivariate analysis.

[0106] For numerical attributes, a coefficient is randomly selected for each value of the attribute of each of the k nearest neighbors in step 16, so that a random weighted centroid G is calculated from the values ​​of the same attribute of the k nearest neighbors in step 17, each value being weighted by this random coefficient to obtain a new value for the avatar data item. If the data contains N numerical attributes, the random weighted centroid G is calculated in N dimensions, giving all new values ​​of the attribute under consideration.

[0107] For attributes belonging to a category that represents characteristics of an individual, in step 18, the number of attributes belonging to the category in the k nearest neighbors is calculated, and then in step 19, this number is weighted by the number of individuals belonging to this category in the entire initial data set so that in step 20, a new attribute value is randomly selected based on this weighted representation.

[0108] In step 21 , new numerical attribute values ​​and categorical attribute values ​​are generated together to create avatar data, thereby making sensitive data associated with an individual unidentifiable.

[0109] In step 22, as previously described, user-defined constraints are applied to the avatar data to limit outliers or variations in the relationships between attributes associated with the same individual.

[0110] The method according to the invention is repeated for each individual. The method is centered on individual sensitive observations. The method allows generating as many desired numbers of avatars for data sensitive individuals as known simulation methods using global modeling or resampling.

[0111] The avatar data thus created may be recorded in a step 23 in a database of the same computer system and / or in a step 24 in a database of a remote server.

[0112] Recipients of the avatar data are managed in step 26. The data may be made available in different ways, such as downloading the avatar file directly from a unique personalized link (e.g., in CSV, XML, or XLS format), browsing and downloading files using a secure protocol such as SFTP, making secure queries on a database on a remote server, or an application programming interface (API) allowing the recipient to interface one of his or her applications directly with the data.

[0113] The recipient may be notified that the data has been made available via a hybrid authentication system comprising at least two steps, in particular based on generating and transmitting a unique download link, for example by email, followed by a limited lifetime key, for example by text message.

[0114] In step 25, a report containing details of the creation of the avatar data may be automatically generated, including, for example, the parameters of the multivariate analysis used, the number of individuals and the numerical and categorical attributes, and the number k of nearest neighbors.

[0115] Figure 2 An example of an avatar created from initial data containing quantitative attributes (age and red blood cell level, which can be seen in Table 1 below) is shown. For simplicity, this example was generated from raw data, but the avatar is advantageously created after multivariate analysis, especially principal component analysis.

[0116] [Table 1]

[0117] individual age Red blood cells (M / μl) O 25 3.5 A 19 4.5 B 28 1.8 C 42 5.2

[0118] Table 1

[0119] like Figure 2 As shown in , the attribute values ​​of each individual are projected into the same Euclidean space. In this example, an avatar Y is created for individual O using three of his or her neighbors, i.e. k=3. The nearest neighbors of individual O are identified. Coefficients are randomly extracted for each neighbor. The coordinates of each neighbor with a correlation coefficient are used to calculate the randomly weighted center of gravity and form the avatar data. In the example considered, the avatar Y of individual O has 34, 47 as the attribute value of his or her age, and 4, 13 M / μl as the red blood cell attribute.

[0120] Figure 3 The probability density distribution of the avatar attribute values ​​relative to the nearest neighbors of the previous instance is shown. Since the method according to the present invention is partially random, if a large number of avatars are created for the same individual, those avatars are distributed in the space between the k nearest neighbors according to the probability density, as Figure 3 as shown in .

[0121] Examples

[0122] An example of the implementation and effectiveness of the present invention will now be described. In this example, the data set involves real patients and is derived from the open access database "Pima Indians Diabetes Database," which contains 768 individuals, eight continuous variables (number of pregnancies, blood sugar level, blood pressure, skin thickness, blood insulin level, age, body mass index, and diabetes spectrum function) and one categorical variable (whether or not having diabetes).

[0123] The data were subjected to principal component analysis in order to project the data set in nine dimensions corresponding to the nine attributes, for example in three-dimensional space when the data are to be displayed. As described above, the method according to the invention was applied to all the data. The number of nearest neighbors k was set to 50.

[0124] Figure 4 The diagram in shows that, for the considered k=50 nearest neighbors, the method according to the invention allows the avatar data to evolve in the same space as the initial data, thus assuming that the properties of the original dataset are well preserved. By definition, marginal records (in other words, individuals with unusual values) are more sensitive to re-identification. Using the invention, Figure 4 As shown in , marginal records are partially de-marginalized and become systematically closer to other records. On the other hand, the avatar generated for a common record is close to many other records similar to it. The generated avatar is distinguished from the original record by its multiple similarities to other individual records.

[0125] Statistically significant datasets consist of variables that are correlated with each other. The impact of creating avatars on these relationships was assessed by calculating the difference in correlations between the attributes of the initial dataset and the attributes of the avatar data. Figure 5 It is shown that for k=50 the correlation differences are moderate and fairly balanced: the method according to the invention does not change the relationship between the attributes too significantly. These two analyses allow the overall impact of the invention on the data to be assessed. The analysis can be locally decomposed to assess the local impact of the invention on subgroups of the data.

[0126] The preservation of the signal can also be verified at a first level by performing the same analysis on the initial dataset and the avatar data: a diabetes prediction model is built using eight other properties of the dataset. To do this, a prediction algorithm, such as a random forest algorithm, is trained on 80% of the avatar dataset and 80% of the initial dataset. The remaining 20% ​​of the original dataset is then used to evaluate the performance of both models by measuring their sensitivity and specificity. In the example related to the diabetes dataset, the values ​​obtained from these two measurements are very close: the sensitivity of the initial data is 0.575, while the sensitivity of the avatar data is 0.553, and the specificity of the initial data is 0.868, while the specificity of the avatar data is 0.89.

[0127] Thus, the model trained with the avatar allows predicting the onset of diabetes with performance comparable to that of the model trained on the original data. The classification performance of the prediction algorithms is comparable and validates the usefulness of the avatar for analyses, such as statistical analysis or using automatic learning. Thus, the preservation of the original characteristics allows applying the same processing and analysis to the avatar data as was performed on the initial data set.

[0128] In an example of an attack scenario, an attacker wishes to know whether an individual has chosen to participate in a scientific study of diabetes, and the attacker knows some information about the individual. To this end, in a research situation that is unfavorable to the present invention, the attacker has a complete initial data and avatar data set, and the initial data contains all sensitive data related to this individual.

[0129] This case is a very extreme instance where the only information the attacker does not know is whether the patient is in a cohort. The prerequisite of knowing the patient's complete original record is particularly ambitious, but allows analysis of the most adverse cases. However, in the vast majority of cases, the attacker only has some information about the patient, in other words only a few attributes, and is seeking to collect new information about the patient.

[0130] Figure 6 The evolution of the distance between the avatar and the nearest original recording is shown, depending on the number of nearest neighbors k. This distance allows assessing the risk of re-identification in the case of an attack by proximity, in which the goal is to establish a link between the avatar data and the original data, which in this scenario is in the possession of the attacker.

[0131] Figure 7 The evolution of the distances between the nearest neighbors and individuals in the initial data set is shown according to the number of nearest neighbors k. The distances between the nearest neighbors are important for assessing the density of the data set. By comparing this figure with the previous figure, it can be seen that for k equal to 50, the density distribution of the avatar data set is comparable to the density distribution obtained for the original data set.

[0132] Of course, the invention is not limited to the examples just described. In particular, other multivariate analysis methods or random plotting methods may be used, as well as other means of downloading and uploading data. These two examples highlight that the risk of re-identification is higher than signal preservation in the invention, which distinguishes the invention from other known data simulation methods.

[0133] Application of the present invention

[0134] The invention can be used for data sharing applications for analysis. For internal and external stakeholders, avatarization opens up the possibility of utilizing sensitive data at their own granularity, not limited to sensitive data. The purpose of sharing this data is to use the potential information contained in the data set for reviewing interests and predicting needs. Artificial intelligence technology should not be forced to choose between the liberalization of sensitive data that is not conducive to protecting individuals and the collective benefits obtained from it.

[0135] Public health organizations, such as hospitals, have databases containing high-value information. This information is problematic in medical research because legitimate regulatory restrictions make sharing difficult. By creating avatars, the invention allows the quality of the data to be preserved while respecting the confidentiality of patient data. The sharing of health data will improve decision-making, practice and research and therefore provide a second life. A doctor can use a collection of data about patients affected by a specific pathology to guide and assist his decisions, for example choosing between different treatments based on the patient's age and lifestyle. Public health organizations can also create avatars based on their data to predict what is needed to improve their work and alert public authorities early to carry out awareness campaigns and plan the necessary resources, for example in the case of an epidemic.

[0136] Furthermore, municipalities could create avatars based on data from their jurisdictions and delegate said avatars to service providers to detect areas or populations that require special attention. Avatars allow for the use of data that has the potential to be an effective way to help prevent social divisions and provide healthcare. This could also allow preventive actions to be effectively targeted, or even put in place a policy that uses predictions to support healthcare equality, especially through the use of artificial intelligence technologies.

[0137] For example, the planning of vaccination campaigns can be envisioned. Municipalities can also use information about the health of their population to plan and develop policies to expand green spaces, favoring places that really need those spaces, or adjust their alternate-day travel policies as part of anti-pollution measures.

[0138] Subscription services for streaming movies and TV series could publish the avatars of their customers as open data to allow film and TV series producers to focus on customer profiles and thus improve their services.

[0139] The prospect of sharing data can be envisioned internally or externally to improve access to data.

[0140] The invention can also be used to help calculate risk scores for customer profiles with a level of accuracy never before achieved, especially by insurance companies or supplementary insurance schemes. This vision may become clearer with the possibility of database cross-checking using avatars, thereby enhancing the experience from which learning can be achieved.

[0141] Democratizing datasets opens up opportunities for teaching and education quality, improving the prospects of educational methods. Accessing datasets in the form of avatars allows for broader access to data without going through complex and ultimately restrictive curation steps. Students can be trained on avatar datasets of real groups while preserving statistical properties.

[0142] The present invention can be used in for-profit data sharing applications, such as when providing a paid service. Pharmaceutical companies focusing on pathology can use patient avatar data to improve drug development.

[0143] For example, large-scale retail distribution can leverage checkout receipt data (including consumer habits, frequency, and timing) to build consumer pathways that can be used by suppliers.

[0144] Data sharing may occur in the context of improving corporate management and internal strategy. Companies and organizations have an obligation to protect customer privacy. Focusing on privacy is a guarantee that a company is trustworthy: it affects reputation and image, and therefore also long-term customer loyalty. In order to limit the impact of possible IT failures, companies can use avatar databases generated according to the invention in production and maintain complete security of the original sensitive data.

[0145] The present invention can be used for data sharing applications for application development. In order to develop, upgrade or maintain an application, sufficient data is required. It is also important that the test data has the same structure as the real data; for example, to allow the development of a new bank payment application on a bank website, the provider needs a data set that reflects real data. However, it is crucial that the data used for this purpose is not sensitive data, whether it is a service provider or a dedicated internal department. The avatar according to the present invention fulfills this role.

[0146] By creating avatars, the invention allows the potential information contained in sensitive data to be saved without having to delete the data (to comply with GDPR). It is in the company's interest to save the statistical information contained in the data set, which represents a strategic interest. A highway management company can keep an unlimited number of avatars of car driver data.

[0147] It is also possible to envision avatars playing a role in governance processes, where said avatars can mitigate constraints. It is possible to imagine practical governance of data use, where part of the proof of concept on avatar datasets would be an integral part of granting access to raw data and deploying algorithms.

Claims

1. A method for creating an avatar from an initial data set stored in a database of a computer system, the initial data set being an initial sensitive data set, and the initial data in the initial data set containing attributes related to a plurality of individuals, the method being used to identify the nearest neighbors of an individual among other individuals in the initial data set, characterized in that Include: a) taking a given individual as the center, for attributes related to the individual, selecting the number k of nearest neighbors to be used from all the individuals in the initial data set, b) identifying k nearest neighbors for the individual from other individuals in the data set, c) for at least one attribute associated with the individual, generating a new attribute value from quantities characterized by the attribute in the identified k nearest neighbors and weighted by a coefficient, and d) Creating avatar data including the new attribute values ​​to ensure that sensitive data associated with the individual is not identifiable.

2. A method according to claim 1, wherein the number k of nearest neighbors is selected based on a sensitivity factor of the initial data and / or a confidence factor among the intended recipients of the avatar data, the higher the sensitivity factor and / or the lower the confidence factor, the higher the number of nearest neighbors, and the lower the sensitivity factor and / or the higher the confidence factor, the lower the number of nearest neighbors.

3. A method according to claim 1 or claim 2, wherein before identifying the k nearest neighbors of the individual, a multivariate analysis is performed on the initial data. The method according to claim 3 , wherein the multivariate analysis is a principal component analysis.

5. The method according to claim 3, the attribute values ​​thus modified are then projected in the same Euclidean space.

6. A method according to claim 1, wherein the initial data contains at least one attribute with a numerical value, and the new attribute value corresponds to a random weighted centroid (G), which is calculated from the values ​​of the same attribute of the k nearest neighbors, each nearest neighbor being weighted by a randomly selected coefficient.

7. The method of claim 1, wherein a different coefficient is randomly selected for each value of the attribute for each of the k nearest neighbors.

8. A method according to claim 6 or claim 7, wherein the randomly weighted centroids (G) are calculated in a number of dimensions (N) corresponding to the number of attributes having numerical values.

9. A method according to claim 1, wherein the initial data contains at least one attribute belonging to a category representing characteristics of the individual, and the new attribute value is randomly selected based on a weighted representation of the category in the k nearest neighbors, the weighted representation is calculated based on the number of values ​​belonging to the category in the k nearest neighbors, and the value is weighted by the number of values ​​belonging to the category in the entire initial data set.

10. The method of claim 1, wherein for the same initial data set, the number k of nearest neighbors is variable, different for some individuals, or different from one individual to another.

11. The method of claim 1 , wherein at least one constraint function is applied to the avatar data so as to limit outliers or variations in relationships between attributes associated with the same individual.

12. The method of claim 1, wherein at least one constraint function is applied to the avatar data in order to constrain the distribution of numerical attributes or to comply with logical relationships between categorical attributes.

13. The method of claim 1, wherein the avatar data is recorded in a database of the same computer system and / or a remote server.

14. The method of claim 1, wherein a recipient of the avatar data is notified that the data has been made available via a hybrid authentication system, the hybrid authentication system comprising at least two steps.

15. The method of claim 14, wherein the at least two steps include generating and transmitting a unique download link via email and then communicating the limited lifetime key via text message.

16. A device for creating an avatar from an initial data set stored in a database of a computer system, the initial data set being an initial sensitive data set, and the initial data in the initial data set containing attributes related to a plurality of individuals, the device being used to identify the nearest neighbors of an individual among other individuals in the initial data set, characterized in that Include: a) a selection module, the selection module being configured to select, with a given individual as the center, a number k of nearest neighbors to be used from all the individuals in the initial data set for an attribute associated with the individual, b) an identification module configured to identify k nearest neighbors for the individual from other individuals in the data set, c) a generation module configured to generate, for at least one attribute associated with the individual, a new attribute value from only quantities characterized by the attribute in the identified k nearest neighbors and weighted by a coefficient, and d) an avatar creation module, the avatar creation module being configured to create avatar data containing the new attribute values ​​to ensure that sensitive data associated with the individual is unidentifiable.

17. The device according to claim 16, further comprising a recording module configured to record the avatar data in a database of the same computer system and / or a remote server.

18. A device according to claim 16 or claim 17, comprising a notification module configured to notify a recipient of the avatar data that the data has been made available through a hybrid authentication system, the hybrid authentication system comprising at least two steps.

19. The apparatus of claim 18, wherein the at least two steps include generating and transmitting a unique download link via email and then communicating the limited lifetime key via text message.

20. A computer program product for implementing the method for creating an avatar from an initial data set stored in a database of a computer system according to any one of claims 1 to 15, wherein the initial data set is an initial sensitive data set, and the initial data in the initial data set contains attributes related to a plurality of individuals, the computer program product comprising a support and instructions recorded on the support, wherein the instructions can be read by a processor and are used when executed to: a) taking a given individual as the center, for attributes related to the individual, selecting the number k of nearest neighbors to be used from all the individuals in the initial data set, b) identifying k nearest neighbors for the individual from the other individuals in the initial data set, c) for at least one attribute associated with the individual, generating a new attribute value from only the quantities characterized by the attribute in the identified k nearest neighbors and weighted by the coefficients, and d) Creating avatar data including the new attribute values ​​to ensure that sensitive data associated with the individual is not identifiable.

Images