Anonymity method based on sensitive graded information entropy

Abstract

The present invention relates to the technical field of data anonymity, and in particular to an anonymity method based on sensitive graded information entropy, comprising the following steps: obtaining a published data set; establishing an anonymity model based on the published data set; establishing an information loss measurement standard model based on the information entropy of the published data set; traversing the published data set based on the information loss measurement standard model to obtain a maximum tuple with a maximum privacy security index, and adding the maximum tuple to a corresponding equivalence group in the anonymity model; replacing the value of the maximum tuple with a quasi-identifying attribute center of the equivalence group to obtain an anonymous data set; and processing the published data set by introducing the information loss measurement standard model established with the information entropy and the anonymity model, thereby obtaining anonymous data with the highest information entropy, i.e., the highest data availability, thereby solving the problem of low data availability after anonymization in existing anonymity methods.

Description

Technical Field

[0001] The present invention relates to the technical field of data anonymity, and in particular to an anonymity method based on sensitivity-graded information entropy. Background Art

[0002] In the era of big data, vast amounts of personal data, such as consumption data and hospitalization records, are being collected and published. Mining and analyzing this data can advance science and business, but it also contains a significant amount of personal privacy, posing the risk of privacy leakage. Data anonymization technology can effectively reduce the risk of privacy leakage while ensuring data availability. Since shared data is often analyzed and used for decision-making, data publishers should prioritize privacy protection while also maintaining the stability of the data table structure and data authenticity to improve data availability. Therefore, data publishers require better privacy-preserving algorithms to process and publish data.

[0003] Existing anonymization methods can solve the problem of individual privacy leakage caused by the excessive presence of highly sensitive attribute values ​​and the uneven distribution of sensitive attribute values ​​in data equivalence classes, but they cannot well balance the degree of privacy and data availability after data anonymization. Summary of the Invention

[0004] The purpose of the present invention is to provide an anonymization method based on sensitive graded information entropy, aiming to solve the problem of low usability of data after anonymization in existing anonymization methods.

[0005] To achieve the above object, the present invention provides an anonymization method based on sensitivity classification information entropy, comprising the following steps:

[0006] Get the published dataset;

[0007] Building an anonymous model based on the published dataset;

[0008] Establishing an information loss measurement standard model based on the information entropy of the published data set;

[0009] Traversing the published data set based on the information loss measurement standard model to obtain a maximum tuple with the largest privacy security index, and adding the maximum tuple to the corresponding equivalence group in the anonymity model;

[0010] The value of the maximum tuple is replaced by the quasi-identifying attribute center of the equivalence group to obtain an anonymous data set.

[0011] The specific method of obtaining the published data set is:

[0012] Get the original dataset;

[0013] Classifying the original data set to obtain identification attributes, quasi-identification attributes, and sensitive attributes;

[0014] The data corresponding to the identification attribute is removed from the historical data to obtain a published data set.

[0015] The specific method of establishing the anonymous model based on the published data set is:

[0016] The number of the quasi-identification attributes, the number of tuples of the sensitive attributes, and the number of sensitivity levels of the sensitive attributes that are the same in the equivalence group of the published data set are set to obtain an anonymous model.

[0017] The specific method of establishing the information loss measurement standard model based on the information entropy of the published data set is:

[0018] Obtaining the information entropy of any tuple of the sensitivity level to obtain the tuple information entropy;

[0019] Calculating the information entropy of the equivalence class corresponding to the arbitrary tuple based on the tuple information entropy to obtain the equivalence class information entropy;

[0020] Obtaining information loss generated by the anonymous model performing data anonymization on the arbitrary tuple to obtain tuple information loss;

[0021] Calculating the information loss of the equivalence class corresponding to the arbitrary tuple based on the tuple information loss to obtain the equivalence class information loss;

[0022] A privacy security index is defined based on the equivalence class information entropy and the equivalence class information loss, and an information loss measurement standard model is obtained.

[0023] The specific method of traversing the published data set based on the information loss measurement standard model to obtain the maximum tuple with the largest privacy security index and adding the maximum tuple to the corresponding equivalence group in the anonymity model is as follows:

[0024] Traverse the published data set using a greedy method and clustering technology to obtain the largest tuple with the largest privacy security index;

[0025] The tuple is added to the corresponding equivalence group in the anonymous model, and the tuple is removed from the published data set.

[0026] The quasi-identification attribute center includes a continuous attribute center, a hierarchical attribute center, a categorical attribute center and a Boolean attribute center.

[0027] The present invention provides an anonymity method based on sensitive graded information entropy, comprising the following steps: obtaining a published data set; establishing an anonymous model based on the published data set; establishing an information loss measurement standard model based on the information entropy of the published data set; traversing the published data set based on the information loss measurement standard model to obtain a maximum tuple with a maximum privacy security index, and adding the maximum tuple to a corresponding equivalence group in the anonymous model; replacing the value of the maximum tuple with a quasi-identifying attribute center of the equivalence group to obtain an anonymous data set; and processing the published data set by introducing the information loss measurement standard model established by information entropy and the anonymous model to obtain anonymous data with the highest information entropy, i.e., the highest data availability, thereby solving the problem of low data availability after data anonymization in existing anonymity methods. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0029] Figure 1 This is a flow chart of an anonymity method based on sensitivity graded information entropy provided by the present invention.

[0030] Figure 2 This is a flowchart for obtaining the published dataset.

[0031] Figure 3 It is a flow chart of establishing an information loss measurement standard model based on the information entropy of the published data set.

[0032] Figure 4 It is a flowchart of traversing the published data set based on the information loss measurement standard model, obtaining the maximum tuple with the largest privacy security index, and adding the maximum tuple to the corresponding equivalence group in the anonymity model. DETAILED DESCRIPTION

[0033] The following describes embodiments of the present invention in detail, examples of which are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present invention, and are not to be construed as limiting the present invention.

[0034] See also Figures 1 to 4 The present invention provides an anonymity method based on sensitivity classification information entropy, comprising the following steps:

[0035] S1 obtains the published dataset;

[0036] The specific method is as follows: S11 obtains the original data set;

[0037] Specifically, for example, the original data set of a hospital's patient information record table is obtained.

[0038] S12 classifies the published data set to obtain identification attributes, quasi-identification attributes, and sensitive attributes.

[0039] Specifically, the published data set is:

[0040] ID Age ZipCode Disease <![CDATA[t1]]> 21 114235 HIV <![CDATA[t2]]> 26 114751 HIV <![CDATA[t3]]> 25 115032 Flu <![CDATA[t4]]> 48 124151 Diabetes <![CDATA[t5]]> 32 115012 Cancer <![CDATA[t6]]> 45 115451 Fever <![CDATA[t7]]> 35 115313 Hepatitis <![CDATA[t8]]> 50 113726 Flu

[0041] S13 removes the data corresponding to the identification attribute from the historical data to obtain a published data set.

[0042] Specifically, identification attributes: individuals can be directly identified through this category attribute, such as name, ID number, etc., which are removed from the table. Quasi-identification attributes: attributes of individuals can be identified by connecting this category attribute with information or background knowledge obtained from other channels, denoted as QI, QI = (QI1, QI2, ..., QI d ), such as Age and ZipCode in Table 1. Sensitive attributes: attributes that data publishers and individuals are unwilling to disclose, denoted as SA. For example, Disease in Table 1. Equivalence class E C (Equivalence-Class) is a set of several tuples in the dataset, and each tuple has the same value on the quasi-identification attribute.

[0043] S2 establishes an anonymous model based on the published dataset;

[0044] Specifically, the number of the same quasi-identification attributes, the number of tuples of the sensitive attributes, and the number of sensitivity levels of the sensitive attributes in the equivalence group of the published data set are set to obtain an anonymous model.

[0045] The anonymous model is an H-sensitive level p-sensitive k-anonymous model, namely, an (H, p, k)-anonymous model. * In the equivalence class, there are m equivalence classes, each of which has at least k tuples with indistinguishable values ​​on the quasi-identification attribute, p (p≤k) tuples with different values ​​on the sensitive attribute, and the number of tuples with different sensitivity levels in each equivalence class is not less than H. That is, D * =(EC1,EC2,...,EC m ), |EC w |≥k, There is t i [QI]=tj [QI], and |t i [SA] ≠ t j [SA]| ≥ p, |EC w [SL]| ≥ H, where i ≠ j, w ∈ [1, m], p ≤ k. Where |EC w [SL]| is the number of different sensitive levels of tuples in the equivalence class.

[0046] For example, a dataset that satisfies the (2, 2, 2)-anonymity model. Compared with the p-sensitive k-anonymity model, the (H, p, k)-anonymity model restricts the information entropy of the sensitive levels of each equivalence class to avoid the leakage of sensitive attributes caused by similarity attacks. The (2, 2, 2)-anonymity model dataset is as follows:

[0047]

[0048]

[0049] Release dataset D * After anonymization, conforming to the (H, p, k)-anonymity model can make the released dataset D * The minimum number of tuples with the same quasi-identifier attribute QI in the same equivalence class is K, so that the probability for the attacker to identify an individual is at most 1 / K, which can avoid the identification of individuals. And there are p (p < k) tuples with different values on the sensitive attribute, so that the probability for the attacker to identify the sensitive attribute of an individual is at most 1 / p, which enables the model to avoid homogeneous attacks, that is, the attacker can accurately guess the sensitive attribute of a specific individual. Since there is only one type of sensitive attribute in the equivalence class, the attacker can still know the sensitive information of the individual. And the minimum number of levels of the sensitive attribute in the same equivalence class is H, so that the probability for the attacker to guess that an individual has a high-sensitive attribute is at most 1 / H, which can avoid similarity attacks. That is, the attacker does not need to know the specific sensitive information of the individual. When all the sensitive attributes in the equivalence class are high-sensitive attributes, the attacker can still know that the individual has a sensitive attribute with a high-sensitive level.

[0050] S3 establishes an information loss measurement standard model based on the information entropy of the released dataset;

[0051] Specifically: S31 obtains the information entropy of any tuple of the sensitive level to obtain the tuple information entropy;

[0052] Specifically, the tuple information entropy H(li) is the information entropy of the sensitive level l i (any tuple) in the equivalence class EC, H(l i ) is as follows:

[0053] Among them, p li represents l iThe proportion of all tuples of the sensitivity level in the n tuples of the equivalence class.

[0054] S32 calculates the information entropy of the equivalence class corresponding to the arbitrary tuple based on the tuple information entropy to obtain the equivalence class information entropy;

[0055] Specifically, the equivalence class information entropy HEC(EC) represents the sensitivity level information entropy of the equivalence class EC. HEC(EC) is as follows:

[0056]

[0057] Among them, w i Sensitivity level l i The weight of the parameter is , and S is the sensitivity level.

[0058] S33 obtains information loss generated by the anonymous model performing data anonymization on the arbitrary tuple to obtain tuple information loss;

[0059] Specifically, the tuple information loss dt(t, C) represents the information loss caused by the anonymization of tuple data in the equivalence class EC. dt(t, C) is as follows:

[0060]

[0061] Where C is the center of the equivalence class and x is the serial number of the quasi-identifier.

[0062] S34 calculates the information loss of the equivalence class corresponding to the arbitrary tuple based on the tuple information loss to obtain the equivalence class information loss;

[0063] Specifically, the equivalence class information loss InfoLoss (EC) represents the information loss of anonymization of equivalence class EC data. InfoLoss (EC) is as follows:

[0064] InfoLoss(EC)=∑ t ∈EC d t (t,C)

[0065] Where d represents the anonymity loss caused by equivalence class anonymization.

[0066] S35 defines a privacy security index based on the equivalence class information entropy and the equivalence class information loss to obtain an information loss measurement standard model.

[0067] Specifically, define the privacy security index PSI:

[0068]

[0069] Here, w1 + w2 = 1. Different values ​​of w are used to prioritize the privacy protection or data availability of the anonymized dataset. During the clustering process, a higher privacy security index and greater information entropy at the equivalence class sensitivity level lead to higher data security and lower information loss during data anonymization.

[0070] S4 traverses the published data set based on the information loss measurement standard model to obtain a maximum tuple with the largest privacy security index, and adds the maximum tuple to the corresponding equivalence group in the anonymity model;

[0071] The specific method is as follows: S41 uses a greedy method and clustering technology to traverse the published data set to obtain the largest tuple with the largest privacy security index;

[0072] Specifically, we use greedy method and clustering technology to classify the dataset D * Traverse and find the largest tuple t` that maximizes the privacy security index. This is as follows:

[0073]

[0074] Where [SL] is the number of different sensitivity levels in the tuple. Clustering involves dividing tuples into different equivalence groups. A greedy approach is used during clustering to find the tuple that maximizes the information entropy of the equivalence group and add it to the corresponding equivalence group.

[0075] S42 adds the tuple to the corresponding equivalence group in the anonymous model, and removes the tuple from the published data set.

[0076] Specifically, find the tuples and add them to the corresponding equivalence class and remove them from the dataset. Add the remaining tuples in D to the class G with the largest privacy index after merging. i .as follows:

[0077]

[0078] S5 uses the quasi-identifying attribute center of the equivalence group to replace the value of the maximum tuple to obtain an anonymous data set.

[0079] Specifically, the quasi-identification attribute center includes a continuous attribute center, a hierarchical attribute center, a categorical attribute center, and a Boolean attribute center.

[0080] The continuous property C(EC) n The center of is calculated as follows:

[0081]

[0082] Among them, t "QI n ]i is a continuous attribute value.

[0083] The hierarchical attribute C(EC) g The center of is calculated as follows:

[0084]

[0085]

[0086]

[0087]

[0088] Among them, t[QI g ] is a tuple in the hierarchical attribute QI g where |EC| is the number of tuples in the equivalence class. is the mean value of the hierarchical attribute for the tuples in the equivalence class. Tuples in the down_count equivalence class have values ​​less than the mean, while tuples in the up_count equivalence class have values ​​greater than the mean. and Calculate the ratio of tuple values ​​in the equivalence class that are less than the mean and greater than the mean respectively.

[0089]

[0090]

[0091]

[0092] The classification attribute C(EC) C The center of is calculated as follows:

[0093]

[0094] Boolean attribute C(EC) b The center of is calculated as:

[0095]

[0096] where f((t[QI b ] i ) is a tuple t i In the Boolean attribute QI b The frequency with which the upper value appears in the equivalence class.

[0097] After the above steps, we obtain dataset D', which satisfies the H-sensitivity level, p-sensitivity, and k-anonymity model. As shown in the (2,2,2)-anonymity model dataset, the data in the table satisfies the (2,2,2) anonymity model. Within the same equivalence group in the table, the number of identical quasi-identifying attributes is at least two, ensuring that the attacker has a maximum probability of guessing the specific individual. Within the same equivalence group in the table, the number of sensitive disease attributes is at least two, ensuring that the attacker has a maximum probability of guessing the specific sensitive attribute. Within the same equivalence group in the table, the sensitive disease attribute is divided into at least two levels: high sensitivity, medium sensitivity, and low sensitivity. Within the same equivalence group in the table, there are at least two different disease levels, ensuring that the attacker cannot accurately determine that a user has a high sensitivity attribute. Furthermore, the data in the table has the highest PSI privacy protection index, meaning that the information loss of the data in the table is minimized. This ensures data availability to the greatest extent possible while protecting data privacy.

[0098] Compared with existing solutions, this solution uses the (H, p, k) anonymity model to ensure the strength of privacy protection and solve the problem of semantic loss in the anonymization process. At the same time, it uses information entropy to measure the information loss in the anonymization process. It can maximize data availability while ensuring the strength of privacy protection. This achieves a balance between the robustness of privacy protection and data availability.

[0099] The above disclosure is only a preferred embodiment of the anonymity method based on sensitive graded information entropy of the present invention. Of course, it cannot be used to limit the scope of rights of the present invention. Ordinary technicians in this field can understand that all or part of the processes of the above embodiment are implemented, and equivalent changes made in accordance with the claims of the present invention are still within the scope of the invention.

Claims

1. An anonymity method based on sensitive graded information entropy, characterized in that: The following steps are involved: Get the published dataset; Establishing an anonymous model based on the published data set, wherein the anonymous model is an H-sensitive level p-sensitive k-anonymous model; Establishing an information loss measurement standard model based on the information entropy of the published data set; Traversing the published data set based on the information loss measurement standard model to obtain a maximum tuple with the largest privacy security index, and adding the maximum tuple to the corresponding equivalence group in the anonymity model; Using the quasi-identifying attribute center of the equivalence group to replace the value of the maximum tuple to obtain an anonymous data set; The specific method of obtaining the published dataset is: Get the original dataset; Classifying the original data set to obtain identification attributes, quasi-identification attributes, and sensitive attributes; Removing the data corresponding to the identification attribute from the historical data to obtain a published data set; The specific method of establishing the anonymous model based on the published data set is: The number of the quasi-identification attributes, the number of tuples of the sensitive attributes, and the number of sensitivity levels of the sensitive attributes that are the same in the equivalence group of the published data set are set to obtain an anonymous model; The specific method of establishing the information loss measurement standard model based on the information entropy of the published data set is: Obtaining the information entropy of any tuple of the sensitivity level to obtain the tuple information entropy; Calculating the information entropy of the equivalence class corresponding to the arbitrary tuple based on the tuple information entropy to obtain the equivalence class information entropy; Obtaining information loss generated by the anonymous model performing data anonymization on the arbitrary tuple to obtain tuple information loss; Calculating the information loss of the equivalence class corresponding to the arbitrary tuple based on the tuple information loss to obtain the equivalence class information loss; A privacy security index is defined based on the equivalence class information entropy and the equivalence class information loss, and an information loss measurement standard model is obtained.

2. The anonymization method based on sensitivity graded information entropy according to claim 1, characterized in that: The specific method of traversing the published data set based on the information loss measurement standard model to obtain the maximum tuple with the largest privacy security index and adding the maximum tuple to the corresponding equivalence group in the anonymity model is: Traverse the published data set using a greedy method and clustering technology to obtain the largest tuple with the largest privacy security index; The tuple is added to the corresponding equivalence group in the anonymous model, and the tuple is removed from the published data set.

3. The anonymization method based on sensitivity classification information entropy according to claim 1, characterized in that: The quasi-identification attribute center includes a continuous attribute center, a hierarchical attribute center, a categorical attribute center and a Boolean attribute center.

Images