Trajectory publishing method satisfying differential privacy

Abstract

The application provides a trajectory publishing method meeting differential privacy, which represents original trajectory as anchor point trajectory of adjacent grids, constructs a model for the anchor point trajectory by using a prefix tree and a Markov process, adds Laplace noise in a transition matrix of the prefix tree and the Markov process to meet differential privacy, and generates trajectory data to be published from the model containing noise. In one aspect, the application models the anchor point trajectory by using the prefix tree and the Markov process, can keep more original data features, and obtains higher data availability. In another aspect, the application designs a method for adding Laplace noise in the transition matrix of the prefix tree and the Markov process, meets differential privacy, can protect the privacy of trajectory data, and is a practical algorithm for guaranteeing safe and reliable publishing and application of trajectory data.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of privacy protection and information security, in particular to a trajectory publishing method meeting differential privacy. BACKGROUND

[0002] The rise of mobile computing and positioning technology enables the generation of massive trajectory data. Collecting, publishing, mining and analyzing these rich trajectory data can help to better understand the activities of individuals and groups, and further bring many benefits to urban development and people's daily life. However, the trajectory data usually contains a large amount of personal privacy information, such as hobbies, religious beliefs, physical conditions, etc. Unrestricted publishing of trajectory data may lead to the leakage of personal privacy, and even pose a serious threat to the safety of individuals' person and property. How to protect privacy and at the same time ensure the high availability of trajectory data is a problem to be solved in trajectory publishing.

[0003] The method meeting differential privacy is a method that is mathematically proven to protect the privacy of each participant in the data set. The main idea is to add random noise to the original query result, so that the addition or deletion of a piece of data in the data set has little effect on the query result, so that it is difficult for attackers to infer the real data in the data set through multiple query results. This method can resist attacks of any attack model and has good application prospects.

[0004] Currently, people have made some achievements in the research of trajectory publishing meeting differential privacy. Chen et al. proposed a trajectory publishing method based on prefix tree for frequent access pattern query. Since the count value of the leaf node is relatively sparse, adding noise has a greater impact on the availability of trajectory data. In order to obtain high data availability, Chen et al. proposed to replace the prefix tree with an exploration tree, so that each node is associated with a location sequence length variable n-gram, to enhance the anti-noise ability of trajectory data. Mir et al. generated several distributions describing human movement characteristics from the original location trajectory, and added noise to the generated distribution to synthesize the publishable trajectory. In addition, Hua et al. proposed a trajectory publishing method based on clustering. Although the above methods can protect privacy, they can only have high data availability in data sets with less access locations or shorter trajectory length, and have insufficient scalability.

[0005] In terms of GPS trajectory publishing methods, Gursoy et al. proposed a method of synthesizing publishable trajectories by adding noise to the trajectory features of original trajectories. He et al. synthesized publishable GPS trajectories by constructing a forest consisting of prefix trees. Deldar and Abadi stored the most probable segments for different trajectory lengths of each starting point using a new tree structure to obtain high data availability. However, the three algorithms cannot maintain more individual movement details and the data availability is still not high enough.

[0006] In summary, although there have been many achievements in trajectory publishing methods that protect privacy, a better balance between privacy protection and data availability has not yet been achieved.

[0007] In addition, patent application number CN201910976396.6, entitled "A clustering-based differential privacy trajectory data protection method"; patent application number CN201910018634.2, entitled "A new trajectory data publishing method based on differential privacy"; and patent application number CN201810916399.6, entitled "A trajectory privacy protection method and system for mobile users based on differential privacy" of China patent documents also involve trajectory data publishing problems, but the methods used are different from those of the present patent application.

[0008] "Lightweight Privacy Protection Protocol, Methods, and Systems for RFID and Sensor Based Logistics Track and Trace Data Sharing over Business Subcontracting Relationships" in the US patent library is different from the present patent application in terms of content and specific methods. SUMMARY

[0009] A trajectory publishing method that satisfies differential privacy is proposed. The method represents the original trajectory as an anchor point trajectory of adjacent grids, uses a prefix tree and a Markov process to construct a model, adds Laplace noise to the transition matrix of the prefix tree and the Markov process to satisfy differential privacy, and then generates the trajectory data to be published from the model containing noise. On the one hand, the present invention uses a prefix tree and a Markov process to model the anchor point trajectory, which can maintain more original data features and obtain higher data availability. On the other hand, the present invention designs a method to add Laplace noise to the transition matrix of the prefix tree and the Markov process, which satisfies differential privacy and can protect the privacy of trajectory data. It is a practical algorithm that ensures the safe and reliable publication and application of trajectory data.

[0010] Trajectory data can be represented as a sequence of ordered sample point positions of moving objects by time. Trajectory publishing method satisfying differential privacy is an important means to protect the privacy of trajectory. The current trajectory publishing method satisfying differential privacy can protect the privacy of data, but there are still deficiencies in ensuring the high availability of trajectory data. In view of the above problems, the present application provides a trajectory publishing method satisfying differential privacy, comprising the following steps:

[0011] (1) generating anchor point trajectory;

[0012] In this step, the space range of the trajectory data set is divided into several grids, the center point of each grid is called an anchor point, the trajectory data is mapped to the anchor point sequence of the adjacent grid, and the anchor point trajectory is generated.

[0013] Suppose that the trajectory data set D = {Tr i | i = 0, 1,..., |D|-1} is composed of |D| trajectories, |D| represents the number of trajectories of the trajectory data set D, is the i-th trajectory of the trajectory data set D, which contains t sample points, is the j-th sample point of Tr i , and are the longitude and latitude of the sample point respectively.

[0014] The sample points of each trajectory of the trajectory data set D are mapped to anchor points. The anchor point trajectory data set is denoted as is the anchor point trajectory corresponding to the trajectory Tr i , |D c | is the number of trajectories of the anchor point trajectory data set D c . If the adjacent anchor points in the trajectory are located in non-adjacent grids, then the adjacent anchor points in the anchor point trajectory are made adjacent by interpolation. A trajectory end mark is added to the end of the trajectory ; the anchor point trajectory is denoted as is the j-th element of , which is an anchor point or a trajectory end mark, is the number of elements in the trajectory ;

[0015] (2) constructing a prefix tree and adding noise;

[0016] In this step, the anchor point trajectory data set D cThe trajectories are grouped according to the same prefix, a prefix tree PT is constructed, and Laplace noise is added to the prefix tree PT to meet differential privacy.

[0017] (3) Constructing a Markov process transition matrix and adding noise;

[0018] In this step, according to the anchor point trajectory data set D c , a Markov process transition matrix Q is constructed to meet differential privacy.

[0019] (4) Generating trajectory data to be published;

[0020] In this step, the prefix tree PT constructed in step (2) and the Markov process transition matrix Q constructed in step (3) are used to generate trajectory data to be published.

[0021] A trajectory publishing method meeting differential privacy is proposed. The original trajectory is represented as an anchor point trajectory of adjacent grids, a prefix tree and a Markov process are used to construct a model for the anchor point trajectory, Laplace noise is added to the prefix tree and the transition matrix of the Markov process to meet differential privacy, and then trajectory data to be published is generated from the model containing noise. This scheme not only protects the privacy of trajectory data, but also guarantees the high availability of trajectory data, ensuring the safe and reliable publication and application of trajectory data. Compared with other trajectory publishing methods meeting differential privacy, the present application has the following advantages:

[0022] 1. The present application represents the original trajectory data as an anchor point trajectory of adjacent grids, and uses a prefix tree and a Markov process to model the anchor point trajectory, which can maintain more original data features and obtain higher data availability;

[0023] 2. The present application designs a method for adding Laplace noise to the transition matrix of the prefix tree and the Markov process, which meets differential privacy and protects the privacy information of trajectory data. BRIEF DESCRIPTION OF DRAWINGS

[0024] Figure 1 Flow chart of the trajectory publishing method meeting differential privacy. DETAILED DESCRIPTION

[0025] The technical scheme of the present application will be further described below in combination with the drawings and examples:

[0026] As shown in the flow chart of the trajectory publishing method meeting differential privacy, the method steps are as follows: Figure 1

[0027] (1) Generating anchor point trajectories;

[0028] ​The space range where the trajectory dataset is located is divided into several grids, and the center point of each grid is called an anchor point. The trajectory data is mapped to the anchor point sequence of adjacent grids to generate anchor point trajectories.

[0029] Suppose the trajectory dataset D = {Tr i |i = 0, 1, …, |D| - 1} consists of |D| trajectories, |D| represents the number of trajectories of the trajectory dataset D, is the i-th trajectory of the trajectory dataset D, which contains t sampling points, is the j-th sampling point of Tr i , and are the longitude and latitude of the sampling point , respectively.

[0030] The sampling points of each trajectory of the trajectory dataset D are mapped to anchor points, and the specific steps are as follows:

[0031] S1: The space range where the trajectory dataset D is located is recorded as a rectangle R, and the coordinates of the left lower corner and the right upper corner of the rectangle R are recorded as (left, bottom) and (right, bottom) respectively. The rectangle R is divided into u h ×u w grids, u h is the number of rows of the grid, and u w is the number of columns of the grid. The grid set is recorded as Cell = {cell i,j |i = 0, 1, …, u h -1, j = 0, 1, …, u w -1}, cell i,j is the grid in the i-th row and the j-th column. The anchor point of the grid cell i,j is recorded as c i,j , and the anchor point set is recorded as AP = {c i,i |i = 0, 1, …, u h -1, j = 0, 1, …, u w -1}.

[0032] S2: Suppose the trajectory sampling point is located in the grid cell row,col ,row = 0, 1, …, u h -1, col = 0, 1, …, u w -1, then the calculation method of row and col is as follows:

[0033]

[0034] The anchor point c row,col is the anchor point mapped by the trajectory sampling point .

[0035] Let the anchor point trajectory dataset be denoted as For trajectory Tr i The corresponding anchor point trajectory, |D c |For the anchor point trajectory dataset D c The number of trajectories. If the trajectory If adjacent anchor points are located in non-adjacent grids, then interpolation is used to make the anchor point trajectories... In the trajectory, adjacent anchor points are all anchor points of adjacent grids. Add an end marker to the track. This will change the anchor point track. Recorded as for The j-th element is an anchor point or a trajectory end marker. For trajectory The number of elements in the text.

[0036] (2) Construct a prefix tree and add noise;

[0037] The anchor point trajectory dataset D from step (1) c The trajectories are grouped according to the same prefix, a prefix tree PT is constructed, and Laplace noise is added to it to satisfy differential privacy.

[0038] Definition of a prefix: Assume S = p0p1…p |S|-1 For a sequence containing |S| anchor points, p i (i = 1, 2, ..., |S| - 1) is the i-th anchor point of S, and S′ = p0′p1′...p |s′|-1 Let ' be a sequence containing |S'| anchor points if and only if |S'| ≤ |S| and p′ i =p i When S′ is a prefix of S, S′ is a prefix of S.

[0039] Definition of a prefix tree: The prefix tree to be generated is denoted as PT = (V, E, Root), where V is the set of nodes in the prefix tree PT, each node is associated with a prefix and stores the count of that prefix; E is the set of edges in the prefix tree PT, representing the connections between nodes; and Root is the virtual root node of the prefix tree PT. Assuming node v is a node in the prefix tree PT, its associated prefix is ​​denoted as prefix(v, PT). Each node v ∈ V stores a tuple (tr(v), c(v)), where tr(v) represents the anchor point trajectory dataset D. cThe trajectory set with prefix prefix(v, PT), the number of which is |tr(v)|; c(v) represents |tr(v)| after adding noise. The height of PT is denoted as h, and the virtual root node Root is located at the 0th layer of PT, and the highest layer is the (h-1) th layer.

[0040] An anchor trajectory dataset D c The trajectories are grouped according to the same prefix, a prefix tree PT is constructed, and Laplace noise is added to the prefix tree PT, and the specific steps are as follows:

[0041] S1: Construct an empty prefix tree PT.

[0042] S2: In the 1st layer of the prefix tree PT, generate a node for each anchor point in the anchor point set AP.

[0043] S3: Calculate c(v) of each node v in the i (i=1, 2, …, h-1) layer according to the following formula,

[0044] c(v) = |tr(v)| + Lap(1 / ε p,i )

[0045] Wherein, a is an integer with a value of 1, 2, …, h-1, δ is an adjustable parameter, ε p (0<ε p <1) is the privacy budget allocated to the prefix tree PT construction process, and ε p,i is the privacy budget allocated to the i layer node of the prefix tree PT, and Lap(1 / ε p,i ) is a random number subject to a Laplace distribution, and the density function of the Laplace distribution is

[0046] μ = 1 / ε p,i .

[0047] Wherein, z is a random variable. If c(v) > 1, no child node is generated for the node v; otherwise, according to the adjacent grid anchor points and the end of the trajectory of the anchor point at the end of the associated prefix prefix(v, PT), the child node of the node v is generated.

[0048] S4: Repeat step S3 until the prefix tree PT reaches the maximum height h.

[0049] S5: Set c(Root) as |D|, and update c(v) of each node v in the i (i=1, 2, …, h-1) layer of the prefix tree PT according to the following formula in the order from top to bottom,

[0050]

[0051] where par(v) is the parent node of node v, and children(par(v)) is the child node set of par(v).

[0052] (3) constructing a Markov process transition matrix and adding noise;

[0053] According to the anchor point trajectory data set D c in step (1), a Markov process transition matrix Q is constructed to meet differential privacy.

[0054] An anchor point sequence with a length of m is referred to as an m-gram. The anchor point trajectory data set D c Each m-gram is composed of anchor points of adjacent grids. The anchor point trajectory data set D c The number of different m-grams is denoted as F r .

[0055] According to the anchor point trajectory data set D c , a Markov process transition matrix Q is constructed, and the specific steps are as follows:

[0056] S1: Initialize matrices FM and FM={FM k,j =0|k=0,1,…,F r -1,j=0,1,…,u h ×u w}, where FM k,j is the element of the kth row and the jth column of the matrix FM; and FM is the element of the kth row and the jth column of the matrix . Each row of the matrix FM corresponds to an m-gram, and each column corresponds to an anchor point or a trajectory end flag. It is assumed that r k is the m-gram corresponding to the kth row of the matrix FM, n j is the anchor point or the trajectory end flag corresponding to the jth column of the matrix FM, r k n j is an (m+1)-gram obtained by connecting r k and n j , and FM k,j is used to store the frequency of r k n j in the anchor point trajectory data set D c . If n j is not the anchor point of the adjacent grid at the end of r k , in the present application, the values of FM k,j and are always 0, that is,

[0057] S2: Scan the anchor trajectory dataset D c , the frequency of each (m+1)-gram occurrence is calculated as follows,

[0058]

[0059] where, is the r k n j number of times the anchor trajectory appears.

[0060] S3: Add Laplace noise to the matrix FM to obtain the matrix The method is as follows:

[0061]

[0062] where, ε m (0<ε m <1) is the privacy budget allocated to the transition matrix Q construction process.

[0063] S4: Initialize the transition matrix Q={Q k,j =0|k=0,1,…,F r -1,j=0,1,…,u h ×u w}, and calculate the value of each element of the transition matrix Q according to the matrix The method is as follows:

[0064]

[0065] (4) Generate the trajectory data to be published;

[0066] Using the prefix tree PT constructed in step (2) and the Markov process transition matrix Q constructed in step (3), generate the trajectory data to be published, the specific steps are as follows:

[0067] S1: Divide the nodes of the prefix tree PT into two categories: non-expanding nodes and expanding nodes. Non-expanding nodes are nodes whose last element of the prefix associated with the node is the end-of-trail marker, and expanding nodes are nodes whose last element of the prefix associated with the node is not the end-of-trail marker.

[0068] S2: If the node v a of the prefix tree PT is a non-expanding node, generate c(v a ) anchor sequences of the trajectory prefix(v a , PT).

[0069] S3: If the node v b of the prefix tree PT is an expanding node at the (h-1)th layer, first generate c(vb ) anchor sequences as prefix(v b , PT) of trajectory T b . Then, for each trajectory T b , the last m anchors are considered as an m-gram, and if this m-gram is r k , then n j (n j is the anchor or the end-of-trajectory symbol corresponding to the j-th column of the matrix FM) is added to the end of T k,j with a probability of Q b . The process of adding anchors to the end of trajectory T b is repeated until the end-of-trajectory symbol is added or the maximum trajectory length is reached.

Claims

1. A trajectory publishing method that satisfies differential privacy, characterized in that: (1) Generate anchor point trajectory; The spatial range of the trajectory dataset is divided into several grids, and the center point of each grid is called an anchor point. The trajectory data is mapped to the sequence of anchor points of adjacent grids to generate anchor point trajectories. Assume trajectory dataset D = {Tr i The dataset |i = 0, 1, ..., |D|-1} consists of |D| trajectories, where |D| represents the number of trajectories in the dataset D. Let be the i-th trajectory in the trajectory dataset D, which contains t sampling points. For Tr i The j-th sampling point, and Sampling points Longitude and latitude; Map each sampling point of the trajectory dataset D to an anchor point; denote the anchor point trajectory dataset as... For trajectory Tr i The corresponding anchor point trajectory, |D c |For the anchor point trajectory dataset D c The number of trajectories; if the trajectory If adjacent anchor points are located in non-adjacent grids, then interpolation is used to make the anchor point trajectories... In the trajectory, adjacent anchor points are all anchor points of adjacent grids; Add an end marker to the track; add anchor point track Recorded as for The j-th element is an anchor point or a trajectory end marker. For trajectory The number of elements in the middle; (2) Construct a prefix tree and add noise; The anchor point trajectory dataset D from step (1) c The trajectories are grouped according to the same prefix, a prefix tree PT is constructed, and Laplace noise is added to it to satisfy differential privacy; (3) Construct the Markov process transition matrix and add noise; Based on the anchor point trajectory dataset D in step (1) c Construct the Markov process transition matrix Q to satisfy differential privacy; based on the anchor point trajectory dataset D... c The specific steps for constructing the Markov process transition matrix Q are as follows: (3.1) Initialize matrix FM and FM = {FM k,j =0|k=0,1,…,F r -1,j=0,1,…,u h ×u w }, Among them, FM k,j Let be the element in the k-th row and j-th column of matrix FM; For matrix The element in the k-th row and j-th column; each row of matrix FM corresponds to an m-gram, and each column corresponds to an anchor point or trajectory end marker; assuming r k Let n be the m-gram corresponding to the k-th row of matrix FM. j Let r be the anchor point or trajectory end marker corresponding to the j-th column of matrix FM. k n j For connecting r k and n j The resulting (m+1)-gram has elements FM. k,j Used to store r k n j In the anchor point trajectory dataset D c Frequency in; if n j Not r k The anchor points of the adjacent grids of the last anchor point, in this invention, FM k,j and The value is always 0, that is (3.2) Scanning anchor point trajectory dataset D c Calculate the frequency of each (m+1)-gram using the following formula. in, For r k n j In anchor point trajectory The number of times it appears in; (3.3) Add Laplace noise to matrix FM to obtain matrix The method is as follows: Where, ε m (0<ε m <1) is the privacy budget allocated to the construction process of the transition matrix Q; (3.4) Initialize the transition matrix Q = {Q k,j =0|k=0,1,…,F r -1,j=0,1,…,u h ×u w }, based on the matrix The method for calculating each element of the transition matrix Q is as follows: (4) Generate trajectory data to be published; Using the prefix tree PT constructed in step (2) and the Markov process transition matrix Q constructed in step (3), the trajectory data to be published is generated.

2. The trajectory publishing method satisfying differential privacy according to claim 1, characterized in that: The sampling points of each trajectory in the trajectory dataset D are mapped to anchor points. The specific steps are as follows: (1.1) Let the spatial range of the trajectory dataset D be a rectangle R, and let the coordinates of the lower left and upper right vertices of the rectangle R be (left, bottom) and (right, bottom) respectively; divide the rectangle R into u h ×u w One grid, u h u is the number of rows in the grid. w Let {cell} be the number of columns in the grid; denote the grid set as Cell = {cell}. i,j |i=0,1,…,u h -1,j=0,1,…,u w -1},cell i,j For the grid in row i and column j; divide the grid cell i,j Let the anchor point be denoted as c. i,j The set of anchor points is denoted as AP = {c i,j |i=0,1,…,u h -1,j=0,1,…,u w -1}; (1.2) Assuming trajectory sampling points Located in the grid cell row,col row = 0, 1, ..., u h -1,col=0,1,…,u w If -1, then row and col are calculated as follows: Anchor point c row,col For trajectory sampling points The anchor point of the mapping.

3. The trajectory publishing method satisfying differential privacy according to claim 1, characterized in that: Define the prefix as follows: Assume S = p0p1…p |s|-1 For a sequence containing |S| anchor points, p i (i = 1, 2, ..., |S| - 1) is the i-th anchor point of S, and S′ = p0′p1′...p |S′|-1 Let ' be a sequence containing |S'| anchor points if and only if |S'| ≤ |S| and p′ i =p i When S′ is a prefix of S, S′ is a prefix of S.

4. The trajectory publishing method satisfying differential privacy according to claim 1, characterized in that: Define a prefix tree as follows: The prefix tree to be generated is denoted as PT = (V, E, Root), where V is the set of nodes in the prefix tree PT, each node is associated with a prefix and stores the count of that prefix; E is the set of edges in the prefix tree PT, representing the connection relationships between nodes; and Root is the virtual root node of the prefix tree PT. Assume node v is a node in the prefix tree PT, and denote its associated prefix as prefix(v, PT). Each node v ∈ V stores a tuple (tr(v), c(v)), where tr(v) represents the anchor point trajectory dataset D. c The set of trajectories prefixed with prefix(v,PT) has a number of |tr(v)|; c(v) represents |tr(v)| after adding noise; the height of PT is denoted as h, the virtual root node Root is located at the 0th level of PT, and the highest level is the h-1th level.

5. The trajectory publishing method satisfying differential privacy according to claim 1, characterized in that: The anchor point trajectory dataset D c The trajectories are grouped according to the same prefix, a prefix tree PT is constructed, and Laplace noise is added to it. The specific steps are as follows: (2.1) Construct the empty prefix tree PT; (2.2) In the first level of the prefix tree PT, generate a node for each anchor point in the anchor point set AP; (2.3) Calculate c(v) for each node v∈V in the i-th (i=1,2,…,h-1) layer according to the following formula. c(v)=|tr(v)|+Lap(1 / ε p,i ), in, δ is an adjustable parameter, ε p (0<ε p <1) ε is the privacy budget allocated to the prefix tree PT construction process. p,i To allocate the privacy budget to the i-th level node of the prefix tree PT, Lap(1 / ε) p,i Let be a random number following a Laplace distribution, whose density function is: If c(v)>1, then no child node is generated for node v; otherwise, a child node is generated for node v based on the anchor point of the adjacent grid of the anchor point at the end of its associated prefix (v,PT) and the trajectory end marker. (2.4) Repeat step (2.3) until the prefix tree PT reaches its maximum height h; (2.5) Set c(Root) to |D|, and update c(v) for each node v∈V at the i-th (i=1,2,…,h-1) level of the prefix tree PT using the following formula, in order from top to bottom. Where par(v) is the parent node of node v, and children(par(v)) is the set of child nodes of par(v).

6. The trajectory publishing method satisfying differential privacy according to claim 1, characterized in that: An anchor point sequence of length m is called an m-gram; the anchor point trajectory dataset D c Each m-gram consists of anchor points from adjacent grids; the anchor point trajectory dataset D c The number of distinct m-grams is denoted as F. r .

7. The trajectory publishing method satisfying differential privacy according to claim 1, characterized in that: Using the prefix tree PT constructed in step (2) and the Markov process transition matrix Q constructed in step (3), the trajectory data to be published is generated. The specific steps are as follows: (4.1) Divide the nodes of the prefix tree PT into two categories: non-expanded nodes and expanded nodes. Non-expanded nodes are nodes whose prefix end element is the end marker of the trajectory, and expanded nodes are nodes whose prefix end element is not the end marker of the trajectory. (4.2) If the node v of the prefix tree PT a If it is a non-expandable node, then generate c(v) a The sequence of anchor points is prefix(v) a The trajectory of PT); (4.3) If the node v of the prefix tree PT b For an extended node at level (h-1), c(v) is generated first. b The sequence of anchor points is prefix(v) b The trajectory T of PT) b Then, for each trajectory T b Consider the last m anchor points as an m-gram, assuming this m-gram is r. k Then n j (n j (The anchor point or trajectory end marker corresponding to the j-th column of matrix FM) is Q k,j The probability of adding to T b At the end; repeatedly moving towards trajectory T b The process of adding anchor points at the end continues until a trajectory end marker is added or the set maximum trajectory length is reached.

Images