A direction-aware based trajectory data collection method and system satisfying local differential privacy

Abstract

The application provides a direction perception-based trajectory data collection method and system satisfying local differential privacy, first, through an anchor-based spatial constraint method, the trajectory area of a user is adaptively limited, so that the performance is significantly improved without violating the privacy constraint; second, the adjacent direction information of each point in the trajectory is discretized for the disturbance process of the point by using a privacy budget; the information is used as a clue for connecting adjacent points, and can be used to limit the area of each point in the trajectory; finally, the final disturbed trajectory is obtained by using an exponential mechanism and an optimization process and is uploaded to a server; the application satisfies strict local differential privacy, provides provable privacy protection for mobile user trajectory data, and does not need to access additional public knowledge, and solves the privacy leakage problem in the trajectory data collection process by using the method.

Description

Technical Field

[0001] This invention belongs to the field of trajectory data acquisition and privacy protection technology in centralized networks. Specifically, it relates to a direction-aware trajectory data acquisition method and system that satisfies local differential privacy. Background Technology

[0002] Trajectory data has wide applications in data mining tasks, such as point-of-interest (POI) trajectory data analysis. However, as data privacy becomes increasingly important, directly collecting users' trajectory data may leak sensitive location information, making users reluctant to share their trajectories with third parties. Traditional trajectory data collection privacy protection techniques include k-anonymity and differential privacy (DP). These techniques assume the existence of a trusted centralized platform that holds all user data. The platform can then run algorithms that meet privacy requirements, outputting results that satisfy these requirements. However, centralized platforms are not always trustworthy and may leak sensitive user data for various reasons, such as Facebook's past data breaches. Furthermore, platforms themselves may steal sensitive user data. Therefore, users need a decentralized trajectory data collection privacy protection technology.

[0003] Local differential privacy (LDP) is a commonly used privacy protection technique for safeguarding sensitive user information in decentralized environments. LDP assumes that third-party platforms are untrusted, so users need to perturb their own data to meet LDP requirements before sending the perturbed data to the third-party platform. Because the third-party platform receives perturbed data instead of the actual data, sensitive user information cannot be directly accessed, thus protecting user privacy. Previous work on privacy protection in decentralized trajectory data collection mostly satisfied variations of LDP, such as personalized LDP, which relaxed the level of privacy protection. The only work that conforms to LDP focuses on spatiotemporal trajectory data. It assumes that location categories and operating hours are public knowledge, discretizes the location on the trajectory to create an n-gram, and then uses an exponential mechanism and optimization process to obtain the final trajectory.

[0004] Summarizing existing methods reveals that current methods for collecting privacy-preserving trajectory data in decentralized scenarios either have a relatively relaxed level of privacy protection or require publicly available external knowledge. However, external knowledge is difficult to obtain and cannot be updated in a timely manner. Therefore, there is a lack of trajectory data collection methods that can meet strict LDP requirements and do not require external knowledge. Summary of the Invention

[0005] To address the privacy protection issue in trajectory data acquisition in decentralized scenarios and overcome the shortcomings of existing technologies, this invention proposes a direction-aware trajectory data acquisition method and system that satisfies local differential privacy by employing local differential privacy technology, random response mechanism, exponential mechanism, spatial constraint technology, and directional constraint technology.

[0006] This invention is achieved through the following technical solution:

[0007] A direction-aware trajectory data acquisition method that satisfies local differential privacy:

[0008] The method specifically includes the following steps:

[0009] Step 1: Users set a privacy budget, copy their own trajectory into two copies, calculate and perturb the trajectory center of each, and fine-tune the distance from the trajectory center to the farthest point on the trajectory as the trajectory radius, thereby using spatial constraints to obtain the trajectory area of ​​each.

[0010] Step 2: Selecting the user interval; Select the points on the two replicated trajectories from Step 1 that require independent perturbation, and apply independent perturbation to these points.

[0011] Step 3: The user calculates the directions of the undisturbed points and the adjacent independently perturbed points on the two trajectories in Step 2, and discretizes and perturbs the directions by setting different privacy budget granularities.

[0012] Step 4: The user uses the direction after perturbation in Step 3 and the independently perturbed point as the origin, and perturbs the unperturbed points through directional constraints.

[0013] Step 5: The user uses the two perturbated trajectories from Step 4 to obtain the final trajectory through an optimization process and uploads it to the data collector, thus completing the collection of trajectory data.

[0014] Further, in step 1,

[0015] Step 1.1: Users set a privacy budget to track their own movements. Copy and The center of the disturbance trajectory and the distance from that center to the farthest point on the trajectory;

[0016] In step 1.1, the user will record their own trajectory. Copy and And calculate the average position of the points on the two trajectories as the center of their respective trajectories. Mapped to the nearest candidate location point And by using an exponential mechanism to perturb, we obtain The calculation formula is as follows:

[0017]

[0018] in , For Haversine distance, For a finite range of candidate locations, , A privacy budget is allocated to the center of the disturbance trajectory;

[0019] The user calculates the distance between the center of the disturbed trajectory and the farthest point on each trajectory for the two trajectories. and By using the SW mechanism and Because the input range of the SW mechanism is Therefore, it is necessary to process the input. After scaling, the perturbation is performed, where The specific formula for the perturbation is as follows:

[0020]

[0021] in , For the privacy budget used for the perturbation radius; since the output range of the SW mechanism is Therefore, the output needs to be processed. Retract to the actual size;

[0022] Step 1.2: The user fine-tunes the distance after perturbation obtained in Step 1.1 as the trajectory radius, and uses spatial constraints to obtain the trajectory region;

[0023] In step 1.2, the user fine-tunes the trajectory radius obtained using the SW mechanism;

[0024] Users first need to set the test value set. ,make and Then we have:

[0025]

[0026] ,

[0027]

[0028] The user calculates the possible range of the true value of the perturbated radius obtained from the test value set, then filters out candidate points with a higher probability by the distance from the trajectory center to other points, and subsequently calculates and fine-tunes the center. When a time period is given greater weight, the calculation formula is as follows:

[0029]

[0030] After obtaining the fine-tuning center, the user fine-tunes the radii of the two trajectories using the following formula:

[0031]

[0032]

[0033]

[0034] After obtaining the radii of the two finely adjusted perturbation trajectories, the user uses the center of each perturbation trajectory as the center and selects candidate position points within the perturbation radius from that center as the candidate position point domain for each trajectory. The calculation formula is as follows:

[0035]

[0036] Furthermore, in step 2,

[0037] Step 2.1: The user classifies the points on each of the two trajectories, which are separated by a certain distance, into points that need to be disturbed independently and points that need to be constrained by direction.

[0038] Trajectory in step 2.1 and The points on the map are divided into two categories: the points that will be disturbed independently and other points that will be disturbed using directional information;

[0039] The location point to be independently disturbed will be at and The upper interval is selected and independently perturbed to serve as the pivot point;

[0040] The other points that will be disturbed using directional information, namely... and Other position points that were not selected as pivot points then use the directional information between themselves and their neighboring pivot points to limit their own candidate position point range, thereby obtaining a smaller candidate position point perturbation domain.

[0041] That is, for Add the j-th position point to the set of points that need independent perturbation. ,and These are then classified as other points that will be perturbed using directional information; for Then let and ;

[0042] Step 2.2: The user perturbs the points that need to be perturbed independently;

[0043] In step 2.2, the trajectory and The point on the surface that will be independently disturbed, i.e. and The points in the diagram are independently perturbed to serve as pivot points, and the perturbation formula is as follows:

[0044]

[0045] in (or ), , , Represents the Haversine distance, with sensitivity as:

[0046]

[0047] trajectory and The perturbed pivot point is denoted as and .

[0048] Furthermore, in step 3,

[0049] Step 3.1: The user calculates the direction between the perturbed point and the undisturbed point, and discretizes it according to the privacy budget used for the direction perturbation;

[0050] In step 3.1, a neighboring pivot point of the target location is taken as the origin, and the direction between the target point and the origin is taken as the center of the original discrete direction, i.e., 0 degrees. This yields the discrete direction represented by numbers. , where integer The range of directions represented is ,in Represents a discrete set of directions that depends on the granularity;

[0051] In addition, smaller This is beneficial for improving the accuracy of the k-RR mechanism; and When the value is large, it makes it difficult for the k-RR mechanism to select the accurate direction; at the same time, when As the orientation becomes larger, choosing a finer directional granularity will cause the k-RR mechanism to answer with a direction that is close to the original orientation.

[0052] Choose in different Compare the average success probability of maintaining the original orientation for different granularities within different directional ranges under various value ranges; select the directional granularity using the following calculation formula. :

[0053]

[0054] in This represents a set that maintains the query range in different directions. Represents the original direction, i.e., 0 degrees. Representative using privacy budget Used to perturb granularity Discrete direction of time The k-RR mechanism, This function represents the conversion of discrete directions into continuous angles and the calculation of the absolute value of the offset angle between the actual direction and the perturbation direction; the distribution of points within the discrete direction is simply treated as a uniform distribution, and then the corresponding probabilities are calculated; each candidate granularity will be tested, and the granularity that achieves the best average success probability will be selected;

[0055] Step 3.2: The user perturbs the discretized direction;

[0056] In step 3.2, the discrete directions are perturbed using k-RR, and the formula is as follows:

[0057]

[0058] use express The direction in which the disturbance occurs.

[0059] Furthermore, in step 4 specifically...

[0060] Users use the perturbed points and directions to perform orientation-constrained perturbations on the undisturbed points.

[0061] Based on these perturbed discrete directions and the perturbed pivot points, The perturbation domain for the candidate locations of the remaining undisturbed points is determined by running the following algorithm:

[0062] The input to the algorithm is the target location point finite set of location points Input trajectory Pivot point set after independent perturbation and trajectory perturbation of the direction set composition;

[0063] For the i-th position point on the input trajectory , obtain Origin Points in the direction and with Origin The intersection of points in the direction, and the positions of the points in the intersection and It is added to the perturbation domain of the candidate location points that the algorithm will return. middle;

[0064] If the intersection is empty, return the set of all points. As For the first and last position points in the trajectory that have only one neighbor, obtain the... ( (with the origin) ( Points in the direction of ) and these points and ( Add to the perturbation domain to be returned. ( )middle;

[0065] along with As the range increases, these smaller perturbation domains will become increasingly accurate, thus facilitating the selection of better perturbation points; then, for The remaining location points are perturbed using the EM and the perturbation domain corresponding to each point; that is, for each The exponential mechanism formula Replace with Perturb it to obtain ;

[0066] Another copy track It is handled in a similar way; exchange and That is, for ,set up and Based on the directions after these perturbations, other trajectories... Unperturbed points can also be perturbed using EM and by appropriately replacing the candidate location point domain to obtain... .

[0067] Furthermore, in step 5 specifically,

[0068] Users use the two perturbed trajectories to obtain the final trajectory through an optimization process and then upload it to the data collector.

[0069] By respectively in and Apply independent perturbations and pivot perturbations to the above. For each location point, there are two perturbed points; one point is obtained by perturbing only the distance factor of the original location point, and the other point is obtained by perturbing based on the direction information of the neighboring location points. Therefore, the optimal perturbed trajectory can be obtained by the following formula:

[0070]

[0071] in It is a trajectory The i-th position point in the array, , , This represents the Haversine distance; thus, the final perturbation trajectory benefiting from bidirectional directional information is obtained.

[0072] A direction-aware trajectory data acquisition system that satisfies local differential privacy:

[0073] The acquisition system includes a trajectory replication module, an independent perturbation module, a discretization perturbation module, a direction constraint module, and a trajectory upload module;

[0074] The trajectory copying module allows users to set a privacy budget, copy their own trajectory into two copies, calculate and perturb the trajectory center of each copy, and fine-tune the distance from the trajectory center to the farthest point on the trajectory as the trajectory radius, thereby using spatial constraints to obtain the trajectory regions of each copy.

[0075] The independent perturbation module selects points on the two copied trajectories of the user-interval selection trajectory copying module that require independent perturbation, and performs independent perturbation on these points.

[0076] The discretization perturbation module allows the user to calculate the directions of unperturbed points and adjacent perturbed points on the two trajectories of the independent perturbation module, and to discretize and perturb the directions by setting different privacy budget granularities.

[0077] The direction constraint module allows the user to use the direction after perturbation by the discretization perturbation module and the independently perturbed point as the origin, and then perturb the unperturbed points through direction constraints.

[0078] The trajectory upload module allows users to obtain the final trajectory through an optimization process using two perturbed trajectories from the direction constraint module, and then upload it to the data collector to complete the collection of trajectory data.

[0079] An electronic device includes a memory and a processor, the memory storing a computer program, the processor executing the computer program to implement the steps of the above method.

[0080] A computer-readable storage medium for storing computer instructions that, when executed by a processor, implement the steps of the above-described method.

[0081] Beneficial effects of the invention

[0082] This invention protects users' sensitive trajectory location information through local differential privacy technology, satisfies strict local differential privacy, provides provable privacy protection for mobile user trajectory data, and does not require access to additional public knowledge; existing methods either cannot provide strict LDP privacy guarantees or require publicly available external knowledge.

[0083] Compared to existing privacy protection methods for decentralized trajectory data acquisition, this invention employs spatial and directional constraint techniques to reduce the problem of poor utility caused by an excessively large candidate location point domain required to satisfy LDP. Furthermore, it achieves an adaptive algorithm through trajectory radius fine-tuning and directional granularity selection based on privacy budget. In the trajectory acquisition process in decentralized scenarios, it achieves privacy protection that satisfies local differential privacy, while also achieving good performance under the condition of protecting privacy. Attached Figure Description

[0084] Figure 1 This is a flowchart of the method of the present invention;

[0085] Figure 2 This is an example diagram of a direction-aware trajectory data acquisition method;

[0086] Figure 3 This is an example diagram of the trajectory space constraint method;

[0087] Figure 4 Algorithm diagram of a direction-aware trajectory data acquisition method to satisfy local differential privacy. Detailed Implementation

[0088] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0089] Combination Figures 1 to 4 .

[0090] A direction-aware trajectory data acquisition method that satisfies local differential privacy includes the following steps:

[0091] Step 1: Users set a privacy budget, copy their own trajectory into two copies, calculate and perturb the trajectory center of each copy, and fine-tune the distance from the trajectory center to the farthest point on the trajectory as the trajectory radius, thereby using spatial constraints to obtain their respective trajectory regions.

[0092] This step involves perturbing the trajectory data and calculating the trajectory region based on certain trade-offs to protect the privacy of the trajectory data. Specifically, users can set a privacy budget and create a trajectory region by following these steps:

[0093] Make two copies of the original trajectory: To protect privacy, users need to make two copies of the original trajectory. One copy is used to create a privacy-preserving region, and the other is used to calculate and estimate the results of relevant queries. Because this process involves perturbation operations, using multiple copies of the data can reduce the impact of image distortion and other issues.

[0094] Perturbation Trajectory Center: To protect personal privacy, perturbation of the trajectory data is necessary to ensure the data cannot be reverse engineered. This can be achieved by adding Gaussian noise, Laplace noise, or similar methods. To ensure that noise does not adversely affect data analysis, appropriate random perturbation parameters, such as noise intensity, need to be set.

[0095] Trajectory region determination based on perturbation: For each point in the trajectory, the distance between each point and its corresponding trajectory center is calculated, and the desired trajectory region is determined using the center of the perturbation and a certain constant value as the radius. This step restricts the trajectory data to the trajectory region, thereby better protecting the privacy of the trajectory data.

[0096] This step, also known as differentiable privacy, requires several trade-offs to enhance privacy and maintain the usability of data analysis. For example, when setting perturbation parameters and calculating the trajectory region, a trade-off must be struck between privacy protection and the accuracy of data analysis. Therefore, in-depth data analysis and mathematical modeling are necessary to ensure a balance between privacy protection and data analysis.

[0097] Step 1 specifically includes the following steps:

[0098] Step 1.1: Users set a privacy budget to track their own movements. Copy and The center of the disturbance trajectory and the distance from that center to the farthest point on the trajectory;

[0099] In step 1.1, the user will record their own trajectory. Copy and And calculate the average position of the points on the two trajectories as the center of their respective trajectories. Mapped to the nearest candidate location point And by using an exponential mechanism to perturb, we obtain The calculation formula is as follows:

[0100]

[0101] in , For Haversine distance, For a finite range of candidate locations, , A privacy budget is allocated to the center of the disturbance trajectory.

[0102] The user calculates the distance between the center of the disturbed trajectory and the farthest point on each trajectory for the two trajectories. and By using the SW mechanism and Because the input range of the SW mechanism is Therefore, it is necessary to process the input. After scaling, the perturbation is performed, where The specific formula for the perturbation is as follows:

[0103]

[0104] in , A privacy budget is allocated for the perturbation radius. Since the output range of the SW mechanism is... Therefore, the output needs to be processed. Shrink back to the actual range.

[0105] Step 1.2: The user fine-tunes the distance after perturbation obtained in the previous step as the trajectory radius, and uses spatial constraints to obtain the trajectory region.

[0106] In step 1.2, the user fine-tunes the trajectory radius obtained using the SW mechanism. Due to the characteristics of the SW mechanism, when the privacy budget used for the perturbation radius is relatively small, it is easy to obtain unstable output values, resulting in low utility. Therefore, fine-tuning is used to make this value relatively stable. To avoid violating privacy constraints, the user first needs to set a test value set. ,make and Then we have:

[0107]

[0108] ,

[0109]

[0110] The user calculates the possible range of the true value of the perturbated radius obtained from the test value set, then filters out candidate points with a higher probability by the distance from the trajectory center to other points, and subsequently calculates and fine-tunes the center. When a time period is given greater weight, the calculation formula is as follows:

[0111]

[0112] After obtaining the fine-tuning center, the user fine-tunes the radii of the two trajectories using the following formula:

[0113]

[0114]

[0115]

[0116] After obtaining the radii of the two finely adjusted perturbation trajectories, the user uses the center of each perturbation trajectory as the center and selects candidate position points within the perturbation radius from that center as the candidate position point domain for each trajectory. The calculation formula is as follows:

[0117]

[0118] Step 2: The user selects the points on the two replicated trajectories that need to be disturbed independently at intervals, and then disturbs them.

[0119] Specifically, perturbation here refers to applying perturbation algorithms to trajectory data, thereby making small, random changes to the original data. These small changes can fundamentally alter the trajectory data, making it impossible for attackers to determine a specific time and location. Common perturbation algorithms include adding Gaussian noise and Laplace noise, which can protect the privacy of trajectory data to some extent.

[0120] When users select trajectory points to be disturbed, they can make choices based on various factors. For example, they can select points to be disturbed independently based on the sensitivity of the trajectory data or specific privacy protection needs. At the same time, when randomly selecting point locations, users need to ensure the quality of the trajectory data to maintain the accuracy and reliability of data analysis while protecting privacy.

[0121] Additionally, it's important to note that the selected perturbation points should be at a certain distance from each other. Applying excessive noise between adjacent points can lead to skewness or increased entropy in the dataset, thus affecting the data analysis results. Therefore, when applying differentiable privacy technology, this invention needs to comprehensively consider the perturbation intensity, perturbation point location, randomization algorithm, and data analysis requirements, and optimize the trajectory data protection scheme to achieve the best privacy protection effect.

[0122] Step 2 specifically includes the following steps:

[0123] Step 2.1: The user classifies the points on each of the two trajectories at intervals into points that need to be disturbed independently and points that need to be constrained by direction.

[0124] Trajectory in step 2.1 and The points on the map are divided into two categories: points that will be independently disturbed and other points that will be disturbed using directional information. The former will be... and The upper interval is selected and independently perturbed to serve as the pivot point. The latter (i.e., in...) and Other position points (not selected as pivot points) can limit their candidate position range by utilizing the directional information between themselves and their neighboring pivot points, thereby obtaining a smaller candidate position perturbation domain. For If the j-th position on the graph has an index number j%2 equal to 1, then add it to the set of points that need to be independently disturbed. ,and These are then classified as other points that will be perturbed using directional information. For Then let and .

[0125] Step 2.2: The user perturbs the points that need to be perturbed independently.

[0126] In step 2.2, the trajectory and The point on the surface that will be independently disturbed, i.e. and The points in the diagram are independently perturbed to serve as pivot points, and the perturbation formula is as follows:

[0127]

[0128] in (or ), , , Represents the Haversine distance, with sensitivity as:

[0129]

[0130] trajectory and The perturbed pivot point is denoted as and .

[0131] Step 3: The user calculates the direction of the undisturbed point and the direction of the adjacent independently perturbed point on the two trajectories. The direction is discretized and perturbed by setting different privacy budget granularities.

[0132] Step 3 describes a part of differentiable privacy technology, in which the user needs to calculate the direction between undisturbed and independently perturbed points in the trajectory, discretize the direction, and protect it using a perturbation algorithm to protect the privacy of the data.

[0133] Calculate the direction between each pair of adjacent trajectory points: For a typical trajectory, the internal points can be abstracted as a function of the distance between a pair of adjacent trajectory points. Therefore, the direction information of the trajectory points can be determined by calculating the direction between adjacent trajectory points. This requires calculating the directions corresponding to undisturbed and independently disturbed adjacent trajectory points.

[0134] Discretization of direction: Directional information is discretized at a certain granularity, making it easier to perturb and protect it using differentiable privacy techniques. In this process, the granularity of the direction can be adjusted to balance privacy protection and the practicality of data analysis. Generally, the smaller the privacy budget, the higher the granularity of the direction, thus increasing the strength of privacy protection, but also impacting the usability of the data.

[0135] Perturbation algorithms are applied: Gaussian noise, Laplace noise, and other perturbation algorithms are used to add noise to the discretized direction information. This adds noise to the trajectory data, thereby increasing privacy, but it also has a certain impact on the accuracy of data analysis.

[0136] Furthermore, for discretized directional information, the perturbation algorithm must have limitations; that is, all perturbation directions must be restricted to be near the discretized direction. This is to ensure that the perturbed trajectory point data remains accurate and to improve the robustness of the algorithm. Therefore, many factors need to be considered in practical applications, such as privacy protection budget, directional granularity, and the sensitivity of the perturbation algorithm.

[0137] Step 3 includes the following steps:

[0138] Step 3.1: The user calculates the direction between the perturbed point and the undisturbed point and discretizes it according to the privacy budget used for the direction perturbation.

[0139] In step 3.1, taking a neighboring pivot point of the target location point (the point to be perturbed using direction constraints) as the origin, and taking the direction between the target point and the origin as the center of the original discrete direction (i.e., 0 degrees, the center of the original direction angle range represented by the number 0), the discrete direction represented by numbers can be obtained. , where integer The range of directions represented is ,in This represents a discrete set of directions that depends on the granularity. For example, using... Representative trajectory If all discrete directions that need to be disturbed are then in Figure 2 In this invention, the perturbation Each point in the trajectory The direction between neighboring points in the data, i.e. ,in This represents the discrete direction between the j-th position point in the trajectory and the origin (i.e., the i-th position point after perturbation).

[0140] Considering the impact of different granularities on the effectiveness of the proposed mechanism, coarse-grained directions will cover more location points, resulting in a higher recall rate for the selected candidate points.

[0141] In addition, smaller It is conducive to improving - The accuracy of the RR mechanism. Unfortunately, covering more location points also means that a lot of noisy location points are introduced, resulting in a relatively large perturbation domain for candidate location points that is constrained by orientation information when perturbing other points using EM.

[0142] On the other hand, fine-grained orientations do not produce such large perturbation domains, but because The large initial direction makes it difficult for the k-RR mechanism to select the accurate direction. However, even if the most accurate initial direction cannot be obtained, when... As the orientation becomes larger, choosing a finer directional granularity will cause the k-RR mechanism to respond with directions that are increasingly closer to the original orientation.

[0143] In short, correctly choosing the orientation granularity is a trade-off between the degree of orientation preservation and the size of the perturbation domain for candidate locations in the EM. The impact of the size of the perturbation domain depends not only on the chosen orientation granularity but also on the distribution of locations on the map. Since the distribution of locations varies across different regions, it is difficult for this invention to analyze the preservation probability of the target points to be perturbed. Therefore, this invention chooses to design a general strategy to guide the selection of orientation granularity, without relying on a specific dataset (distribution).

[0144] The objective of this invention is to find a directional granularity that optimally preserves the directional information of the target location point overall. Because The -RR mechanism always returns the original discrete direction with the highest probability. Querying only the probability of maintaining the original direction after perturbation within a constant directional range is not the fairest method, because the granularity with the highest probability is always closest to the granularity of the queried constant range. Therefore, this invention selects different... The average success probability of maintaining the original direction is compared for different granularities in different directional ranges under the given values.

[0145] Therefore, the present invention selects the directional granularity using the following calculation formula. :

[0146]

[0147] in This represents a set that maintains the query range in different directions. Represents the original direction (i.e., 0 degrees). This represents my use of privacy budget Used to perturb granularity Discrete direction of time The k-RR mechanism, This represents a function that converts discrete directions into continuous angles and calculates the absolute value of the offset angle between the actual direction and the perturbed direction. The distribution of points within the discrete direction is simply considered as a uniform distribution, and then the corresponding probabilities are calculated. The directional granularity recommended by this invention should be between 2 and 12; otherwise, the region constrained by the perturbed direction may be too small to cover the original location points. Each candidate granularity will be tested, and the granularity that achieves the best average success probability will be selected.

[0148] Step 3.2: The user perturbs the direction after discretization.

[0149] In step 3.2, the discrete directions are perturbed using k-RR, and the formula is as follows:

[0150]

[0151] use express The direction in which the disturbance occurs.

[0152] Step 4: The user uses the perturbed direction and the independently perturbed point as the origin to perturb the undisturbed points through directional constraints in order to protect the privacy of the trajectory data.

[0153] First, define the origin: using the perturbation direction and the independently perturbed point from step 3 as the origin of the trajectory, establish a small circular range around this origin.

[0154] Next, determine the disturbance point: select a point on the trajectory that has not been independently disturbed, and calculate the direction formed by the line connecting the point and the origin of the trajectory.

[0155] Finally, directional constraints are applied: the perturbation is restricted to a circular range in the direction of the selected trajectory points, and differentiable privacy techniques are used to perturb it, such as adding Gaussian noise or Laplace noise.

[0156] Furthermore, the direction of the trajectory data has been discretized through the perturbation in step 3. Therefore, in this step, coarse perturbation can be performed within the perturbation constraints to improve data privacy rather than data accuracy. In practical applications, it is necessary to carefully select the perturbation direction and ensure that the perturbation direction does not affect the distribution of data points in the feature space.

[0157] Step 4 specifically involves the user perturbing the unperturbed points based on directional constraints using the perturbed points and directions.

[0158] Based on these perturbed discrete directions and the perturbed pivot points, The perturbation domain for the remaining undisturbed candidate locations can be determined by running the following algorithm: the input of the algorithm consists of the target location points. finite set of location points Input trajectory Pivot point set after independent perturbation and trajectory perturbation of the direction set Composition. For the i-th position point on the input trajectory. The present invention can obtain Origin Points in the direction and with Origin The intersection of points in the direction, and the positions of the points in the intersection and It is added to the perturbation domain of the candidate location points that the algorithm will return. If the intersection is empty, then return the set of all points. As For the first (and last) position point in the trajectory that has only one neighbor, this invention obtains... ( (with the origin) ( Points in the direction of ) and these points and ( Add to the perturbation domain to be returned. ( In, for example, the present invention considers and the direction after the disturbance By applying this algorithm, we can obtain... , and Candidate perturbation domain , and .along with As the range increases, these smaller perturbation domains will become increasingly accurate, thus facilitating the selection of better perturbation points. Then, it is possible to... The remaining location points are perturbed using the EM and the perturbation domain corresponding to each point. That is, for each... The exponential mechanism formula Replace with Perturb it to obtain .

[0159] Another copy track It is processed in a similar way. Like Figure 2 As shown, this process can run in parallel with the previous process. This invention swaps... and That is, for The present invention sets and .

[0160] For example, in Figure 2 In the settings To obtain the perturbation through the exponential mechanism ,set up And perturbation obtained Based on these perturbations and their resulting directions, other aspects of the trajectory... Unperturbed points can also be perturbed using EM and by appropriately replacing the candidate location point domain to obtain... .

[0161] Step 5: The user uses the two perturbed trajectories to obtain the final trajectory through an optimization process and uploads it to the data collector.

[0162] In this step, the present invention uses the perturbed trajectory from step 4 to generate the final anonymous trajectory data, which involves an optimization process. The purpose is to ensure that the final anonymous trajectory data does not deviate too much from the original trajectory data, while maximizing the effect of privacy protection.

[0163] Step 5 requires using the two perturbed trajectories generated in Step 4 to minimize the distance between the original trajectory data and the perturbed trajectory data through certain mathematical optimization methods, while maximizing the privacy of the trajectory, in order to obtain a final anonymous trajectory data.

[0164] During the optimization process, this invention needs to consider the characteristics of the trajectory data, such as the relative distance between trajectory points. Furthermore, the average distance between two trajectories is easier to calculate and optimize than that between a single trajectory; therefore, this invention uses two perturbed trajectories in this process.

[0165] Ultimately, through this optimization process, the present invention will obtain a final anonymous trajectory data, which will be uploaded to the data collector, completing the trajectory data collection process. The uploaded anonymous trajectory data will not expose the original user's real location, thus protecting the user's privacy.

[0166] Step 5 specifically involves the user using the two perturbed trajectories to obtain the final trajectory through an optimization process and then uploading it to the data collector.

[0167] By respectively in and Apply independent perturbations and pivot perturbations to the above. For each location point, there are two perturbed points. One point is obtained by perturbing only the distance factor of the original location point, and the other point is obtained by perturbing based on the direction information of the neighboring location points. Therefore, the optimal perturbed trajectory can be obtained by the following formula:

[0168]

[0169] in It is a trajectory The i-th position point in the array, , , This represents the Haversine distance. Thus, the present invention obtains the final perturbation trajectory benefiting from bidirectional directional information.

[0170] A direction-aware trajectory data acquisition system that satisfies local differential privacy:

[0171] The acquisition system includes a trajectory replication module, an independent perturbation module, a discretization perturbation module, a direction constraint module, and a trajectory upload module;

[0172] The trajectory copying module allows users to set a privacy budget, copy their own trajectory into two copies, calculate and perturb the trajectory center of each copy, and fine-tune the distance from the trajectory center to the farthest point on the trajectory as the trajectory radius, thereby using spatial constraints to obtain the trajectory regions of each copy.

[0173] The independent perturbation module selects points on the two copied trajectories of the user-interval selection trajectory copying module that require independent perturbation, and performs independent perturbation on these points.

[0174] The discretization perturbation module allows the user to calculate the directions of unperturbed points and adjacent perturbed points on the two trajectories of the independent perturbation module, and to discretize and perturb the directions by setting different privacy budget granularities.

[0175] The direction constraint module allows the user to use the direction after perturbation by the discretization perturbation module and the independently perturbed point as the origin, and then perturb the unperturbed points through direction constraints.

[0176] The trajectory upload module allows users to obtain the final trajectory through an optimization process using two perturbed trajectories from the direction constraint module, and then upload it to the data collector to complete the collection of trajectory data.

[0177] An electronic device includes a memory and a processor, the memory storing a computer program, the processor executing the computer program to implement the steps of the above method.

[0178] A computer-readable storage medium for storing computer instructions that, when executed by a processor, implement the steps of the above-described method.

[0179] The memory in the embodiments of this application can be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory. Non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. Volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate synchronous DRAM (DDR SDRAM), enhanced synchronous DRAM (ESDRAM), synchronous linked DRAM (SLDRAM), and direct rambus RAM (DR RAM). It should be noted that the memory of the methods described in this invention is intended to include, but is not limited to, these and any other suitable types of memory.

[0180] In the above embodiments, implementation can be achieved entirely or partially through software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented entirely or partially in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired means such as coaxial cable, optical fiber, digital subscriber line, DSL, or wireless means such as infrared, wireless, microwave, etc. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium such as a floppy disk, hard disk, magnetic tape; an optical medium such as a high-density digital video disc, DVD; or a semiconductor medium such as a solid-state disk, SSD, etc.

[0181] In implementation, each step of the above method can be completed by integrated logic circuits in the processor's hardware or by instructions in software. The steps of the method disclosed in the embodiments of this application can be directly implemented by a hardware processor, or by a combination of hardware and software modules in the processor. The software modules can reside in random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. This storage medium is located in memory, and the processor reads information from the memory and, in conjunction with its hardware, completes the steps of the above method. To avoid repetition, detailed descriptions are omitted here.

[0182] It should be noted that the processor in the embodiments of this application can be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above method embodiments can be completed by the integrated logic circuits in the processor's hardware or by instructions in software form. The processor can be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this application can be directly embodied as execution by a hardware decoding processor, or as execution by a combination of hardware and software modules in the decoding processor. The software modules can be located in random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. This storage medium is located in memory; the processor reads information from the memory and, in conjunction with its hardware, completes the steps of the above methods.

[0183] The foregoing has provided a detailed description of the trajectory data acquisition method and system based on direction awareness that satisfies local differential privacy, and has elucidated the principles and implementation methods of the present invention. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of the present invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of the present invention. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. A direction-aware trajectory data acquisition method that satisfies local differential privacy, characterized in that: The method specifically includes the following steps: Step 1: Users set a privacy budget, copy their own trajectory into two copies, calculate and perturb the trajectory center of each, and fine-tune the distance from the trajectory center to the farthest point on the trajectory as the trajectory radius, thereby using spatial constraints to obtain the trajectory area of ​​each. Step 2: Selecting the user interval; Select the points on the two replicated trajectories from Step 1 that require independent perturbation, and perturb these points independently. Step 3: The user calculates the directions of the undisturbed points and the adjacent independently perturbed points on the two trajectories in Step 2, and discretizes and perturbs the directions by setting different privacy budget granularities. Step 4: The user uses the direction after perturbation in Step 3 and the independently perturbed point as the origin, and perturbs the unperturbed points through directional constraints; Step 5: The user uses the two perturbated trajectories from Step 4 to obtain the final trajectory through an optimization process and uploads it to the data collector, thus completing the collection of trajectory data.

2. The method according to claim 1, characterized in that: In step 1, Step 1.1: Users set a privacy budget to track their own movements. Copy and The center of the disturbance trajectory and the distance from that center to the farthest point on the trajectory; In step 1.1, the user will record their own trajectory. Copy and And calculate the average position of the points on the two trajectories as the center of their respective trajectories. Mapped to the nearest candidate location point And by using an exponential mechanism to perturb, we obtain The calculation formula is as follows: in , For Haversine distance, For a finite range of candidate locations, , A privacy budget is allocated to the center of the disturbance trajectory; The user calculates the distance between the center of the two trajectories after the disturbance and the farthest point on each trajectory. and By using the SW mechanism and Because the input range of the SW mechanism is Therefore, it is necessary to process the input. After scaling, the perturbation is performed, where The specific formula for the perturbation is as follows: in , For the privacy budget used for the perturbation radius; since the output range of the SW mechanism is Therefore, the output needs to be processed. Retract to the actual size; Step 1.2: The user fine-tunes the distance after perturbation obtained in Step 1.1 as the trajectory radius, and uses spatial constraints to obtain the trajectory region; In step 1.2, the user fine-tunes the trajectory radius obtained using the SW mechanism; Users first need to set the test value set. ,make and Then we have: ， The user calculates the possible range of the true value of the perturbated radius obtained from the test value set, then filters out candidate points with a higher probability by the distance from the trajectory center to other points, and subsequently calculates and fine-tunes the center. When a time period is given greater weight, the calculation formula is as follows: After obtaining the fine-tuning center, the user fine-tunes the radii of the two trajectories using the following formula: After obtaining the radii of the two finely adjusted perturbation trajectories, the user uses the center of each perturbation trajectory as the center and selects candidate position points within the perturbation radius from that center as the candidate position point domain for each trajectory. The calculation formula is as follows: 。 3. The method according to claim 2, characterized in that: In step 2, Step 2.1: The user classifies the points on each of the two trajectories, which are separated by a certain distance, into points that need to be disturbed independently and points that need to be constrained by direction. Trajectory in step 2.1 and The points on the map are divided into two categories: the points that will be disturbed independently and other points that will be disturbed using directional information; The location point to be independently disturbed will be at and The upper interval is selected and independently perturbed to serve as the pivot point; The other points that will be disturbed using directional information, namely... and Other position points that were not selected as pivot points then use the directional information between themselves and their neighboring pivot points to limit their own candidate position point range, thereby obtaining a smaller candidate position point perturbation domain. That is, for Add the j-th position point to the set of points that need independent perturbation. ,and These are then classified as other points that will be perturbed using directional information; for Then let and ; Step 2.2: The user perturbs the points that need to be perturbed independently; In step 2.2, the trajectory and The point on the surface that will be independently disturbed, i.e. and The points in the diagram are independently perturbed to serve as pivot points, and the perturbation formula is as follows: in or , , , Represents the Haversine distance, with sensitivity as: trajectory and The perturbed pivot point is denoted as and .

4. The method according to claim 3, characterized in that: In step 3, Step 3.1: The user calculates the direction between the perturbed point and the undisturbed point, and discretizes it according to the privacy budget used for the direction perturbation; In step 3.1, a neighboring pivot point of the target location is taken as the origin, and the direction between the target point and the origin is taken as the center of the original discrete direction, i.e., 0 degrees. This yields the discrete direction represented by numbers. , where integer The range of directions represented is ,in This represents a discrete set of directions that depends on the granularity. In addition, smaller This is beneficial for improving the accuracy of the k-RR mechanism; and When the value is large, it makes it difficult for the k-RR mechanism to select the accurate direction; at the same time, as the privacy budget becomes larger and larger, the fine granularity of the direction selection will cause the k-RR mechanism to select a direction that is close to the original direction. We selected different granularities to compare the average success probability of maintaining the original direction in different directional ranges under different privacy budget values; Select directional granularity using the following calculation formula. : in This represents a set that maintains the query range in different directions. The representative used a privacy budget to perturb the granularity. Discrete direction of time The k-RR mechanism, This function represents the conversion of discrete directions into continuous angles and the calculation of the absolute value of the offset angle between the actual direction and the perturbation direction. The distribution of points in the discrete directions is simply treated as a uniform distribution, and then the corresponding probabilities are calculated; each candidate granularity will be tested, and the granularity that achieves the best average success probability will be selected. Step 3.2: The user perturbs the discretized direction; In step 3.2, the discrete directions are perturbed using k-RR, and the formula is as follows: use express The direction in which the disturbance occurs.

5. The method according to claim 4, characterized in that: Specifically in step 4: Users use the perturbed points and directions to perform orientation-constrained perturbations on the undisturbed points; Based on these perturbed discrete directions and the perturbed pivot points, The perturbation domain for the candidate locations of the remaining undisturbed points is determined by running the following algorithm: The input to the algorithm is the target location point finite set of location points Input trajectory Pivot point set after independent perturbation and trajectory perturbation of the direction set composition; For the i-th position point on the input trajectory , obtain Origin Points in the direction and with Origin The intersection of points in the direction, and the positions of the points in the intersection and It is added to the perturbation domain of the candidate location points that the algorithm will return. middle; If the intersection is empty, return the set of all points. As For the first location point in the trajectory with only one neighbor, obtain the... Origin Points in the direction, and these points and Add to the perturbation domain to be returned middle; For the last location point in the trajectory that has only one neighbor, obtain the... Origin Points in the direction, and these points and Add to the perturbation domain to be returned middle; As privacy budgets increase, these smaller perturbation domains will become increasingly accurate, thus facilitating the selection of better perturbation points; then, for The remaining location points are perturbed using the EM and the perturbation domain corresponding to each point; that is, for each The exponential mechanism formula Replace with Perturb it to obtain ; Another copy track It is handled in a similar way; exchange and That is, for ,set up and ; Based on these perturbations and their resulting directions, other aspects in the trajectory... Unperturbed points can also be perturbed using EM and by appropriately replacing the candidate location point domain to obtain... .

6. The method according to claim 5, characterized in that: Specifically, in step 5, Users use the two perturbed trajectories to obtain the final trajectory through an optimization process and then upload it to the data collector. By respectively in and Apply independent perturbations and pivot perturbations to the above. For each location point, there are two perturbed points; one point is obtained by perturbing only the distance factor of the original location point, and the other point is obtained by perturbing based on the direction information of the neighboring location points. Therefore, the optimal perturbed trajectory can be obtained by the following formula: in It is a trajectory The i-th position point in the array, , , This represents the Haversine distance; thus, the final perturbation trajectory benefiting from bidirectional directional information is obtained.

7. A trajectory data acquisition system based on direction awareness that satisfies local differential privacy, characterized in that: The acquisition system includes a trajectory replication module, an independent perturbation module, a discretization perturbation module, a direction constraint module, and a trajectory upload module; The trajectory copying module allows users to set a privacy budget, copy their own trajectory into two copies, calculate and perturb the trajectory center of each copy, and fine-tune the distance from the trajectory center to the farthest point on the trajectory as the trajectory radius, thereby using spatial constraints to obtain the trajectory regions of each copy. The independent perturbation module selects points on the two copied trajectories of the user-interval selection trajectory copying module that require independent perturbation, and performs independent perturbation on these points. The discretization perturbation module allows the user to calculate the directions of unperturbed points and adjacent perturbed points on the two trajectories of the independent perturbation module, and to discretize and perturb the directions by setting different privacy budget granularities. The direction constraint module allows the user to use the direction after perturbation by the discretization perturbation module and the independently perturbed point as the origin, and then perturb the unperturbed points through direction constraints. The trajectory upload module allows users to obtain the final trajectory through an optimization process using two perturbed trajectories from the direction constraint module, and then upload it to the data collector to complete the collection of trajectory data.

8. An electronic device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 6.

9. A computer-readable storage medium for storing computer instructions, characterized in that, When the computer instructions are executed by the processor, they implement the steps of the method according to any one of claims 1 to 6.

Images