A local differential privacy publishing method for continuously monitoring data statistical results

Abstract

The application discloses a local differential privacy publishing method of data statistical result under continuous monitoring, and the method is used for aggregating and statistically processing the data provided by a data provider through a heuristic budget allocation method of fully utilizing user budget allocation mode, remaining budget taking half and budget absorption, so as to significantly improve the utility of the data statistical result under continuous monitoring. A two-stage heuristic algorithm provides key information of publishing strategy selection by evaluating whether the real statistical result of the current timestamp data is significantly fluctuated compared with the last timestamp, and uses the statistical variance of the agreed protocol to evaluate the real error based on the characteristics of the real data of the data provider which is invisible to the data collector, so as to reasonably estimate the error of the current aggregation statistical result in the scene where the data collector cannot access the real data, compare the error with the lazy publishing error, select the most suitable publishing strategy, significantly improve the utility of the data under the condition of ensuring the privacy protection of the data, and reduce the communication cost and overhead.

Description

Technical Field

[0001] This invention belongs to the field of data security, specifically relating to a local differential privacy publishing method for data statistical results under continuous monitoring. Background Technology

[0002] With the development of information technology and the rise of the Internet of Things (IoT), the application scenarios for continuous monitoring and data statistical release are increasing, bringing many conveniences to production and life, such as medical case data analysis, traffic flow monitoring in the IoT environment, smart infrastructure, and customer data analysis in the financial sector. Successfully implementing continuous data monitoring relies on data collectors continuously collecting and statistically analyzing real-time personal information or data transmitted in real-time by a large number of sensors uploaded by data providers. The uploaded data may contain a large amount of sensitive user information, such as illness status, real-time location, electrical appliance power consumption, and personal savings. Directly publishing the true statistical results of all data in a continuous release scenario could allow attackers with certain knowledge to infer a user's sensitive information from the continuous release results, leading to the leakage of user privacy. Furthermore, with privacy issues becoming a widespread concern in recent years and the emergence of data breaches on social networks, people's awareness of personal information security is constantly increasing, making it difficult for users to find a truly trustworthy third-party data collector. Therefore, data providers tend to protect the privacy of raw data before uploading it.

[0003] To address this issue, the concept of local differential privacy was proposed. Compared to methods like k-anonymity, l-diversity, and r-tightness, which require specific attack assumptions and background knowledge, differential privacy strictly defines the strength of privacy protection. Adding or deleting any record will not affect the final published result. In local differential privacy, the data provider first interferes with and processes the original data before uploading it to the data collector. The data collector cannot infer the original data values ​​from the collected data. This technology provides a high level of security for the statistical publication of privacy data and has been implemented in production. However, existing local differential privacy protection cannot effectively handle the publication of statistical results under continuous monitoring. Especially after allocating the privacy budget to the timestamps of continuous publication, injecting a large amount of noise or interference into the data may cause the published information to lose its original data utility. Summary of the Invention

[0004] The purpose of this invention is to address the shortcomings of existing privacy publishing methods under continuous monitoring and to provide a local differential privacy publishing method for data statistical results under continuous monitoring. This method can ensure ε-level differential user protection within the s-window of data statistical publishing under continuous monitoring, significantly improving the utility of data statistical results in scenarios of massive data aggregation and statistical monitoring, while reducing communication costs and overhead.

[0005] This invention is achieved using the following technical solution:

[0006] A method for local differential privacy publishing of data statistical results under continuous monitoring includes:

[0007] This method addresses the data statistics and publishing scenario under continuous monitoring. It uses a heuristic algorithm to adjust the data collector's publishing strategy, ensuring that within a sliding window of size s, the probability ratio of deleting or retaining a single data provider is ε, thus limiting the risk of privacy leakage during the continuous publishing of statistical results. Simultaneously, this method employs a user budget allocation approach, allocating user budgets for each timestamp based on either a halving of remaining budget allocation or a budget absorption allocation method. This improves the utility of the aggregated statistical results after data provider intervention, while reducing the communication cost of the privacy publishing process.

[0008] A further improvement of the present invention is that the method specifically includes the following steps:

[0009] Step 1: The data collector sets and manages parameters, confirming the number of participating data providers P, the sliding window size s, the privacy budget ε, and the proportion of user budget in the exploration phase μ. The total user budget in the exploration phase in window s is μ·P, and the total user budget in the decision phase is (1-μ)·P. The used table is initialized as an empty table, and the budget_record table is set to record the user budget used for each timestamp. The initial remain table contains indexes of all participating data providers. As the s window slides along the timestamps, the used and remain tables are managed.

[0010] Step 2: The data collector confirms the current timestamp ts. If ts > s, the user budget U is used based on the timestamp ts - s recorded in the budget_record table. ts-s Remove the first U from the used table ts-s The bit data provider is moved to the remain table, and the U is deleted from the used table. ts-s Bit data provider;

[0011] Step 3: Enter the release strategy exploration phase. At each timestamp, the data collector randomly selects data from the remain table. The data provider is notified, and the selected data provider index is moved from the remain table to the end of the used table;

[0012] Step 4: The selected data provider intervenes in and processes its raw data according to the agreed generalized random response protocol and other protocols with a privacy budget of ε, and sends the processed data to the data collector.

[0013] Step 5. At timestamp ts, the data collector aggregates and statistically calculates the corresponding frequency estimate or mean estimate according to the processed data of all selected data providers received, based on the agreed protocol. The data collector compares the statistical result with the release result release at the previous timestamp ts - 1 ts-1 to calculate the square of the difference diff' between the two; the data collector calculates the statistical variance sd of the corresponding protocol when the privacy budget is ε and the user budget is . The value obtained by subtracting the variance value from the square of the difference is diff = diff' - sd at this timestamp;

[0014] Step 6. Enter the release strategy decision-making stage; the data collector calculates the user budget P pre-allocated to the release strategy decision-making stage at the current timestamp ts according to the selected budget allocation method. ts The data collector calculates the statistical variance sd of frequency estimation when the user budget is P ts to approximate the error dev; compare diff with dev. If dev < diff, select the statistical release strategy. If dev ≥ diff, select the lazy strategy.

[0015] A further improvement of the present invention is that in step 5, for counting the frequency of bn discrete values, the specific calculation formula of diff' is as follows:

[0016]

[0017] A further improvement of the present invention is that in step 5, for calculating the mean of numerical data, the specific calculation formula of diff' is as follows:

[0018]

[0019] A further improvement of the present invention is that in step 6, the budget allocation method in the release strategy decision-making stage adopts the half of the remaining budget HD or the budget absorption allocation method AD.

[0020] A further improvement of the present invention is that if the half of the remaining budget allocation method HD is adopted, it is specifically carried out according to the following steps:

[0021] Step 6.1. The data collector calculates the remaining budget P in the release strategy decision-making stage for the current s window through budget_record remain and determines the current timestamp ts;

[0022] Step 6.2. The data collector takes as the pre-allocated budget for the release strategy decision-making stage at the current timestamp ts and calculates dev;

[0023] Step 6.3. If dev < diff, the timestamp needs to consume the pre-allocated user budget statistical release result; the data collector randomly selects a number of data providers from the remain table for notification, moves the indexes of the selected data providers from the remain table to the end of the used table; after the selected data providers process the original data according to the protocol agreed with the data collector, they send the processed data to the data collector; the data collector integrates all the collected data, performs aggregation statistics and then releases the statistical result; record

[0024] Step 6.4. If dev ≥ diff, the timestamp selects the lazy strategy, and the data collector does not collect data from the data providers, and uses the release result of the previous timestamp ts - 1 as the statistical release content release ts = release ts-1 , and does not consume the privacy budget in this stage, record

[0025] A further improvement of the present invention is that in step 6.1, when ts ≤ s, when ts > s,

[0026] A further improvement of the present invention is that if the budget absorption allocation method AD is adopted, it is specifically carried out according to the following steps:

[0027] Step 6 - 1. The data collector pre-allocates an initial user budget for each timestamp in the release strategy decision stage Use lts to record the previous timestamp that adopted the statistical release strategy, and the budget used in the release strategy decision stage at the timestamp lts Calculate for measuring whether the timestamp needs to passively select the lazy strategy;

[0028] Step 6 - 2. If ts - lts ≤ t θ , in order to prevent the over-expenditure of the user budget in the current s window, the data collector passively selects the lazy strategy and uses the release result of the previous timestamp ts - 1 as the statistical release content release ts = release ts-1 , record

[0029] Step 6 - 3. If ts - lts > t θ, the algorithm enters the active selection state, and the data collector calculates the maximum timestamp t of the currently absorbable budget absorb = ts - lts - t θ , pre-allocates the user budget P for the release policy decision-making phase of the current timestamp ts ts = P init ·min(t θ , s), and calculates the corresponding dev;

[0030] Step 6-4: If dev < diff, this timestamp needs to consume the pre-allocated P ts Budget statistics release result; the data collector randomly selects P ts data providers from the remain table for notification, moves the indexes of the selected data providers from the remain table to the end of the used table; after the selected data providers perform interference processing on the original data according to the agreement with the data collector, they send the processed data to the data collector; the data collector integrates all the collected data, performs aggregation statistics and then releases the statistical result; record

[0031] [[ID=२१]]Step 6-5: If dev ≥ diff, this timestamp selects the lazy strategy, the data collector does not collect data from the data provider, and sets the pre-allocated user budget to zero P ts = 0, and uses the release result of the previous timestamp ts - 1 as the content release of this time ts = release ts-1 , record

[0032] The present invention has at least the following beneficial technical effects:

[0033] A local differential privacy release method for data statistical results under continuous monitoring provided by the present invention uses a user budget allocation framework, taking half of the remaining budget, and a supervised heuristic budget allocation method of budget absorption to perform aggregation statistics on the data after interference processing by data providers, which can significantly improve the utility of data statistical results in a monitoring scenario.

[0034] Furthermore, based on a two-stage data statistical release privacy protection heuristic algorithm, in the exploration stage, it is possible to measure whether there is a large fluctuation change in the true statistical result of the data provider's data at this timestamp compared with the previous timestamp by using the aggregation statistical result of a certain budget as much as possible, providing knowledge for the selection of subsequent release strategies and improving the accuracy of data release.

[0035] Furthermore, when the data provider's real data is not transparent to the data collector, the statistical variance of the generalized random response is used to assess the real error. This allows for a reasonable estimation of the error generated by using aggregated statistical results when the data collector cannot obtain the real data. The error is compared with the lazy release error, and a more appropriate release strategy for the current timestamp is selected, while taking into account both the utility of the data statistical results and the protection of data privacy.

[0036] Furthermore, allocating user budgets at each stage of each timestamp, i.e., randomly sampling data collection from data providers that are not currently in use, can significantly reduce time costs and overhead, and decrease the time required for data statistics release. Attached Figure Description

[0037] Figure 1 This is a schematic diagram of the process of the present invention.

[0038] Figure 2 This is a schematic diagram of the logical architecture of the present invention.

[0039] Figure 3 This is a comparison chart of the average relative errors of the present invention and the comparison algorithm as the total privacy budget changes.

[0040] Figure 4 This is a comparison chart of the average communication flow size of the present invention and the comparison algorithm as the sliding window size changes. Detailed Implementation

[0041] Exemplary embodiments of the present disclosure will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the disclosure to those skilled in the art. It should be noted that, unless otherwise specified, the embodiments and features described herein can be combined with each other. The present invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0042] Reference Figure 1 The present invention provides a local differential privacy publishing method for data statistical results under continuous monitoring, which specifically includes the following steps:

[0043] Step 1: The data collector sets and manages parameters, confirming the number of participating data providers P, the sliding window size s, the privacy budget ε, and the proportion of user budget in the exploration phase μ. The total user budget in the exploration phase in window s is μ·P, and the total user budget in the decision phase is (1-μ)·P. The used table is initialized as an empty table, and the budget_record table is set to record the user budget used for each timestamp. The initial remain table contains indexes of all participating data providers. As the s window slides along the timestamps, the used and remain tables are managed.

[0044] Step 2: The data collector confirms the current timestamp ts. If ts > s, the user budget U is used based on the timestamp ts - s recorded in the budget_record table. ts-s Remove the first U from the used table ts-s The bit data provider is moved to the remain table, and the U is deleted from the used table. ts-s Bit data provider;

[0045] Step 3: Enter the release strategy exploration phase. At each timestamp, the data collector randomly selects data from the remain table. The data provider is notified, and the selected data provider index is moved from the remain table to the end of the used table;

[0046] Step 4: The selected data provider intervenes in and processes its raw data according to the agreed generalized random response protocol and other protocols with a privacy budget of ε, and sends the processed data to the data collector.

[0047] Step 5: At timestamp ts, the data collector aggregates and statistically calculates the corresponding frequency or mean estimates based on the processed data received from all selected data providers, according to the agreed-upon protocol. The data collector compared the statistical results with the release results of the previous timestamp ts-1. ts-1 The comparison is performed, and the squared difference, diff′, is calculated. The data collector calculates the user budget when the privacy budget is ε and the user budget is ε. The statistical variance sd of the corresponding protocol is used to obtain the timestamp diff = diff′ - sd by subtracting the variance value from the squared difference.

[0048] Step 6: Proceed to the release strategy decision-making stage; the data collector calculates the current timestamp ts and pre-allocates the user budget P to the release strategy decision-making stage based on the selected budget allocation method. ts Data collectors calculate that the user's budget is P tsApproximate the error dev with the statistical variance sd of the frequency estimate at that time; compare diff with dev. If dev < diff, select the statistical release strategy. If dev ≥ diff, select the lazy strategy. The budget allocation method in the release strategy decision-making stage can adopt the method of halving the remaining budget or budget absorption allocation method.

[0049] If the method of halving the remaining budget HD is adopted, it is specifically carried out according to the following steps:

[0050] Step 6.1: The data collector calculates the remaining budget P of the current s window in the release strategy decision-making stage through budget_record remain , determine the current timestamp ts. When ts ≤ s, When ts > s,

[0051] Step 6.2: The data collector takes value as the pre-allocated budget for the release strategy decision-making stage of the current timestamp ts, and calculates dev;

[0052] Step 6.3: If dev < diff, the user budget statistical release result needs to be consumed at this timestamp; the data collector randomly selects data providers from the remain table for notification, and moves the indexes of the selected data providers from the remain table to the end of the used table; after the selected data providers process the original data according to the agreement with the data collector, they send the processed data to the data collector; the data collector integrates all the collected data, performs aggregation statistics and then releases the statistical result; record

[0053] Step 6.4: If dev ≥ diff, the lazy strategy is selected at this timestamp. The data collector does not collect data from the data providers and uses the release result of the previous timestamp ts - 1 as the statistical release content release for this time ts =release ts-1 , and no privacy budget is consumed in this stage, record

[0054] If the budget absorption allocation method AD is adopted, it is specifically carried out according to the following steps:

[0055] Step 6 - 1: The data collector pre-allocates the initial user budget for each timestamp in the release strategy decision-making stage Use lts to record the previous timestamp when the statistical release strategy was adopted, and the budget used in the release strategy decision-making stage at timestamp lts Calculate​ Used to measure whether the timestamp needs to passively select the lazy strategy;

[0056] Step 6-2, if ts - lts ≤ t θ , in order to prevent the over-expenditure of the current s-window user budget, the data collector passively selects the lazy strategy and uses the release result of the previous timestamp ts-1 as the content of this statistical release Record

[0057] Step 6-3, if ts - lts > t θ , the algorithm enters the active selection state, and the data collector calculates the maximum timestamp t of the currently absorbable budget absorb = ts - lts - t θ , pre-allocates the user budget P for the release strategy decision stage of the current timestamp ts ts = P inii ·min(t θ , s), and calculates the corresponding dev;

[0058] Step 6-4, if dev < diff, this timestamp needs to consume the pre-allocated P ts Budget statistical release result; the data collector randomly selects P ts data providers in the remain table for notification, moves the indexes of the selected data providers from the remain table to the end of the used table; the selected data providers process the original data according to the agreement with the data collector and send the processed data to the data collector; the data collector integrates all the collected data, performs aggregation statistics and then releases the statistical result; Record

[0059] Step 6-5, if dev ≥ diff, this timestamp selects the lazy strategy, the data collector does not collect data from the data provider, sets the pre-allocated user budget to zero P ts = 0, and uses the release result of the previous timestamp ts-1 as the content release of this release ts = release ts-1 , Record

[0060] Embodiment

[0061] In the description of this invention, it should be understood that the term "timestamp" refers to a time point mark taken at certain time intervals in a continuously monitored time stream, used to represent and record changes that occur within a period of time after the mark; "data provider" refers to a person or organization that provides data; and "local differential privacy" refers to two datasets with only one data inconsistency obtaining probabilistically similar calculation results after performing a specified calculation.

[0062] refer to Figure 3 To test the impact of different total privacy budgets on the performance of this method, we compared it with several existing privacy-focused data publishing methods under continuous monitoring. We conducted experiments using a dataset of 200,000 data providers, 800 timestamps, and two discrete values, with a sliding window size of 20. The evaluation metric was the mean relative error. The results are as follows: Figure 3 As shown in the figure, it can be seen that as the total privacy budget increases, the average relative error of all privacy publishing methods based on data statistics under continuous monitoring decreases significantly. The average relative error of our method (HD\AD) is lower than that of other methods, demonstrating better performance.

[0063] refer to Figure 4 To test the impact of different sliding window sizes on the performance of this method, experiments were conducted with sliding window sizes of 10, 20, 30, and 40. The evaluation metric was the average communication flow size. The results are as follows: Figure 4 As shown in the figure, as the sliding window increases, the average communication flow size of all data statistics continuous monitoring privacy publishing methods decreases. The average communication flow of this method is lower than that of other methods, and it has lower communication overhead.

[0064] refer to Figure 2 This invention provides a local differential privacy publishing method for statistical results of data under continuous monitoring. The logical approach includes two phases: publishing strategy exploration and publishing strategy decision-making. To improve the rational allocation of user budgets within the S-window, two user budget allocation methods—halving the remaining budget and budget absorption allocation—are used to determine the publishing strategy at different timestamps. To improve the prediction value of statistical results for opaque data, a statistical variance approximation based on a pre-agreed protocol is used to aggregate the true error of the statistics, reducing budget expenditure during the exploration phase and improving the accuracy of the final aggregated statistical values.

[0065] Although the present invention has been described in detail above with general descriptions and specific embodiments, modifications or improvements can be made to it, which will be obvious to those skilled in the art. Therefore, all such modifications or improvements made without departing from the spirit of the present invention fall within the scope of protection claimed by the present invention.

Claims

1. A method for local differential privacy publishing of data statistical results under continuous monitoring, characterized in that, include: Step 1: The data collector sets and manages the parameters and confirms the number of participating data providers. Sliding window size Privacy Budget The proportion of user budget during the exploration phase , The total user budget for the exploration phase in the window is The total user budget during the decision-making phase was Initialize the `used` table as empty, and set the `budget_record` table to record the user budget used for each timestamp. The initial `remain` table contains indexes for all participating data providers; as... The window slides along the timestamp to manage the used and remain tables; Step 2: Data collector confirms the current timestamp. ,like According to the records in the budget_record table User budget used for timestamps , take the first from the used table The bit data provider is moved to the remain table and removed from the used table. Bit data provider; Step 3: Enter the release strategy exploration phase. At each timestamp, the data collector randomly selects data from the remain table. The data provider is notified, and the selected data provider index is moved from the remain table to the end of the used table; Step 4: The selected data provider... The privacy budget intervenes in and processes its raw data in accordance with agreed protocols such as generalized random response, and sends the processed data to the data collector; Step 5: Add timestamp At that time, the data collector aggregates and statistically calculates the corresponding frequency estimates or mean estimates based on the processed data received from all selected data providers, according to the agreed protocol. ; Data collectors compared the statistical results with the previous timestamp. Release results Compare them and calculate the square of the difference between them. Data collectors calculate when the privacy budget is User budget is Statistical variance of the corresponding protocol The timestamp is obtained by subtracting the variance from the squared difference. ; Step 6: Proceed to the release strategy decision-making stage; The data collector calculates the current timestamp based on the selected budget allocation method. User budget pre-allocated during the release strategy decision-making phase Data collectors calculate based on user budgets. Statistical variance of frequency estimation To approximate error ;Compare and ,like Select a statistics publishing strategy, if Choose a lazy strategy.

2. The method for local differential privacy publishing of data statistical results under continuous monitoring according to claim 1, characterized in that, In step 5, for statistics Frequency of discrete values The specific calculation formula is as follows:

3. The local differential privacy publishing method for data statistical results under continuous monitoring according to claim 1, characterized in that, In step 5, for the mean of statistical numerical data, The specific calculation formula is as follows:

4. The local differential privacy publishing method for data statistical results under continuous monitoring according to claim 1, characterized in that, In step 6, the budget allocation method in the release strategy decision-making stage adopts either the remaining budget halving (HD) or the budget absorption allocation method (AD).

5. The local differential privacy publishing method for data statistical results under continuous monitoring according to claim 4, characterized in that, If the remaining budget is allocated in half (HD) method, the specific steps are as follows: Step 6.1: The data collector calculates the current data using budget_record. The remaining budget during the release strategy decision-making phase Determine the current timestamp ; Step 6.2, Data collectors retrieve... The value is used as the current timestamp. The pre-allocated budget during the release strategy decision-making phase is calculated. ; Step 6.3, if This timestamp requires pre-allocated resources. User budget statistics are published; the data collector randomly selects from the remain table. The data provider is notified to move the index of the selected data provider from the remain table to the end of the used table; The selected data provider processes the raw data according to the agreement agreed upon with the data collector, and then sends the processed data to the data collector. Data collectors integrate all collected data, perform aggregated statistics, and then publish the results; records ; Step 6.4, if This timestamp uses a lazy strategy, meaning the data collector does not collect data from the data provider and uses the previous timestamp. The results of this statistical release will be included in this statistical release. During this phase, no privacy budget is consumed, and records are kept. .

6. The local differential privacy publishing method for data statistical results under continuous monitoring according to claim 5, characterized in that, In step 6.1, when hour, ,when hour, .

7. The local differential privacy publishing method for data statistical results under continuous monitoring according to claim 4, characterized in that, If the budget absorption allocation method (AD) is adopted, the specific steps are as follows: Step 6-1: The data collector pre-allocates the initial user budget to each timestamp during the release strategy decision-making phase. ;use Record the timestamp of the last time a statistical publishing strategy was used. Budget used during the strategy decision-making phase ,calculate Used to measure whether a lazy strategy should be passively selected for this timestamp; Step 6-2, if In order to prevent the current When user budgets are exceeded, data collectors are forced to adopt a lazy strategy, using the previous timestamp. The results of this statistical release will be included in this statistical release. ,Record ; Step 6-3, if The algorithm enters an active selection state, where the data collector calculates the maximum timestamp of the currently absorbable budget. , is the current timestamp Pre-allocate user budget during the release strategy decision-making phase Calculate the corresponding ; Step 6-4, if This timestamp requires pre-allocated resources. Budget statistics results are released; data collectors randomly select from the remain table. The data provider is notified to move the index of the selected data provider from the remain table to the end of the used table; The selected data provider processes the raw data according to the agreement agreed upon with the data collector, and then sends the processed data to the data collector. Data collectors integrate all collected data, perform aggregated statistics, and then publish the results; records ; Step 6-5, if This timestamp adopts a lazy strategy, whereby data collectors do not collect data from data providers and reset the pre-allocated user budget to zero. Use the previous timestamp The release results will be used as the content of this release. ,Record .

Images