Real-time trajectory data publishing method based on geographical indistinguishability

Abstract

The invention discloses a real-time trajectory data publishing method based on geographical indistinguishability, which comprises the following steps: a user selects a protection level according to own privacy preference, sets a corresponding privacy budget value, and performs grid division of corresponding granularity on a geographical area; the prediction mechanism predicts the cell where the user is located at the current moment according to the position index published at the last moment and the collected driving direction and speed; the detection mechanism monitors the position information at the current moment and judges whether to publish the predicted position by calculating the distance between the real position and the predicted position: when the distance between the predicted position and the real position is greater than a set threshold value, the disturbance mechanism is started, plane Laplacian noise disturbance is added to the real position, and disturbance position information is published; otherwise, the predicted position information is directly published. According to the method, the consumption of privacy budget is effectively reduced, and the availability of the published data is increased on the premise of ensuring that the privacy intensity is not changed.

Description

Technical Field

[0001] The present invention relates to the technical field of geographic data calculation and privacy protection, and in particular to a real-time trajectory data publishing method based on geographic indistinguishability. Background Art

[0002] Publishing real-time trajectories is of great significance in many application fields such as disease emergency control and road condition updates. However, users' concerns about privacy leakage limit their willingness to share and publish location data. If users are allowed to disturb the data on the client before publishing it, their concerns about the server being unreliable can be alleviated.

[0003] Geographic indistinguishability is an extension of standard differential privacy. It converts the difficulty for attackers to distinguish whether a specific tuple is in the data set in standard differential privacy into the difficulty for attackers to infer the real location based on the published location within a certain area. By adding planar Laplace noise to the real location on the client side, the real location is geographically indistinguishable from other locations within a circle with a radius of r and the real location as the center. However, this model is only applicable to single-point location data, and the correlation between trajectory locations and continuous queries will reduce the privacy protection strength of this model.

[0004] In addition, most of the existing real-time trajectory publishing methods improve data availability at a single privacy level, ignoring the differences in users' demands for service quality and privacy protection. The present invention proposes a real-time trajectory publishing method based on geographic indistinguishability, which supports multi-level privacy levels during trajectory data collection and publishing, allowing users to independently control the degree of privacy protection while ensuring service quality.

[0005] The relevant concepts involved in the technical solution of this application are described and explained:

[0006] Definition 1. ε-Differential Privacy: Given datasets D and D′, the two datasets have the same data structure and differ by only one record, i.e., |D′ΔD|≤1. Given an algorithm A, Range(A) is the value range of A, if the output O(O∈Range(A)) of algorithm A on datasets D and D′ satisfies the inequality Pr[A(D)=O]≤e ε ×Pr[A(D′)=O], then A satisfies ε-differential privacy.

[0007] Where Pr[·] represents the probability of user privacy leakage, ε represents the privacy budget, and indicates the degree of privacy protection. The smaller ε is, the higher the degree of privacy protection is.

[0008] Definition 2. Global sensitivity: Let the query function f: D→R d , for any adjacent data sets D and D′, the global sensitivity of function f is Among them, R is the real space mapped by the data set D, d represents the query dimension of the function f, and p is the norm distance used to measure Δf, generally p=1.

[0009] Definition 3. Laplace mechanism: Given a data set D, there is a query function f: D→R d , its global sensitivity is Δf. For a random algorithm A that satisfies differential privacy, the algorithm output is A(D) = f(D) + Lap(Δf / ε). Among them, Lap(Δf / ε) is an independent Laplace distribution. The amount of noise added is proportional to Δf and inversely proportional to the privacy budget ε. The smaller ε is, the larger Δf is, the greater the added noise is, and the higher the privacy protection is, and vice versa.

[0010] Property 1. Sequential compositionality: Given a data set D and n sequences satisfying ε i (1≤i≤n)-Differentially Privacy Preserving Randomized Algorithm A i (1≤i≤n), these algorithms constitute the combined algorithm A(A1(D), D2(D), ..., A n (D) Satisfaction -Differential privacy protection.

[0011] Property 2. Parallel Combinability: A given data set D is partitioned into n disjoint subsets, D = {D1, D2, ..., D n}, let A i For a set of i -Randomized algorithm for differential privacy protection, A i D i To implement privacy protection, the combined algorithm A(A1(D), D2(D), ..., A n (D)) satisfies max(ε i )-Differential privacy protection.

[0012] Definition 4. Geographic Indistinguishability

[0013] Let X be the point of interest, that is, the user's possible real location, and Z be the published location after disturbance. For all x, x′∈X, Z∈Z, if the following inequality exists, then K is said to satisfy ε-geographic indistinguishability.

[0014] K(x)(Z)≤e εd (x, x′)K(x′)(Z)

[0015] Where K(x)(Z) represents the probability that the output of the perturbation mechanism K is Z when the input is x. d(x, x′) is the Euclidean distance between x and x′, which represents the level of indistinguishability between x and x′. The smaller d(x, x′) is, the higher the level of indistinguishability between the real locations, that is, the stronger the privacy. The larger d(x, x′) is, the higher the degree to which attackers can distinguish these real locations, and the weaker the privacy.

[0016] Definition 5. Planar Laplace distribution

[0017] Given parameters And the actual location For any The probability density function of the planar Laplace noise distribution is:

[0018]

[0019] in, is the normalization factor, and d(x0, x) represents the Euclidean distance between x0 and x. Summary of the invention

[0020] The purpose of this section is to summarize some aspects of the embodiments of the present invention and briefly introduce some preferred embodiments. Some simplifications or omissions may be made in this section and the abstract of the specification and the title of the invention of this application to avoid blurring the purpose of this section, the abstract of the specification and the title of the invention, and such simplifications or omissions cannot be used to limit the scope of the present invention.

[0021] In view of the above existing problems, the present invention is proposed.

[0022] To solve the above technical problems, the present invention provides the following technical solutions: users select corresponding protection levels according to their privacy preferences, set corresponding privacy budget values, and divide the geographical area into grids of corresponding granularity;

[0023] The prediction mechanism predicts the cell where the user is located at the current moment based on the location index published at the last moment and the collected driving direction and speed;

[0024] The detection mechanism monitors the current location information and determines whether to publish the predicted location by calculating the distance between the actual location and the predicted location:

[0025] When the distance between the predicted position and the real position is greater than a set threshold, a disturbance mechanism is enabled to add a plane Laplace noise disturbance to the real position, and the disturbance position information is published;

[0026] When the distance between the predicted position and the actual position is ≤ the set threshold, a prediction success is returned and the predicted position information is directly released.

[0027] As a preferred solution of the real-time trajectory data publishing method based on geographic indistinguishability of the present invention, the user selects a corresponding protection level according to his or her privacy preference. The protection level is divided into three levels: low, medium, and high. The privacy budget ε value is set according to the privacy level selected by the user, and the geographical area is grid-divided into corresponding granularities, wherein:

[0028] The smaller the privacy budget ε value, the stronger the privacy protection is. Conversely, the larger the ε value, the weaker the privacy protection is.

[0029] The smaller the grid granularity, the more accurate the service obtained, but the weaker the privacy protection. Conversely, the larger the grid granularity, the stronger the privacy protection, but the accuracy of the service decreases.

[0030] As a preferred solution of the real-time trajectory data publishing method based on geographic indistinguishability of the present invention, predicting the cell where the user is located at the current moment includes:

[0031] Define 8 directions for users to drive out of a cell, that is, the out-degree of each cell is 8, represented by 0 to 7, 0 is due north, marked in clockwise direction, 1 is northwest, 2 is due west, and so on;

[0032] By calculating the true direction θ i With the preset direction dir j The preset direction with the smallest angle is marked as the driving direction;

[0033] Through the previous moment t i-1 The marked driving direction and speed predict the current cell.

[0034] As a preferred solution of the method for publishing real-time trajectory data based on geographic indistinguishability of the present invention, the method further includes:

[0035] According to the driving speed, the i-1 To the current time t i The driving distance is obtained by i =|v i-1 |×(t i -t i-1 );

[0036] When θ i-1 When mod2=0, l=round(dis i / λ), for dis i / λ is rounded to the nearest integer. i-1 Move l cells in the direction;

[0037] When θi-1 When mod2=1, That is The value of θ is rounded off. i-1 Move l cells in the direction;

[0038] Among them, λ is the side length of the unit cell, θ i is the true direction, dir j The default direction.

[0039] As a preferred solution of the real-time trajectory data publishing method based on geographic indistinguishability of the present invention, the real location loc i With predicted position The distance between them is expressed as Euclidean distance, and the calculation formula is:

[0040]

[0041] Among them, (x i ,y i ) is the coordinate value of the center point of the cell where the real position is located. The coordinate value of the center point of the cell where the prediction position is located.

[0042] As a preferred solution of the method for publishing real-time trajectory data based on geographic indistinguishability of the present invention, the method further includes:

[0043] When the position at time t1 cannot be predicted, the prediction mechanism and the monitoring mechanism are skipped, and the real position data is directly released after being disturbed;

[0044] When the actual driving speed at two consecutive timestamps is less than 10km / h, the monitoring mechanism is skipped and the published location loc at the previous moment is published i-1 .

[0045] As a preferred solution of the real-time trajectory data publishing method based on geographic indistinguishability described in the present invention, the location of the failed prediction is disturbed and then published by adopting a geographic indistinguishability model.

[0046] As a preferred solution of the real-time trajectory data publishing method based on geographic indistinguishability of the present invention, the real location loc i The Cartesian coordinates are converted into polar coordinates, and the real position loc i Adding plane Laplace noise, the probability density function of plane Laplace noise is expressed as:

[0047]

[0048] in, is a random number between [0, 2π), which is the line x loci The angle between the random variable r and the horizontal axis Are independent of each other.

[0049] As a preferred solution of the real-time trajectory data publishing method based on geographic indistinguishability of the present invention, r is the difference between x and the real position loc i The Euclidean distance between them is expressed mathematically as:

[0050]

[0051] Where ε is the privacy budget, p is a random number in [0, 1), and W -1 Represents the branch of the Lambert W(X) function at (-∞, -1).

[0052] Beneficial effects of the present invention: The present invention supports multi-level privacy levels in the process of trajectory data collection and release, allowing users to independently control the degree of privacy protection. At the same time, the user's movement direction and position are generalized and predicted, and the prediction mechanism, detection mechanism and disturbance mechanism work together to effectively reduce the consumption of the privacy budget, and increase the availability of the released data while ensuring that the privacy strength remains unchanged. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative labor. Among them:

[0054] Figure 1 It is a schematic diagram of the composition architecture of the real-time trajectory data publishing method based on geographic indistinguishability shown in the present invention;

[0055] Figure 2 A schematic diagram of a single point location release shown in the present invention;

[0056] Figure 3 A schematic diagram of a user trajectory shown in the present invention;

[0057] Figure 4 It is a schematic diagram of the implementation process of the scheme shown in the present invention;

[0058] Figure 5 This is a dynamic time normalization comparison diagram of the privacy budget shown in the present invention when ε=0.5, 1.0, and 2.0;

[0059] Figure 6 This is a comparison diagram of query relative errors when the privacy budget is ε=0.5, 1.0, and 2.0 as shown in the present invention. DETAILED DESCRIPTION

[0060] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings. It is obvious that the described embodiments are only part of the embodiments of the present invention, but not all of the embodiments.

[0061] Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without making any creative work should fall within the scope of protection of the present invention.

[0062] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0063] In the prior art, although standard differential privacy can provide strong privacy protection, it is not suitable for directly protecting two-dimensional location data. If the privacy budget is divided equally and noise is added to the latitude and longitude coordinates of the location data, the accuracy of the disturbed position is low and the service quality cannot be guaranteed.

[0064] At present, the most influential method for publishing single-point locations is the geographic indistinguishability model proposed by Andrés et al. This model is an extension of standard differential privacy. Users add planar Laplace noise to their locations on the client to perturb them, so that the user's true location within a certain area meets geographic indistinguishability.

[0065] Reference Figure 2 , is a schematic diagram of a single point location release shown in an embodiment of the present invention, wherein the central dot represents the user's real location x o , the model ensures that o The real position x is in the area with radius r as the center. o It is geographically indistinguishable from any other location. When the value of ε is fixed, the smaller r is, the greater the protection strength.

[0066] Reference Figure 3 , is a schematic diagram of a user trajectory shown in an embodiment of the present invention, and the trajectory defined therein is as follows:

[0067] The trajectory T is a spatiotemporal sequence, which is a six-dimensional data consisting of the grid index of the position, direction, speed, etc., formally expressed as:

[0068]

[0069] Among them, ID is the track identifier, L irepresents the i-th position in the trajectory, x i and i They are t i The horizontal and vertical indexes of the cell at the moment, θ i Represents the user from t i The exit direction of the cell at the time. In order to reduce the computational complexity and privacy leakage, the embodiment of the present invention presets 8 exit directions of the cell, that is, the exit degree of each cell is 8, represented by 0 to 7, 0 is marked as due north, 1 is northwest, 2 is due west, and so on. i Represents t i The running speed at the moment, |T|=n is the length of the trajectory.

[0070] Furthermore, the user's running trajectory is as follows Figure 3 As shown, the location point in the trajectory is replaced by the horizontal and vertical index values ​​of the cell where it is located. The arrow represents the exit direction of the user at the location. By calculating the angle between the real direction and the preset direction, the preset direction with the smallest angle is set as the published direction.

[0071] As an example, the user's running trajectory from t1 to t7 is expressed as:

[0072]

[0073] Reference Figure 4 , is a data publishing flow chart shown in an embodiment of the present invention. The data owner disturbs the position on the client and publishes it to the data collector and stores it in the trajectory database. The data analyst mines and analyzes the trajectory data in the database.

[0074] According to an embodiment of the present invention, Figure 1 The flowchart shown in the figure is a method for publishing real-time trajectory data based on geographic indistinguishability, which specifically includes the following steps:

[0075] S1. Users select the corresponding protection level according to their privacy preferences, set the corresponding privacy budget value, and divide the geographical area into grids of corresponding granularity;

[0076] S2, the prediction mechanism predicts the cell where the user is located at the current moment based on the location index published at the last moment and the collected driving direction and speed;

[0077] S3. The detection mechanism monitors the current location information and determines whether to publish the predicted location by calculating the distance between the real location and the predicted location:

[0078] When the distance between the predicted position and the actual position is greater than the set threshold, the perturbation mechanism is enabled to add plane Laplace noise perturbation to the actual position and publish the perturbed position information;

[0079] When the distance between the predicted location and the actual location is ≤ the set threshold, the prediction is successful and the predicted location information is directly published.

[0080] As an example, locations where predictions fail can be perturbed and published using a geographic indistinguishability model.

[0081] In an optional implementation, the user selects a corresponding protection level according to his or her privacy preference. The protection level is divided into three levels: low, medium, and high. The privacy budget ε value is set according to the privacy level selected by the user, and the geographical area is divided into grids of corresponding granularity, where:

[0082] The smaller the privacy budget ε value, the stronger the privacy protection is. Conversely, the larger the ε value, the weaker the privacy protection is.

[0083] The smaller the grid granularity, the more accurate the service obtained, but the weaker the privacy protection. Conversely, the larger the grid granularity, the stronger the privacy protection, but the accuracy of the service decreases.

[0084] As an example, predict the cell where the user is at the current moment, including:

[0085] Define 8 directions for users to drive out of a cell, that is, the out-degree of each cell is 8, represented by 0 to 7, 0 is due north, marked in clockwise direction, 1 is northwest, 2 is due west, and so on;

[0086] By calculating the angle between the real direction and the preset direction, the preset direction with the smallest angle is marked as the driving direction;

[0087] Predict the current cell by the driving direction and speed marked at the last moment:

[0088] According to the driving speed, the i-1 To the current time t i The driving distance is obtained by i =|v i-1 |×(t i -t i-1 );

[0089] When θ i-1 When mod2=0, l=round(dis i / λ), for dis i / λ is rounded to the nearest integer. i-1 Move l cells in the direction;

[0090] When θ i-1 When mod2=1, That is The value of θ is rounded off. i-1 Move l cells in the direction;

[0091] Among them, λ is the side length of the unit cell, θ i is the true direction, dir j The default direction.

[0092] As an example, the real location loc i With predicted position The distance between them is expressed as Euclidean distance, and the calculation formula is:

[0093]

[0094] Among them, (x i ,y i ) is the coordinate value of the center point of the cell where the real position is located. is the coordinate value of the center point of the cell where the prediction position is located;

[0095] When the position at time t1 cannot be predicted, the prediction mechanism and monitoring mechanism are skipped, and the real position data is directly released after disturbance processing;

[0096] When the actual driving speed at two consecutive timestamps is less than 10km / h, the monitoring mechanism is skipped and the published location loc at the previous moment is published i-1 .

[0097] In an alternative embodiment, the real position loc i The Cartesian coordinates are converted into polar coordinates, and the real position loc i Adding plane Laplace noise, the probability density function of plane Laplace noise is expressed as:

[0098]

[0099] in, is a random number between [0, 2π), which is the line x loc i The angle between the random variable r and the horizontal axis are independent of each other;

[0100] r is x and the real position loc i The Euclidean distance between them is expressed mathematically as:

[0101]

[0102] Where ε is the privacy budget, p is a random number in [0, 1), and W-1 Represents the branch of the Lambert W(X) function at (-∞, -1).

[0103] It should also be noted that in this embodiment, Figure 5 (a) to (f) are dynamic time normalization comparison diagrams based on the public datasets Porto-Taxi and T-drive with privacy budgets of ε = 0.5, 1.0, and 2.0. Dynamic time normalization is often used to measure the similarity between trajectory patterns. Its formal definition is: given two trajectories T and T′, P i is the position point on trajectory T, is a position point in the trajectory T′, then the dynamic time normalization algorithm is defined as:

[0104]

[0105] in, YesP i and When comparing the distances between position points on two trajectories, a position point on one trajectory is allowed to be compared with one or more consecutive position points on the other trajectory.

[0106] Reference Figure 5 It can be seen that the performance of the proposed method in the dynamic time normalization index is generally better than that of the comparison algorithm, which is particularly obvious on the Porto-Taxi dataset. The similarity between trajectories increases with the increase of ε. The reason is that the increase of ε means the decrease of the amount of noise added in the trajectory. Therefore, the larger the ε, the higher the trajectory similarity. However, with the increase of ε, the DTW of the comparison algorithm decreases significantly, while the change of the proposed method is relatively stable. This is because the proposed method can personalize the degree of privacy protection. When the privacy budget ε increases, the amount of noise added decreases accordingly. However, the privacy degree set by the user restricts the size of the grid granularity.

[0107] When the privacy protection level is set to low, that is, ε = 2.0, the side length of the cell is the smallest. At this time, the driving speed of the taxi causes the user to cross multiple cells within a sampling interval. The prediction mechanism generalizes the driving direction of the previous moment to the preset direction and predicts the current location. When the user crosses multiple cells, the prediction accuracy of the prediction mechanism will decrease, resulting in a decrease in trajectory similarity.

[0108] Reference Figure 6 (a) to (b) are comparison diagrams of query relative error based on the public datasets Porto-Taxi and T-drive with privacy budgets of ε = 0.5, 1.0, and 2.0. Query relative error is a metric for evaluating the availability of published data. Its calculation formula is:

[0109]

[0110] Where Q is the query box, D is the original dataset, D′ is the published dataset, Q(D′) is the result of executing query Q on the published dataset, Q(D) is the result of executing query Q on the original dataset D, s is the threshold set to avoid the denominator being 0. The smaller the relative error value, the more similar the distribution of the published dataset is to the original dataset, that is, the higher the data availability.

[0111] Reference Figure 6 ,It can be seen that the performance of the dataset synthesized by the proposed method in terms of query error index is generally better than that of the comparison algorithm, and is only slightly higher than DP-Star when the privacy budget ε=2.

[0112] The query relative error value of the method of the present invention is not positively correlated with the privacy budget ε. Although the query relative error of the comparison algorithm decreases with the increase of ε, the query relative error of the method of the present invention when ε=2 is slightly higher than that when ε=1.

[0113] The reason is that, on the one hand, although the increase of ε is accompanied by a decrease in the amount of injected noise, the grid granularity also decreases accordingly. The error caused by generalizing the driving direction to the preset direction in the method of the present invention is more obvious under the fine-grained grid, resulting in a decrease in prediction accuracy; on the other hand, the query relative error is closely related to the distribution of the synthetic dataset. The method of the present invention replaces the user position with the center of the cell where it is located, that is, multiple location points in a cell are replaced by the center point. Although this method can increase the privacy strength, it affects the distribution of the synthetic dataset to a certain extent.

[0114] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A real-time trajectory data publishing method based on geographic indistinguishability, characterized in that: include: Users select the corresponding protection level according to their privacy preferences, set the corresponding privacy budget value, and divide the geographical area into grids of corresponding granularity; The prediction mechanism predicts the cell where the user is located at the current moment based on the location index published at the last moment and the collected driving direction and speed; The detection mechanism monitors the current location information and determines whether to publish the predicted location by calculating the distance between the actual location and the predicted location: When the distance between the predicted position and the actual position is greater than a set threshold, a perturbation mechanism is enabled to add a plane Laplace noise perturbation to the actual position, and the perturbed position information is published; When the distance between the predicted position and the actual position is ≤ the set threshold, a prediction success is returned and the predicted position information is directly released.

2. The method for publishing real-time trajectory data based on geographic indistinguishability according to claim 1, characterized in that: The user selects a corresponding protection level according to his / her privacy preference. The protection level is divided into three levels: low, medium, and high. The privacy budget ε value is set according to the privacy level selected by the user, and the geographical area is grid-divided into corresponding granularities, where: The smaller the privacy budget ε value, the stronger the privacy protection is. Conversely, the larger the ε value, the weaker the privacy protection is. The smaller the grid granularity, the more accurate the service obtained, but the weaker the privacy protection. Conversely, the larger the grid granularity, the stronger the privacy protection, but the accuracy of the service decreases.

3. The method for publishing real-time trajectory data based on geographic indistinguishability according to claim 1, characterized in that: Predicting the cell where the user is located at the current moment includes: Define 8 directions for users to drive out of a cell, that is, the out-degree of each cell is 8, represented by 0 to 7, 0 is due north, marked in clockwise direction, 1 is northwest, 2 is due west, and so on; By calculating the true direction θ i With the preset direction dir j The preset direction with the smallest angle is marked as the driving direction; Through the previous moment t i-1 The marked driving direction and speed predict the current cell.

4. The method for publishing real-time trajectory data based on geographic indistinguishability according to claim 3, characterized in that: Also includes: According to the driving speed, the i-1 To the current time t i The driving distance is obtained by i =|v i-1 |×(t i -t i-1 ); When θ i-1 When mod2=0, l=round(dis i / λ), for dis i / λ is rounded to the nearest integer. i-1 Move l cells in the direction; When θ i-1 When mod2=1, right The value of θ is rounded off. i-1 Move l cells in the direction; Among them, λ is the side length of the unit cell, θ i is the true direction, dir j The default direction.

5. The method for publishing real-time trajectory data based on geographic indistinguishability according to claim 1, characterized in that: Real location loc i With predicted position The distance between them is expressed as Euclidean distance, and the calculation formula is: Among them, (x i ,y i ) is the coordinate value of the center point of the cell where the real position is located. The coordinate value of the center point of the cell where the prediction position is located.

6. The method for publishing real-time trajectory data based on geographic indistinguishability according to claim 1, characterized in that: Also includes: When the position at time t1 cannot be predicted, the prediction mechanism and the monitoring mechanism are skipped, and the real position data is directly released after being disturbed; When the actual driving speed at two consecutive timestamps is less than 10km / h, the monitoring mechanism is skipped and the published location loc at the previous moment is published i-1 .

7. The method for publishing real-time trajectory data based on geographic indistinguishability according to claim 6, characterized in that: The locations where prediction fails are perturbed and released by adopting a geographic indistinguishability model.

8. The method for publishing real-time trajectory data based on geographic indistinguishability according to claim 7, characterized in that: The real position loc i The Cartesian coordinates are converted into polar coordinates, and the real position loc i Adding plane Laplace noise, the probability density function of plane Laplace noise is expressed as: in, is a random number between [0, 2π), which is the line x loc i The angle between the random variable r and the horizontal axis Are independent of each other.

9. The method for publishing real-time trajectory data based on geographic indistinguishability according to claim 8, characterized in that: r is x and the real position loc i The Euclidean distance between them is expressed mathematically as: Where ε is the privacy budget, p is a random number in [0, 1), and W -1 Represents the branch of the Lambert W(X) function at (-∞, -1).

Images