Personalized trajectory privacy protection method based on hierarchical time semantic tree

Abstract

The invention provides a personalized trajectory privacy protection method based on a hierarchical time semantic tree. The method comprises the following steps: acquiring a data set; respectively extracting staying points according to the trajectory data, constructing a public semantic tree by utilizing the public trajectory staying points, and constructing a hierarchical time semantic tree by utilizing the historical trajectory staying points and the public semantic tree; calculating the semantic privacy sensitivity of each original track stay point by using a TF-IDF algorithm, and calculating a privacy protection demand according to the semantic privacy sensitivity of each original track stay point; acquiring a privacy budget corresponding to each original track stay point according to the hierarchical time semantic tree and privacy protection requirements, and performing minimum quality loss calculation according to the privacy budget corresponding to each original track stay point by using a differential privacy method; and after all original track stay points are calculated, protected track data are finally obtained. According to the method, personalized track privacy protection can be realized, and a solution thought is provided for personalized and diversified track privacy protection requirements in the future.

Description

Technical Field

[0001] The present invention relates to the technical field of privacy protection, and in particular to a personalized trajectory privacy protection method based on a hierarchical time semantic tree. Background Art

[0002] With the rise of mobile Internet and the rapid development of smart mobile terminals, location-based services have been widely used in various fields of life, such as travel services, social media positioning, health and sports tracking, etc. Location service providers provide users with more personalized services by collecting and analyzing a large amount of user location data. While users enjoy the great convenience brought by location services, they also bear the risk of privacy leakage.

[0003] The invention patent with publication number CN113886866A discloses a privacy protection method for spatiotemporal correlation trajectory based on semantic location transfer, including: the central anonymous server initializes the database, divides the urban road network into Voronoi units, and counts the number of user transfers between semantic locations to construct a behavior probability matrix; the mobile terminal sends the privacy requirements and query requests to the central anonymous server, and constructs an anonymous set through the spatiotemporal correlation anonymous set generation module; the spatiotemporal correlation check module determines whether the anonymous sets at adjacent moments meet the spatiotemporal correlation, and if so, directly sends the anonymous request to the LBS location-based server; if not, the delayed sending time is calculated, and the anonymous request is sent with delay; the LBS location-based server queries the anonymous request and returns the candidate result set to the central anonymous server; the central anonymous server uses the query result refinement processor to process the candidate result set, and sends the accurate result to the mobile terminal. This method can effectively prevent inference attacks and spatiotemporal correlation attacks.

[0004] However, although the existing trajectory privacy protection methods have demonstrated the ability of privacy protection to a certain extent, most of these methods provide a uniform degree of privacy protection for data, resulting in some data not being fully protected, while other data may not require high privacy protection. In addition, most methods focus on the spatial and temporal dimensions of trajectory data, and rarely consider the semantic information of location. The semantic information of location refers to abstract information related to the geographic location, which provides deeper information for the location. Therefore, it is very meaningful to consider semantic information when performing location privacy protection. However, the same semantic category will also have different privacy requirements due to different user stay times. For example: the semantic category of location A is a cinema. User 1 and User 2 stay in location A for eight hours and two hours respectively. It can be inferred that User 1 works at location A and User 2 entertains at location A, so they have different privacy requirements. In the process of personalized privacy protection, it is necessary to take both semantic category and stay time into consideration to better meet the development needs of diversified and personalized location services in the future. Summary of the invention

[0005] In view of the privacy leakage caused by semantic factors and the technical problems that need to be met by the personalized privacy needs of users, the present invention proposes a personalized trajectory privacy protection method based on hierarchical temporal semantic tree HTST-PTPP (Hierarchical Temporal Semantic Tree-Based Personalized Trajectory Privacy Protection), which constructs a personalized hierarchical temporal semantic tree by considering the semantic category and residence time of the user's trajectory stop point; uses the TF-IDF (Term Frequency-Inverse Document Frequency) algorithm to calculate the semantic sensitivity of each location, and then quantifies the privacy needs of each location; reasonably divides the privacy level and allocates the privacy budget. The present invention can realize personalized trajectory privacy protection, solve the privacy leakage problem caused by semantic factors, and consider the personalized privacy needs of users.

[0006] In order to achieve the above object, the technical solution of the present invention is achieved as follows:

[0007] A personalized trajectory privacy protection method based on a hierarchical time semantic tree comprises the following steps:

[0008] S1: Obtain public trajectory data, historical trajectory data, original trajectory data and POI dataset;

[0009] S2: extract the public trajectory stop points, historical trajectory stop points and original trajectory stop points according to the public trajectory data, historical trajectory data and original trajectory data, build a public semantic tree using the public trajectory stop points, and build a hierarchical time semantic tree using the historical trajectory stop points and the public semantic tree;

[0010] S3: Use the TF-IDF algorithm to calculate the semantic privacy sensitivity of each original trajectory stop point, and calculate the privacy protection requirement based on the semantic privacy sensitivity of each original trajectory stop point;

[0011] S4: Obtain the privacy budget corresponding to each original trajectory stop point according to the hierarchical time semantic tree and privacy protection requirements, and use the differential privacy method to minimize the quality loss calculation based on the privacy budget corresponding to each original trajectory stop point; after calculating all the original trajectory stop points, the protected trajectory data is finally obtained.

[0012] The method of extracting the public trajectory stop points, the historical trajectory stop points and the original trajectory stop points according to the public trajectory data, the historical trajectory data and the original trajectory data in step S2 is: respectively calculating the latitude and longitude information of the public trajectory stop points, the historical trajectory stop points and the original trajectory stop points, and the formula is:

[0013]

[0014] Among them, S i (lon) and S i (lat) represents the longitude and latitude information of the ith stop point, l k (lon) and l k (lat) represents each original position point l in each trajectory data k The longitude and latitude information of each trajectory data, |S| represents the set of stop points of each trajectory data; m and n represent the starting point and end point of each trajectory data respectively;

[0015] Labeling semantic categories for each stop point: On the server side, the distance from each public track stop point to the nearby POI is calculated based on the latitude and longitude information of the public track stop point, and the semantic category of the closest POI is used to describe the public track stop point; on the mobile client, a POI attribute table is set up, and each set of longitude and latitude information corresponds to a semantic category. The longitude and latitude information and semantic categories are stored in the POI attribute table and saved on the mobile client. The POI attribute table is used to label the semantic categories of the historical track stop points and the original track stop points;

[0016] Calculate the stay time of the mobile client's stop point: take the earliest location point time of the geographical area where the historical trajectory stop point and the original trajectory stop point are located as the arrival time, and the latest location point time as the departure time, and calculate the stay time of the mobile client's stop point.

[0017] The method for constructing a public semantic tree using public trajectory stop points described in step S2 is as follows: on the server side, the public trajectory stop points are divided into different clusters as bottom-level nodes according to the semantic categories and common granularity of the public trajectory stop points; the semantic categories of the bottom-level nodes are abstracted and generalized to form upper-level nodes, and the execution is iterated from the bottom to the top until the root node is obtained, thereby constructing a public semantic tree.

[0018] The method for abstracting and generalizing the semantic categories of the underlying nodes is as follows: clustering the semantic categories of the underlying nodes using a clustering algorithm, extracting representative categories from each cluster as higher-level abstract categories, creating a mapping table to map the semantic categories of the underlying nodes to higher-level abstract categories, and summarizing the characteristics and attributes of each abstracted category.

[0019] The method for constructing a hierarchical time semantic tree using historical trajectory stay points and a public semantic tree as described in step S2 is: the semantic categories of the user's historical trajectory stay points and the clusters of common granularity are used as nodes of the middle layer, the semantic categories of the middle layer nodes are abstracted and generalized with reference to the semantic categories of the public semantic tree, and the upper layer nodes are formed, and then the upper layer nodes are further abstracted and generalized until the root node is found; according to the stay time, clustering classification is iterated downward from the middle layer, and finally, a hierarchical time semantic tree with a specific number of layers is generated.

[0020] The method for calculating the semantic privacy sensitivity of the original trajectory stop point described in step S3 is: embedding the corresponding algorithm and logic in the mobile client, based on the assumption that there is a positive correlation between the public user's access to semantic categories and the demand for semantic attributes, and there is also a positive correlation between the demand for semantic attributes and the number of semantic categories in the POI dataset, preprocessing the original trajectory data and calculating TF-IDF, the calculation method is:

[0021]

[0022] Among them, w i is the semantic sensitivity of the original trajectory stop point u to POI type i, N u Indicates the total number of POIs existing in the original trajectory stop point u, n iu represents the number of POI type i in the original trajectory stop point u, |L| represents the number of elements in the original trajectory stop point set, |CS i | represents the number of original trajectory stop points containing POI type i in the original trajectory stop point set, TF i Indicates word frequency, IDF i Represents inverse document frequency.

[0023] The method for calculating the privacy protection requirement according to the semantic privacy sensitivity of each original trajectory stop point in step S3 is:

[0024] By mapping the semantic privacy sensitivity into the hierarchical time semantic tree, a connection is established between the semantic privacy sensitivity of each original trajectory stop point u and the hierarchical time semantic tree to obtain the privacy protection requirements:

[0025]

[0026] Where W = Σ k w k is the normalization factor of semantic sensitivity, bt is the number of backtracking layers, which is used to indicate the privacy protection requirement, and w j is the semantic sensitivity of the original trajectory stop point u to POI type j, w kis the semantic sensitivity of the original trajectory stop point u to POI type k, O l is the baseline number of backtracking layers under low privacy sensitivity, O r Benchmark for the number of backtracking layers under high privacy sensitivity.

[0027] The method for obtaining the privacy budget of the original trajectory stop point according to the hierarchical time semantic tree and the privacy protection requirement described in step S4 is as follows: after constructing the hierarchical time semantic tree, the longest path from the root node to the farthest leaf node is calculated to obtain the height h of the hierarchical time semantic tree, and according to the height h of the hierarchical time semantic tree, the privacy is divided into multiple privacy levels, and the privacy budget is allocated according to the privacy level. The privacy level is found according to the number of backtracking layers bt of the original trajectory stop point, thereby determining the privacy budget corresponding to the original trajectory stop point.

[0028] The method of using the differential privacy method and performing the minimization quality loss calculation according to the privacy budget corresponding to the original trajectory stop point in step S4 is: using the mechanism K to perform data perturbation on the original trajectory stop point, adding differential privacy constraints, and using the linear optimization method to solve the minimum data quality loss generated by the mechanism K;

[0029] The mechanism K is: K:L→O(L * ), where L represents the set of original trajectory stop points, O(L * ) represents the disturbance position set L * The set of perturbation probability distributions on the upper layer. The input of mechanism K is the original trajectory stop point l, l∈L, and the output is the perturbation position l * , l * ∈L * .

[0030] The method of using a linear optimization method to solve the minimum data quality loss caused by mechanism K by adding differential privacy constraints is:

[0031] The data quality loss caused by the definition mechanism K is:

[0032]

[0033] Among them, d(l·l * ) means to disturb the original trajectory stop point l to the disturbance position l * The mass loss of π(l) is the prior probability, Indicates that the original trajectory stop point l is disturbed to the disturbance position l * The probability of

[0034] When the differential privacy constraint is satisfied: When , the data quality loss generated by mechanism K takes the minimum value, l and l' represent two different original trajectory stop points, e represents the natural logarithm base, and ε represents the privacy budget corresponding to the position to be protected.

[0035] Beneficial effects of the present invention:

[0036] By considering the semantic category and dwell time of the user's historical trajectory stop points, and combining with the public semantic tree, a personalized hierarchical time semantic tree is constructed; the TF-IDF algorithm is used to calculate the semantic sensitivity of each position (original trajectory stop point) in the user's trajectory, and then the privacy requirements of each position (original trajectory stop point) are quantified; the privacy level is reasonably divided and the privacy budget is allocated. The present invention can realize personalized trajectory privacy protection, and by processing the original trajectory, it effectively solves the privacy leakage problem caused by semantic factors, and at the same time considers the personalized privacy requirements of users, providing a solution for the personalized and diversified trajectory privacy protection needs in the future. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0038] Figure 1 It is a principle flow chart of the present invention.

[0039] Figure 2 It is a schematic diagram of constructing a hierarchical time semantic tree of the present invention.

[0040] Figure 3 It is a schematic diagram of the framework of the personalized trajectory privacy protection system based on the hierarchical time semantic tree of the present invention.

[0041] Figure 4 It is a schematic diagram of constructing the public semantic tree of the present invention.

[0042] Figure 5 This is a comparison chart of the impact of privacy budget on quality loss.

[0043] Figure 6 This is a comparison chart of the impact of privacy budget on adversarial error. DETAILED DESCRIPTION

[0044] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0045] A personalized trajectory privacy protection method based on hierarchical temporal semantic tree, such as Figure 3 As shown, the following steps are included:

[0046] S1: Obtain public trajectory data, historical trajectory data, original trajectory data and POI dataset.

[0047] Public trajectory data is obtained from the server, while historical trajectory data and original trajectory data are obtained from the user's mobile terminal.

[0048] POI (Point of Interest) dataset refers to point data in Internet electronic maps, which basically includes four attributes: name, address, coordinates, and category; it describes the geographic location information covered by each semantic type.

[0049] S2: Extract the public trajectory stop points, historical trajectory stop points and original trajectory stop points according to the public trajectory data, historical trajectory data and original trajectory data respectively, use the public trajectory stop points to build a public semantic tree, and use the historical trajectory stop points and the public semantic tree to build a hierarchical time semantic tree.

[0050] The stay point represents the geographical area where the user stays within a certain time and space range. The trajectory data records the continuous location information of the user. Before the trajectory data is analyzed, specific location points are extracted from the trajectory data as trajectory stay points. In this embodiment, the latitude and longitude coordinates and the stay time of the stay points in the trajectory data are mainly extracted.

[0051] S2.1. The method for extracting the public trajectory stop points, the historical trajectory stop points and the original trajectory stop points respectively according to the public trajectory data, the historical trajectory data and the original trajectory data is as follows:

[0052] The latitude and longitude information of the public trajectory stop points, historical trajectory stop points and original trajectory stop points are calculated respectively. The formula is as follows:

[0053]

[0054] Among them, S i (lon) and S i (lat) represents the longitude and latitude information of the ith stop point, l k (lon) and l k(lat) represents each original position point l in each trajectory data k The longitude and latitude information of each trajectory data, m and n represent the starting point and end point of each trajectory data, respectively, and |S| represents the set of stop points of each trajectory data.

[0055] S2.2. Label the semantic category for each stop point:

[0056] The stay points extracted from the trajectory data (public trajectory data, historical trajectory data, and original trajectory data) are fused with the POI dataset according to the latitude and longitude information, and the semantic category of each stay point is marked as follows:

[0057] On the server side, the distance from each common trajectory stop point to the nearby POI is calculated based on the latitude and longitude information, and the semantic category of the closest POI is used to describe the common trajectory stop point.

[0058] On the mobile client (including mobile phones, computers, etc.), a POI attribute table is set up. Each set of longitude and latitude information corresponds to a semantic category. The longitude and latitude information and semantic categories are stored in the POI attribute table and saved on the mobile client. Therefore, the POI attribute table can be used to mark the semantic categories of historical trajectory stop points and original trajectory stop points.

[0059] S2.3. Calculate the time the mobile client stays at the point where it stays:

[0060] The earliest location point time of the geographical area where the mobile client's stop point (historical trajectory stop point and original trajectory stop point) is located is taken as the arrival time, and the latest location point time is taken as the departure time, and the stay time of the mobile client's stop point is calculated.

[0061] S2.4, such as Figure 4 As shown in the figure, the specific method of constructing a public semantic tree is as follows: the construction of the public semantic tree is completed on the server side. According to the semantic categories and common granularity of the public trajectory stop points, the public trajectory stop points are divided into different clusters as the bottom nodes; the semantic categories of the bottom nodes are abstracted and summarized; thus, the upper nodes are formed, and the execution is iterated from the bottom to the top until the root node is obtained, thereby constructing a public semantic tree. Common granularity is divided according to the more commonly used categories in daily life, such as: universities, hospitals, playgrounds, shopping centers, etc. These different categories. .

[0062] Abstract and summarize the semantic categories of the underlying nodes: Use clustering algorithms (such as K-means, DBSCAN, etc.) to cluster the semantic categories of the underlying nodes to identify category groups that share similar characteristics, and extract representative categories from each cluster as higher-level abstract categories. For example, abstract "catering industry" from categories such as "restaurant", "cafe", and "fast food restaurant". Create a mapping table to map the semantic categories of the underlying nodes to higher-level abstract categories. For example, create a mapping table to map all catering-related categories to "catering industry". For each abstracted category, summarize its characteristics and attributes. For example, for "catering industry", you can summarize the subcategories it contains, the average consumption level, etc.

[0063] S2.5. Specifically, the method for constructing a hierarchical time semantic tree is as follows: Figure 2 As shown, the hierarchical temporal semantic tree is constructed based on the stay time of the historical trajectory stay points and combined with the public semantic tree downloaded from the server.

[0064] The construction of the hierarchical time semantic tree takes the semantic categories of the user's historical trajectory stay points and the clusters of common granularity as the nodes of the middle layer, and abstracts and summarizes the semantic categories of the middle layer nodes with reference to the semantic categories of the public semantic tree to form the upper layer nodes, and then abstracts and summarizes the upper layer nodes until the root node is found; according to the stay time, cluster classification is performed iteratively from the middle layer downward, and nodes with similar stay time are aggregated into one category to form a more detailed time hierarchy, which can refine the user's privacy needs and set different privacy budgets for different stay points, so as to achieve personalized trajectory privacy protection. Finally, a hierarchical time semantic tree with a specific number of layers is generated.

[0065] S3: Use the TF-IDF algorithm to calculate the semantic privacy sensitivity of each original trajectory stop point, and calculate the privacy protection requirement based on the semantic privacy sensitivity of each original trajectory stop point.

[0066] The TF-IDF model is a weighted technique widely used in information retrieval and text mining to evaluate the importance of a word in a document set or a single document in a word library, where TF represents term frequency and IDF represents inverse document frequency. In this paper, TF represents the frequency of a semantic category in a user's personal original trajectory data, and IDF represents the frequency of the semantic category in other users' original trajectory data.

[0067] The TF-IDF model is used to measure the semantic privacy sensitivity of the user's original trajectory stop point. This process is executed on the user's mobile client. When the TF-IDF model is used on the mobile client, the corresponding algorithm and logic need to be embedded in its APP, and the data is preprocessed and TF-IDF is calculated on the mobile client. During the calculation process, the APP will use the computing resources of the mobile device to execute the TF-IDF algorithm and use the calculation results in the subsequent formulation of privacy protection strategies. Therefore, there is no original trajectory data of other users. There is a positive correlation between the public user's access to semantic categories and their demand for semantic attributes, and there is also a positive correlation between the demand for semantic attributes and the number of semantic categories in the POI dataset. Semantic categories refer to the classification of various things or concepts in the real world, such as restaurants, hotels, shops, parks, etc. Semantic attributes refer to information used to describe the characteristics or properties of data items under a specific semantic category, providing a more detailed and specific description of the data items, which helps users understand and evaluate these data items. In the context of the POI database, semantic attributes may include "cuisine", "per capita consumption", "rating", "business hours", etc. of restaurants, or "stars", "room types", "facilities", etc. of hotels. The TF-IDF algorithm can be used to effectively process and analyze text data, extract key information, and provide users with more accurate and personalized services.

[0068] The calculation method of the semantic privacy sensitivity of the user's original trajectory stop point is as follows: embed the corresponding algorithm and logic in the mobile client, based on the assumption that there is a positive correlation between the public user's access to semantic categories and the demand for semantic attributes, and there is also a positive correlation between the demand for semantic attributes and the number of semantic categories in the POI dataset, preprocess the original trajectory data and calculate TF-IDF:

[0069] The set of all original trajectory stop points is regarded as a corpus, where each original trajectory stop point corresponds to a file and the POI type corresponds to a word. According to the TF-IDF model, the word frequency TF of POI type i in a stop area can be calculated as:

[0070]

[0071] Among them, N u Indicates the total number of POIs existing in the original trajectory stop point u, n iu represents the number of POI type i in the original trajectory stop point u;

[0072] At the same time, the inverse document frequency IDF of POI type i in the set of stay points can be calculated as:

[0073]

[0074] Among them, |L| represents the number of elements in the original trajectory stop point set, |CS i | represents the number of original trajectory stop points of POI type i in the original trajectory stop point set.

[0075] Thus, the weight of the POI category corresponding to the original trajectory stop point u can be calculated as:

[0076]

[0077] where w i is the weight of POI type i to the original track stop point u, that is, the semantic sensitivity of the original track stop point u to POI type i; the feature vector of the original track stop point u can be expressed as: u = <w1,w2,…,w k ,…>.

[0078] The semantic privacy sensitivity of each original trajectory stop point is connected to the hierarchical time semantic tree (connection is established through semantic privacy sensitivity, and each node in the hierarchical time semantic tree, that is, each stop point has semantic sensitivity), and the semantic privacy sensitivity is mapped to the hierarchical time semantic tree for backtracking to the corresponding layer. The backtracking layer bt can be regarded as the privacy protection requirement for the user's original trajectory stop point. The smaller the backtracking layer bt value, the lower the user's privacy protection requirement for the original trajectory stop point, and the larger the backtracking layer bt value, the higher the privacy protection requirement. This is because a larger backtracking layer means a closer distance to the root node and a more generalized corresponding semantic category.

[0079] The calculation formula is:

[0080]

[0081] Where W = Σ k w k , w j is the semantic sensitivity of the original trajectory stop point u to POI type j, w k is the semantic sensitivity of the original trajectory stop point u to POI type k, W is the normalization factor of the semantic sensitivity, O l is the backtracking layer number benchmark (or left boundary) under low privacy sensitivity, O r The baseline (or right bound) for the number of backtracking layers under high privacy sensitivity.

[0082] S4: Obtain the privacy budget corresponding to the original trajectory stop points to be protected according to the hierarchical time semantic tree and privacy protection requirements, and use the differential privacy method to minimize the quality loss calculation based on the privacy budget corresponding to the original trajectory stop points to be protected; after calculating all the original trajectory stop points to be protected, the protected trajectory data is finally obtained.

[0083] After constructing the hierarchical time semantic tree, the longest path from the root node to the farthest leaf node is calculated to obtain the height h of the hierarchical time semantic tree. According to the height h of the hierarchical time semantic tree, the privacy is divided into four privacy levels. Then, according to the privacy protection requirements (number of backtracking layers bt) of each original trajectory stop point in the original trajectory data, the corresponding privacy level is found to determine the privacy budget corresponding to the original trajectory stop point to be protected. The privacy protection degree required for the four privacy levels is increasing in sequence. This division can allocate the privacy budget more reasonably, avoiding allocating a smaller privacy budget when the user's privacy requirements are low, or allocating a larger privacy budget when the privacy requirements are high. The privacy budget is obtained by setting, and the subsequent differential privacy method adds the amount of noise according to the size of the privacy budget.

[0084] As shown in the following table:

[0085]

[0086] The method of using the differential privacy method and minimizing the quality loss calculation according to the privacy budget is as follows: use the mechanism K to perturb the original trajectory data to be protected, add differential privacy constraints, and use the linear optimization method to solve the minimum data quality loss generated by the mechanism K.

[0087] Differential privacy solves the two main defects of traditional privacy protection models. It does not need to consider the background knowledge of the attacker and has a strict mathematical definition. The model mainly achieves the purpose of privacy protection by adding random noise to the data.

[0088] Differential privacy definition: Definition (ε-differential privacy): A randomized algorithm M satisfies ε-differential privacy if and only if any possible output result Y on adjacent data sets D and D' satisfies: Pr[M(D)∈Y]≤e ε Pr[M(D')∈Y], where Pr[] is the probability distribution and ε is the privacy budget corresponding to the original trajectory stop point to be protected.

[0089] The differential privacy method perturbs the data by adding random noise to the original trajectory stop points, thereby achieving the purpose of privacy protection; therefore, the original trajectory stop points should meet the requirements of location differential privacy to achieve the purpose of privacy protection.

[0090] For mechanism K:L→O(L *), where L represents the set of original trajectory stop points, O(L * ) represents the set of perturbation probability distributions on the set L of original trajectory stop points. The input of mechanism K is the original trajectory stop point l, l∈L, and the output is the perturbation position l * , l * ∈L * , L * is the set of disturbance positions.

[0091] This mechanism can perturb the original position l (the original trajectory stop point) to a new position l * , while meeting the requirements of location differential privacy and minimizing data quality loss, thereby improving data availability. Data quality loss measures the degree of interference between the output trajectory data and the input trajectory data, and is used to measure the data availability after adding noise.

[0092] Given the prior probability and quality metric, the data quality loss expression generated by mechanism K is:

[0093]

[0094] Among them, d() is the distance function, d(l·l * ) means that the original trajectory stop point l is disturbed to position l * The prior probability π(l) is the ratio of the number of occurrences of the original trajectory stop point l in the set L of the original trajectory stop points to the set L of the original trajectory stop points. Indicates that the original trajectory stop point l is disturbed to position l * The probability of

[0095] A linear optimization problem is used to solve the minimum data quality loss, satisfying the following conditions:

[0096] When the probability When , the data quality loss caused by mechanism K takes the minimum value. Analogy to differential privacy definition Pr[M(D)∈Y]≤e ε Pr[M(D')∈Y] is used to quantify the difference between different original positions l and l' in perturbation to the same position l * The probability difference when is used to require the mechanism K to satisfy differential privacy, e represents the natural logarithm base, and ε represents the privacy budget corresponding to the position to be protected.

[0097] Finally, the set L of original trajectory stop points is perturbed to obtain the perturbed position set L * , so that other users cannot obtain the original location information of this user, thereby achieving location privacy protection and disturbing the location set L * This is the final protected trajectory data.

[0098] This process adds random disturbance noise to the original trajectory stop point data to seek higher data availability and reduce quality loss, so as to obtain the optimal trajectory differential privacy after solving the minimum quality loss, so that the user trajectory data can be personalized with privacy protection.

[0099] Experiment and analysis:

[0100] This paper verifies the performance of the proposed HTST-PTPP method from two aspects: data availability and privacy protection, and compares it with the PLDP-TD method and the TPP-POIs method respectively.

[0101] The PLDP-TD method is a personalized noise trajectory tree structure for personal privacy. This method assumes that each location point on the map has different privacy preferences, but the privacy preference of its location is determined by the location itself and has nothing to do with personal behavior. In other words, the privacy preference of the same location is the same for different users. The TPP-POIs method is a privacy protection method based on trajectory reconstruction. This method first annotates the semantic attributes of all sampling points on the trajectory and establishes the corresponding classification tree, then extracts sensitive stop points, and uses different strategies to select POIs for replacement for different types of sensitive points, thereby completing trajectory reconstruction.

[0102] (1) Data availability

[0103] In terms of data availability, quality loss is used as its evaluation indicator. Quality loss measures the degree of interference between the output trajectory and the input trajectory. The larger the quality loss, the greater the difference between the perturbed trajectory data and the original trajectory data, and the lower the data availability.

[0104] Figure 5 The performance comparison of the HTST-PTPP method proposed in the present invention with the PLDP-TD method and the TPP-POIs method in terms of mass loss is shown. Figure 5It can be seen that as the privacy budget ε increases, the quality loss of the three methods decreases. This is mainly because the similarity between the generated perturbation position and the original position increases with the decrease in the privacy protection strength, thereby enhancing the availability of data. However, the HTST-PTPP method has a smaller quality loss than the other two methods. The main reason is that the HTST-PTPP method not only considers the semantic information of the location and constructs a public semantic tree, but also builds a hierarchical time semantic tree for each user based on the personalized needs of the user. Through hierarchical privacy protection, a perturbation position is generated for each original position, which effectively reduces the quality loss in the process of trajectory privacy protection. The TPP-POIs method considers the semantic information of the location, adds semantic annotations to each location, and selects the perturbation location by the classified location. The PLDP-TD method lacks consideration of the semantic information of the location. Therefore, the TPP-POIs method has a smaller quality loss than the PLDP-TD method.

[0105] (2) Privacy protection

[0106] In terms of privacy protection, adversarial error is used as its evaluation indicator. This indicator measures the expected error of the adversary in reasoning attacks and can be calculated as:

[0107]

[0108] Among them, h(l'|l * ) means to change the position l * The probability of being mapped to position l'.

[0109] The adversarial error represents the expected distortion in the reconstructed event, which means that the larger the adversarial error, the greater the difference between the attacker's predicted location and the true location, and the stronger its privacy protection.

[0110] Figure 4-6 The impact of privacy budget on adversarial errors

[0111] Figure 6The performance comparison of the HTST-PTPP method proposed in the present invention with the PLDP-TD method and the TPP-POIs method in terms of adversarial error is shown. As can be seen from the figure, with the increase of the privacy budget ε, the adversarial errors of the three methods are all reduced. This is because the privacy protection strength decreases with the increase of the privacy budget ε value, and correspondingly less noise needs to be added, resulting in a reduction in adversarial error. When the privacy budget ε is the same, the HTST-PTPP method has a larger adversarial error than the other two methods. The main reason is that the HTST-PTPP method not only considers the semantic information of the location, but also considers the user's stay time, providing users with a more personalized privacy requirement. Although the TPP-POIs method also considers the semantic information of the location, it lacks consideration of the time factor, so the adversarial error is lower than the HTST-PTPP method. The PLDP-TD method only considers the privacy preference of the location point, ignoring the influence of semantic factors and time factors. Therefore, the HTST-PTPP method has better privacy protection.

[0112] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A personalized trajectory privacy protection method based on a hierarchical temporal semantic tree, characterized in that: Includes steps: S1: Obtain public trajectory data, historical trajectory data, original trajectory data and POI dataset; S2: extract the public trajectory stop points, historical trajectory stop points and original trajectory stop points according to the public trajectory data, historical trajectory data and original trajectory data, build a public semantic tree using the public trajectory stop points, and build a hierarchical time semantic tree using the historical trajectory stop points and the public semantic tree; S3: Use the TF-IDF algorithm to calculate the semantic privacy sensitivity of each original trajectory stop point, and calculate the privacy protection requirement based on the semantic privacy sensitivity of each original trajectory stop point; S4: Obtain the privacy budget corresponding to each original trajectory stop point according to the hierarchical time semantic tree and privacy protection requirements, and use the differential privacy method to minimize the quality loss calculation based on the privacy budget corresponding to each original trajectory stop point; After calculating all the original trajectory stop points, the protected trajectory data is finally obtained.

2. The personalized trajectory privacy protection method based on hierarchical time semantic tree according to claim 1 is characterized in that: The method of extracting the public trajectory stop points, the historical trajectory stop points and the original trajectory stop points according to the public trajectory data, the historical trajectory data and the original trajectory data in step S2 is: respectively calculating the latitude and longitude information of the public trajectory stop points, the historical trajectory stop points and the original trajectory stop points, and the formula is: Among them, S i (lon) and S i (lat) represents the longitude and latitude information of the ith stop point, l k (lon) and l k (lat) represents each original position point l in each trajectory data k The longitude and latitude information of each trajectory data, |S| represents the set of stop points of each trajectory data; m and n represent the starting point and end point of each trajectory data respectively; Labeling semantic categories for each stop point: On the server side, the distance from each public track stop point to the nearby POI is calculated based on the longitude and latitude information of the public track stop point, and the semantic category of the closest POI is used to describe the public track stop point; on the mobile client, a POI attribute table is set up, and each set of longitude and latitude information corresponds to a semantic category. The longitude and latitude information and semantic category are stored in the POI attribute table and saved on the mobile client. The POI attribute table is used to label the semantic categories of the historical track stop points and the original track stop points; Calculate the stay time of the mobile client's stop point: take the earliest location point time of the geographical area where the historical trajectory stop point and the original trajectory stop point are located as the arrival time, and the latest location point time as the departure time, and calculate the stay time of the mobile client's stop point.

3. The personalized trajectory privacy protection method based on hierarchical time semantic tree according to claim 1 or 2, characterized in that: The method for constructing a public semantic tree using public trajectory stay points described in step S2 is as follows: on the server side, the public trajectory stay points are divided into different clusters as bottom-level nodes according to the semantic categories and common granularities of the public trajectory stay points; Abstract and generalize the semantic categories of the bottom-level nodes to form the upper-level nodes, and iterate upward from the bottom level until the root node is obtained, thus constructing a public semantic tree.

4. The personalized trajectory privacy protection method based on hierarchical time semantic tree according to claim 3 is characterized in that: The method for abstracting and generalizing the semantic categories of the bottom nodes is as follows: clustering the semantic categories of the bottom nodes using a clustering algorithm, extracting representative categories from each cluster as higher-level abstract categories, creating a mapping table to map the semantic categories of the bottom nodes to higher-level abstract categories, and for each abstracted category, summarizing its characteristics and properties.

5. The personalized trajectory privacy protection method based on hierarchical time semantic tree according to claim 4 is characterized in that: The method for constructing a hierarchical time semantic tree using the historical trajectory stay points and the public semantic tree described in step S2 is: taking the semantic categories of the user's historical trajectory stay points and the clusters of common granularity as the nodes of the middle layer, abstracting and generalizing the semantic categories of the middle layer nodes with reference to the semantic categories of the public semantic tree, and forming upper-layer nodes, and then continuing to abstract and generalize the upper-layer nodes until the root node is found; According to the residence time, clustering classification is iteratively performed downward from the middle layer, and finally, a hierarchical temporal semantic tree with a specific number of layers is generated.

6. The personalized trajectory privacy protection method based on the hierarchical time semantic tree according to any one of claims 2 to 5, characterized in that: The method for calculating the semantic privacy sensitivity of the original trajectory stop point described in step S3 is: embedding the corresponding algorithm and logic in the mobile client, based on the assumption that there is a positive correlation between the public user's access to semantic categories and the demand for semantic attributes, and there is also a positive correlation between the demand for semantic attributes and the number of semantic categories in the POI dataset, preprocessing the original trajectory data and calculating TF-IDF, the calculation method is: Among them, w i is the semantic sensitivity of the original trajectory stop point u to POI type i, N u Indicates the total number of POIs existing in the original trajectory stop point u, n iu represents the number of POI type i in the original trajectory stop point u, |L| represents the number of elements in the original trajectory stop point set, |CS i | represents the number of original trajectory stop points containing POI type i in the original trajectory stop point set, TF i Indicates word frequency, IDF i Represents inverse document frequency.

7. The personalized trajectory privacy protection method based on hierarchical time semantic tree according to claim 6 is characterized in that: The method for calculating the privacy protection requirement according to the semantic privacy sensitivity of each original trajectory stop point in step S3 is: by mapping the semantic privacy sensitivity to the hierarchical time semantic tree, a connection is established between the semantic privacy sensitivity of each original trajectory stop point u and the hierarchical time semantic tree to obtain the privacy protection requirement: Where W = ∑ k w k is the normalization factor of semantic sensitivity, bt is the number of backtracking layers, which is used to indicate the privacy protection requirement, and w j is the semantic sensitivity of the original trajectory stop point u to POI type j, w k is the semantic sensitivity of the original trajectory stop point u to POI type k, O l is the baseline number of backtracking layers under low privacy sensitivity, O r Benchmark for the number of backtracking layers under high privacy sensitivity.

8. The personalized trajectory privacy protection method based on hierarchical time semantic tree according to claim 7 is characterized in that: The method for obtaining the privacy budget of the original trajectory stop point according to the hierarchical time semantic tree and the privacy protection requirement described in step S4 is as follows: after constructing the hierarchical time semantic tree, the longest path from the root node to the farthest leaf node is calculated to obtain the height h of the hierarchical time semantic tree, and according to the height h of the hierarchical time semantic tree, the privacy is divided into multiple privacy levels, and the privacy budget is allocated according to the privacy level. The privacy level is found according to the number of backtracking layers bt of the original trajectory stop point, thereby determining the privacy budget corresponding to the original trajectory stop point.

9. The personalized trajectory privacy protection method based on hierarchical time semantic tree according to claim 8 is characterized in that: The method of using the differential privacy method and performing the minimization quality loss calculation according to the privacy budget corresponding to the original trajectory stop point in step S4 is: using the mechanism K to perturb the data of the original trajectory stop point, adding the differential privacy constraint, and using the linear optimization method to solve the minimum data quality loss generated by the mechanism K; The mechanism K is: K:L→O(L * ), where L represents the set of original trajectory stop points, O(L * ) represents the disturbance position set L * The set of perturbation probability distributions on the upper layer. The input of mechanism K is the original trajectory stop point l, l∈L, and the output is the perturbation position l * , l * ∈L * .

10. The personalized trajectory privacy protection method based on hierarchical time semantic tree according to claim 9 is characterized in that: The method of using a linear optimization method to solve the minimum data quality loss caused by mechanism K by adding differential privacy constraints is: The data quality loss caused by the definition mechanism K is: Among them, d(l·l * ) means to disturb the original trajectory stop point l to the disturbance position l * The mass loss of π(l) is the prior probability, Indicates that the original trajectory stop point l is disturbed to the disturbance position l * The probability of When the differential privacy constraint is satisfied: When , the data quality loss generated by mechanism K takes the minimum value, l and l' represent two different original trajectory stop points, e represents the natural logarithm base, and ε represents the privacy budget corresponding to the position to be protected.

Images