Anonymized data analysis method and device and electronic equipment

Abstract

The invention discloses an anonymized data analysis method and device and electronic equipment, and belongs to the technical field of artificial intelligence. The method comprises the steps that anonymization parameters and an anonymization data set of all attributes in user privacy data are acquired, and the anonymization parameters comprise hj and pj; according to the anonymization parameter and the anonymization data set of each attribute, estimating the distribution of each non-empty attribute value of each attribute in the anonymization data set and the distribution of a combined value of the non-empty attribute values of any two attributes; according to the distribution of each non-null attribute value of each attribute in the anonymized data set and the distribution of a combined value of the non-null attribute values of any two attributes, a generation model is constructed, and the generation model is used for expressing a distribution function of the attribute value of each attribute; and reconstructing all attribute values of each attribute according to the generative model.

Description

Technical Field

[0001] The present application belongs to the field of artificial intelligence technology, and specifically relates to an anonymized data analysis method, device and electronic equipment. Background Art

[0002] In order to control the pandemic of certain viruses, it is necessary to collect highly sensitive privacy data such as the age, gender, family structure and medical history of infected people. Many infected people choose not to provide personal information, and some infected people only provide partial personal attribute values ​​for privacy reasons. In this case, the collected privacy-protected data has many missing values.

[0003] Several methods have been proposed for privacy-preserving data mining, but none of these methods take missing values ​​into account. Therefore, when there are many missing values, the accuracy of data analysis will be greatly reduced. Summary of the invention

[0004] The purpose of the embodiments of the present application is to provide an anonymized data analysis method that can solve the problem of reduced data analysis accuracy caused by missing values ​​in user privacy data.

[0005] In a first aspect, an embodiment of the present application provides an anonymized data analysis method, the method comprising:

[0006] Obtain anonymization parameters and anonymized data sets of each attribute in the user's private data, wherein the anonymization parameters include: j and p j , p j A non-null attribute value used to indicate that the attribute has p j Probabilistic anonymization is the non-empty attribute value and (h j -1) randomly selected values, with 1-p j Probabilistic anonymization is h j randomly selected values, h j is an integer greater than 0, p j is a rational number greater than 0 and less than 1;

[0007] According to the anonymization parameters of each of the attributes and the anonymized data set, estimating the distribution of each non-null attribute value of each of the attributes in the anonymized data set and the distribution of the combination value of any two non-null attribute values ​​of the attributes;

[0008] Constructing a generative model according to the distribution of each non-null attribute value of each attribute in the anonymized data set and the distribution of the combined value of any two non-null attribute values ​​of the attributes, wherein the generative model is used to express the distribution function of the attribute value of each attribute;

[0009] According to the generation model, all attribute values ​​of each of the attributes are reconstructed.

[0010] In a second aspect, an embodiment of the present application provides a method for anonymizing private data, the method comprising:

[0011] For each attribute in the collected user privacy data, an anonymization parameter corresponding to the attribute is calculated according to a preset privacy parameter and the number of non-null attribute values ​​of the attribute in the user privacy data, wherein the anonymization parameter includes: h j and p j ,h j is an integer greater than 0, p j is a rational number greater than 0 and less than 1;

[0012] According to the anonymization parameter and the value range of the attribute, each non-empty attribute value of the attribute in the user privacy data is anonymized to obtain an anonymized data set corresponding to the non-empty attribute value of the attribute, wherein for a non-empty attribute value of the attribute, there are p j Probabilistic anonymization is the non-empty attribute value and (h j -1) randomly selected values, with 1-p j Probabilistic anonymization is h j A randomly selected value.

[0013] In a third aspect, an embodiment of the present application provides an anonymized data analysis device, the device comprising:

[0014] An acquisition module is used to acquire anonymization parameters and anonymized data sets of various attributes in the user's private data, wherein the anonymization parameters include: j and p j , p j A non-null attribute value used to indicate that the attribute has p j Probabilistic anonymization is the non-empty attribute value and (h j -1) randomly selected values, with 1-p j Probabilistic anonymization is h j randomly selected values, h j is an integer greater than 0, p j is a rational number greater than 0 and less than 1;

[0015] An estimation module, used for estimating the distribution of each non-null attribute value of each attribute in the anonymized data set and the distribution of the combination value of any two non-null attribute values ​​of the attributes according to the anonymization parameter of each attribute and the anonymized data set;

[0016] A construction module, used to construct a generation model according to the distribution of each non-null attribute value of each attribute in the anonymized data set and the distribution of the combination value of any two non-null attribute values ​​of the attributes, wherein the generation model is used to express the distribution function of the attribute value of each attribute;

[0017] The reconstruction module is used to reconstruct all attribute values ​​of each of the attributes according to the generation model.

[0018] In a fourth aspect, an embodiment of the present application provides a device for anonymizing private data, the method comprising:

[0019] A calculation module, for calculating, for each attribute in the collected user privacy data, an anonymization parameter corresponding to the attribute according to a preset privacy parameter and the number of non-null attribute values ​​of the attribute in the user privacy data, wherein the anonymization parameter includes: j and p j ,h j is an integer greater than 0, p j is a rational number greater than 0 and less than 1;

[0020] anonymization module, used for anonymizing each non-empty attribute value of the attribute in the user privacy data according to the anonymization parameter and the value range of the attribute, to obtain an anonymized data set corresponding to the non-empty attribute value of the attribute, wherein for a non-empty attribute value of the attribute, there are p j Probabilistic anonymization is the non-empty attribute value and (h j -1) randomly selected values, with 1-p j Probabilistic anonymization is h j A randomly selected value.

[0021] In a fifth aspect, an embodiment of the present application provides an electronic device, which includes a processor and a memory, wherein the memory stores programs or instructions that can be run on the processor, and when the program or instructions are executed by the processor, the steps of the method described in the first aspect or the second aspect are implemented.

[0022] In a sixth aspect, an embodiment of the present application provides a computer-readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by a processor, the steps of the method described in the first aspect or the second aspect are implemented.

[0023] In the seventh aspect, an embodiment of the present application provides a chip, which includes a processor and a communication interface, the communication interface is coupled to the processor, and the processor is used to run a program or instruction to implement the method described in the first aspect or the second aspect.

[0024] In an eighth aspect, an embodiment of the present application provides a computer program product, which is stored in a storage medium and is executed by at least one processor to implement the method described in the first aspect or the second aspect.

[0025] In the embodiment of the present application, the distribution of each non-empty attribute value of each attribute in the anonymized data set and the distribution of the combined value of the non-empty attribute values ​​of any two attributes can be estimated based on the anonymization parameters of each attribute in the privacy data obtained from the user and the anonymized data set, and then a generation model for describing the distribution function of the attribute value of each attribute can be constructed based on the distribution of each non-empty attribute value of each attribute in the anonymized data set and the distribution of the combined value of the non-empty attribute values ​​of any two attributes, and all attribute values ​​of each attribute can be reconstructed based on the generation model. Missing values ​​can be filled to obtain complete data records, and the accuracy of data analysis can be improved when performing data analysis. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 A schematic diagram showing a flow chart of an anonymized data analysis method provided in an embodiment of the present application;

[0027] Figure 2 A schematic diagram showing an overall architecture of estimated server-side data provided by an embodiment of the present application;

[0028] Figure 3 A schematic diagram showing a flow chart of a method for anonymizing private data provided in an embodiment of the present application;

[0029] Figure 4 A schematic diagram showing the experimental results of an experiment for calculating JS divergence provided in an embodiment of the present application is shown;

[0030] Figure 5 A schematic diagram showing the structure of an anonymized data analysis device provided in an embodiment of the present application is shown;

[0031] Figure 6 A schematic diagram showing the structure of a device for anonymizing private data provided in an embodiment of the present application;

[0032] Figure 7 A structural block diagram of an electronic device provided by an exemplary embodiment of the present application is shown;

[0033] Figure 8 A structural block diagram of another electronic device provided by an exemplary embodiment of the present application is shown. DETAILED DESCRIPTION

[0034] The following will be combined with the drawings in the embodiments of the present application to clearly describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments in the present application belong to the scope of protection of this application.

[0035] The terms "first", "second", etc. in the specification and claims of the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable under appropriate circumstances, so that the embodiments of the present application can be implemented in an order other than those illustrated or described here, and the objects distinguished by "first", "second", etc. are generally of one type, and the number of objects is not limited. For example, the first object can be one or more. In addition, "and / or" in the specification and claims represents at least one of the connected objects, and the character " / " generally indicates that the objects associated with each other are in an "or" relationship.

[0036] In order to control the pandemic of certain viruses, it is necessary to collect the age, gender, family structure and medical history of infected people. Although this data can be provided to medical institutions by the patients themselves, this information is highly sensitive. If this information is anonymous, it can be shared among researchers around the world without identifying the patients, which will help to clarify the status of the pandemic and predict its course more accurately. Many patients choose not to provide personal information, and some patients only provide partial personal attribute values ​​for privacy reasons. In this case, the collected privacy-protected data has many missing values. At present, many scholars have proposed several methods for privacy-preserving data mining, but none of these methods take missing values ​​into account. Therefore, when there are many missing values, the accuracy of data analysis will be greatly reduced.

[0037] In 2014, Erlingsson et al. proposed a privacy protection technique called Randomized Aggregatable Privacy-Preserving Ordinal Response (RAPPOR). Subsequently, Kairouz et al. analyzed the k-ary randomized response (RR) and RAPPOR algorithms in 2016, and extended them into O-RR (the O-RR method is an improvement on the k-RR method. On the basis of k-RR, hash mapping and cohort operations are also introduced. Through hash mapping, the method no longer focuses on the string itself, so there is no need to collect a list of candidate strings in advance, and the cohort operation can further reduce the probability of hash mapping value conflicts) and O-RAPPOR (O-RAPPOR is an encoding and decoding method based on the RAPPOR method, and hash mapping and cohort operations are introduced on this basis). O-RAPPOR is superior to k-ary RR, RAPPOR, and O-RR. O-RAPPOR uses a space-efficient probabilistic data structure called Bloom filter, which is randomly changed to ensure differential privacy. Sei et al. proposed Single to Randomized Multiple Dummies with Bayes (S2Mb) in 2017, which enhanced the random response scheme and proposed a method to estimate the true count from values ​​with multiple errors. In 2020, Wang et al. proposed a differentially private deep neural network platform for sensitive crowdsourced data.

[0038] The methods proposed by Kairouz et al. do not consider missing values, so all records with missing values ​​must be deleted before applying these methods. The method proposed by Sei et al. assumes that there is one attribute with no missing values; if there are multiple attributes without missing values, they will be converted into one attribute in advance. In the related art, all methods used for different private anonymous data collection in the research on privacy-preserving data collection are seriously affected by the number of records in the database. Therefore, when the number of records is small, the accuracy of data analysis using these methods will be greatly reduced. In the platform proposed by Wang et al., attackers can use model inversion attacks and membership inference attacks to infer sensitive raw data from the trained model. Although in order to protect this data, the platform adds noise during the training phase. However, Wang et al. assume that the platform is a trusted entity that can collect real information about sensitive data.

[0039] The anonymized data analysis method provided by the embodiment of the present application is described in detail below through specific embodiments and their application scenarios in conjunction with the accompanying drawings.

[0040] Figure 1 An anonymized data analysis method provided by an exemplary embodiment of the present application is shown, which is applied to the server side. The method 100 can be executed by an electronic device. In other words, the method can be executed by software or hardware installed in the electronic device. The electronic device can be a terminal device such as a mobile phone. Figure 1 As shown, the method mainly includes the following steps:

[0041] S101: Obtain anonymization parameters and anonymized data sets of various attributes in user privacy data.

[0042] The anonymization parameters include: j and p j , p j A non-null attribute value used to indicate that the attribute has p j Probabilistic anonymization is the non-empty attribute value and (h j -1) randomly selected values, with 1-p j Probabilistic anonymization is h j randomly selected values, h j is an integer greater than 0, p j is a rational number greater than 0 and less than 1.

[0043] In the application embodiment, the server side can receive the anonymization parameters and anonymization data set of each attribute in the user's private data sent by the client, and then obtain the anonymization parameters and anonymization data set of each attribute in the user's private data. For each non-empty attribute value of each attribute in the user's private data of each user, there is a corresponding anonymization parameter and anonymization data set.

[0044] S102: Estimate the distribution of each non-null attribute value of each attribute in the anonymized dataset and the distribution of the combination value of any two non-null attribute values ​​of the attributes according to the anonymization parameter of each attribute and the anonymized dataset.

[0045] In an embodiment of the present application, the distribution of each non-empty attribute value of each attribute in the anonymized data set and the distribution of the combined value of the non-empty attribute values ​​of any two attributes can be estimated based on the anonymization parameter of each attribute and the anonymized data set.

[0046] In practical applications, for each attribute A in the user's private data j , each client has p j The probability of sending its true value and (h j -1) randomly selected values, and there are 1-p j The probability of sending h jrandomly selected values. So for attribute A j For example, the probability of sending the true value is p j , the probability of sending a randomly selected value is:

[0047]

[0048] Let w jk Indicates V jk In {R 1 , R 2 , ..., R g}, u jk Indicates V jk In {R 1 , R 2 , ..., R g}. Therefore, we have the following equation:

[0049]

[0050] Where M is the diagonal element p j , the other elements are q j Let z jk Indicates V jk In {R 1 , R 2 , ..., R g}, so we have:

[0051]

[0052] Among them, M -1 Represents the inverse matrix of matrix M.

[0053] make Represents attribute A j The number of records where the value exists is:

[0054]

[0055] Alternatively, z can be obtained by the expectation maximization algorithm jk :

[0056] z jk ←z jk (p j D k +q j (α-D k )) Formula (1)

[0057] in,

[0058] In the embodiment of the present application, other iterative algorithms can also be used to calculate z jk , the embodiments of the present application are not specifically limited.

[0059] In practical applications, let V jj′ Represents attribute A j And attribute A j′ The combination of elements is:

[0060] V jj′ =V j ×V j′ Formula (2)

[0061] Let u jj′kk′ Indicates V jk and V j′k′ In {R 1 , R 2 , ..., R g}, Indicates that attribute A exists at the same time j And attribute A j′ The number of records of the value of , that is:

[0062]

[0063] As shown in Table 1, due to the attribute A 1 (age) has 4 values, A 2 (Body temperature) has 2 values, A 3 (address) has 3 values, so They are 4, 2, and 3 respectively. Since only two records (items 1 and 4) contain attribute A at the same time 1 and A 2 (the values ​​are [39, 40, 58, 35.2, 35.5], [33, 34, 88, 37.5, 37.6] respectively), so is 2. Similarly, and They are 3 and 1 respectively.

[0064] Table 1. Example of table created from acquired user privacy data

[0065]

[0066]

[0067] In the attribute value distribution estimation, we can estimate the attribute A among n patients. j And attribute A j′ Combination of elements V jk and V j′k′ The occurrence of.

[0068] S103: constructing a generation model according to the distribution of each non-empty attribute value of each attribute in the anonymized data set and the distribution of the combination value of any two non-empty attribute values ​​of the attributes.

[0069] The generation model is used to describe the distribution function of the attribute value of each attribute.

[0070] In an embodiment of the present application, a generation model for describing the distribution function of the attribute value of each attribute can be constructed based on the distribution of each non-empty attribute value of each attribute in the anonymized data set and the distribution of the combined value of the non-empty attribute values ​​of any two attributes.

[0071] In an optional implementation, constructing a generation model according to the distribution of each non-null attribute value of each attribute in the anonymized data set and the distribution of the combination value of any two non-null attribute values ​​of the attributes includes:

[0072] Constructing a joint probability distribution function of multiple attribute values ​​of each attribute according to the value distribution of each attribute and the distribution of the combined values ​​of any two attributes;

[0073] Based on the joint distribution function of multiple attribute values ​​of each of the attributes, the generation model is constructed using a Gaussian copula function.

[0074] In the embodiment of the present application, let F(x 1 , x 2 , ..., x g ) represents the random variable X 1 , X 2 , ..., X g The joint probability distribution function and marginal distribution function F 1 , F 2 , ..., F g The Gaussian Copula function C represents the cumulative distribution function in which each marginal distribution is uniformly distributed in the range [0, 1]. 1 ,u 2 , ..., u g ; The probability density function of Σ) satisfies the following relationship:

[0075]

[0076] in, Represents the probability witness function of the standard Gaussian distribution, that is:

[0077]

[0078] Therefore, it can be concluded that:

[0079]

[0080] Where w = Φ -1 (u).

[0081] In an optional implementation, the joint distribution function of multiple attribute values ​​based on each of the attributes is used to construct the generation model using a Gaussian copula function, including:

[0082] estimating the covariance matrix of the Gaussian link function using a suboptimal method based on a joint distribution function of a plurality of attribute values ​​of each of the attributes;

[0083] Based on the covariance matrix, the generative model is constructed.

[0084] In the embodiment of the present application, Σ needs to be estimated from the collected data. i and w i Respectively represent the i-th u and i-th w. From formula (4), we can get the log-likelihood function of the Gaussian link function:

[0085]

[0086] Among them, w j =Φ -1 (u j ). For Σ in formula (5) -1 The derivative is:

[0087]

[0088] Therefore, the maximum likelihood estimator for:

[0089]

[0090] In the above optional implementation, based on the joint distribution function of the multiple attribute values ​​of each of the attributes, a suboptimal method is used to estimate the covariance matrix of the Gaussian link function, including:

[0091] Calculating the first mutual information between any two attributes based on the estimated distribution of the combination value of the non-null attribute values ​​of any two of the attributes;

[0092] Based on the joint distribution function of multiple attribute values ​​of each of the attributes, each suboptimal element of the covariance matrix is ​​determined to minimize the distance between the first mutual information and the second mutual information, wherein the second mutual information is the mutual information between any two attributes after reconstruction.

[0093] In the embodiment of the present application, the distribution of the combination value of any two non-null attribute values ​​of the attribute can be estimated by calculating the attribute A by the following formula: j And attribute A j′ The first mutual information:

[0094]

[0095] Among them, p(k,k′) is the joint probability distribution function of k and k′, and p(k) and p(k′) are the marginal probability distribution functions of k and k′ respectively.

[0096] In order to alleviate the high computational cost of formula (7), in practical applications, a suboptimal method can be used to estimate ∑. First, the mutual information of each pair of attributes can be calculated using the reconstructed data. Then, each suboptimal element of ∑ is determined to minimize the distance between the first mutual information of the estimated joint distribution and the second mutual information calculated from the reconstructed data.

[0097] S104: Reconstruct all attribute values ​​of each of the attributes according to the generation model.

[0098] In the embodiment of the present application, all attribute values ​​of each attribute can be reconstructed according to the obtained generation model, that is, missing values ​​can be filled to obtain a complete anonymized data set, which can improve the accuracy of analyzing the anonymized data.

[0099] In an optional implementation, after obtaining all attribute values ​​of each of the attributes according to the generation model, the method further includes:

[0100] According to the number of occurrences of each attribute combination between multiple target attributes in all attribute values ​​of each of the attributes, a target contingency table of the multiple target attributes is obtained, wherein the target contingency table is used for the association relationship between the attribute values ​​of the multiple target attributes.

[0101] In an embodiment of the present application, after n complete data records are generated from the Gaussian copula function C and the reconstructed data according to the separation attribute, data analysis can be performed based on the obtained complete data records. In practical applications, a contingency table can be used to analyze the association between various attributes, but if the contingency table is used for many attributes, it loses its main value. Therefore, several attributes are usually selected to construct a contingency table. In an embodiment of the present application, several attributes can be selected as target attributes, and the number of occurrences of each attribute combination between multiple target attributes in the n generated complete data records is simply calculated to construct a target contingency table.

[0102] In practical applications, the generative model and the target contingency table can be constructed through Algorithm 1 shown in Table 2.

[0103] Table 2 Algorithm 1 - Gaussian Copula model and contingency table generation algorithm

[0104]

[0105]

[0106] In the embodiment of the present application, the distribution of each non-empty attribute value of each attribute in the anonymized data set and the distribution of the combined value of the non-empty attribute values ​​of any two attributes can be estimated based on the anonymization parameters of each attribute in the privacy data obtained from the user and the anonymized data set. Then, based on the distribution of each non-empty attribute value of each attribute in the anonymized data set and the distribution of the combined value of the non-empty attribute values ​​of any two attributes, a generation model for describing the distribution function of the attribute value of each attribute is constructed, and all attribute values ​​of each attribute are reconstructed based on the generation model. Not only can a complete data record be obtained, but data analysis can also be performed based on the complete data record to improve accuracy.

[0107] The anonymized data analysis method provided in the embodiment of the present application is as follows Figure 2 As shown, it mainly includes five steps, and the time complexity of each step is shown in Table 3:

[0108] Table 3 Time complexity of Algorithm 1

[0109]

[0110] From the above table, we can see that the total time complexity is.

[0111] Figure 3 A method for anonymizing private data provided by an exemplary embodiment of the present application is shown, which is applied to the client side. The method 300 can be executed by an electronic device. In other words, the method can be executed by software or hardware installed in the electronic device. The electronic device can be a terminal device such as a mobile phone. Figure 3 As shown, the method mainly includes the following steps:

[0112] S301: For each attribute in the collected user privacy data, calculate an anonymization parameter corresponding to the attribute according to a preset privacy parameter and the number of non-null attribute values ​​of the attribute in the user privacy data.

[0113] The anonymization parameters include: j and p j ,h j is an integer greater than 0, p j is a rational number greater than 0 and less than 1.

[0114] In the embodiment of the present application, for each attribute in the collected user privacy data, the anonymization parameter corresponding to the attribute is calculated according to the preset privacy parameter and the number of non-null attribute values ​​of the attribute in the user privacy data. In general, each attribute has its corresponding anonymization parameter h j and p j .

[0115] In the embodiment of the present application, s can be ij A represents the attribute of patient i j The value of the attribute is g, that is, the attribute value of patient i is {s i1 ,s i1 ,…s ig}, and at the same time ij Some values ​​of may be missing, that is, there are missing values. Suppose patient 1 has A 1 (condition) is not missing and is influenza, then s 11 For influenza, s 11 The corresponding anonymization parameter h j and p j .

[0116] In an optional implementation, the calculating the anonymization parameter corresponding to the attribute according to the preset privacy parameter and the number of non-null attribute values ​​of the attribute in the user privacy data may include the following steps:

[0117] Step 1: Based on the privacy parameter and the number of attributes in the user's privacy data, obtain the differential privacy parameter of each attribute; in the embodiment of the present application, the differential privacy parameter of each attribute can be obtained according to the preset privacy parameter and the number of attributes in the user's privacy data. In practical applications, the smaller the privacy parameter, the higher the security (lower the risk of leakage) and the worse the usability (the greater the noise introduced, the smaller the research value of the output data set). Usually a smaller value is taken, such as 0.01, 0.1, 0.5, etc., which can be determined according to actual conditions. The differential privacy parameter can be calculated by dividing the privacy parameter by the number of attributes g in the user's privacy data, that is, ε / g. For example, the preset privacy parameter ε is 0.1, and the attributes in the user's privacy data are age and disease status. The number of attributes g is 2, and the differential privacy parameter of the attribute is 0.05.

[0118] Step 2: Calculate the anonymization parameter corresponding to the attribute based on the differential privacy parameter and the number of attribute values ​​of the attribute. In an embodiment of the present application, the anonymization parameter corresponding to the attribute may be calculated based on the differential privacy parameter and the number of non-null attribute values ​​of the attribute.

[0119] In the above optional implementation, calculating the anonymization parameter corresponding to the attribute based on the number of attribute values ​​of the attribute of the differential privacy parameter includes:

[0120] The anonymization parameters h corresponding to the attributes are calculated by the following formula: j and p j :

[0121]

[0122] Among them, f j represents the number of attribute values ​​of the attribute, ε is the privacy parameter, and g is the number of attributes in the user privacy data.

[0123] In the embodiment of the present application, let f j Represents attribute A j Anonymize each non-null attribute value (non-missing value) s ij , let V j Indicates A j The value range of V jk Indicates V j For example, suppose attribute A 1 Indicates the disease status, and V 1 ={influenza, cancer, hypertension}, then f 1 =3, and V 11 , V 12 , V 13 They represent influenza, cancer, and hypertension respectively. j When the Get the largest integer smaller than itself, and then take the maximum value between that integer and 1 as h j ; Then we can use h j 、f j And the differential privacy parameter ε / g calculates p j .

[0124] S302: Anonymize each non-empty attribute value of the attribute in the user privacy data according to the anonymization parameter and the value range of the attribute to obtain an anonymized data set corresponding to the non-empty attribute value of the attribute.

[0125] Among them, for a non-empty attribute value of the attribute, there are p j Probabilistic anonymization is the non-empty attribute value and (h j -1) randomly selected values, with 1-p j Probabilistic anonymization is h j A randomly selected value.

[0126] In the embodiment of the present application, each non-empty attribute value of the attribute in the user's privacy data can be anonymized according to the anonymization parameter and the value range of the attribute to obtain an anonymized data set corresponding to the non-empty attribute value. 11 For influenza, assume that the corresponding anonymization parameter p is calculated 1 70%,h 1 is 2, then s 11 In the corresponding anonymized data set, there is a 70% probability of including influenza and 1 other disease condition, and a 30% probability (1-p 1 ) includes only cancer and hypertension, excluding influenza.

[0127] In an optional implementation, anonymizing each non-empty attribute value of the attribute in the user privacy data according to the anonymization parameter and the value range of the attribute to obtain an anonymized data set corresponding to the non-empty attribute value of the attribute, including:

[0128] The anonymized data set R corresponding to the attribute is obtained by the following formula: ij :

[0129]

[0130] Here, Ran(S, h) means randomly selecting h non-repeating elements from the set S. For example, assuming S = {A, B, C}, and h = 2, the output of Ran(S, h) is {A, B}, {A, C}, or {B, C}.

[0131] Assumptions 56 A,h 6 is 2, p 6 is 70%, V 6 ={A, B, C}, then the corresponding R 56 for

[0132] In an optional implementation, it is characterized in that after obtaining the anonymized data set corresponding to the attribute, the method further includes:

[0133] The anonymization parameters of the attributes and the anonymized data set are sent to a server.

[0134] In the embodiment of the present application, after obtaining the anonymized data set corresponding to the attribute, the anonymization parameter of the attribute and the anonymized data set can be sent to the server. For example, 56 The corresponding h 6 is 2, p 6 is 70%, After that, h 6and p 6 Send to the server and the corresponding R 56 It is also sent to the server according to probability, so that the server can aggregate the anonymized user privacy data and analyze it.

[0135] For each attribute in the collected user privacy data, the embodiment of the present application calculates the anonymization parameter corresponding to the attribute according to the pre-set privacy parameter and the number of non-empty attribute values ​​of the attribute in the user privacy data. According to the anonymization parameter and the value range of the attribute, each non-empty attribute value of the attribute in the user privacy data is anonymized to obtain an anonymized data set corresponding to the non-empty attribute value of the attribute. The anonymization method of privacy data provided by the embodiment of the present application is more concise in terms of calculation, which can improve processing efficiency and save resources.

[0136] As shown in Table 4, the algorithm steps for anonymizing client data are presented.

[0137] Table 4 Algorithm 2 - Algorithm for anonymizing data

[0138]

[0139] In order to better illustrate the difference between the privacy data anonymization method and the anonymized data analysis method provided in the embodiments of the present application and the related methods in terms of Jensen-Shannon (JS) divergence, a comparative experiment was conducted (JS divergence can measure the similarity of two probability distributions).

[0140] In this comparative experiment, the number of attributes is 10 and 100 respectively, and the attribute value of each individual is randomly determined. The number of patients n is 10000, and for each j there is f j =2. Figure 4 (a), 4(b), 4(c) and Figure 4 (d), 4(e), and 4(f) are the results of g = 10 and g = 100, respectively. Under almost all parameter settings, the JS divergence of the method provided in the embodiment of the present application is lower than that of the related methods. At the same time, as the number of attributes g increases, Figure 4 The results of (d), 4(e), and 4(f) are higher than Figure 4 (a), 4(b), 4(c). At the same time, as ε increases, the JS divergence of all methods decreases.

[0141] As the missing value rate m and the number of target attributes c increase, the JS divergence increases in O-RAPPOR, S2Mb, multidimensional negative surveys (MDN), and perturbing data with sensing errors (PDE) / estimating true distribution considering sensing errors (ETE) methods, but the JS divergence remains at a low level in the method proposed in the application embodiment. PDE / ETE does not convert numerical values ​​into categorical values.

[0142] The anonymized data analysis method provided in the embodiment of the present application can be executed by an anonymized data analysis device. In the embodiment of the present application, the anonymized data analysis device executing the anonymized data analysis method is taken as an example to illustrate the anonymized data analysis device provided in the embodiment of the present application.

[0143] Figure 5 The structure diagram of an anonymous data analysis device provided by an exemplary embodiment of the present application is shown. The anonymous data analysis device can be implemented as follows: Figure 1 In the illustrated embodiment, all or part of the content, the anonymized data analysis device includes: an acquisition module 501, an estimation module 502, a construction module 503 and a reconstruction module 504.

[0144] In the embodiment of the present application, the acquisition module 501 is used to obtain anonymization parameters and anonymized data sets of various attributes in the user's private data, wherein the anonymization parameters include: j and p j , p j A non-null attribute value used to indicate that the attribute has p j Probabilistic anonymization is the non-empty attribute value and (h j -1) randomly selected values, with 1-p j Probabilistic anonymization is h j randomly selected values, h j is an integer greater than 0, p jis a rational number greater than 0 and less than 1; an estimation module 502 is used to estimate the distribution of each non-null attribute value of each attribute in the anonymized data set and the distribution of the combination value of any two non-null attribute values ​​of the attributes according to the anonymization parameters of each attribute and the anonymized data set; a construction module 503 is used to construct a generation model according to the distribution of each non-null attribute value of each attribute in the anonymized data set and the distribution of the combination value of any two non-null attribute values ​​of the attributes, wherein the generation model is used to express the distribution function of the attribute value of each attribute; a reconstruction module 504 is used to reconstruct all attribute values ​​of each attribute according to the generation model.

[0145] In an optional implementation, the reconstruction module 504 is also used to obtain a target contingency table of the multiple target attributes based on the number of occurrences of each attribute combination between the multiple target attributes in all attribute values ​​of each of the attributes, wherein the target contingency table is used for the association relationship between the attribute values ​​of the multiple target attributes.

[0146] In an optional implementation, the construction module 503, when used to construct the generation model according to the distribution of each non-empty attribute value of each attribute in the anonymized data set and the distribution of the combined value of any two non-empty attribute values ​​of the attributes, is specifically used to:

[0147] Constructing a joint probability distribution function of multiple attribute values ​​of each attribute according to the value distribution of each attribute and the distribution of the combined values ​​of any two attributes;

[0148] Based on the joint distribution function of multiple attribute values ​​of each of the attributes, the generation model is constructed using a Gaussian copula function.

[0149] In an optional implementation, the construction module 503, when used for the joint distribution function based on the multiple attribute values ​​of each of the attributes and using the Gaussian copula function to construct the generation model, is specifically used to:

[0150] estimating the covariance matrix of the Gaussian link function using a suboptimal method based on a joint distribution function of a plurality of attribute values ​​of each of the attributes;

[0151] Based on the covariance matrix, the generative model is constructed.

[0152] In an optional implementation, the construction module 503, when used to estimate the covariance matrix of the Gaussian link function using a suboptimal method based on the joint distribution function of multiple attribute values ​​of each of the attributes, is specifically used to:

[0153] Calculating the first mutual information between any two attributes based on the estimated distribution of the combination value of the non-null attribute values ​​of any two of the attributes;

[0154] Based on the joint distribution function of multiple attribute values ​​of each of the attributes, each suboptimal element of the covariance matrix is ​​determined to minimize the distance between the first mutual information and the second mutual information, wherein the second mutual information is the mutual information between any two attributes after reconstruction.

[0155] The anonymized data analysis device in the embodiment of the present application can be an electronic device, or a component in an electronic device, such as an integrated circuit or a chip. The electronic device can be a terminal, or it can be other devices other than a terminal. Exemplarily, the electronic device can be a mobile phone, a tablet computer, a laptop computer, a PDA, a car electronic device, a mobile Internet device (Mobile Internet Device, MID), an augmented reality (augmented reality, AR) / virtual reality (virtual reality, VR) device, a robot, a wearable device, an ultra-mobile personal computer (ultra-mobile personal computer, UMPC), a netbook or a personal digital assistant (personal digital assistant, PDA), etc., and can also be a server, a network attached storage (Network Attached Storage, NAS), a personal computer (personal computer, PC), a television (television, TV), a teller machine or a self-service machine, etc., which is not specifically limited in the embodiment of the present application.

[0156] The anonymized data analysis device in the embodiment of the present application may be a device having an operating system. The operating system may be an Android operating system, an iOS operating system, or other possible operating systems, which are not specifically limited in the embodiment of the present application.

[0157] The anonymized data analysis device provided in the embodiment of the present application can achieve Figure 1 To avoid repetition, the various processes implemented in the illustrated method embodiment will not be described again here.

[0158] The anonymization method for private data provided in the embodiment of the present application can be executed by a private data anonymization device. In the embodiment of the present application, the anonymization method for private data performed by a private data anonymization device is taken as an example to illustrate the anonymization device for private data provided in the embodiment of the present application.

[0159] Figure 6The structure diagram of the anonymization device for private data provided by an exemplary embodiment of the present application is shown. The anonymization device for private data can be implemented as follows: Figure 3 In the illustrated embodiment, all or part of the content, the anonymization device for privacy data includes: a calculation module 601 and an anonymization module 602 .

[0160] In the embodiment of the present application, the calculation module 601 is used to calculate the anonymization parameter corresponding to each attribute in the collected user privacy data according to the preset privacy parameter and the number of non-empty attribute values ​​of the attribute in the user privacy data, wherein the anonymization parameter includes: h j and p j ,h j is an integer greater than 0, p j is a rational number greater than 0 and less than 1; an anonymization module 602 is used to anonymize each non-empty attribute value of the attribute in the user privacy data according to the anonymization parameter and the value range of the attribute, and obtain an anonymized data set corresponding to the non-empty attribute value of the attribute, wherein for a non-empty attribute value of the attribute, there are p j Probabilistic anonymization is the non-empty attribute value and (h j -1) randomly selected values, with 1-p j Probabilistic anonymization is h j A randomly selected value.

[0161] In an optional implementation, when the calculation module 601 is used to calculate the anonymization parameter corresponding to the attribute according to the preset privacy parameter and the number of non-null attribute values ​​of the attribute in the user privacy data, it is specifically used to:

[0162] Based on the privacy parameter and the number of attributes in the user private data, obtaining a differential privacy parameter for each of the attributes;

[0163] An anonymization parameter corresponding to the attribute is calculated based on the differential privacy parameter and the number of attribute values ​​of the attribute.

[0164] In an optional implementation, when the calculation module 601 is used to calculate the anonymization parameter corresponding to the attribute based on the number of attribute values ​​of the attribute of the differential privacy parameter, it is specifically used to:

[0165] The anonymization parameters h corresponding to the attributes are calculated by the following formula: j and p j :

[0166]

[0167] Among them, f jrepresents the number of attribute values ​​of the attribute, ε is the privacy parameter, and g is the number of attributes in the user privacy data.

[0168] In an optional implementation, the anonymization module 602 is used to anonymize each non-empty attribute value of the attribute in the user privacy data according to the anonymization parameter and the value range of the attribute to obtain an anonymized data set corresponding to the non-empty attribute value of the attribute, specifically for:

[0169] The anonymized data set R corresponding to the attribute is obtained by the following formula: ij :

[0170]

[0171] In an optional implementation, the anonymization module 602 is further configured to send anonymization parameters of the attribute and the anonymized data set to a server.

[0172] The anonymization device of the privacy data in the embodiment of the present application can be an electronic device, or a component in the electronic device, such as an integrated circuit or a chip. The electronic device can be a terminal, or it can be other devices other than the terminal. Exemplarily, the electronic device can be a mobile phone, a tablet computer, a laptop computer, a PDA, a car-mounted electronic device, a mobile Internet device (Mobile Internet Device, MID), an augmented reality (augmented reality, AR) / virtual reality (virtual reality, VR) device, a robot, a wearable device, an ultra-mobile personal computer (ultra-mobile personal computer, UMPC), a netbook or a personal digital assistant (personal digital assistant, PDA), etc., and can also be a server, a network attached storage (Network Attached Storage, NAS), a personal computer (personal computer, PC), a television (television, TV), a teller machine or a self-service machine, etc., which is not specifically limited in the embodiment of the present application.

[0173] The anonymization device for private data in the embodiment of the present application may be a device having an operating system. The operating system may be an Android operating system, an iOS operating system, or other possible operating systems, which are not specifically limited in the embodiment of the present application.

[0174] The privacy data anonymization device provided in the embodiment of the present application can achieve Figure 3 To avoid repetition, the various processes implemented in the illustrated method embodiment will not be described again here.

[0175] Alternatively, if Figure 7 As shown, an embodiment of the present application also provides an electronic device 700, including a processor 701 and a memory 702, wherein the memory 702 stores programs or instructions that can be executed on the processor 701, and when the program or instructions are executed by the processor 701, the various steps of the above-mentioned anonymized data analysis method or the privacy data anonymization method are implemented, and the same technical effect can be achieved. To avoid repetition, they are not repeated here.

[0176] It should be noted that the electronic devices in the embodiments of the present application include the mobile electronic devices and non-mobile electronic devices mentioned above.

[0177] Figure 8 FIG. 8 is a block diagram of another electronic device 800 according to an exemplary embodiment of the present application. The electronic device 800 may be implemented as a smart phone, a tablet computer, a laptop computer, a desktop computer, a smart watch, a TV, etc. The electronic device 800 may also be called a user device, a portable terminal, a laptop terminal, a desktop terminal, etc.

[0178] Typically, the electronic device 800 includes a processor 801 and a memory 802 .

[0179] The processor 801 may include one or more processing cores, such as a 4-core processor, a 10-core processor, etc. The processor 801 may be implemented in at least one hardware form of DSP (Digital Signal Processing), FPGA (Field-Programmable Gate Array), and PLA (Programmable Logic Array). The processor 801 may also include a main processor and a coprocessor. The main processor is a processor for processing data in the awake state, also known as a CPU (Central Processing Unit); the coprocessor is a low-power processor for processing data in the standby state. In some embodiments, the processor 801 may be integrated with a GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content to be displayed on the display screen. In some embodiments, the processor 801 may also include an AI (Artificial Intelligence) processor, which is used to process computing operations related to machine learning.

[0180] The memory 802 may include one or more computer-readable storage media, which may be non-transitory. The memory 802 may also include a high-speed random access memory, and a non-volatile memory, such as one or more disk storage devices, flash memory storage devices. In some embodiments, the non-transitory computer-readable storage medium in the memory 802 is used to store at least one instruction, which is used to be executed by the processor 801 to implement all or part of the steps in the anonymized data analysis method or the privacy data anonymization method shown in the method embodiment of the present application.

[0181] In some embodiments, the electronic device 800 may further optionally include: a peripheral device interface 803 and at least one peripheral device. The processor 801, the memory 802 and the peripheral device interface 803 may be connected via a bus or a signal line. Each peripheral device may be connected to the peripheral device interface 803 via a bus, a signal line or a circuit board. Specifically, the peripheral device includes: at least one of a radio frequency circuit 804, a display screen 805, a camera assembly 806, an audio circuit 807 and a power supply 808.

[0182] In some embodiments, the electronic device 800 further includes one or more sensors 809 , including but not limited to: an acceleration sensor 810 , a gyroscope sensor 811 , a pressure sensor 812 , an optical sensor 813 , and a proximity sensor 814 .

[0183] Those skilled in the art will understand that Figure 8 The structure shown in the figure does not constitute a limitation on the electronic device 800, and may include more or less components than those shown in the figure, or combine some components, or adopt a different component arrangement.

[0184] An embodiment of the present application also provides a computer-readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by a processor, the various processes of the above-mentioned anonymized data analysis method or the privacy data anonymization method are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0185] The processor is the processor in the electronic device described in the above embodiment. The readable storage medium includes a computer readable storage medium, such as a computer read-only memory ROM, a random access memory RAM, a magnetic disk or an optical disk.

[0186] An embodiment of the present application further provides a chip, which includes a processor and a communication interface, wherein the communication interface is coupled to the processor, and the processor is used to run programs or instructions to implement the various processes of the above-mentioned anonymized data analysis method or the privacy data anonymization method, and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0187] It should be understood that the chip mentioned in the embodiments of the present application can also be called a system-level chip, a system chip, a chip system or a system-on-chip chip, etc.

[0188] An embodiment of the present application provides a computer program product, which is stored in a storage medium. The program product is executed by at least one processor to implement the various processes of the above-mentioned anonymized data analysis method or the privacy data anonymization method, and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0189] It should be noted that, in this article, the terms "comprise", "include" or any other variant thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise one..." do not exclude the presence of other identical elements in the process, method, article or device including the element. In addition, it should be pointed out that the scope of the methods and devices in the embodiments of the present application is not limited to performing functions in the order shown or discussed, and may also include performing functions in a substantially simultaneous manner or in reverse order according to the functions involved, for example, the described method may be performed in an order different from that described, and various steps may also be added, omitted, or combined. In addition, the features described with reference to certain examples may be combined in other examples.

[0190] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a computer software product, which is stored in a storage medium (such as ROM / RAM, a disk, or an optical disk), and includes a number of instructions for a terminal (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present application.

[0191] The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of the present application, ordinary technicians in this field can also make many forms without departing from the purpose of the present application and the scope of protection of the claims, all of which are within the protection of the present application.

Claims

1. A method for analyzing anonymized data, characterized in that: include: Obtain anonymization parameters and anonymized data sets of each attribute in the user's private data, wherein the anonymization parameters include: j and p j , p j A non-null attribute value used to indicate that the attribute has p j Probabilistic anonymization is the non-empty attribute value and (h j -1) randomly selected values, with 1-p j Probabilistic anonymization is h j randomly selected values, h j is an integer greater than 0, p j is a rational number greater than 0 and less than 1; According to the anonymization parameters of each of the attributes and the anonymized data set, estimating the distribution of each non-null attribute value of each of the attributes in the anonymized data set and the distribution of the combination value of any two non-null attribute values ​​of the attributes; Constructing a generative model according to the distribution of each non-null attribute value of each attribute in the anonymized data set and the distribution of the combined value of any two non-null attribute values ​​of the attributes, wherein the generative model is used to express the distribution function of the attribute value of each attribute; According to the generation model, all attribute values ​​of each of the attributes are reconstructed.

2. The method according to claim 1, characterized in that: After obtaining all attribute values ​​of each of the attributes according to the generation model, the method further includes: According to the number of occurrences of each attribute combination between multiple target attributes in all attribute values ​​of each of the attributes, a target contingency table of the multiple target attributes is obtained, wherein the target contingency table is used for the association relationship between the attribute values ​​of the multiple target attributes.

3. The method according to claim 1 or 2, characterized in that: The constructing of a generation model according to the distribution of each non-empty attribute value of each attribute in the anonymized data set and the distribution of the combined value of any two non-empty attribute values ​​of the attributes comprises: Constructing a joint probability distribution function of multiple attribute values ​​of each attribute according to the value distribution of each attribute and the distribution of the combined values ​​of any two attributes; Based on the joint distribution function of multiple attribute values ​​of each of the attributes, the generation model is constructed using a Gaussian copula function.

4. A method for anonymizing private data, characterized in that: include: For each attribute in the collected user privacy data, an anonymization parameter corresponding to the attribute is calculated according to a preset privacy parameter and the number of non-null attribute values ​​of the attribute in the user privacy data, wherein the anonymization parameter includes: h j and p j ,h j is an integer greater than 0, p j is a rational number greater than 0 and less than 1; According to the anonymization parameter and the value range of the attribute, each non-empty attribute value of the attribute in the user privacy data is anonymized to obtain an anonymized data set corresponding to the non-empty attribute value of the attribute, wherein for a non-empty attribute value of the attribute, there are p j Probabilistic anonymization is the non-empty attribute value and (h j -1) randomly selected values, with 1-p j Probabilistic anonymization is h j A randomly selected value.

5. The method according to claim 4, characterized in that The calculating, according to the preset privacy parameter and the number of non-null attribute values ​​of the attribute in the user privacy data, an anonymization parameter corresponding to the attribute includes: Based on the privacy parameter and the number of attributes in the user private data, obtaining a differential privacy parameter for each of the attributes; An anonymization parameter corresponding to the attribute is calculated based on the differential privacy parameter and the number of attribute values ​​of the attribute.

6. An anonymized data analysis device, characterized in that: include: An acquisition module is used to acquire anonymization parameters and anonymized data sets of various attributes in the user's private data, wherein the anonymization parameters include: j and p j , p j A non-null attribute value used to indicate that the attribute has p j Probabilistic anonymization is the non-empty attribute value and (h j -1) randomly selected values, with 1-p j Probabilistic anonymization is h j randomly selected values, h j is an integer greater than 0, p j is a rational number greater than 0 and less than 1; An estimation module, used for estimating the distribution of each non-null attribute value of each attribute in the anonymized data set and the distribution of the combination value of any two non-null attribute values ​​of the attributes according to the anonymization parameter of each attribute and the anonymized data set; A construction module, used to construct a generation model according to the distribution of each non-null attribute value of each attribute in the anonymized data set and the distribution of the combination value of any two non-null attribute values ​​of the attributes, wherein the generation model is used to express the distribution function of the attribute value of each attribute; The reconstruction module is used to reconstruct all attribute values ​​of each of the attributes according to the generation model.

7. A device for anonymizing private data, the method comprising: A calculation module is used to calculate, for each attribute in the collected user privacy data, an anonymization parameter corresponding to the attribute according to a preset privacy parameter and the number of non-null attribute values ​​of the attribute in the user privacy data, wherein the anonymization parameter includes: j and p j ,h j is an integer greater than 0, p j is a rational number greater than 0 and less than 1; anonymization module, used for anonymizing each non-empty attribute value of the attribute in the user privacy data according to the anonymization parameter and the value range of the attribute, and obtaining an anonymized data set corresponding to the non-empty attribute value of the attribute, wherein a non-empty attribute value of the attribute has a probability pj to be anonymized into the non-empty attribute value and (h j -1) randomly selected values, with 1-p j Probabilistic anonymization is h j A randomly selected value.

8. An electronic device comprising a processor and a memory, wherein the memory stores programs or instructions that can be run on the processor, and when the program or instructions are executed by the processor, the steps of the anonymized data analysis method as described in any one of claims 1 to 3 or the privacy data anonymization method as described in any one of claims 4 to 5 are implemented.

9. A computer-readable storage medium storing a program or instruction, wherein the program or instruction, when executed by a processor, implements the steps of the anonymized data analysis method as described in any one of claims 1 to 3 or the privacy data anonymization method as described in any one of claims 4 to 5.

10. A computer program product, wherein the program product is stored in a storage medium and is executed by at least one processor to implement the steps of the anonymized data analysis method according to any one of claims 1 to 3 or the privacy data anonymization method according to any one of claims 4 to 5.

Images