Data anonymization method and device, electronic equipment and storage medium

Abstract

The invention provides a data anonymization method and device, electronic equipment and a storage medium, and the method comprises the steps: classifying medical data, clustering each piece of medical data according to a preset K value, calculating the sensitivity of the medical data contained in a cluster, and if the sensitivity is lower than a preset sensitivity threshold, generalizing each piece of medical data in the cluster, and if the information loss between the generalized data and the original medical data is less than the preset information loss, issuing the generalized data for data sharing. By ensuring that the sensitivity in the clustering cluster is lower than the sensitivity threshold value, the sensitivity of the privacy data in the clustering cluster is controlled to be at a certain level, so that aggregation of high-sensitivity attributes in the clustering cluster is avoided, similarity attacks and background knowledge attacks are effectively resisted, the data privacy protection strength is improved, and the data security is improved. And by controlling the information loss between the generalized data and the original medical data, the information loss caused by data generalization is reduced, and the reliability of the data is ensured.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a data anonymization method, device, electronic equipment and storage medium. Background Art

[0002] At present, the K-Anonymity algorithm has been widely used in relational data and has also been used in medical data sharing. With the development of science and technology, the information flow of various industries has become increasingly high. The sharing of medical data in the medical industry has brought great convenience to medical research, but also increased the risk of individual privacy leakage. Therefore, the realization of data sharing with privacy protection has become an imminent issue. Privacy protection in data release is to take privacy protection measures for publicly released data to prevent others from obtaining private data through knowledge inference, data mining, link attacks and other means.

[0003] Traditional K-Anonymity protection technology has the following shortcomings in the use of medical data: the existing privacy protection algorithm does not consider medical data information comprehensively, does not truly combine the characteristics of medical data, and cannot achieve the ideal privacy protection effect; in the process of k-anonymity clustering, there is a lack of control over the types of sensitive attributes, and the similarity of non-sensitive attributes is used as the clustering standard alone. There is no restriction on the types of privacy data within the class, resulting in similarity attacks and background knowledge attacks on medical data. Summary of the invention

[0004] In view of this, embodiments of the present invention provide a data anonymization method, device, electronic device, and storage medium to improve data security.

[0005] According to one aspect of the present invention, a data anonymization method is provided, the method comprising:

[0006] Acquire medical data to be anonymized, each piece of the medical data including a disease identifier and an attribute identifier;

[0007] Classifying each piece of medical data based on the disease identifier of each piece of medical data to obtain each medical data bucket;

[0008] For each of the medical data buckets, clustering the medical data in the medical data bucket according to a preset clustering K value to obtain each cluster cluster;

[0009] Determine the sensitivity of each medical data in each cluster based on a preset disease semantic tree, wherein the preset disease semantic tree includes a plurality of parent nodes and a plurality of leaf nodes, the parent nodes are classifications of different levels of diseases, and the leaf nodes are specific diseases;

[0010] When the sensitivity of each medical data in the cluster is lower than a preset sensitivity threshold, generalizing each medical data in the cluster based on the preset disease semantic tree to obtain generalized data corresponding to each medical data;

[0011] When the information loss between the generalized data in the cluster and the corresponding medical data is less than the preset information loss, the generalized data in the classification cluster are published to share the medical data.

[0012] In a possible embodiment, for each of the medical data buckets, the medical data in the medical data bucket is clustered according to a preset clustering K value to obtain each cluster cluster, including:

[0013] For each of the medical data buckets, calculating a similarity distance between each of the medical data contained in the medical data bucket;

[0014] Based on the similarity distance between the target medical data and other medical data in the medical data bucket, determine the target medical data with the highest density as the initial node, wherein the other medical data in the medical data bucket refers to the remaining medical data in the medical data bucket except the target medical data;

[0015] Based on the preset clustering K value, the medical data buckets are clustered with the initial node as the clustering center to obtain clusters.

[0016] In a possible embodiment, the attribute includes a numerical attribute and a categorical attribute, and the calculating the similarity distance between each medical data contained in the medical data bucket includes:

[0017] Obtaining disease identifiers and attribute values ​​of first medical data and second medical data, wherein the first medical data is any medical data in the medical data bucket, and the second medical data is any medical data in the medical data bucket except the first medical data;

[0018] For each numerical attribute, determine the numerical similarity corresponding to the numerical attribute based on the first attribute value of the numerical attribute of the first medical data, the second attribute value of the numerical attribute of the second medical data, and the maximum value and the minimum value of the numerical attribute in the medical data bucket;

[0019] For each category-type attribute, based on the distance between the category-type attribute value of the first medical data and the common parent node in the category-type attribute generalization tree, the distance between the category-type attribute value of the second medical data and the common parent node in the category-type attribute generalization tree, the distance between the category-type attribute value of the first medical data and the root node in the category-type attribute generalization tree, and the distance between the category-type attribute value of the second medical data and the root node in the category-type attribute generalization tree, determine the category similarity corresponding to the category-type attribute; wherein the generalization tree is preset according to the classification of each category-type attribute, and the common parent node is the nearest common parent node of the category-type attribute value of the first medical data and the category-type attribute value of the second medical data in the category-type attribute generalization tree;

[0020] Based on the numerical similarities, category similarities, and preset numerical weights and category weights, a similarity distance between the first medical data and the second medical data is obtained.

[0021] In a possible embodiment, the numerical weight is calculated by the following formula:

[0022]

[0023] Among them, ω i is the numerical weight corresponding to the numerical attribute of the i-th dimension, K r is the number of numeric attributes contained in the cluster, i is the number of the numeric attribute, Q i is the information entropy of the numerical attribute of the i-th dimension, which is obtained by the following formula: Where n is the number of medical data contained in the cluster, Q mi is the proportion of medical data mi under numerical attribute i;

[0024] The category weights are calculated using the following formula:

[0025]

[0026] in, is the category weight corresponding to the j-th dimension category attribute, j is the number of the category attribute, Q j is the information entropy of the j-th dimension categorical attribute, which is obtained by the following formula: Among them, Q mj is the proportion of attribute value mj under category attribute j;

[0027] The similarity distance is calculated by the following formula:

[0028]

[0029] Wherein, tm and tn are the first medical data and the second medical data respectively. is the product of the distance between the first attribute value of the numerical attribute i of the first medical data and the second attribute value of the numerical attribute i of the second medical data and the numerical weight, It is the product of the distance between the category attribute i of the first medical attribute and the category attribute i of the second medical data and the category weight.

[0030] In a possible embodiment, the method further includes:

[0031] In the case where there is unclustered medical data in the medical data bucket, determining the similarity between the unclustered medical data and each of the clusters;

[0032] The cluster having the highest similarity to the unclustered medical data is determined as the target cluster of the unclustered medical data.

[0033] In a possible embodiment, determining the sensitivity of each medical data in each cluster based on a preset disease semantic tree includes:

[0034] Divide the disease semantic tree based on different levels of disease types;

[0035] Determining the target category to which each medical data in each of the clusters belongs according to a preset clustering level;

[0036] Based on the proportion of each target classification in the cluster, the sensitivity of the corresponding medical data is determined.

[0037] In a possible embodiment, generalizing each medical data in the cluster based on the preset disease semantic tree to obtain generalized data corresponding to each medical data includes:

[0038] Based on the disease identifiers of the medical data, determining the nearest common parent node of the disease identifiers in the disease semantic tree as the generalized disease identifier of the medical data;

[0039] Based on the attribute identifiers of each of the medical data, the nearest common parent node of each of the attribute identifiers in the corresponding attribute generalization tree is determined as the generalized attribute of each of the medical data.

[0040] According to another aspect of the present invention, a data anonymization device is provided, the device comprising:

[0041] An acquisition module, used for acquiring medical data to be anonymized, each piece of medical data including a disease identifier and an attribute identifier;

[0042] A classification module, used for classifying each piece of medical data based on the disease identification of each piece of medical data to obtain each medical data bucket;

[0043] A clustering module, for clustering the medical data in the medical data buckets according to a preset clustering K value to obtain clusters;

[0044] A determination module, used to determine the sensitivity of each medical data in each cluster based on a preset disease semantic tree, wherein the preset disease semantic tree includes a plurality of parent nodes and a plurality of leaf nodes, the parent nodes are classifications of different levels of diseases, and the leaf nodes are specific diseases;

[0045] A generalization module, used for generalizing each medical data in the cluster based on the preset disease semantic tree to obtain generalized data corresponding to each medical data when the sensitivity of each medical data in the cluster is lower than a preset sensitivity threshold;

[0046] The publishing module is used to publish each generalized data in the classification cluster for medical data sharing when the information loss between the generalized data in the cluster cluster and the corresponding medical data is less than a preset information loss.

[0047] According to another aspect of the present invention, there is provided an electronic device, comprising:

[0048] Processor; and

[0049] Memory for storing programs,

[0050] The program includes instructions, which, when executed by the processor, enable the processor to perform any of the above-mentioned data anonymization methods.

[0051] According to another aspect of the present invention, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are used to enable a computer to execute any of the above-mentioned data anonymization methods.

[0052] One or more technical solutions provided in the embodiments of the present invention, after classifying the medical data to be anonymized, cluster the medical data of each category according to the preset K value, and calculate the sensitivity of the medical data contained in each cluster cluster for each cluster cluster. If the sensitivity is lower than the preset sensitivity threshold, the medical data in the cluster cluster is generalized, and then the information loss between the generalized data and the original medical data is determined. If the information loss is less than the preset information loss, the generalized data can be published for data sharing. By calculating the sensitivity in each cluster cluster, it is ensured that the sensitivity in the cluster cluster is lower than the preset sensitivity threshold, so as to control the sensitivity of the privacy data in the cluster cluster to a certain level, thereby avoiding the aggregation of highly sensitive attributes in the cluster cluster, effectively resisting similarity attacks and a certain degree of background knowledge attacks, improving the protection of data privacy, and improving data security. In addition, by controlling the information loss between the generalized data and the original medical data to be lower than the preset information loss threshold, the information loss caused by data generalization is reduced, and the reliability of the data is guaranteed. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] Further details, features and advantages of the invention are disclosed in the following description of exemplary embodiments in conjunction with the accompanying drawings, in which:

[0054] Figure 1 A schematic diagram of a flow chart of a data anonymization method provided in an embodiment of the present invention;

[0055] Figure 2 A schematic diagram of a disease semantic tree in the data anonymization method provided in an embodiment of the present invention;

[0056] Figure 3 A schematic diagram of a process of data clustering in a data anonymization method provided in an embodiment of the present invention;

[0057] Figure 4 A schematic diagram of an attribute generalization tree in a data anonymization method provided in an embodiment of the present invention;

[0058] Figure 5 A schematic diagram of a process of data generalization in a data anonymization method provided in an embodiment of the present invention;

[0059] Figure 6 A schematic diagram of another flow chart of the data anonymization method provided in an embodiment of the present invention;

[0060] Figure 7 A schematic diagram of the structure of a data anonymization device provided by an embodiment of the present invention;

[0061] Figure 8 A block diagram of an exemplary electronic device that can be used to implement an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0062] Embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present invention are shown in the accompanying drawings, it should be understood that the present invention can be implemented in various forms and should not be construed as being limited to the embodiments described herein, which are instead provided for a more thorough and complete understanding of the present invention. It should be understood that the drawings and embodiments of the present invention are only for exemplary purposes and are not intended to limit the scope of protection of the present invention.

[0063] It should be understood that the various steps described in the method embodiments of the present invention may be performed in different orders and / or in parallel. In addition, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present invention is not limited in this respect.

[0064] The term "including" and its variations used in this document are open inclusions, that is, "including but not limited to". The term "based on" means "based at least in part on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one other embodiment"; the term "some embodiments" means "at least some embodiments". Relevant definitions of other terms will be given in the following description. It should be noted that the concepts of "first", "second", etc. mentioned in the present invention are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0065] It should be noted that the modifications of "one" and "plurality" mentioned in the present invention are illustrative rather than restrictive, and those skilled in the art should understand that, unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0066] The names of the messages or information exchanged between multiple devices in the embodiments of the present invention are only used for illustrative purposes, and are not used to limit the scope of these messages or information.

[0067] In order to improve data security, the embodiments of the present invention provide a data anonymization method, device, electronic device and storage medium. The data anonymization method provided by the embodiments of the present invention can be applied to any electronic device with a data anonymization function, which can be a server, a computer or a mobile terminal, etc. The scheme of the present invention is described below with reference to the accompanying drawings:

[0068] Figure 1 A flow chart of a data anonymization method provided in an embodiment of the present invention may include the following steps:

[0069] S101, obtaining medical data to be anonymized, each piece of the medical data including a disease identifier and an attribute identifier;

[0070] S102, classifying each piece of medical data based on the disease identification of each piece of medical data to obtain each medical data bucket;

[0071] S103, for each of the medical data buckets, clustering the medical data in the medical data bucket according to a preset clustering K value to obtain clusters;

[0072] S104, determining the sensitivity of each medical data in each cluster based on a preset disease semantic tree, wherein the preset disease semantic tree includes a plurality of parent nodes and a plurality of leaf nodes, the parent nodes are classifications of different levels of diseases, and the leaf nodes are specific diseases;

[0073] S105, when the sensitivity of each medical data in the cluster is lower than a preset sensitivity threshold, generalize each medical data in the cluster based on the preset disease semantic tree to obtain generalized data corresponding to each medical data;

[0074] S106. When the information loss between the generalized data in the cluster and the corresponding medical data is less than a preset information loss, publish each generalized data in the classification cluster to share the medical data.

[0075] By applying the embodiment of the present invention, after the medical data to be anonymized is classified, each category of medical data is clustered according to the preset K value, and the sensitivity of the medical data contained in each cluster is calculated for each cluster. If the sensitivity is lower than the preset sensitivity threshold, the medical data in the cluster is generalized, and then the information loss between the generalized data and the original medical data is determined. If the information loss is less than the preset information loss, the generalized data can be published for data sharing. By calculating the sensitivity in each cluster, it is ensured that the sensitivity in the cluster is lower than the preset sensitivity threshold, so as to control the sensitivity of the privacy data in the cluster to a certain level, thereby avoiding the aggregation of highly sensitive attributes in the cluster, effectively resisting similarity attacks and a certain degree of background knowledge attacks, improving the protection of data privacy, and improving data security. In addition, by controlling the information loss between the generalized data and the original medical data to be lower than the preset information loss threshold, the information loss caused by data generalization is reduced, and the reliability of the data is guaranteed.

[0076] The above S101-S106 are exemplarily described below:

[0077] In S101, the medical data to be anonymized may be the medical data generated during the user's medical treatment, or the user's medical data obtained through questionnaires and the like. Each piece of medical data may include a disease identifier and an attribute identifier. The disease identifier may be a disease name, a preset code of the disease, etc. The above attributes may include age, gender, weight, marital status, etc. The above attribute identifiers may be attribute values ​​of corresponding attributes. For example, the attribute identifier of age is a specific age, the attribute identifier of gender includes male and female, the attribute identifier of weight is a specific weight, and the attribute identifier of marital status includes married and unmarried.

[0078] After obtaining the above medical data to be anonymized, each piece of medical data can be classified according to the disease identifier to obtain each medical data bucket, and the medical data in each medical data bucket corresponds to the same disease classification. The disease classification can be performed based on a preset classification rule, which can be set according to the actual application scenario, such as classification according to the site where the disease occurs, or classification according to the body system to which the disease belongs.

[0079] In a possible embodiment, a disease semantic tree may be pre-set, so that the required classification level may be selected based on the disease semantic tree to classify each medical data. The disease semantic tree may include multiple parent nodes and multiple leaf nodes, wherein the parent nodes are classifications of different levels of the disease, and the leaf nodes are specific diseases. Figure 2 As shown, Figure 2 This is a schematic diagram of a disease semantic tree, which may include two classification levels, wherein the first classification level classifies diseases into digestive system diseases, blood system diseases, respiratory system diseases, etc., and the second classification level is the next level of the first classification level, which may include stomach diseases, respiratory infections, etc. The leaf node is the specific disease type contained in the corresponding parent node.

[0080] As a possible implementation method, the medical data to be anonymized can be classified by selecting the corresponding classification level based on the disease semantic tree according to the actual application scenario. Through this technical solution, the data processing standardization is improved by unifying the classification standards, thereby improving the efficiency of data anonymization.

[0081] After obtaining the above-mentioned different medical data buckets, clustering can be performed for each medical data bucket. Specifically, the medical data in each medical data bucket can be clustered according to the preset clustering K value, and the clustering K value refers to the K data included in each cluster obtained by clustering. In actual application scenarios, the K value refers to the number of data corresponding to a piece of user data after anonymization.

[0082] The clustering K value can be set according to the actual application scenario. As a possible implementation, it can be obtained through Python's T-SNE (T-Distributed Stochastic Neighbor Embedding), which is a data visualization technology that can display the number of clusters included in a set of data. Exemplarily, the medical data to be anonymized can be used as the input parameter of T-SNE, and T-NSE can output the number of clusters included in the medical data for the input medical data to be anonymized.

[0083] In one possible embodiment, the data in each medical data bucket may be clustered by a K-means method. In another possible embodiment, the medical data in the data bucket may be clustered according to the following steps:

[0084] S201. For each of the medical data buckets, calculate the similarity distance between each medical data contained in the medical data bucket.

[0085] S202, based on the similarity distance between the target medical data and other medical data in the medical data bucket, determine the target medical data with the highest density as the initial node, wherein the other medical data in the medical data bucket refers to the remaining medical data in the medical data bucket except the target medical data;

[0086] S203 . Based on a preset clustering K value and taking the initial node as the clustering center, clustering the medical data buckets to obtain clusters.

[0087] In related technologies, two definitions, truncated kernel and Gaussian kernel, are usually used to calculate the density ρi of a data object xi. The formula is as follows:

[0088]

[0089] ρ i =∑ j≠i exp(-(d(x i , x j ) / d l ) 2 ) Formula 2

[0090] Among them, d(x i , x j ) represents the data object x i and x j The distance between l is the cutoff distance, which is determined by the neighbor ratio p d To determine, usually p d ∈[1%, 2%], that is, all d(x i , x j ) After sorting from small to large, the values ​​from 1% to 2% are taken as dl However, through analysis, we can know that the parameter d l The choice of ρ t The calculation of is decisive. In order to reduce such interference, the data density of medical data is defined as follows in the embodiment of the present invention:

[0091]

[0092] In Formula 3, the local density ρ t is defined as the similarity distance d from data point i to its first k nearest neighbors ij The choice of neighbor k is more robust than the choice of cutoff distance, that is, no matter what the parameter value of k is, for points in data-dense areas, the distance to surrounding points is relatively short, so ρ is larger, and vice versa. Since the nearest k data points are needed to calculate the density, the larger k is, the more global information the local density can reflect.

[0093] As described above, the medical data contains multiple attributes, and the contribution of each attribute to the relevance of the medical data may be different. In order to consider the relevance between the attribute and the medical data, a weight may be set for each attribute. Specifically, in a possible embodiment, the similarity distance may be calculated by the following steps:

[0094] S211, obtaining disease identifiers and attribute values ​​of first medical data and second medical data, wherein the first medical data is any medical data in the medical data bucket, and the second medical data is any medical data in the medical data bucket except the first medical data;

[0095] S212, for each numerical attribute, determining the numerical similarity corresponding to the numerical attribute based on the first attribute value of the numerical attribute of the first medical data, the second attribute value of the numerical attribute of the second medical data, and the maximum value and the minimum value of the numerical attribute in the medical data bucket;

[0096] For example, the numerical similarity can be obtained by the following formula:

[0097]

[0098] in, Represents the i-th numerical attribute value of the m-th medical data. Represents the i-th numerical attribute value of the m-th medical data. and is the maximum and minimum value of the numerical attribute in the entire data set, and the data set refers to the cluster.

[0099] S213. For each category-type attribute, determine the category similarity corresponding to the category-type attribute based on the distance between the category-type attribute value of the first medical data and the common parent node in the category-type attribute generalization tree, the distance between the category-type attribute value of the second medical data and the common parent node in the category-type attribute generalization tree, the distance between the category-type attribute value of the first medical data and the root node in the category-type attribute generalization tree, and the distance between the category-type attribute value of the second medical data and the root node in the category-type attribute generalization tree; wherein the generalization tree is preset according to the classification of each category-type attribute, and the common parent node is the nearest common parent node of the category-type attribute value of the first medical data and the category-type attribute value of the second medical data in the category-type attribute generalization tree.

[0100] For example, the category similarity can be obtained by the following formula:

[0101]

[0102] in, represents the ith categorical attribute value of the mth medical data. Represents the nearest common parent node of the two classification attributes in the generalization tree, root1 represents the root node of the generalization tree, Representative attributes and The distance can be represented by the number of nodes that the categorical attribute value in the generalization tree needs to pass through to the common parent node and the root node.

[0103] In a possible embodiment, a generalization tree may be preset for each attribute, and the generalization tree includes different levels for classifying different attribute values. For example, for the age attribute, the generalization tree may be the first level: 1-100, the second level: 1-50, 50-100, the third level: 1-18, 18-30, 30-50; 50-60, 60-75, 75-100. Based on this example, if the similarity distance between the attribute value 20 and the attribute value 36 needs to be calculated, their common parent node is 1-50 and the root node is 1-100.

[0104] S214: Obtain a similarity distance between the first medical data and the second medical data based on the numerical similarities, the category similarities, and the preset numerical weights and category weights.

[0105] The above numerical weights and category weights can be calculated for numerical attributes and category attributes of different dimensions. Specifically, the numerical weights are calculated using the following formula:

[0106]

[0107] Among them, ω i is the numerical weight corresponding to the numerical attribute of the i-th dimension, K r is the number of numeric attributes contained in the cluster, i is the number of the numeric attribute, Q i is the information entropy of the numerical attribute of the i-th dimension, which is obtained by the following formula: Where n is the number of medical data contained in the cluster, Q mi is the proportion of medical data mi under numerical attribute i;

[0108] The category weights are calculated using the following formula:

[0109]

[0110] in, is the category weight corresponding to the j-th dimension category attribute, j is the number of the category attribute, Q j is the information entropy of the j-th dimension categorical attribute, which is obtained by the following formula: Among them, Q mj is the proportion of attribute value mj under category attribute j;

[0111] The similarity distance is calculated by the following formula:

[0112]

[0113] Wherein, tm and tn are the first medical data and the second medical data respectively. is the product of the distance between the first attribute value of the numerical attribute i of the first medical data and the second attribute value of the numerical attribute i of the second medical data and the numerical weight, It is the product of the distance between the category attribute i of the first medical attribute and the category attribute i of the second medical data and the category weight.

[0114] After calculating the density of each medical data in each medical data bucket by the above formula, we can sort them in descending order according to the bucket classification to get ρ i Specifically, the medical data in each medical data bucket can be sorted to obtain the ρ corresponding to each medical data bucket. i Sort the list.

[0115] After the above steps are completed, clustering begins. The specific process is to first select ρ from the largest number of clusters tThe largest piece of data is used as the initial data, and then k / (theta-1) pieces of data are selected from the cluster according to the optimal similarity standard and added to the equivalent class generated by clustering. According to this idea, k / (theta-1) pieces of data are selected from the remaining theta-1 clusters in turn. The above theta is the number of groups into which the clusters are divided, which can be set according to the actual application scenario. After clustering is completed, ρ t The list is updated. Specifically, the clustered data in the list can be removed.

[0116] In a possible embodiment, when there is unclustered medical data in the medical data bucket, determining the similarity between the unclustered medical data and each of the clusters;

[0117] The cluster having the highest similarity to the unclustered medical data is determined as the target cluster of the unclustered medical data.

[0118] Exemplarily, after the above steps, the data in Table 1 below can be clustered into the data in Table 3:

[0119] Table 1 Original data table

[0120]

[0121] Table 2 Anonymous data Table 1

[0122]

[0123] Table 3 Anonymous data Table 2

[0124]

[0125]

[0126] Anonymous data table 1 is an anonymous data table obtained through the solution in the related technology. From anonymous data table 1, it can be concluded that 50% of patients suffer from gastric diseases. If the attacker knows that a patient is in the equivalence class at this time, then it can be concluded that the patient with the changed name has a high probability of suffering from gastric diseases, which brings a great risk of privacy leakage. This type of attack is also called a similarity attack. If the attacker knows that a patient in the equivalence class suffers from an orthopedic disease based on background knowledge, but cannot determine the name of the disease, according to the data in anonymous data table 1, it can be concluded that the only orthopedic disease is fracture, then the attacker can infer that the patient's disease is fracture. This privacy theft behavior based on background knowledge is called background attack.

[0127] Anonymous data table 2 is the anonymous data table obtained by the solution proposed in this paper. The k=6 data are divided into theta=3 groups, so that the data between groups have high semantic dissimilarity, ensuring the heterogeneity ratio of sensitive attributes and resisting similarity attacks; the data within the group has high semantic similarity to resist background knowledge attacks. However, there are many serious diseases in anonymous data table 2, such as lung cancer and gastric cancer, which account for as high as 33.33%. If the attacker knows that a patient in the equivalence class has a large expenditure in a certain period of time based on background knowledge, then the attacker can infer that the patient has cancer. In this case, there will also be corresponding background knowledge attacks.

[0128] Therefore, in a possible embodiment, a sensitivity threshold can be preset, and the sensitivity threshold can be flexibly set according to the actual application scenario. The above method can also include: dividing the disease semantic tree based on different levels of disease types; determining the target category to which each medical data in each cluster belongs according to the preset clustering level; and determining the sensitivity of the corresponding medical data based on the proportion of each target category in the cluster.

[0129] Based on the above example, the sensitivities of lung cancer and gastric cancer are set to 0.8 and 0.78 respectively; then the sensitivity of the equivalent group in anonymous data table 2 is (0.8+0.78) / 6=0.2633, and the probability of occurrence of the high-sensitivity attribute group in the equivalence class should be less than 0.263. In anonymous data table 2, two high-sensitivity attributes appear in two different groups, and the probability of occurrence of the high-sensitivity attribute group is 0.667>0.263. Therefore, the anonymous table does not meet the threshold of the sensitivity threshold control mechanism proposed in this scheme, and clustering adjustment is required until the probability of occurrence of the high-sensitivity attribute is less than the sensitivity threshold within the group, and it is continuously iterated until an equivalent class that meets the sensitivity threshold is obtained.

[0130] like Figure 3 As shown, Figure 3 A schematic diagram of a clustering process in a data anonymization method provided in an embodiment of the present invention may include the following steps:

[0131] S301, calculate the local density of the data and generate a descending list P list .

[0132] S302: Select the data with the largest local density from the largest number of medical data classification buckets as the initial node.

[0133] S303 . Select K / m pieces of data from m data buckets through similarity calculation.

[0134] S304: Calculate whether the intra-group sensitivity of the high-sensitivity attribute is less than a preset sensitivity threshold. If so, execute S305; if not, return to S303.

[0135] S305: Is the equivalence class data less than K? If so, return to S303; if not, output the data.

[0136] After obtaining each cluster, based on the disease identifier of each medical data, the nearest common parent node of each disease identifier in the disease semantic tree can be determined as the generalized disease identifier of each medical data; based on the attribute identifier of each medical data, the nearest common parent node of each attribute identifier in the corresponding attribute generalization tree can be determined as the generalized attribute of each medical data.

[0137] like Figure 4 As shown, Figure 4 A schematic diagram of a process of generalizing data in a data anonymization method provided in an embodiment of the present invention. After inputting each cluster, data noise can be added based on a generalization tree, that is, the parent node of the medical data attribute value in the generalization tree is used as the generalization result of the corresponding attribute of the medical data. In this embodiment, each attribute of the medical data can be generalized. As described above, the attribute generalization tree includes different classification levels of attributes, such as Figure 5 As shown, for the gender attribute, its attribute generalization tree may include two nodes, male and female.

[0138] After generalization is completed, the information loss between the generalized data and the original medical data in the cluster can be calculated, specifically, the information entropy loss. If the information loss is greater than the preset loss threshold, the process can return to S103 and cluster the data again. If the information loss is less than the preset loss threshold, the data can be output, that is, the cluster can be published for data sharing.

[0139] like Figure 6 As shown, Figure 6 A flow chart of a data anonymization method provided in an embodiment of the present invention is provided. The method may include clustering and generalization. Specifically, the method may include the following steps:

[0140] S601. Construct a disease semantic tree.

[0141] In this step, each disease can be divided level by level according to the disease type to obtain a disease semantic tree, and the disease semantic tree includes multiple nodes, wherein the parent node is each disease type and the leaf node is a specific disease.

[0142] S602: initial node selection.

[0143] In this step, an initial node may be selected from the medical data to be anonymized, and the initial node is the cluster center. Specifically, the data density of each medical data may be calculated, and then the medical data with the highest data density among various types of medical data may be selected as the initial node.

[0144] S603: Similarity calculation.

[0145] In this step, for each type of medical data, the similarity between each medical data in the type of medical data and the initial node can be calculated, and based on the preset clustering K value, the K data with the highest similarity to the initial node are determined for clustering to obtain each cluster cluster.

[0146] S604: Calculate the intra-group sensitivity.

[0147] The intra-group sensitivity calculation is performed for each cluster obtained in the previous step. Specifically, the sensitivity of each disease can be determined according to the proportion of each disease in the group. If there is data with a sensitivity higher than the preset sensitivity threshold, execute S605; if there is no data with a sensitivity higher than the preset sensitivity threshold, execute S606.

[0148] S605: Cluster adjustment.

[0149] In this step, the initial node or the medical data to be clustered with the initial node can be reselected to obtain a new cluster. The cluster adjustment can also include that if there is non-clustered data in a certain type of medical data, and the number of the non-clustered data is less than K, the non-clustered data can be added to the cluster with the highest similarity, and the cluster with the highest similarity refers to the cluster with the highest sum of similarities between each data contained in the cluster and the non-clustered data.

[0150] S606: Add noise to the data.

[0151] In this step, based on the above disease semantic tree, the diseases in each cluster can be generalized to its parent node. Specifically, the attribute information corresponding to the disease can be generalized to the corresponding parent node. The attribute information may include age, identity, etc.

[0152] S607, K anonymous condition judgment.

[0153] The K anonymity condition may be an information entropy loss condition. Specifically, after generalizing the data in each cluster, the information entropy loss between the generalized data and the original data may be calculated. If the information entropy loss is less than a preset loss threshold, it may be determined that the generalized cluster meets the K anonymity condition. If the information entropy loss is greater than the preset loss threshold, it may be determined that the generalized cluster does not meet the K anonymity condition and data generalization may be performed again.

[0154] S608. Medical data sharing.

[0155] By using the embodiment of the present invention, a classification tree of sensitive attributes is constructed by combining disease information of medical data, clustering data is restricted, and corresponding sensitivity is set for sensitive attributes. During the clustering process, the threshold of the high-sensitivity data group in the equivalence class is continuously controlled to control the sensitivity of the privacy data in the equivalence class at a certain level, thereby avoiding the aggregation of high-sensitivity attributes in the equivalence class and effectively resisting similarity attacks and a certain degree of background knowledge attacks.

[0156] In addition, the data is clustered by similarity, and the nodes with the largest degree of clustering are used as the initial seed nodes to improve the usability of the method. In the clustering process, the idea of ​​greedy clustering is adopted to achieve the global optimum through the local optimum, so that the data in the equivalent class can achieve the highest similarity, thereby reducing the information loss caused by data generalization. It can better cope with the challenges of medical data privacy protection, ensure the privacy security of medical data, and obtain better results in data clustering.

[0157] Based on the same inventive concept, the embodiment of the present invention also provides a data anonymization device, such as Figure 7 As shown, the apparatus 700 may include:

[0158] An acquisition module 701 is used to acquire medical data to be anonymized, each piece of the medical data including a disease identifier and an attribute identifier;

[0159] A classification module 702, for classifying each piece of medical data based on the disease identification of each piece of medical data to obtain each medical data bucket;

[0160] The clustering module 703 is used to cluster the medical data in the medical data bucket according to a preset clustering K value for each medical data bucket to obtain each cluster cluster;

[0161] A determination module 704 is used to determine the sensitivity of each medical data in each cluster based on a preset disease semantic tree, wherein the preset disease semantic tree includes a plurality of parent nodes and a plurality of leaf nodes, the parent nodes are classifications of different levels of diseases, and the leaf nodes are specific diseases;

[0162] A generalization module 705 is used to generalize each medical data in the cluster based on the preset disease semantic tree to obtain generalized data corresponding to each medical data when the sensitivity of each medical data in the cluster is lower than a preset sensitivity threshold;

[0163] The publishing module 706 is used to publish each generalized data in the classification cluster for medical data sharing when the information loss between the generalized data in the cluster and the corresponding medical data is less than a preset information loss.

[0164] Among them, the collection, storage, use, processing, transmission, provision and disclosure of user personal information involved in the present invention are in compliance with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0165] The exemplary embodiment of the present invention further provides an electronic device, comprising: at least one processor; and a memory connected to the at least one processor in communication. The memory stores a computer program that can be executed by the at least one processor, and the computer program is used to enable the electronic device to perform a method according to an embodiment of the present invention when executed by the at least one processor.

[0166] Exemplary embodiments of the present invention also provide a non-transitory computer-readable storage medium storing a computer program, wherein the computer program, when executed by a processor of a computer, is used to cause the computer to perform a method according to an embodiment of the present invention.

[0167] An exemplary embodiment of the present invention further provides a computer program product, comprising a computer program, wherein when the computer program is executed by a processor of a computer, the computer is used to enable the computer to perform a method according to an embodiment of the present invention.

[0168] refer to Figure 8 , a block diagram of an electronic device 800 that can be used as a server or client of the present invention will now be described, which is an example of a hardware device that can be applied to various aspects of the present invention. The electronic device is intended to represent various forms of digital electronic computer devices, such as laptop computers, desktop computers, workbenches, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0169] like Figure 8As shown, the electronic device 800 includes a computing unit 801, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 802 or a computer program loaded from a storage unit 808 into a random access memory (RAM) 803. In the RAM 803, various programs and data required for the operation of the electronic device 800 can also be stored. The computing unit 801, the ROM 802, and the RAM 803 are connected to each other via a bus 804. An input / output (I / O) interface 805 is also connected to the bus 804.

[0170] A plurality of components in the electronic device 800 are connected to the I / O interface 805, including: an input unit 806, an output unit 807, a storage unit 808, and a communication unit 809. The input unit 806 may be any type of device capable of inputting information to the electronic device 800, and the input unit 806 may receive input digital or character information, and generate key signal inputs related to user settings and / or function control of the electronic device. The output unit 807 may be any type of device capable of presenting information, and may include, but is not limited to, a display, a speaker, a video / audio output terminal, a vibrator, and / or a printer. The storage unit 808 may include, but is not limited to, a disk, an optical disk. The communication unit 809 allows the electronic device 800 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks, and may include, but is not limited to, a modem, a network card, an infrared communication device, a wireless communication transceiver, and / or a chipset, such as a Bluetooth™ device, a WiFi device, a WiMax device, a cellular communication device, and / or the like.

[0171] The computing unit 801 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 801 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 801 performs the various methods and processes described above. For example, in some embodiments, any of the above-described data anonymization methods may be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as a storage unit 808. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 800 via the ROM 802 and / or the communication unit 809. In some embodiments, the computing unit 801 may be configured to perform any of the above-described data anonymization methods in any other appropriate manner (e.g., by means of firmware).

[0172] The program code for implementing the method of the present invention can be written in any combination of one or more programming languages. These program codes can be provided to a processor or controller of a general-purpose computer, a special-purpose computer or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code can be executed entirely on the machine, partially on the machine, partially on the machine as a stand-alone software package and partially on a remote machine, or entirely on a remote machine or server.

[0173] In the context of the present invention, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0174] As used herein, the terms "machine-readable medium" and "computer-readable medium" refer to any computer program product, apparatus, and / or device (e.g., disk, optical disk, memory, programmable logic device (PLD)) for providing machine instructions and / or data to a programmable processor, including a machine-readable medium that receives machine instructions as a machine-readable signal. The term "machine-readable signal" refers to any signal for providing machine instructions and / or data to a programmable processor.

[0175] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0176] The systems and techniques described herein may be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), and the Internet.

[0177] A computer system may include clients and servers. Clients and servers are generally remote from each other and usually interact through a communication network. The relationship of client and server is generated by computer programs running on respective computers and having a client-server relationship to each other.

Claims

1. A data anonymization method, characterized in that: The method comprises: Acquire medical data to be anonymized, each piece of the medical data including a disease identifier and an attribute identifier; Classifying each piece of medical data based on the disease identifier of each piece of medical data to obtain each medical data bucket; For each of the medical data buckets, clustering the medical data in the medical data bucket according to a preset clustering K value to obtain each cluster cluster; Determine the sensitivity of each medical data in each cluster based on a preset disease semantic tree, wherein the preset disease semantic tree includes a plurality of parent nodes and a plurality of leaf nodes, the parent nodes are classifications of different levels of diseases, and the leaf nodes are specific diseases; When the sensitivity of each medical data in the cluster is lower than a preset sensitivity threshold, generalizing each medical data in the cluster based on the preset disease semantic tree to obtain generalized data corresponding to each medical data; When the information loss between the generalized data in the cluster and the corresponding medical data is less than the preset information loss, the generalized data in the classification cluster are published to share the medical data.

2. The method according to claim 1, characterized in that For each of the medical data buckets, the medical data in the medical data bucket is clustered according to a preset clustering K value to obtain each cluster cluster, including: For each of the medical data buckets, calculating a similarity distance between each of the medical data contained in the medical data bucket; Based on the similarity distance between the target medical data and other medical data in the medical data bucket, determine the target medical data with the highest density as the initial node, wherein the other medical data in the medical data bucket refers to the remaining medical data in the medical data bucket except the target medical data; Based on the preset clustering K value, the medical data buckets are clustered with the initial node as the clustering center to obtain clusters.

3. The method according to claim 2, characterized in that The attributes include numerical attributes and categorical attributes, and the calculating of the similarity distance between the medical data contained in the medical data bucket includes: Obtaining disease identifiers and attribute values ​​of first medical data and second medical data, wherein the first medical data is any medical data in the medical data bucket, and the second medical data is any medical data in the medical data bucket except the first medical data; For each numerical attribute, determine the numerical similarity corresponding to the numerical attribute based on the first attribute value of the numerical attribute of the first medical data, the second attribute value of the numerical attribute of the second medical data, and the maximum value and the minimum value of the numerical attribute in the medical data bucket; For each category-type attribute, based on the distance between the category-type attribute value of the first medical data and the common parent node in the category-type attribute generalization tree, the distance between the category-type attribute value of the second medical data and the common parent node in the category-type attribute generalization tree, the distance between the category-type attribute value of the first medical data and the root node in the category-type attribute generalization tree, and the distance between the category-type attribute value of the second medical data and the root node in the category-type attribute generalization tree, determine the category similarity corresponding to the category-type attribute; wherein the generalization tree is preset according to the classification of each category-type attribute, and the common parent node is the nearest common parent node of the category-type attribute value of the first medical data and the category-type attribute value of the second medical data in the category-type attribute generalization tree; Based on the numerical similarities, category similarities, and preset numerical weights and category weights, a similarity distance between the first medical data and the second medical data is obtained.

4. The method according to claim 3, characterized in that The numerical weight is calculated by the following formula: Among them, ω i is the numerical weight corresponding to the numerical attribute of the i-th dimension, K r is the number of numeric attributes contained in the cluster, i is the number of the numeric attribute, Q i is the information entropy of the numerical attribute of the i-th dimension, which is obtained by the following formula: Where n is the number of medical data contained in the cluster, Q mi is the proportion of medical data mi under numerical attribute i; The category weights are calculated using the following formula: in, is the category weight corresponding to the j-th dimension category attribute, j is the number of the category attribute, Q j is the information entropy of the j-th dimension categorical attribute, which is obtained by the following formula: Among them, Q mj is the proportion of attribute value mj under category attribute j; The similarity distance is calculated by the following formula: Among them, t m ,t n are the first medical data and the second medical data respectively, is the product of the distance between the first attribute value of the numerical attribute i of the first medical data and the second attribute value of the numerical attribute i of the second medical data and the numerical weight, It is the product of the distance between the category attribute i of the first medical attribute and the category attribute i of the second medical data and the category weight.

5. The method according to claim 2, characterized in that: The method further comprises: In the case where there is unclustered medical data in the medical data bucket, determining the similarity between the unclustered medical data and each of the clusters; The cluster having the highest similarity to the unclustered medical data is determined as the target cluster of the unclustered medical data.

6. The method according to claim 1, characterized in that The step of determining the sensitivity of each medical data in each cluster based on the preset disease semantic tree includes: Divide the disease semantic tree based on different levels of disease types; Determining the target category to which each medical data in each of the clusters belongs according to a preset clustering level; Based on the proportion of each target classification in the cluster, the sensitivity of the corresponding medical data is determined.

7. The method according to claim 1, characterized in that The generalizing each medical data in the cluster based on the preset disease semantic tree to obtain generalized data corresponding to each medical data includes: Based on the disease identifiers of the medical data, determining the nearest common parent node of the disease identifiers in the disease semantic tree as the generalized disease identifier of the medical data; Based on the attribute identifiers of each of the medical data, the nearest common parent node of each of the attribute identifiers in the corresponding attribute generalization tree is determined as the generalized attribute of each of the medical data.

8. A data anonymization device, characterized in that: The device comprises: An acquisition module, used for acquiring medical data to be anonymized, each piece of medical data including a disease identifier and an attribute identifier; A classification module, used for classifying each piece of medical data based on the disease identification of each piece of medical data to obtain each medical data bucket; A clustering module, for clustering the medical data in the medical data buckets according to a preset clustering K value to obtain clusters; A determination module, used to determine the sensitivity of each medical data in each cluster based on a preset disease semantic tree, wherein the preset disease semantic tree includes a plurality of parent nodes and a plurality of leaf nodes, the parent nodes are classifications of different levels of diseases, and the leaf nodes are specific diseases; A generalization module, used for generalizing each medical data in the cluster based on the preset disease semantic tree to obtain generalized data corresponding to each medical data when the sensitivity of each medical data in the cluster is lower than a preset sensitivity threshold; The publishing module is used to publish each generalized data in the classification cluster for medical data sharing when the information loss between the generalized data in the cluster cluster and the corresponding medical data is less than a preset information loss.

9. An electronic device, comprising: processor; as well as Memory for storing programs, The program includes instructions, which, when executed by the processor, cause the processor to perform the method according to any one of claims 1 to 7.

10. A non-transitory computer-readable storage medium storing computer instructions, wherein: The computer instructions are used to make a computer execute the method according to any one of claims 1-7.

Images