User data intelligent protection method and system based on differential privacy

Abstract

The invention discloses a user data intelligent protection method and system based on differential privacy, and belongs to the technical field of data protection, and the method specifically comprises the steps: collecting and preprocessing user health data; setting a dynamic privacy budget according to the data sensitivity, the analysis purpose and the privacy demand, and adding random noise to generate disturbance data by adopting a multi-strategy fused data disturbance strategy; statistical analysis is carried out, and an improved differential privacy algorithm is used to assess the privacy leakage risk, the protection degree and the data availability; based on an evaluation result, a privacy budget and a disturbance strategy are iteratively adjusted through a feedback loop mechanism; the health data analysis method provided by the invention not only can protect user privacy, but also can ensure data availability.

Description

Technical Field

[0001] The present invention belongs to the technical field of data protection, and specifically relates to a user data intelligent protection method and system based on differential privacy. Background Art

[0002] Intelligent methods for protecting user data mainly involve information technology, privacy protection, data encryption, and security protocols. With the development of the Internet, mobile computing, and the Internet of Things, personal health data has become easier to obtain and share, but it also brings challenges to data privacy and security. Among them, data privacy protection is a key technology to ensure that user health data is not accessed, used, or disclosed without authorization. It involves all aspects of data collection, storage, use, and sharing, aiming to protect the personal privacy rights and interests of users. In the early days, the protection of user health data mainly relied on traditional data encryption and data desensitization technologies. Although these technologies can protect the privacy of data to a certain extent, their limitations are gradually emerging in the face of increasingly complex data usage scenarios and privacy leakage risks.

[0003] For example, the patent with the authorization announcement number CN111814189B discloses a distributed learning privacy protection method based on differential privacy, including: applying to n user nodes in the network, each user has its own independently distributed set of data samples, and including the following steps: initialization phase; user node local learning phase; user node obtains neighbor node information and updates phase; noise disturbance phase; broadcast phase. This technical solution can solve the current privacy protection problem in distributed learning, allowing user nodes to update their local parameters through neighbor nodes and send noise-processed parameters to neighbor nodes, thereby protecting users' personal sensitive data from being leaked in a decentralized network environment.

[0004] For example, the patent with the authorization announcement number CN110598447B discloses a t-closeness privacy protection method that satisfies ε-differential privacy, including: pre-processing the original data (hospital patient data, including name, age, contact information, place of origin, and health status), establishing a QIS data table that associates quasi-identifiers with sensitive attributes, and then dividing the data table into a set of buckets according to the hierarchical tree of sensitive attributes in the data table, adding a dynamic programming algorithm to partition the data table, and finally generalizing the partition results to generate an anonymous data table. In view of the shortcomings of the traditional t-closeness privacy protection model, such as its inability to resist attackers with certain background knowledge, over-reliance on the distribution of sensitive attributes, and the possibility that differential privacy may cause the published data to lose its value and meaning, a new distance function is introduced to optimize t-closeness, and the threshold t is optimized and adjusted, realizing the combination of t-closeness and differential privacy standards, which can ensure the utility of data release and protect the relationship between data while minimizing data loss.

[0005] The above existing technologies all have the following problems: parameter setting is difficult and data loss is large; flexibility is poor and there may be certain limitations when dealing with attackers with different background knowledge; and a high level of technology and computing resources are required. Summary of the invention

[0006] In view of the shortcomings of the prior art, the present invention proposes a user data intelligent protection method and system based on differential privacy, which collects and preprocesses user health data; sets a dynamic privacy budget according to data sensitivity, analysis purpose and privacy requirements, and adopts a multi-strategy fusion data perturbation strategy to add random noise to generate perturbation data; performs statistical analysis, and uses an improved differential privacy algorithm to evaluate the privacy leakage risk, protection level and data availability; based on the evaluation results, iteratively adjusts the privacy budget and perturbation strategy through a feedback loop mechanism; the present invention provides a health data analysis method that can both protect user privacy and ensure data availability.

[0007] To achieve the above object, the present invention provides the following technical solutions:

[0008] A user data intelligent protection method based on differential privacy, comprising:

[0009] Step S1: Collect user health data and perform preprocessing;

[0010] Step S2: according to data sensitivity, analysis purpose and privacy protection requirements, an adaptive privacy budget allocation mechanism is set up. Based on the adaptive privacy budget allocation mechanism, a multi-strategy fusion data perturbation strategy is used to add random noise to the pre-processed user health data to generate perturbed health data;

[0011] Step S3: Statistically analyze the disturbed health data, and use the improved differential privacy protection algorithm to evaluate the privacy leakage risk, privacy protection degree, and data availability of the differential privacy protection method by calculating the privacy loss;

[0012] Step S4: Based on the evaluation results of step S3, a feedback loop mechanism is used to iteratively adjust the privacy budget and data perturbation strategy.

[0013] Specifically, the specific steps of step S2 include:

[0014] S2.1: Assess the sensitivity of user health data, clarify the purpose of data analysis, and determine the specific needs for privacy protection;

[0015] S2.2: Obtain pre-processed user health data and set up an adaptive privacy budget allocation mechanism based on data sensitivity, analysis purpose, and privacy protection requirements;

[0016] S2.3: According to the privacy budget and data characteristics, a multi-strategy fusion data perturbation strategy is used to add random noise to the preprocessed user health data to generate perturbed health data.

[0017] Specifically, the specific steps of S2.2 include:

[0018] S2.21: Receive pre-processed user health data X = {x1,...,x N}, obtain data sensitivity, analysis purpose and privacy protection requirements, and set a global privacy budget δ total , where x i ,i∈[1,N] represents the i-th preprocessed user health data, and N represents the number of preprocessed user health data;

[0019] S2.22: Sensitivity difference α based on preprocessed user health data i , the privacy budget allocation of each data item is dynamically adjusted using a weight allocation method based on data sensitivity. The formula is:

[0020]

[0021] Among them, δ i represents the privacy budget allocated to the i-th preprocessed user health data, w i represents the importance weight of the i-th preprocessed user health data for the analysis purpose, s i represents the sensitivity level of the i-th preprocessed user health data, λ i represents the correlation coefficient between the i-th preprocessed user health data and other preprocessed user health data, β irepresents the dynamic adjustment factor of the i-th preprocessed user health data;

[0022] S2.23: Set the privacy budget consumption threshold h1, and monitor the consumption of the privacy budget Loss in real time during the data analysis process;

[0023] If Loss ≥ h1, adjust the privacy protection strategy or stop the analysis.

[0024] Specifically, the specific steps of S2.3 include:

[0025] S2.31: According to X={x1,...,x N} and δ total , and for X={x1,...,x N} Perform feature extraction to obtain user health feature data in, represents the nth user health characteristic data, where n represents the number of user health characteristic data;

[0026] S2.32: According to and privacy protection requirements, determine the jth strategy ce j ,j∈[1,4] is the weight in the fusion and priority And according to ce j The weights and priorities are integrated to generate the data perturbation strategy ce shu ,in, Indicates the weight of the jth strategy in the fusion process, Level j represents the priority of the jth strategy in the fusion process, α, η represents the weight coefficient, g j represents the privacy protection contribution of the jth strategy, sun j represents the availability loss of the jth strategy, ben j represents the implementation cost of the jth strategy.

[0027] Specifically, the specific steps of S2.3 also include:

[0028] S2.33: Data perturbation strategy based on ce shu , calculate each data x i The sensitivity Δs, and according to the noise distribution type and δ i , calculate the amount of random noise Δnoise that needs to be added, and the calculation formula for sensitivity and random noise is:

[0029]

[0030] Where X(A) and X(B) represent two adjacent data sets, that is, only one data point is different, f(X(A)) and f(X(B)) represent the query functions of X(A) and X(B), ‖f(X(A))-f(X(B))|| represents the norm of the difference between the output values ​​of the sensitivity function f on two different data sets X(A) and X(B), and Laplace(·) represents the Laplace noise function;

[0031] S2.34: Generate random noise using a random number generator according to the obtained random noise amount, and add the generated random noise to X={x1,...,x N}, generate perturbed health data X′={x1′,...,x′ N}, where x i ′,i∈[1,N] represents the i-th perturbed health data.

[0032] Specifically, the specific steps of S3 include:

[0033] S3.1: Obtain disturbance health data X′={x1′,...,x′ N}, combined with the privacy protection requirement information, calculate X′={x1′,...,x′ N}mean and variance;

[0034] S3.2: Use the improved differential privacy protection algorithm to calculate the privacy loss. The formula is:

[0035]

[0036] Where L represents the privacy loss, D represents the number of output sets considered, and μ k represents the kth output set R k The weight of P[f(X(A),t k )∈R k ] and P[f(X(B),t k )∈R k ] means that on the data sets X(A) and X(B), the parameter t is used k After the query function is queried, the output result falls into the set R k The probability of t k represents the time parameter associated with the kth output set, R k represents the k-th output set, b represents the adjustment parameter, f1(Δs) represents the sensitivity function, and ln(·) represents the logarithmic function;

[0037] S3.3: Evaluate the privacy protection degree of the differential privacy protection method based on the calculation results of privacy loss, and evaluate the data availability by comparing the statistical analysis results of the original data and the perturbed data.

[0038] Specifically, the strategy in S2.32 selects Laplace noise addition, k-anonymity, l-diversity and differential privacy.

[0039] A user data intelligent protection system based on differential privacy, comprising: a data processing module, a data perturbation module, a differential privacy protection module and a strategy adjustment module;

[0040] The data processing module is used to collect user health data and perform preliminary processing and cleaning;

[0041] The data perturbation module is used to protect user privacy by adding random noise to the preprocessed user health data;

[0042] The differential privacy protection module is used to perform statistical analysis on the disturbed health data and to quantitatively evaluate the differential privacy protection method using an improved differential privacy protection algorithm;

[0043] The strategy adjustment module is used to iteratively adjust the privacy budget and data perturbation strategy according to the evaluation results.

[0044] Specifically, the data perturbation module includes: a privacy budget setting unit, a strategy selection unit and a noise adding unit;

[0045] The privacy budget setting unit is used to dynamically calculate and set the privacy budget;

[0046] The strategy selection unit is used to select a data perturbation strategy and noise based on a privacy budget;

[0047] The noise adding unit is used to add noise to the preprocessed user health data according to the selected data perturbation strategy.

[0048] Specifically, the differential privacy protection module includes: an algorithm application unit, a risk assessment unit, a privacy protection degree assessment unit and a data availability assessment unit;

[0049] The algorithm application unit is used to implement an improved differential privacy protection algorithm;

[0050] The risk assessment unit is used to assess the privacy leakage risk in the process of processing user health data in real time and identify potential security threats;

[0051] The privacy protection degree evaluation unit is used to quantitatively evaluate the effectiveness of the currently adopted privacy protection measures;

[0052] The data availability assessment unit is used to assess whether the data after privacy protection processing is still available and accurate.

[0053] Compared with the prior art, the present invention has the following beneficial effects:

[0054] 1. The present invention proposes a user data intelligent protection method based on differential privacy. By collecting and preprocessing user health data, the accuracy and integrity of the data are ensured. According to the sensitivity of the data, the purpose of analysis and the privacy protection requirements, the privacy budget is dynamically set, and a multi-strategy fusion data perturbation strategy is used to add random noise to the data, thereby effectively protecting user privacy. The combination of dynamic adjustment and multiple protection strategies makes privacy protection more flexible and effective.

[0055] 2. The present invention proposes a user data intelligent protection method based on differential privacy. It also uses an improved differential privacy protection algorithm to perform statistical analysis on the perturbation data, and evaluates the privacy leakage risk, privacy protection level and data availability. Through the feedback loop mechanism, the privacy budget and data perturbation strategy are iteratively adjusted according to the evaluation results to further optimize the privacy protection effect and data availability. This continuous optimization and improvement enables the process to better balance the relationship between privacy protection and data utilization in practical applications. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] Figure 1 A schematic diagram of a user data intelligent protection method based on differential privacy in the present invention;

[0057] Figure 2 This is a principle flow chart of a user data intelligent protection method based on differential privacy of the present invention;

[0058] Figure 3 A flowchart of health data generation by a user data intelligent protection method based on differential privacy according to the present invention;

[0059] Figure 4 This is an architecture diagram of a user data intelligent protection system based on differential privacy in the present invention. DETAILED DESCRIPTION

[0060] Example 1

[0061] See also Figure 1-Figure 3 , an embodiment provided by the present invention: a user data intelligent protection method based on differential privacy, comprising the following steps:

[0062] Step S1: Collect user health data and perform preprocessing, wherein the user health data includes but is not limited to physiological indicators, disease history, and living habits, specifically including age, gender, height, weight, sleep quality, eating habits, exercise volume, blood pressure, and blood sugar;

[0063] Step S2: according to data sensitivity, analysis purpose and privacy protection requirements, an adaptive privacy budget allocation mechanism is set up. Based on the adaptive privacy budget allocation mechanism, a multi-strategy fusion data perturbation strategy is used to add random noise to the pre-processed user health data to generate perturbed health data;

[0064] It should be noted that it is necessary to set an adaptive privacy budget allocation mechanism based on the sensitivity of the data, the specific purpose of the analysis, and the actual needs of privacy protection. This privacy budget is a key parameter that determines the amount of random noise that can be added during the data perturbation process. The higher the data sensitivity or the stricter the privacy protection requirements, the higher the privacy budget needs to be set to ensure that too much personal privacy information is not leaked during the data analysis process. Then, the set privacy budget is used to guide the application of multiple data perturbation strategies. The data perturbation strategies of multi-strategy fusion include but are not limited to Laplace noise addition based on differential privacy, and a hybrid strategy combining k-anonymity and l-diversity. As well as synthetic data replacement generated based on deep learning, the selection and parameter setting of these noise addition methods will be affected by the privacy budget. Specifically, the higher the privacy budget, the less or milder noise can be added to maintain the availability of the data; the lower the privacy budget, the more or stronger noise needs to be added to enhance privacy protection. Therefore, after setting the dynamic privacy budget, the appropriate multi-data perturbation strategy will be selected according to this budget and the corresponding parameters will be set for it; finally, these strategies are applied to the preprocessed user health data to add an appropriate amount of random noise to it, thereby generating perturbed health data that protects user privacy and maintains data characteristics.

[0065] Step S3: Statistically analyze the disturbed health data, and use the improved differential privacy protection algorithm to evaluate the privacy leakage risk, privacy protection degree, and data availability of the differential privacy protection method by calculating the privacy loss;

[0066] Step S4: Based on the evaluation results of step S3, a feedback loop mechanism is used to iteratively adjust the privacy budget and data perturbation strategy.

[0067] The specific steps of step S2 include:

[0068] S2.1: Assess the sensitivity of user health data, clarify the purpose of data analysis, and determine the specific needs for privacy protection;

[0069] Among them, (1) Data sensitivity assessment: assess the sensitivity of user health data, including the privacy level of the data and the scope of personal information involved; (2) Clarify the purpose of analysis: clarify the purpose of data analysis, such as whether it is used for medical research, health monitoring or other purposes; (3) Determine privacy protection needs: determine the specific needs of privacy protection based on laws, regulations, industry standards or user agreements.

[0070] S2.2: Obtain the pre-processed user health data and set up an adaptive privacy budget allocation mechanism based on data sensitivity, analysis purpose, and privacy protection requirements. The adaptive privacy budget allocation mechanism not only considers the limitation of the global privacy budget, but also dynamically adjusts the privacy budget allocation of each data item based on the sensitivity difference of the data item;

[0071] S2.3: According to the privacy budget and data characteristics, a multi-strategy fusion data perturbation strategy is used to add random noise to the preprocessed user health data to generate perturbed health data.

[0072] The specific steps of S2.2 include:

[0073] S2.21: Receive pre-processed user health data X = {x1,...,x N}, obtain data sensitivity, analysis purpose and privacy protection requirements, and set a global privacy budget δ total , where x i ,i∈[1,N] represents the i-th preprocessed user health data, and N represents the number of preprocessed user health data;

[0074] S2.22: Sensitivity difference α based on preprocessed user health data i , the privacy budget allocation of each data item is dynamically adjusted using a weight allocation method based on data sensitivity. The formula is:

[0075]

[0076] Among them, δ i represents the privacy budget allocated to the i-th preprocessed user health data, w i represents the importance weight of the i-th preprocessed user health data for the analysis purpose, s i represents the sensitivity level of the i-th preprocessed user health data, which can be divided according to the data type, the relevance of personal identity information, and the time sensitivity of the data. i It represents the correlation coefficient between the i-th preprocessed user health data and other preprocessed user health data. This coefficient reflects the degree of association between data items and can be determined by calculating the correlation coefficient between data items or using other correlation measurement methods. In the formula, 1-λi It is used to reduce the privacy budget allocation for data items that are highly correlated with other data items to avoid overprotecting redundant information, β i represents the dynamic adjustment factor of the i-th preprocessed user health data. This factor can adjust the allocation of the privacy budget according to the real-time feedback during the data analysis process, changes in user privacy preferences, or data updates. It allows the system to dynamically optimize the privacy protection strategy during the analysis process;

[0077] It should be noted that the present invention is improved on the basis of the prior art. First, the formula in the present invention introduces the weight w i and sensitivity i , and considering the privacy leakage risk λ i and the dynamic adjustment factor β i , achieving the privacy budget δ total This allocation method not only improves the efficiency of privacy protection, but also ensures the maximization of data availability, so that a better balance is achieved between privacy protection and data utilization; secondly, the formula in the present invention is highly flexible and scalable. By adjusting parameters such as weights, sensitivity and adjustment factors, it can easily adapt to different application scenarios and privacy protection requirements. At the same time, the structure of the formula also facilitates its future expansion and optimization, so that it can continue to evolve with the development of technology and changes in application scenarios.

[0078] S2.23: Set the privacy budget consumption threshold h1, and monitor the consumption of the privacy budget Loss in real time during the data analysis process;

[0079] If Loss ≥ h1, adjust the privacy protection strategy or stop the analysis.

[0080] The specific steps of S2.3 include:

[0081] S2.31: According to X={x1,...,x N} and δ total , and for X={x1,…,x N} Perform feature extraction to obtain user health feature data in, represents the nth user health characteristic data, where n represents the number of user health characteristic data;

[0082] S2.32: According to and privacy protection requirements, determine the jth strategy ce j ,j∈[1,4] is the weight in the fusion and priority And according to ce j The weights and priorities are integrated to generate the data perturbation strategy ceshu ,in, Indicates the weight of the jth strategy in the fusion process, Level j represents the priority of the jth strategy in the fusion process, α, η represents the weight coefficient, g j represents the privacy protection contribution of the jth strategy, sun j represents the availability loss of the jth strategy, ben j represents the implementation cost of the jth strategy;

[0083] In S2.32, the strategies selected are Laplace noise addition, k-anonymity, l-diversity and differential privacy.

[0084] It should be noted that when determining the jth strategy ce j Weights in the ensemble When , the size of the weight can be comprehensively considered according to factors such as the contribution of the strategy to privacy protection, data availability loss, and implementation cost.

[0085] Furthermore, the specific steps of S2.32 include:

[0086] (1) Receive the user's health characteristic data Including but not limited to physiological indicators, disease history, living habits, and pre-processing operations such as cleaning, deduplication, and normalization of the data to improve the efficiency and accuracy of subsequent processing;

[0087] (2) Analyze the user's privacy protection needs, including factors such as data sensitivity, purpose of use, and potential risks, and determine the level of privacy protection and specific measures based on the needs, such as anonymization, encryption, and access control;

[0088] (3) Select strategies and determine the weight and priority of each strategy in the fusion based on the sensitivity and privacy protection requirements of the user's health feature data;

[0089] (4) According to the determined weights and priorities, the selected strategies are integrated to generate a data perturbation strategy, and the data perturbation strategy is applied to the original health feature data to generate perturbed data.

[0090] S2.33: Data-based perturbation strategy shu , calculate each data x i The sensitivity Δs, and according to the noise distribution type and δ i , calculate the amount of random noise Δnoise that needs to be added, and the calculation formula for sensitivity and random noise is:

[0091]

[0092] Wherein, X(A) and X(B) represent two adjacent data sets, that is, only one data point is different, f(X(A)) and f(X(B)) represent query functions of X(A) and X(B), ‖f(X(A))-f(X(B))‖ represents the norm of the difference between the output values ​​of the sensitivity function f on two different data sets X(A) and X(B), Laplace(·) represents the Laplace noise function, wherein the probability density function of the Laplace distribution is the prior art content in this field, is not the inventive solution of the present application, and is not elaborated here;

[0093] S2.34: Generate random noise using a random number generator according to the obtained random noise amount, and add the generated random noise to X={x1,...,x N}, generate perturbed health data X′={x′1,...,x′ N}, and x′ N =x N +noise, where x′ i ,i∈[1,N] represents the i-th disturbed health data, and noise represents random noise.

[0094] The specific steps of S3 include:

[0095] S3.1: Obtain disturbance health data X′={x′1,...,x′ N}, combined with the privacy protection requirement information, calculate X′={x′1,...,x′ N}, wherein the calculation formulas for the mean and variance are prior art contents in the art and are not the inventive solutions of the present application, and are not described in detail here;

[0096] S3.2: Use the improved differential privacy protection algorithm to calculate the privacy loss. The formula is:

[0097]

[0098] Where L represents the privacy loss, D represents the number of output sets considered, and μ k represents the kth output set R k The weight of P[f(X(A),t k )∈R k ] and P[f(X(B),t k )∈R k ] means that on the data sets X(A) and X(B), the parameter t is used k After the query function is queried, the output result falls into the set R k This probability value is used to measure the output distribution of the query function f under different data sets and parameter settings, t krepresents the time parameter related to the kth output set, reflecting the change of privacy loss over time, R k represents the kth output set, and b represents the adjustment parameter, which is used to control the impact of the dataset size |X(A) on the privacy loss calculation. When b=0, the dataset size does not affect the privacy loss. When b>0, as the dataset size increases, the privacy loss decreases. f1(Δs) represents the sensitivity function. The symbol for a subset indicates that the set on the left is a subset of the set on the right. Range(f) represents the range of the query function f. ln(·) represents the logarithmic function.

[0099] It should be noted that the formula in the present invention introduces the coefficient μ k , allowing different weightings for the privacy loss of each query or event k; the introduction of b and f1(Δs) also increases the flexibility of the formula, making it possible to adjust the calculation of privacy loss according to the size of the dataset |X(A)| and Δs, providing a parameterized method to adjust the calculation of privacy loss, which makes it customizable according to different privacy protection requirements and data characteristics; the output set is expanded to more comprehensively evaluate the privacy loss. At the same time, the introduction of time factors and potential privacy protection enhancement helps to further reduce the risk of privacy leakage.

[0100] S3.3: Evaluate the privacy protection degree of the differential privacy protection method based on the calculation results of privacy loss, and evaluate the data availability by comparing the statistical analysis results of the original data and the perturbed data.

[0101] Furthermore, when evaluating the privacy protection degree of differential privacy protection methods, the smaller the privacy budget, the higher the privacy protection degree, but the data availability may be lower; data availability is measured by the difference in statistics or the accuracy indicator of query results.

[0102] Example 2

[0103] See also Figure 4 Another embodiment provided by the present invention is a user data intelligent protection system based on differential privacy, comprising:

[0104] Data processing module, data perturbation module, differential privacy protection module and policy adjustment module;

[0105] Data processing module, used to collect user health data and perform preliminary processing and cleaning to ensure data quality and consistency;

[0106] The data perturbation module is used to protect user privacy by adding random noise to the preprocessed user health data. This involves introducing randomness into the data set, making the differences between query results for individuals blurry and unreliable, thereby preventing attackers from accurately restoring sensitive information about individuals.

[0107] The differential privacy protection module is used to perform statistical analysis on disturbed health data and quantitatively evaluate the differential privacy protection method using an improved differential privacy protection algorithm;

[0108] The policy adjustment module is used to iteratively adjust the privacy budget and data perturbation strategy according to the evaluation results to optimize the privacy protection effect and data availability.

[0109] The data perturbation module includes: a privacy budget setting unit, a strategy selection unit, and a noise addition unit;

[0110] The privacy budget setting unit is used to dynamically calculate and set the privacy budget to control the amount of noise added to the original data. The size of the privacy budget directly affects the balance between the degree of privacy protection and data availability.

[0111] A strategy selection unit, used to select data perturbation strategies and noise based on the privacy budget, where the data perturbation strategies include different noise addition methods and privacy budget allocation;

[0112] The noise adding unit is used to add noise to the preprocessed user health data according to the selected data perturbation strategy to achieve the requirements of differential privacy protection.

[0113] The differential privacy protection module includes: algorithm application unit, risk assessment unit, privacy protection degree assessment unit and data availability assessment unit;

[0114] The algorithm application unit is used to implement the improved differential privacy protection algorithm to ensure that the data meets the preset privacy protection standards during the processing;

[0115] Risk assessment unit, used to assess the privacy leakage risk in the process of user health data processing in real time and identify potential security threats;

[0116] Privacy protection degree assessment unit, which is used to quantitatively assess the effectiveness of the privacy protection measures currently adopted to ensure that privacy protection achieves the expected goals;

[0117] The data availability assessment unit is used to assess whether the data after privacy protection processing is still available and accurate, ensuring that the data quality is not seriously affected to support business needs.

[0118] The strategy adjustment module includes: an evaluation result receiving unit, an adjustment unit and a feedback loop control unit;

[0119] An evaluation result receiving unit, used to receive the evaluation result from the differential privacy protection module as a basis for subsequent policy adjustments;

[0120] An adjustment unit, which is used to dynamically adjust the privacy budget and data perturbation strategy, including noise addition methods and parameters, based on the evaluation results;

[0121] The feedback loop control unit is used to control the entire feedback loop process to ensure the smooth progress of iterative adjustments.

[0122] Through the data processing module, data perturbation module, differential privacy protection module and policy adjustment module and the units they contain, the user data intelligent protection system based on differential privacy can achieve comprehensive protection of user health data while ensuring the availability of data and the accuracy of statistical analysis.

[0123] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0124] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0125] The embodiments of the present invention are described above in conjunction with the accompanying drawings, but the present invention is not limited to the above-mentioned specific implementation modes, which are merely illustrative rather than restrictive. Under the guidance of the present invention, ordinary technicians in the field may also change, modify, replace and modify the above-mentioned embodiments without departing from the purpose and scope of protection of the present invention, and all of these are within the protection of the present invention.

Claims

1. A user data intelligent protection method based on differential privacy, characterized in that: include: Step S1: Collect user health data and perform preprocessing; Step S2: according to data sensitivity, analysis purpose and privacy protection requirements, an adaptive privacy budget allocation mechanism is set up. Based on the adaptive privacy budget allocation mechanism, a multi-strategy fusion data perturbation strategy is used to add random noise to the pre-processed user health data to generate perturbed health data; Step S3: Statistically analyze the disturbed health data, and use the improved differential privacy protection algorithm to evaluate the privacy leakage risk, privacy protection degree, and data availability of the differential privacy protection method by calculating the privacy loss; Step S4: Based on the evaluation results of step S3, a feedback loop mechanism is used to iteratively adjust the privacy budget and data perturbation strategy.

2. The user data intelligent protection method based on differential privacy as claimed in claim 1, characterized in that: The specific steps of step S2 include: S2.1: Assess the sensitivity of user health data, clarify the purpose of data analysis, and determine the specific needs for privacy protection; S2.2: Obtain pre-processed user health data and set up an adaptive privacy budget allocation mechanism based on data sensitivity, analysis purpose, and privacy protection requirements; S2.3: According to the privacy budget and data characteristics, a multi-strategy fusion data perturbation strategy is used to add random noise to the preprocessed user health data to generate perturbed health data.

3. The user data intelligent protection method based on differential privacy as claimed in claim 2, characterized in that: The specific steps of S2.2 include: S2.21: Receive pre-processed user health data X = {x1,...,x N }, obtain data sensitivity, analysis purpose and privacy protection requirements, and set a global privacy budget δ total , where x i ,i∈[1,N] represents the i-th preprocessed user health data, and N represents the number of preprocessed user health data; S2.22: Sensitivity difference α based on preprocessed user health data i , the privacy budget allocation of each data item is dynamically adjusted using a weight allocation method based on data sensitivity. The formula is: Among them, δ i represents the privacy budget allocated to the i-th preprocessed user health data, w i represents the importance weight of the i-th preprocessed user health data for the analysis purpose, s i represents the sensitivity level of the i-th preprocessed user health data, λ i represents the correlation coefficient between the i-th preprocessed user health data and other preprocessed user health data, β i represents the dynamic adjustment factor of the i-th preprocessed user health data; S2.23: Set the privacy budget consumption threshold h1, and monitor the consumption of the privacy budget Loss in real time during the data analysis process; If Loss ≥ h1, adjust the privacy protection strategy or stop the analysis.

4. The user data intelligent protection method based on differential privacy as claimed in claim 3, characterized in that: The specific steps of S2.3 include: S2.31: According to X={x1,...,x N } and δ total , and for X={x1,...,x N } Perform feature extraction to obtain user health feature data in, represents the nth user health characteristic data, where n represents the number of user health characteristic data; S2.32: According to and privacy protection requirements, determine the jth strategy ce j ,j∈[1,4] is the weight in the fusion and priority And according to ce j The weights and priorities are integrated to generate the data perturbation strategy ce shu ,in, Indicates the weight of the jth strategy in the fusion process, Level j represents the priority of the jth strategy in the fusion process, α, η represents the weight coefficient, g j represents the privacy protection contribution of the jth strategy, sun j represents the availability loss of the jth strategy, ben j represents the implementation cost of the jth strategy.

5. The user data intelligent protection method based on differential privacy as claimed in claim 4, characterized in that: The specific steps of S2.3 also include: S2.33: Data perturbation strategy based on ce shu , calculate each data x i The sensitivity Δs, and according to the noise distribution type and δ i , calculate the amount of random noise Δnoise that needs to be added, and the calculation formula for sensitivity and random noise is: Where X(A) and X(B) represent two adjacent data sets, that is, only one data point is different, f(X(A)) and f(X(B)) represent the query functions of X(A) and X(B), ‖f(X(A))-f(X(B))‖ represents the norm of the difference between the output values ​​of the sensitivity function f on two different data sets X(A) and X(B), and Laplace(·) represents the Laplace noise function; S2.34: Generate random noise using a random number generator according to the obtained random noise amount, and add the generated random noise to X={x1,...,x N }, generate perturbed health data X′={x′1,...,x′ N }, where x i ′,i∈[1,N] represents the i-th perturbed health data.

6. The user data intelligent protection method based on differential privacy as claimed in claim 5, characterized in that: The specific steps of S3 include: S3.1: Obtain disturbance health data X′={x1′,...,x′ N }, combined with the privacy protection requirement information, calculate X′={x′1,...,x′ N }mean and variance; S3.2: Use the improved differential privacy protection algorithm to calculate the privacy loss. The formula is: Where L represents the privacy loss, D represents the number of output sets considered, and μ k represents the kth output set R k The weight of P[f(X(A),t k )∈R k ] and P[f(X(B),t k )∈R k ] means that on the data sets X(A) and X(B), the parameter t is used k After the query function is queried, the output result falls into the set R k The probability of t k represents the time parameter associated with the kth output set, R k represents the k-th output set, b represents the adjustment parameter, f1(Δs) represents the sensitivity function, and ln(·) represents the logarithmic function; S3.3: Evaluate the privacy protection degree of the differential privacy protection method based on the calculation results of privacy loss, and evaluate the data availability by comparing the statistical analysis results of the original data and the perturbed data.

7. The user data intelligent protection method based on differential privacy as claimed in claim 6, characterized in that: The strategy in S2.32 selects Laplace noise addition, k-anonymity, l-diversity and differential privacy.

8. A user data intelligent protection system based on differential privacy, which is used to implement a user data intelligent protection method based on differential privacy as claimed in any one of claims 1 to 7, characterized in that: include: Data processing module, data perturbation module, differential privacy protection module and policy adjustment module; The data processing module is used to collect user health data and perform preliminary processing and cleaning; The data perturbation module is used to protect user privacy by adding random noise to the preprocessed user health data; The differential privacy protection module is used to perform statistical analysis on the disturbed health data and to quantitatively evaluate the differential privacy protection method using an improved differential privacy protection algorithm; The strategy adjustment module is used to iteratively adjust the privacy budget and data perturbation strategy according to the evaluation results.

9. The user data intelligent protection system based on differential privacy as claimed in claim 8, characterized in that: The data perturbation module includes: a privacy budget setting unit, a strategy selection unit and a noise adding unit; The privacy budget setting unit is used to dynamically calculate and set the privacy budget; The strategy selection unit is used to select a data perturbation strategy and noise based on a privacy budget; The noise adding unit is used to add noise to the preprocessed user health data according to the selected data perturbation strategy.

10. The user data intelligent protection system based on differential privacy as claimed in claim 9, characterized in that: The differential privacy protection module includes: an algorithm application unit, a risk assessment unit, a privacy protection degree assessment unit and a data availability assessment unit; The algorithm application unit is used to implement an improved differential privacy protection algorithm; The risk assessment unit is used to assess the privacy leakage risk in the process of processing user health data in real time and identify potential security threats; The privacy protection degree evaluation unit is used to quantitatively evaluate the effectiveness of the currently adopted privacy protection measures; The data availability assessment unit is used to assess whether the data after privacy protection processing is still available and accurate.

Images