Anonymization of time series data using matrix profiles

Abstract

Methods and systems for anonymizing time series data are disclosed. An anonymization computer may generate an anonymized time series data sequence that may share many useful properties, patterns, or characteristics with a private time series data sequence without exhibiting sensitive or private information about the private time series data sequence. This may enable data researchers and scientists to research the anonymized time series data sequence in place of the private time series data sequence, thereby protecting the privacy of a data subject (e.g., a person) corresponding to the private time series data sequence. The anonymized time series data sequence may be generated using an iterative optimization process, which may involve updating the anonymized time series data sequence to minimize a loss value. The loss value may correspond to both the utility and privacy of the anonymized time series data sequence.

Description

[0001] Cross-reference to related applications

[0002] This application is a PCT application claiming priority to and the benefit of U.S. Provisional Application No. 63 / 406,688, filed on September 14, 2022, which is incorporated herein by reference in its entirety for all purposes. Background Art

[0003] Time series data may refer to a sequence of data values ​​associated with time. In time series data, each "time series data value" may be associated with a corresponding "time value" or "time stamp" that may indicate the time associated with a particular time series data value and may enable the time series data to be sorted, analyzed, and / or displayed in chronological order. Other data, such as an "index" or "indicator," may be used to indicate the relative order of the time series data values.

[0004] There are many different types of time series data. For example, many forms of medical data, such as electrocardiograms (ECGs), respiratory rates, blood pressure, daily white blood cell counts (WBCs), data collected from smart watches or wearable fitness devices (e.g., heart rate data, accelerometer data during sleep tracking, etc.), can include time series data. Other examples of time series data include household utility consumption data, such as the number of gallons of water consumed per day, the kWh of electricity consumed per day, gas usage, etc. Transaction data (e.g., related to debit and credit card transactions) and stock prices can also include time series data.

[0005] Many scientific disciplines (e.g., signal processing and data mining) are devoted to analyzing time series data. For example, by analyzing heart rate time series data, scientists and doctors can identify heart rate patterns that can predict heart attacks or other diseases. As another example, by analyzing household electricity consumption time series data, civil engineers can predict the electricity demand of a particular city or geographic area and increase the capacity and output of their power grid to accommodate this demand. As a third example, by analyzing time series credit card transaction data, a payment processing network can identify spending patterns that may indicate fraud. Therefore, it may be useful for members of the data mining and data analysis community to publish or share time series data in order to encourage collaboration and generate innovation or other new and useful discoveries.

[0006] However, many forms of time series data are sensitive or private. The data subjects (e.g., people) corresponding to those time series data may not want their data to be published or become publicly available. For example, a person may not want sensitive medical information to be disclosed, e.g., to avoid discrimination or stigmatization based on that medical information. In addition, some time series data may enable an individual to make inferences about the data subject beyond what is explicitly disclosed in the time series data. For example, the age or gender of the data subject may be determined based on the data subject's ECG data, even if the ECG data (or any associated metadata) does not explicitly or directly disclose this information. In some cases, such data may be controlled or protected by privacy rules and regulations such as HIPAA

[29] , GDPR[2], and PIPA[1].

[0007] This creates problems for analyzing this time series data. While useful information can be learned from the analysis of time series data, data researchers and other scientists have an ethical, social, and in some cases legal responsibility to protect the privacy of data subjects or other data contributors. As a result, it is difficult for scientists and researchers to publish or otherwise share sensitive time series data and comply with information privacy laws, which hinders the development and publication of useful time series data.

[0008] The embodiments address these and other problems individually and collectively. Summary of the invention

[0009] Embodiments of the present disclosure relate to methods and systems for generating anonymized time series data sequences from private time series data sequences. Some methods according to embodiments may use a "matrix profile" to generate anonymized time series data sequences. Therefore, some methods and systems according to embodiments may be referred to by the acronym "TSAUMP", which stands for "Time Series Anonymization Using Matrix Profile".

[0010] Anonymized time series data sequences (generated using embodiments of the present disclosure) can be published, analyzed, and / or studied in place of private time series data sequences, which may include sensitive or otherwise private information that may be protected by privacy rules and regulations. In this way, data scientists and other researchers can learn from private time series data sequences without having access to the sensitive information contained therein. "Private time series data sequences may include any suitable input time series data sequences to be anonymized. In some embodiments, the private time series data sequences include user health data (e.g., EKG), utility data, computer data, or financial data.

[0011] In summary, the anonymizing computer may generate an anonymized time series data sequence that satisfies one or more of a "privacy protection condition", a "practicality protection condition", and a "decoration condition". In general, the privacy protection condition may indicate that the anonymized time series data sequence generally protects the privacy of the private time series data sequence, for example, a malicious individual cannot use the anonymized time series data sequence to recover sensitive information from the private time series data sequence. As described in more detail below, the anonymizing computer may implement the privacy protection condition by generating an anonymized time series data sequence that is largely unrelated to the corresponding private time series data sequence, which may make it difficult (or in some cases impossible) to make inferences about the private time series data sequence by evaluating the anonymized time series data sequence, thereby protecting the privacy of the private time series data sequence.

[0012] The usefulness protection condition may indicate that the anonymized time series data sequence is useful for analysis or data mining operations, for example, the anonymized time series data sequence retains sufficient useful information from the corresponding private time series data sequence, so that data analysis can be performed on the anonymized time series data sequence instead of the private time series data sequence, and achieves similar results as performing data analysis directly on the private time series data sequence. As described in more detail below, a series of experiments show that the anonymized time series data sequence retains sufficient information to perform data mining operations, such as motif mining, inconsistency mining, anomaly detection, semantic segmentation, and clustering, thereby demonstrating the effectiveness of the methods and systems according to the embodiments.

[0013] In more detail, the anonymization computer can satisfy the usefulness protection condition by using matrix profiles to preserve structural information or other high-level patterns (sometimes referred to as "motifs" or "inconsistencies") from the private time series data sequence in the anonymized time series data sequence. This enables data scientists and researchers to study and draw useful conclusions from the anonymized time series data sequence.

[0014] In some embodiments, the anonymizing computer may satisfy the decoration condition by generating an anonymized time series data sequence such that the anonymized time series data sequence has similar "decoration" characteristics as the private time series data sequence, such as its complexity and variability. If a data scientist or other researcher intends to study the variability or complexity of the time series data, it may be useful to protect these decoration characteristics.

[0015] The anonymization computer can generate an anonymized time series data sequence using an iterative loss-based optimization process. Prior to the iterative process, the anonymization computer can generate an initial anonymized time series data sequence, which can be improved in a series of iterative process rounds until it substantially meets one or more of the conditions described above. To this end, the anonymization computer can calculate a "loss" or "loss value" (sometimes also referred to as an "error" or "error value"), which can associate the desired characteristics of the anonymized time series data sequence with its actual characteristics. By repeatedly updating the anonymized time series data sequence to reduce the loss, the anonymization computer can generate an anonymized time series data sequence that meets one or more of the conditions described above. In some embodiments, the loss may include a combined loss, which may include a weighted combination of multiple losses. Each of these multiple losses may correspond to one or more of the conditions described above, such as a privacy protection condition, a practicality protection condition, and a decorative condition. Some of these losses can be determined using a matrix profile and can be referred to as a "matrix profile loss."

[0016] In more detail, one embodiment relates to a method for generating an anonymized time series data sequence from a private time series data sequence. In this method, an anonymizing computer may receive a private time series data sequence including one or more private time series data values. The anonymizing computer may determine a matrix profile and a matrix profile index based on the private time series data sequence. The anonymizing computer may initialize the anonymized time series data sequence. The anonymized time series data sequence may include one or more anonymized time series data values. The anonymizing computer may perform an iterative process to update the anonymized time series data sequence. During the iterative process, the anonymizing computer may sample a batch of anonymized subsequences from the anonymized time series data sequence. The anonymizing computer may determine a batch of anonymized subsequence indicators corresponding to the batch of anonymized subsequences. The batch of anonymized subsequence indicators may include one or more anonymized subsequence indicators. The anonymizing computer may determine a loss based on a batch of anonymized subsequences, a batch of anonymized subsequence indicators, the private time series data sequence, the matrix profile, and the matrix profile index. The anonymizing computer may update the anonymized time series data sequence based on the loss. The anonymizing computer may repeat this iterative process until a termination condition has been met. The anonymizing computer may provide the anonymized time series data sequence to the client computer.

[0017] Another embodiment relates to a method for evaluating an anonymization method (e.g., the method described above). A computer system may receive a private time series data sequence including one or more private time series data values ​​and an anonymized time series data sequence including one or more anonymized time series data values. The anonymized time series data sequence may have been generated by an anonymization computer based on the private time series data sequence using an anonymization method. The computer system may use an analysis program to analyze the private time series data sequence, thereby generating a private analysis result. The computer system may also use an analysis program to analyze the anonymized time series data sequence, thereby generating an anonymous analysis result. The computer system may generate a private score based on the private analysis result and a scoring mechanism. Similarly, the computer system may generate an anonymous score based on the anonymous analysis result and a scoring mechanism. The computer system may evaluate the anonymization method by comparing the private score with the anonymous score.

[0018] Other embodiments relate to systems for performing the methods described herein, such as those described above. Such systems may include, for example, an anonymizing computer including a processor and a non-transitory computer-readable medium coupled to the processor. The non-transitory computer-readable medium may include code or instructions executable by the anonymizing computer to perform the methods described herein.

[0019] the term

[0020] A "server computer" may refer to a computer or a cluster of computers. A server computer may be a powerful computing system, such as a mainframe. A server computer may also include a cluster of small computers or a group of servers that operate as a unit. In one example, a server computer may include a database server coupled to a network server. A server computer may include one or more computing devices and may use any of a variety of computing structures, arrangements, and compilations to service requests from one or more client computers.

[0021] "Memory" may refer to any suitable device or devices that can store electronic data. Suitable memory may include non-transitory computer-readable media that stores instructions that can be executed by a processor to implement a desired method. Examples of memory include one or more memory chips, disk drives, etc. Such memory may operate using any suitable electrical, optical, and / or magnetic operating modes.

[0022] "Processor" may refer to any suitable one or more data computing devices. A processor may include one or more microprocessors working together to perform the desired functions. A processor may include a CPU including at least one high-speed data processor sufficient to execute program components for executing user and / or system generated requests. The CPU may be a microprocessor such as AMD's Athlon, Duron, and / or Opteron; IBM and / or Motorola's PowerPC; IBM and Sony's Cell processor; Intel's Celeron, Itanium, Pentium, Xenon, and or XScale; and / or similar processors.

[0023] "Time series data" may refer to any data whose data elements have associated time values, such that the time series data can be sorted and interpreted in chronological order. "Private time series data" or "sensitive time series data" may refer to time series data whose data elements are private, sensitive, or wish to be anonymized. Private time series data may be protected by law or regulation preventing its distribution. Time series data may include a sequence of time series data, e.g., a plurality of time series data values ​​presented or stored in chronological order. A time series data value "subsequence" may be derived from such a sequence of time series data values. A time series data value subsequence may include one or more sequential time series data values ​​from a sequence of time series data values.

[0024] "Data value" may refer to a value representing data. Data values ​​may include numbers as well as other forms of data, such as strings, or any other data (e.g., computer files), etc. Data values ​​may include univariate data values ​​(e.g., a single value) or multivariate data values ​​(e.g., multiple values). Time series data may include a sequence of data values ​​with an associated timestamp or index.

[0025] "Anonymized data" may refer to data (e.g., time series data values) that is masked or hidden (e.g., anonymized) for deriving some aspect of the anonymized data. "Anonymized time series data" or "anonymized time series data sequence" may refer to time series data or a sequence of time series data that has been anonymized.

[0026] A "window" may refer to a frame region used to determine a contiguous subset of time series data. A window or subsequence may be defined by a "window length" or "subsequence length", which may determine the number of time series data values ​​in the window or subsequence, or alternatively may define the time range over which the window or subsequence is defined.

[0027] "Loss" or "loss value" (also known as "error" or "error value") can refer to a metric used to compare the performance of something (e.g., a machine learning model or data set) relative to the expected, expected, or desired performance. The loss value can be used to train a machine learning model.

[0028] "Correlation," "correlation value," or "correlation coefficient" may refer to a number used to define the degree to which two or more data sets are related. Correlation may indicate a functional, mathematical, or probabilistic relationship between two data sets, which may enable information about one data set to be inferred about the other. Two correlated data sets are typically more similar than two uncorrelated data sets.

[0029] An "anomaly" or "inconsistency" may refer to some data within a data set that is different from the rest of the data in the data set. A "motif" or "pattern" may refer to some data within a data set that is repeated throughout the data set. Detecting motifs or patterns is a common goal of machine learning applications. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Figure 1 An exemplary application of a time series anonymization method according to some embodiments is shown.

[0031] Figure 2 An exemplary time series data management and data anonymization system is shown in accordance with some embodiments.

[0032] Figure 3 An exemplary distance profile constructed from a reference time series data sequence is shown.

[0033] Figure 4 An exemplary AB connectivity matrix profile constructed from an exemplary first time series data sequence and an exemplary second time series data sequence is shown.

[0034] Figure 5 An exemplary self-connection matrix profile constructed from an exemplary time series data sequence that can be used for inconsistency mining is shown.

[0035] Figure 6 An exemplary self-connection matrix outline constructed from an exemplary time series data sequence that can be used for a motif mining task is shown.

[0036] Figure 7 A flowchart of an exemplary time series anonymization method according to an embodiment is shown.

[0037] Figure 8 A graph comparing the complexity of different exemplary time series data value sequences is shown.

[0038] Fig. 9A flow chart of an exemplary method for determining one or more private subsequence complexity values ​​according to some embodiments of the present disclosure is shown.

[0039] Fig.10 A flow chart of an exemplary method for determining a loss value according to an embodiment is shown, which exemplary method may be performed as part of a time series anonymization method according to an embodiment.

[0040] Fig.11 A diagram summarizing the evaluation of anonymized time series data sequences and private time series data sequences is shown.

[0041] Fig.12 A flow chart illustrating an exemplary method for comparing anonymized time series data sequences to private time series data sequences in accordance with some embodiments.

[0042] Fig.13A , 13B and 13C show a flowchart of a method for determining nearest neighbor loss, non-nearest neighbor loss, and correlation loss according to some embodiments.

[0043] Fig.14 A graph comparing a private subsequence and its private nearest neighbor subsequence and a corresponding anonymized subsequence and its anonymized nearest neighbor subsequence is shown.

[0044] Fig.15 A graph comparing a subsequence of private time series data and a sequence of anonymized time series data used to determine relevance loss is shown.

[0045] Fig.16A A flow chart of an exemplary method of determining a first complexity loss according to some embodiments is shown.

[0046] Fig. 16B A flow chart of an exemplary method of determining a second complexity loss according to some embodiments is shown.

[0047] Fig. 16C A flow chart is shown of an exemplary method of determining a nearest neighbor complexity loss in accordance with some embodiments.

[0048] Fig.17 A plot showing matrix profiles comparing private and anonymized time series data sequences for inconsistency mining and motif mining experiments.

[0049] Fig.18 A system block diagram of an exemplary anonymization computer according to some embodiments is shown. DETAILED DESCRIPTION

[0050] As described above in the content of the invention, embodiments relate to methods and systems for generating anonymized time series data sequences from private time series data sequences (also more generally referred to as "input time series data sequences"). Using an iterative optimization process, an anonymization computer can generate an anonymized time series data sequence that meets one or more of privacy protection conditions, practicality protection conditions, and decoration conditions, so as to produce anonymized sequence time series data that protects the privacy of the corresponding private time series data sequence while still retaining useful structural or pattern information. Such structural or pattern information can enable data researchers or other scientists to analyze and draw useful conclusions from the anonymized time series data sequence, thereby allowing researchers or scientists to use the anonymized time series data sequence instead of the private time series data sequence for research or analysis, thereby protecting the privacy of the data subject (e.g., person) corresponding to the private time series data sequence.

[0051] Several previous methods have been proposed for anonymizing time series data [11, 22, 33, 35, 38, 39]. Some of these previous works focus on time series data corresponding to specific domains [11, 22, 39], while other previous works attempt to design methods for general time series data [33, 35, 38]. For example, Shou et al.

[35] proposed a time series anonymization method based on the (k, P)-anonymity privacy model

[35] , which is extended from k-anonymity

[36] . Under the (k, P)-anonymity privacy model, a set of time series are divided into different groups or subgroups, and the privacy of each time series in the group is protected by using generalized quasi-identifiers and shared pattern representations. Differential privacy [3] is another privacy paradigm studied for time series data

[38] . In particular, Wang et al.

[39] proposed a privacy-preserving time series generative model, called PART-GAN, which extends the conditional generative adversarial network

[27] to guarantee differential privacy.

[0052] Unlike the previous work described above, the method according to the embodiment can be used to directly generate anonymized time series data sequences from private time series data sequences without requiring any additional information. In contrast, Shou et al.

[35] and the PART-GAN method

[39] both require multiple time series in the database to perform anonymization. Therefore, the method according to the embodiment is less data intensive and can be performed faster and more efficiently by the anonymization computer.

[0053] Figure 1 Some potential privacy risks associated with publishing private time series data sequences are illustrated, and exemplary use cases of methods and systems according to embodiments are also illustrated. Figure 1It shows how the anonymized time series data sequence 106 can be used in a data analysis task (e.g., analysis task 110) in place of the private time series data sequence 102, but cannot be used to identify private or other personal information, unlike the private time series data sequence 102 used to derive the anonymized time series data sequence 106.

[0054] In more detail, Figure 1 Three exemplary private time series data sequences 102 including electrocardiogram (ECG) signals corresponding to three patients are shown. These ECG signals can be published as a time series anomaly detection benchmark dataset or otherwise released to the public. Such data can be published without any metadata containing personal information in order to protect the patient's data privacy. However, a malicious individual may be able to build a gender prediction model 108 that can identify private personal information based on this ECG benchmark dataset. Such a gender prediction model 108 can be built using other ECG data in the public domain

[17] . Using this gender prediction model 108, a malicious individual can use the private time series data sequence 102 to determine the corresponding gender of each patient, thereby violating the privacy of each patient.

[0055] However, by using the anonymization method 104 (TSAUMP) according to an embodiment, the anonymization computer can generate an anonymized time series data sequence 106 corresponding to the private time series data sequence 102. The anonymized time series data sequence 106 may have different local patterns, but still maintain the general structural information from the private time series data sequence 102. The gender prediction model 108 of the malicious individual may not be able to determine the correct gender of the patient because the shape of the "heartbeat" in the anonymized time series data sequence 106 may no longer conform to the typical public domain ECG data used to train or otherwise construct the gender prediction model 108.

[0056] In addition, the preservation of the general global structure enables the anonymized time series data sequence 106 to be used in various analysis tasks, such as the anomaly detection analysis task 110, instead of the private time series data sequence 102. When the anonymized time series data sequence 106 is analyzed using the analysis task 110, the anonymized time series data sequence can achieve similar analysis results or scores as the private time series data sequence 102, which is Figure 1 The anonymized time series data sequence 106 is indicated by the similarity between the private analysis result or score 112 and the anonymous analysis result or score 114. Therefore, the data researcher can use the anonymized time series data sequence 106 instead of the private time series data sequence 102 for meaningful data analysis, thereby protecting the privacy of the private time series data sequence 102 and any corresponding data subject or data donor.

[0057] As further described below, experiments were conducted to evaluate whether it is possible to build a model to accurately predict gender (and age) information from ECG data, whether the anonymization method according to an embodiment can anonymize time series data so that the model will not be able to accurately predict such information from an anonymized ECG data sequence, and whether the anonymized ECG data sequence can be used for anomaly detection tasks and achieve similar results as the corresponding private ECG data sequence. In summary, the experiments generally show that it is possible to build a model to accurately predict gender (and age) information from ECG data, such a model cannot predict gender and age information based on anonymized time series data sequences, and anomaly detection tasks can generally be performed on anonymized time series data sequences instead of private time series data sequences. In this way, these experiments demonstrate the effectiveness of the methods and systems according to embodiments of the present disclosure.

[0058] although Figure 1 An exemplary use case corresponding to ECG data is shown, but it should be understood that the anonymization method according to an embodiment of the present disclosure can be used in a variety of different situations, particularly in situations where it may be necessary to protect the privacy of time series data or the data subject corresponding to the time series data. After analyzing the anonymized time series data, different actions can be taken. As an example, time series data corresponding to household electricity, water or gas usage can be used to determine the production or capacity requirements of a city relative to those resources at different times of the day or year. However, individuals may not want to share private time series data corresponding to their resource usage because this can enable others to determine, for example, when the individual is at home, when he or she is away from home, etc. However, using an embodiment of the present disclosure, private time series data sequences corresponding to electricity, water or gas usage can be anonymized before analysis, thereby protecting the privacy of the homeowner or tenant. The anonymized time series data can be analyzed to determine anomalies, and actions can be taken. For example, anonymized time series data related to water usage can indicate that a certain group of rooms is experiencing a sharp increase in water usage. An action such as executing an automatic leak detection process can be initiated.

[0059] As another example, the anonymization method according to the embodiment of the present disclosure can enable a network security auditor to assess the security of a computer network while protecting the privacy of communications sent through the network. In some conventional network audits, auditors can assess packets and other messages sent between computers and devices on the network to assess security risks. However, these packets may contain private information that the auditors will preferably not have access to. These packets or other network communications received within a defined time period (e.g., one day) can be regarded as time series data values ​​in a private time series data sequence, and the method according to the embodiment can be used to generate anonymized time series data sequences from this private time series data sequence. Auditors can assess this anonymized time series data sequence to assess the security of a computer network, thereby protecting the privacy of network communications carried out through the network. Anonymized time series data can be analyzed to determine anomalies, and actions can be taken. For example, a security patch or other remedial work can be initiated to address any security issues related to any abnormal data from anonymized time series data.

[0060] It should be understood that the examples provided above are intended to be non-limiting, and embodiments of the present disclosure can be used in a wide variety of other applications. As yet another example, the time series data corresponding to a bank transfer can be anonymized using a method according to an embodiment, and the resulting anonymized time series data sequence can be used to detect fraud or financial crime without infringing the privacy of the bank account holder. As another example, the time series data corresponding to the global positioning system, speed, and fuel consumption of a smart car can be used to diagnose operational problems of the smart car (e.g., engine failures that may reduce fuel efficiency) without showing private information about the owner of the smart car (e.g., the location where the owner drives the car or the time when the owner visits those locations). The anonymized time series data can be analyzed to determine anomalies, and actions can be taken in the above two examples. For example, actions can be taken to close accounts associated with potential financial crimes, or corrective actions such as air updates can be sent to the above-mentioned smart care to solve any problems related to anomalies in the anonymized time series data.

[0061] Figure 2A data management system including an anonymization computer 204 is shown, which may include a computer system that can perform some methods according to the embodiments. The anonymization computer 204 can interface with a private data source 202 to receive private time series data sequences. The private data source 202 may include a database of private time series data sequences, or may include a "data administrator", an entity that manages and protects private time series data sequences. For example, the private data source 202 may include a medical research institution that collects private time series data sequences from medical research experiments. In some cases, the anonymization computer 204 may be attached to the private data source 202, for example, the anonymization computer 204 may include a computer system owned and / or operated by a data administrator of, for example, a medical research institution. In other cases, the anonymization computer 204 may be associated with an entity trusted by the private data source 202 to anonymize the private time series data sequences.

[0062] Using methods according to embodiments, anonymization computer 204 can generate anonymized time series data sequences from private time series data sequences received from private data source 202. Anonymization computer 204 can then publish these anonymized time series data sequences, or otherwise make them available to other computer systems or entities. For example, in some embodiments, publishing anonymized time series data sequences can include sending anonymized time series data sequences to a client computer, such as client computer 208. This client computer 208 can include, for example, a computer system owned and / or operated by a data scientist or other member of the data mining community, who can analyze the anonymized time series data sequences as part of their research. As an alternative, anonymization computer 204 can use a publishing system 206 to publish anonymized time series data sequences, which can include, for example, a publicly available network server that a computer system (e.g., client computer 208) can access to retrieve anonymized time series data sequences.

[0063] Figure 2 Also shown is a computer system 210, which may be referred to as an "anonymization evaluation computer." This computer system 210 may evaluate the effectiveness of an anonymization method implemented using the anonymization computer 204. For example, the computer system 210 may perform data mining or other data evaluation tasks (e.g., Figure 1 ) in order to verify that the anonymized time series data sequence generally produces similar analysis results as the private time series data sequence when analyzed.

[0064] The computer system 210 may receive a private time series data sequence from the private data source 202, and receive anonymized time series data sequence from the anonymization computer 204 or the publishing system 206. In some cases, the computer system 210 may include the anonymization computer 204, that is, the anonymization computer 204 itself may evaluate the effectiveness of the anonymization method according to the embodiment. Alternatively, the computer system 210 may be associated with the private data source 202, for example, a data administrator may use the computer system 210 to evaluate the effectiveness of the anonymization method according to the embodiment. As yet another alternative, the computer system 210 may include the client computer 208.

[0065] Figure 2 Devices, computers, and other entities in the communication network 212 may communicate with each other via one or more communication networks, such as communication network 212. Communication network 212 may take any suitable form, and may include any one and / or combination of the following: direct interconnection; the Internet; a local area network (LAN); a metropolitan area network (MAN); an operating mission as a node on the Internet (OMNI); a secure custom connection; a wide area network (WAN); a wireless network (e.g., using protocols such as, but not limited to, wireless application protocol (WAP), I-mode, etc.); and the like. Figure 2 Messages between computers, entities and other devices in the network can be sent using communication protocols, such as but not limited to: File Transfer Protocol (FTP), Hypertext Transfer Protocol (HTTP), Secure Sockets Layer (SSL), ISO (e.g., ISO 8583), etc.

[0066] Before describing methods and systems according to embodiments in more detail, it may be useful to describe some concepts related to time series analysis and anonymization, including matrix profiles. In addition, a more formal description of the "time series anonymization problem" is provided below.

[0067] For ease of explanation, embodiments of the present disclosure are generally described from the perspective of a univariate time series data sequence. However, it should be understood that embodiments of the present disclosure may also be practiced using a multivariate time series data sequence. A univariate time series data sequence T may include time series data values ​​t i The sequence, that is, T = [t1, t2, ..., t n], where n is the length of T. A time series data sequence can generally be interpreted as a vector, which can include a one-dimensional sequential array of elements. T = [115 mmHg, 150 mmHg, 121 mmHg] is an example of a vector including three systolic blood pressure data elements. Each time series data element in T can correspond to an observation time or time period, which can be indicated by a timestamp or another appropriate time value. For example, each blood pressure measurement value may be recorded at one-month intervals, and thus the time series data sequence T may correspond to a time period of three months.

[0068] Vectors (and therefore sequences or subsequences of time series data represented by vectors) can be "indexed" using "indexes", "indices", or "indicators". For example, by "indexing" T = [115mmHg, 150mmHg, 121mmHg] with the indicator "3", the third data value in T can be identified or retrieved, i.e., T[3] = 121mmHg. The term "index" is used somewhat vaguely in the field of time series analysis, and can mean an individual indicator (e.g., "3") or a set or vector of indicators (e.g., [1,2,3]). In the present disclosure, the term index generally refers to a set of indicators, and the term indicator generally refers to a single indicator.

[0069] Sometimes, data mining and data analysis tasks are performed on local patterns or "subsequences" of time series data. A time series data subsequence may include a contiguous subset of time series data values ​​derived from a time series data sequence. Indicators may be used for the purpose of identifying or extracting a time series data subsequence from a time series data sequence. For example, T[2,3]=[150mmHg,121mmHg] may include a subsequence that includes the second and third time series data elements from T. Throughout this disclosure, subsequences are generally defined based on an indicator i and a subsequence length m. Thus, a subsequence "T i,m " may include a continuous subset of i values ​​from the time series data sequence m starting from indicator T. For example, T 2,2 =[150mmHg,121mmHg] may include a time series data subsequence starting from the second element of T with a subsequence length of two.

[0070] Sometimes, sequences and subsequences of time series data can be compared to evaluate their similarities or differences. "Distance" or "distance metric" is a way to quantify the similarity or difference between two time series data sequences or subsequences. In order to calculate the distance, the vector representing the time series data sequence or subsequence can be interpreted as a position vector, pointing to two points in the vector space. The distance may include the distance between the two points, which may include, for example, the magnitude of the difference between the two position vectors. Some embodiments of the present disclosure use Euclidean distance (the distance between points in Euclidean space) to quantify the difference between two time series data sequences or subsequences. Other techniques, such as determining the angle between two vectors representing the time series data sequence or subsequence, can be used to evaluate the similarity of those sequences. Cosine similarity can be used for this purpose.

[0071] Z-normalization may refer to a process by which the elements of a data set may be normalized so that the data set has a mean μ = 0 and a standard deviation σ = 1. The formula may be used: Generate a normalized dataset X from dataset X norm (If necessary, the sample standard deviation s may be substituted.) Such data sets may include time series data sequences or subsequences, and such time series data sequences or subsequences may therefore be z-normalized. "Z-normalized Euclidean distance" [45, 46] may include the Euclidean distance between two z-normalized time series data sequences or subsequences, and may be used to measure the similarity or difference between those time series data sequences or subsequences.

[0072] Distance Contour Can include time series data subsequences (sometimes called the “query subsequence”) and the time series data sequence T B A vector of distances (e.g., Euclidean distances or z-normalized Euclidean distances) between each subsequence (usually of equal length m) in T. In this way, the distance profile can be used to identify the time series T B Similar to subsequence subsequence. Figure 3 An exemplary query time series data subsequence 302 is shown Reference time series data series 306T B and the corresponding distance profile 308 The reference time series data sequence 306 contains a time series data subsequence 304 that is similar to the query time series data subsequence 302. The value of the distance profile 308 (indicated by its amplitude) indicates the similarity between the query time series data subsequence 302 and the time series data subsequences in the reference time series data sequence 306. Notably, the value of the distance profile 308 is lowest at the indicator corresponding to the time series data subsequence 304, which is similar to the query time series data subsequence 302 and can be referred to as the "nearest neighbor" of the query time series data sequence 302. In other words, the "nearest neighbor" subsequence of the query time series data subsequence is the subsequence that is most similar to the query subsequence in the entire time series data sequence. The distance between a time series data subsequence and its nearest neighbor can be referred to as the "nearest neighbor distance". Therefore, Figure 3 It is shown how distance profiles can be used to identify subsequences in a time series data sequence, in particular, nearest neighbor time series data subsequences.

[0073] Matrix Profile It is an effective and general tool for time series data mining [20, 40, 47]. It is similar to a distance profile in that it is concerned with the distances between subsequences in a time series data sequence. However, while a distance profile describes the distances between a time series data subsequence (e.g., a query subsequence as described above) and each time series data subsequence in a time series data sequence (e.g., a reference sequence as described above), a matrix profile describes the distances between each subsequence of a first time series data sequence and its nearest neighbor subsequence in a second time series data subsequence. Thus, a matrix profile [45, 46] may include a vector summarizing a set of distance profiles.

[0074] More formally, the matrix profile It may include a first time series data sequence T A Each subsequence in Instead of the second time series data series T B The nearest neighbor subsequence in The vector of distances (e.g., Euclidean distances or z-normalized Euclidean distances) between them. That is, Matrix profiles can be used for data analysis tasks such as motif discovery [42, 45], inconsistency discovery [44, 45], anomaly detection [4, 24, 25], semantic segmentation [15, 16], and many more tasks [20, 40, 41, 43, 47]. Matrix profiles can usually be computed efficiently [48, 49].

[0075] For the first time series data sequence T A and the second time series data sequence TB These definitions are provided for the case where the first time series data sequence T A and the second time series data sequence T B When they are the same sequence, that is, T A =T B , the corresponding matrix profile can be called a "self-connected" matrix profile. When the first time series data sequence and the second time series data sequence are different, that is, T A ≠T B , it can be called an "AB connection" matrix profile.

[0076] Figure 4 The first time series data sequence 402T is shown A and the second time series data sequence 404T B Constructed AB connectivity matrix profile 410. The subsequence length m is used to construct the AB connectivity matrix profile 410. The first time series data sequence 402 contains a first unique pattern 406 and a second unique pattern 408. As described above, the AB connectivity matrix profile 410 indicates the distance between each subsequence in the first time series data sequence 402 and its nearest neighbor subsequence in the second time series data sequence 404. Since the first time series data sequence 402 and the second time series data sequence 404 are mostly identical, the values ​​of the AB connectivity matrix profile are generally close to zero. However, the values ​​of the AB connectivity matrix profile increase near the indicators corresponding to the first unique pattern 406 and the second unique pattern 408 because these unique patterns do not exist in the second time series data sequence 404, and therefore the distance to the "nearest neighbor" of the second time series data sequence is higher than usual. Therefore, Figure 4 It shows how matrix profiles (particularly AB connection matrix profiles) can be used to identify unique patterns in a time series data sequence. If the second time series data sequence 404 is considered "normal", then the first unique pattern 406 and the second unique pattern 408 can be considered "abnormal", thereby showing how matrix profiles can be used to detect abnormal or anomalous time series data subsequences

[44] .

[0077] Figure 5A “self-connection” matrix profile 506 corresponding to the time series data sequence 502 is shown. The self-connection matrix profile 506 can be calculated by determining the distance between each subsequence in the time series data sequence 502 and its nearest neighbor subsequence (ignoring “unimportant matches”, i.e., a given subsequence and itself). A “sliding window” 504 can define each time series data subsequence in the time series data sequence 502 as it moves across the time series data sequence 502 from left to right. The time series data sequence 502 contains an anomaly 510. Because there are almost no subsequences that contain this anomaly 510, the subsequences that contain this anomaly typically have a high distance between themselves and their nearest neighbor subsequences. Therefore, as the sliding window 504 moves across the anomaly 510, the value of the self-connection matrix profile 506 increases. The “peaks” in the matrix profile can be referred to as “inconsistencies” and can indicate the location of the anomaly. In Figure 5 Inconsistency 508 indicates the location of anomaly 510. Therefore, Figure 5 It was shown how matrix profiles can be used for inconsistency mining and anomaly detection in time series data sequences

[44] .

[0078] Figure 6 Additional uses of self-connection matrix outlines are depicted. Figure 6 A time series data sequence 602 is shown, which typically includes random noise, but also contains a repeating pattern 614. A sliding window 604 can define the length of a subsequence and can be used to determine the value of a self-connection matrix profile 606 at a corresponding indicator. Because the time series data sequence 602 typically includes random noise, most subsequences are not similar even to their nearest neighbor subsequences, and therefore the value of the self-connection matrix profile 606 is typically high. However, the repeating patterns 614 are similar to each other. Therefore, as the sliding window 604 moves over the repeating pattern 614, the value of the self-connection matrix profile 606 decreases. Such "valleys" in the matrix profile are sometimes referred to as "motifs"

[42] , which can indicate the location of a repeating pattern (also referred to as a motif) in the time series data sequence. In Figure 6 In , motifs 608, 610, and 612 indicate the location of repeating pattern 614. Thus, Figure 6 It shows how matrix profiles can be used for motif mining and pattern detection in time series data sequences.

[0079] Having described some useful concepts related to time series analysis and anonymization, it may be useful to describe the "time series anonymization problem" in more detail. In general, the process of time series anonymization involves generating an anonymized time series data sequence T corresponding to a given input time series data sequence T (e.g., private time series data sequence T). Preferably, the anonymized time series data sequence satisfies at least two conditions.

[0080] The first of these conditions may be referred to as a "privacy protection condition" (or other similar terms, such as "privacy condition", "privacy criterion", etc.). The privacy protection condition may indicate that the anonymized time series data sequence maintains the privacy of the corresponding private time series data sequence, for example, the anonymized time series data sequence does not contain (or contains very little) information that would allow a malicious individual to learn private information corresponding to the private time series data sequence.

[0081] Correlation is a means of determining or estimating how much information one time series data sequence (e.g., an anonymized time series data sequence) conveys in general about another time series data sequence (e.g., a private time series data sequence). For example, the Pearson correlation may include values ​​between -1 and 1, which indicate a linear correlation between two data sets (e.g., time series data sequences or subsequences). A correlation value of 0 indicates that the data sets are uncorrelated, meaning that information about one data set cannot be determined based on the linear relationship between the two data sets. A correlation value of 1 indicates that the data sets are completely linearly correlated, meaning that for any observation (e.g., an individual time series data value) in one data set, there is an identical observation in the other data set. A correlation value of -1 indicates that the data sets are completely negatively correlated, meaning that for any observation in one data set, there is a corresponding negative observation in the other data set.

[0082] Therefore, if where c(·,·) is a correlation measure, then the sequence of anonymized time series data values ​​(or the anonymization method used to generate such a sequence of anonymized time series data values) can be said to satisfy the privacy condition. This prevents malicious entities from attempting to recover the private time series data sequence from the anonymized time series data sequence, because The solution is not unique.

[0083] The second of these conditions may be referred to as a "usefulness protection condition" (or other similar terms, such as "usefulness condition", "usefulness criterion", etc.), which indicates that the anonymized time series data sequence is "useful" for data mining or other data analysis. For example, if executing the data analysis method d(·) on the anonymized time series data sequence generally achieves similar performance as executing the data analysis method on the corresponding private time series data sequence (e.g., measured using the scoring mechanism s(·)), then the anonymized time series data sequence may be said to satisfy the usefulness condition, i.e., In other words, for a set of time series data mining methods or tasks D, That is, in general, for all tasks d in D, the anonymized time series data sequence Executing a data mining method or task d typically produces the same results as executing the same data mining method on the private time series data sequence T. As an example, if the data analysis method is a motif detection method, motifs should typically be detected at the same rate and at the same position in the private time series data sequence as in the anonymized time series data sequence.

[0084] As described in more detail below, embodiments of the present disclosure may use matrix profiles [45, 46] by enforcing To roughly satisfy By preserving the matrix profiles from the private time series data sequence to the anonymized time series data sequence, the anonymized time series data sequence can retain enough information to succeed on many tasks, especially common tasks in data mining or data analysis applications, such as anomaly detection.

[0085] In some cases, the privacy condition and the practicality condition may be somewhat inconsistent, as shown in the following example. A simple and effective way to meet the privacy condition is to generate an anonymized time series data sequence including random values ​​independent of the private time series data sequence. Due to its randomness and independence, it is impossible to determine any information about the private time series data sequence from the anonymized time series data sequence. However, such anonymized time series data sequence will not meet the practicality condition because it is useful for data mining or other data analysis. Similarly, a simple and effective way to meet the practicality condition is to generate an anonymized time series data sequence identical to the private time series data sequence because it will produce the same results for any deterministic data analysis or data mining method. However, this anonymized time series data sequence will not meet the privacy condition because it directly shows the private time series data sequence. Typically, for anonymization techniques such as differential privacy, this dilemma is managed by establishing privacy parameters (e.g., ε and δ), which control the "degree of privacy" provided by the anonymization method. Increasing this privacy may result in lower practicality, and therefore, data scientists typically determine privacy parameters that achieve a good balance between privacy and practicality.

[0086] Other conditions or criteria may also be applied to the time series anonymization problem in order to generate an anonymized time series data sequence with desired characteristics. For example, some embodiments of the present disclosure use an optional "decoration loss" to enforce a "decoration criterion", which encourages the anonymization computer to generate an anonymized time series data sequence that has many of the same decorative features of the private time series data sequence, such as its variability and complexity.

[0087] It should be understood that the time series anonymization problem can be formulated in a variety of ways, and a variety of conditions or criteria can be introduced, such as to generate anonymized time series data having any number of desired characteristics. In addition, the use of correlations (e.g., Pearson correlations) to enforce privacy protection conditions and the use of matrix profiles to enforce utility protection conditions is only one of many possible approaches to the time series anonymization problem described above, and other such approaches may become apparent after reading this disclosure.

[0088] Having described the time series anonymization problem and other useful background concepts, we refer to Figure 7 and also refer to Figure 8 , 9 , 10, 12, 11, 13A-13C, 15, 14 and 16A-16C describe the method according to the embodiment in more detail. Generally speaking, the time series anonymization method according to the embodiment may include three stages, including a pre-iteration process stage (e.g., corresponding to Figure 7 702-708 in ), an iterative process (eg, corresponding to Figure 7 710-720 in ) and the post-iteration process phase (e.g., corresponding to Figure 7 722 and 724 in FIG.

[0089] In general, the pre-iterative process phase may involve steps performed by the anonymization computer to set up or otherwise prepare for the iterative process. These steps may involve receiving a sequence of private time series data, initializing the sequence of anonymized time series data, and determining or otherwise preparing information that may be used during the iterative process, such as determining a matrix profile and a matrix profile index, determining a private subsequence complexity value (which may later be used to determine a complexity loss), etc.

[0090] In step 702, the anonymization computer may, for example, retrieve the anonymization information from a private data source such as a data administrator (e.g., Figure 2 ) or by retrieving a private data source from a memory element (e.g., a hard drive) associated with the anonymizing computer to receive a private time series data sequence T comprising one or more private time series data values. In some embodiments, the anonymizing computer may receive the private time series data sequence from a database.

[0091] In some embodiments, the anonymization computer may additionally determine the length n of the private time series data sequence, for example by iterating through the private time series data sequence and counting the number of time series data values ​​stored therein. This length n may be used to perform Figure 7For example, the anonymization computer may initialize the anonymized time series data sequence with length n at step 708, for example, by generating an anonymized time series data sequence of the same length as the private time series data sequence.

[0092] At step 704, the anonymization computer may determine a matrix profile based on the private time series data sequence. and matrix contour index The anonymization computer may determine the matrix profile and the matrix profile index by performing a self-join on the private time series data sequence. Any suitable self-join or other matrix profile method may be used for this purpose, such as the SCAMP method

[49] . In some embodiments, the matrix profile may include a z-normalized matrix profile, for example, the distance between each subsequence in the matrix profile and its nearest neighbor subsequence may include a z-normalized Euclidean distance. The anonymization computer may determine the matrix profile and the matrix profile index based on a subsequence length m, which may include Figure 7 A hyperparameter or another input to the anonymization method depicted in .

[0093] At step 706, the anonymization computer may determine one or more private subsequence complexity values. The anonymization computer may store the one or more private subsequence complexity values ​​in a vector C m In some embodiments, the private time series data sequence may include one or more private subsequences, such as a subsequence of a private time series data sequence of length m. One or more private subsequence complexity values ​​may correspond to these one or more private subsequences. Therefore, the vector C m Data element C in m [i] can store the private subsequence T i,m The private subsequence complexity value of .

[0094] One or more private subsequence complexity values ​​may be later used to determine the decoration loss, for example, as described below with reference to Fig.10 and 16A -16C. In more detail, one or more private subsequence complexity values ​​may be used to determine the first complexity loss, the second complexity loss, and the nearest neighbor complexity loss, and in some embodiments, the decoration loss may include a weighted combination of the first complexity loss, the second complexity loss, and the nearest neighbor complexity loss. Thus, the anonymization computer may postpone the determination of the one or more private subsequence complexity values, for example, the anonymization computer may determine the one or more private subsequence complexity values ​​when determining the decoration loss rather than before the iterative process as described above.

[0095] The concepts of time series complexity and time series complexity value are given by Figure 8The complexity of a time series data sequence or subsequence is generally related to the frequency, amplitude, and general variability of the sequence or subsequence. The complexity of a time series data sequence or subsequence may be proportional to the length of the time series after being "stretched flat". After such "stretching", more complex sequences or subsequences are longer than less complex time series data sequences or subsequences.

[0096] refer to Fig. 9 A series of exemplary steps for determining one or more private subsequence complexity values ​​are described in more detail. At step 902, the anonymization computer may determine the total number of private subsequences in the private time series data sequence. Determining the total number of private subsequences may enable the anonymization computer to iterate through the private time series data sequence and allocate memory or otherwise initialize a data structure for storing one or more private subsequence complexity values, such as the vector C described above. m In some embodiments, the anonymization computer may determine the total number of subsequences of private time series data using the formula total=n-m+1, where n is the length of the private time series data sequence and m is the subsequence length.

[0097] At step 904, the anonymization computer may determine a corresponding private subsequence complexity value for each of the one or more private subsequences, thereby determining one or more private subsequence complexity values. i,m Process of Determining a Single Private Subsequence Complexity Value. By repeating these steps for each of the one or more private subsequences, the anonymization computer may determine one or more private subsequence complexity values.

[0098] At step 906, the anonymization computer may determine a private subsequence mean μ and a private subsequence standard deviation σ based on the private subsequences. The computer system may determine the private subsequence mean and the private subsequence standard deviation using any suitable mean determination and standard deviation determination method or formula.

[0099] At step 908, the anonymization computer may normalize the private subsequences based on the private subsequence mean and the private subsequence standard deviation. This normalization process may include a form of z-normalization, where the anonymization computer uses, for example, In other words, the anonymization computer may subtract the private subsequence mean from the private subsequence and then scale (e.g., divide) the subtracted private subsequence based on the private subsequence standard deviation, thereby generating a normalized private subsequence. In some embodiments, the anonymization computer may compare the private subsequence standard deviation to a private subsequence standard deviation threshold and may scale the subtracted private subsequence based on the comparison. For example, if the private subsequence standard deviation σ>10 -6 , then the anonymization computer may divide the subtracted private subsequence by the private subsequence standard deviation to produce a normalized private subsequence. Otherwise, the anonymization computer may use the subtracted private subsequence as the normalized private subsequence.

[0100] At step 910, the anonymization computer may determine one or more private sequence differences T based on the normalized private subsequence. diff Each of the one or more private sequence differences may include a difference between a normalized private subsequence time series data value and a sequential normalized private subsequence time series data value from the normalized private subsequence, e.g., T diff [i] = T i,m,norm [i+1]-T i,m,norm [i].

[0101] At step 912, the anonymization computer may determine one or more squared private sequence differences based on the private sequence differences, for example, by squaring each of the one or more private sequence differences, for example, T diff [i] 2 .

[0102] At step 914, the anonymization computer may determine a sum of one or more squared private sequence differences. The private subsequence complexity value may include the sum of these one or more squared private sequence differences, e.g., c m [i] = ∑T diff [j] 2 . Step 904 (and thereby steps 906-914) may be repeated for each of the one or more private subsequences, thereby determining one or more private subsequence complexity values ​​corresponding to the one or more private subsequences. As described above, these private subsequence complexity values ​​may be later used to determine the decoration loss. Therefore, in some cases, it may be preferable to determine the one or more private subsequence complexity values ​​during the determination of the decoration loss. However, since the decoration loss may be determined during each round of the iterative process, determining the one or more private subsequence complexity values ​​in this manner may involve redundant computations. Therefore, it may be preferable to determine the one or more private subsequence complexity values ​​prior to the iterative process, as described above.

[0103] Return to reference Figure 7 At step 708, the anonymization computer may initialize an anonymized time series data sequence including one or more anonymized time series data value sequences. In some embodiments, the length of the anonymized time series data sequence may be equal to the length of the private time series data sequence (which may be determined by the anonymization computer in step 702, as described above). In some embodiments, the anonymization computer may initialize the anonymized time series data sequence by generating one or more random values, and the one or more anonymized time series data values ​​may include the one or more random values. The anonymization computer may initialize the sequence of anonymized time series data values ​​as a Gaussian noise vector, i.e., the anonymization computer may sample the one or more random values ​​from a standard normal distribution.

[0104] At step 710, the anonymization computer may then perform an iterative process to update (e.g., optimize) the anonymized time series data sequence. This iterative process may include Figure 7 Steps 710-720 in , and can be repeated until the termination condition is met. Generally speaking, in each round of the iterative process, the anonymization computer can sample multiple batches of time series data. Each batch can include one or more subsequences of time series data. These batches can be used to determine the loss The loss may be used to update the anonymized time series data sequence.

[0105] In some embodiments, the loss A combined loss may be included, the combined loss including a weighted combination of multiple losses, the multiple losses may include a privacy loss (which may also be called "correlation loss"), distance loss (which may also be called “nearest neighbor loss”), identity loss (which may also be referred to as “non-nearest neighbor loss”) and the decoration loss (This may also be referred to as a "complexity loss".) In some embodiments, the utility loss A weighted combination of distance loss and identity loss may be included. Likewise, in some embodiments, the decoration loss may include a weighted combination of a first complexity loss, a second complexity loss, and a nearest neighbor complexity loss. One or more of these losses may correspond to the criteria or conditions described above. For example, the privacy loss may correspond to a privacy protection condition, and the utility loss may correspond to a utility protection condition.

[0106] Based on the loss, the anonymization computer can update the anonymized time series data sequence using a technique such as mini-batch stochastic gradient descent. This iterative process of sampling batches, determining the loss, and updating the anonymized time series data sequence can be repeated with the goal of gradually reducing the loss until a termination condition has been met.

[0107] In more detail, at step 712, the anonymization computer may sample a batch of anonymized subsequences including one or more anonymized subsequences from the anonymized time series data sequence. The anonymization computer may sample the batch of anonymized subsequences randomly and without replacement. In some embodiments, the batch of anonymized subsequences may include a first batch of anonymized subsequences so as to distinguish the first batch of anonymized subsequences from a second batch of anonymized subsequences described in more detail below. In some embodiments, the anonymization computer may z-normalize the batch of anonymized subsequences after sampling the batch of anonymized subsequences from the anonymized time series data sequence. The batch of anonymized subsequences may be used later to determine various losses, such as privacy losses, as described in more detail below.

[0108] Similarly, in step 712, the anonymization computer may determine a batch of anonymized subsequence indicators corresponding to the batch of anonymized subsequences. An "anonymized subsequence indicator" is an indicator that indicates an anonymized subsequence. The indicator itself is not anonymous. The batch of anonymized subsequence indicators may include one or more anonymized subsequence indicators. In some embodiments, the batch of anonymized subsequence indicators may include a first batch of anonymized subsequence indicators corresponding to the first batch of anonymized subsequences. The batch (first batch) of anonymized subsequence indicators may be stored in a vector I or represented by the vector. In some embodiments, the batch (first batch) of anonymized subsequence indicators may be used to sample the batch (first batch) of anonymized subsequences. For example, each anonymized subsequence indicator may be used to identify the "starting point" of an anonymized subsequence of length m in an anonymized time series data sequence. In some embodiments, the anonymization computer may sample the anonymized subsequences by randomly sampling (and sampling without replacement) n from an integer interval [0, ..., nm] (where n is the length of the anonymized time series data sequence) batch times (where n batch The batch of anonymized subsequence indicators is determined by using a hyperparameter including the number of anonymized subsequences in the batch of anonymized subsequences.

[0109] In some embodiments, at step 712, the anonymization computer may sample a second batch of anonymized subsequences including one or more second anonymized subsequences from the anonymized time series data sequence. As with the first batch of anonymized subsequences described above, the second batch of anonymized subsequences may be sampled randomly and without replacement. In some embodiments, the anonymization computer may z-normalize the second batch of anonymized subsequences after sampling the second batch of anonymized subsequences from the anonymized time series data sequence. In some embodiments, the second batch of anonymized subsequences may be sampled so that the second batch of anonymized subsequences are different from the first batch of anonymized subsequences, for example, no second anonymized subsequence in the second batch of anonymized subsequences is the same as the corresponding first anonymized subsequence in the first batch of anonymized subsequences. The second batch of anonymized subsequences may be used later to determine various losses, such as identity loss (also referred to as "non-nearest neighbor loss"), as described below.

[0110] Similarly, the anonymization computer can determine a second batch of anonymized subsequence indicators corresponding to the second batch of anonymized subsequences. The second batch of anonymized subsequence indicators may include one or more second anonymized subsequence indicators. The second batch of anonymized subsequence indicators may be stored in a vector K or represented by the vector. In some embodiments, the second batch of anonymized subsequence indicators may be used to sample the second batch of anonymized subsequences. For example, each second anonymized subsequence indicator may be used to identify the starting point of a second anonymized subsequence with a subsequence length of m in an anonymized time series data sequence. In some embodiments, the anonymization computer may determine the batch of anonymized subsequence indicators for each first anonymized subsequence indicator i in the first batch of anonymized subsequence indicators I by randomly sampling (and sampling without replacement) the second anonymized subsequence indicator k from an integer interval [0, ..., nm]. If any second anonymized subsequence indicator is identical to the corresponding first anonymized subsequence indicator, the anonymization computer may evaluate the second batch of anonymized subsequence indicators and resample the second anonymized subsequence indicators.

[0111] In some embodiments, at step 712, the anonymization computer may additionally use the batch of anonymized subsequence indicators I and the private time series data sequence T to identify a batch of target subsequences T i,m. The batch of target subsequences may include one or more private subsequences from the private time series data sequence, and may each have a predetermined subsequence length (e.g., m, as described above). Each private subsequence in the batch of target subsequences may substantially correspond to a (first) anonymized subsequence from the batch of (first) anonymized subsequences. In some embodiments, the anonymization computer may z-normalize each private subsequence in the batch of target subsequences after extracting the batch of private subsequences from the private time series data sequence. As described below, the batch of target subsequences may be later used to determine the correlation loss (also referred to as the privacy loss) by, for example, determining the average of the Pearson correlations between each (first) anonymized subsequence in the batch of (first) anonymized subsequences and the corresponding private subsequence in the batch of target subsequences.

[0112] In step 714, the anonymization computer may determine a batch of nearest neighbor subsequences using the anonymized time series data sequence, the matrix profile index, and the batch of (first) anonymized subsequence indicators. The batch of nearest neighbor subsequences may include one or more nearest neighbor subsequences. The batch of nearest neighbor subsequences may include subsequences that are theoretically or expected to be the nearest neighbors of the batch of (first) anonymized subsequences based on the nearest neighbor indicators provided by the matrix profile index. As further described below, the batch of nearest neighbor subsequences may be used later to calculate a loss, such as a utility loss, for example, by determining the distance between the batch of nearest neighbor subsequences and the batch of (first) anonymized subsequences and comparing the distance to the expected nearest neighbor distance outlined by the matrix.

[0113] In some embodiments, the anonymization computer may first use the matrix profile index and the batch (first batch) of anonymized subsequence indicators I to determine a batch of nearest neighbor indicators. The batch of nearest neighbor indicators may include one or more nearest neighbor indicators. In some embodiments, the batch of nearest neighbor indicators may be represented by or stored in a vector J. In more detail, the anonymization computer may use the batch (first batch) of anonymized subsequence indicators I to annotate the matrix profile. Indexing is performed to determine the batch of nearest neighbor indicators J, that is, Here, the use of square brackets around an index vector indicates that the index vector I enclosed in the brackets is used to start from the vector before the left bracket. Extract elements from .

[0114] The anonymization computer can then use the batch of nearest neighbor indicators and the anonymized time series data sequence To determine the batch of nearest neighbor subsequences For example, the method is to use the batch of nearest neighbor indicators J to extract the anonymized time series data sequence Get a batch of n of length m batch In some embodiments, the anonymization computer may perform z-normalization on one or more nearest neighbor subsequences in the batch of nearest neighbor subsequences after obtaining the batch of nearest neighbor subsequences.

[0115] At step 716, the anonymization computer may determine a loss based on the batch of anonymized subsequences, the batch of anonymized subsequence indicators, the private time series data sequence, the matrix profile, and the matrix profile index. In some embodiments, the loss may include a combined loss that includes a weighted combination of multiple losses. Thus, the anonymizing computer may determine the loss by determining each of the multiple losses and then determining the weighted combination of the multiple losses. The combined loss can be formulated such that The solution satisfies some of the conditions described above (eg, privacy protection conditions, practicality protection conditions, and decoration conditions).

[0116] One (unweighted or equally weighted) formulation of the loss is For example, privacy loss (also known as "relevance loss"), utility loss and decorative loss (also called "complexity loss"). In some embodiments, the utility loss itself may include the distance loss (also known as the "nearest neighbor loss") and identity loss (also known as the “non-nearest neighbor loss”), namely, Some of the multiple losses, particularly the losses determined using matrix profiles, may be referred to as "matrix profile losses". For example, the distance loss may be determined using matrix profiles and may include a matrix profile loss. In some embodiments, the decoration loss may include a weighted combination of multiple decoration losses, which may include a first decoration loss corresponding to a first batch of anonymized subsequences. The second decoration loss corresponding to the second batch of anonymized subsequences and the nearest neighbor decoration loss corresponding to the batch of nearest neighbor subsequences Right now, If the loss comprises a weighted combination of multiple losses, the iterative process may additionally include anonymizing computer determinations such as a nearest neighbor loss, a correlation loss, and a decoration loss.

[0117] Another formulation of the loss is Where α, β, and γ are weighted hyperparameters used to weight each loss relative to the privacy loss. In some embodiments, hyperparameters such as α=1, β=2, and γ=1 may be used to calculate the losses, however it should be understood that any suitable values ​​of α, β, and γ may be used to weight multiple losses.

[0118] References below Fig.10 , 13A -13C and Figures 16A-16C A process for determining multiple losses is described. It should be understood that the combined losses may include some or all of the losses described above as well as combinations of other losses. Therefore, some or all of the loss determination steps described below with reference to these figures may be optional.

[0119] refer to Fig.10 , at step 1002, the anonymization computer may determine a nearest neighbor loss, also known as a distance loss. Fig.13A An exemplary process for determining a nearest neighbor loss is described. In general, the nearest neighbor loss associates the expected difference between each (first) anonymized subsequence in the batch of (first) anonymized subsequences and its corresponding nearest neighbor subsequence from the batch of nearest neighbor subsequences with the actual difference between these subsequences. The nearest neighbor loss can be related to the practicality of the anonymized time series data sequence, and can therefore be a component of the practicality loss, as described above. If the anonymized time series data sequence retains the matrix profile of the private time series data sequence, the distance between each anonymized subsequence and its assumed nearest neighbor subsequence should be similar to the distance indicated by the matrix profile. As described above, the nearest neighbor loss can include a matrix profile loss.

[0120] In general, the nearest neighbor loss (or distance loss) corresponding to the (first) anonymized subsequence can be defined by the formula The formula includes the private time series data subsequence T i,m Its nearest neighbor T j,m (which can be derived from the matrix profile) and the z-normalized Euclidean distance (Dist(·,·)) between the anonymized time series data sequences and its assumed nearest neighbor The distance loss of the entire batch (first batch) of anonymized subsequences may include a mean square error of the distance loss corresponding to each (first) anonymized subsequence in the batch (first) anonymized subsequences.

[0121] Minimizing the distance loss (using, for example, mini-batch stochastic gradient descent) can produce an anonymized time series data sequence with a matrix profile similar to that of the private time series data sequence, thereby partially satisfying the utility protection condition. Fig.14 As shown in , when the distance between an individual first anonymized subsequence (e.g., first anonymized subsequence 1410) and the corresponding anonymized nearest neighbor subsequence (e.g., anonymized nearest neighbor subsequence 1412) is similar to the difference between a private time series data subsequence (e.g., private subsequence 1406) and its corresponding nearest neighbor subsequence (e.g., private nearest neighbor subsequence 1408), the distance loss of the first anonymized subsequence can be minimized.

[0122] refer to Fig.13A An exemplary method of determining nearest neighbor loss is described. At step 1302, an anonymization computer may determine a batch of nearest neighbor distances including one or more nearest neighbor distances based on the batch of anonymized subsequences and the batch of nearest neighbor subsequences. The batch of nearest neighbor distances may include z-normalized Euclidean distances. The anonymization computer may determine the batch of nearest neighbor distances using any suitable method or formulation, such as a standard formula for calculating the z-normalized Euclidean distance between the anonymized subsequence and the batch of z-normalized nearest neighbor subsequences.

[0123] In step 1304, the anonymization computer may determine a batch of target nearest neighbor distances. The batch of target nearest neighbor distances may include one or more target nearest neighbor distances. The anonymization computer may use the batch (first batch) of anonymized subsequence indicators and the matrix profile to determine the batch of target nearest neighbor distances, for example, by using the batch (first batch) of anonymized subsequence indicators, i.e. The matrix profile is indexed. In some embodiments, the batch of target nearest neighbor distances may include z-normalized Euclidean distances.

[0124] At step 1306, the anonymization computer may determine the nearest neighbor loss based on the batch of nearest neighbor distances and the batch of target nearest neighbor distances. For example, the anonymization computer may use the formula The anonymization computer may then determine a mean square error of the one or more nearest neighbor losses, and the nearest neighbor loss may include the mean square error.

[0125] Return to reference Fig.10At step 1004, the anonymization computer may determine a non-nearest neighbor loss, which is also referred to as an identity loss. The anonymization computer may determine the non-nearest neighbor loss based on the first batch of anonymized subsequences, the second batch of anonymized subsequences, and the batch of nearest neighbor subsequences. Fig. 13B An exemplary process for determining a non-nearest neighbor loss is described.

[0126] In general, the non-nearest neighbor loss relates to the difference between the first batch of anonymized subsequences and the second batch of anonymized sequences. The non-nearest neighbor loss can be related to the utility of the anonymized time series data sequence and can be a component of the utility loss. The non-nearest neighbor loss can include a matrix profile loss. If the anonymized time series data sequence retains the matrix profile of the private time series data sequence, the difference between the first anonymized subsequence and a random anonymized subsequence (e.g., the second anonymized subsequence) can be greater than the distance between the first anonymized subsequence and its assumed nearest neighbor subsequence, as determined by the matrix profile index.

[0127] In other words, if T i,m The nearest neighbor of j,m , then for any k∈{0,…,n-m+1}\{i,j}, Preferably less than To enforce such a relationship, the formula To define the nearest neighbor loss for a given (first) anonymized subsequence Where ReLU is a rectified linear unit function that returns the value of its argument if the argument is greater than or equal to zero, and returns zero otherwise. As described above, the term The distances between pairs of putative nearest neighbor subsequences are calculated, and the term Compute the distances between pairs of putative non-nearest neighbor subsequences. In order to preserve the matrix profile from private time series data sequences, Preferably less than If this relationship is violated, the above formulation may produce non-zero values. Fig.14 As shown in , when a particular first anonymized subsequence (e.g., first anonymized subsequence 1410) is more similar to an anonymized nearest neighbor subsequence (e.g., anonymized nearest neighbor subsequence 1412) than a second anonymized subsequence (e.g., second anonymized subsequence 1414), the non-nearest neighbor loss corresponding to the first anonymized subsequence is minimized.

[0128] refer to Fig. 13BAt step 1308, the anonymization computer may determine a batch of nearest neighbor distances based on the first batch of anonymized subsequences and the batch of nearest neighbor indicators. The batch of nearest neighbor distances may include one or more nearest neighbor distances. The anonymization computer may, for example, refer to Fig.13A The anonymization computer may determine the nearest neighbor distances at step 1302, store the nearest neighbor distances, and then retrieve them at step 1308, thereby eliminating the need to determine the batch of nearest neighbor distances twice. The batch of nearest neighbor distances may include z-normalized Euclidean distances.

[0129] At step 1310, the anonymization computer may determine a batch of anonymized subsequence distances using the first batch of anonymized subsequences and the second batch of anonymized subsequences. The batch of anonymized subsequence distances may include one or more anonymized subsequence distances and may include z-normalized Euclidean distances. The anonymization computer may determine the batch of nearest neighbor distances using any suitable method or formula, such as a standard formula for calculating the z-normalized Euclidean distances between the first batch of anonymized subsequences and the z-normalized batch of nearest neighbor subsequences.

[0130] At step 1312, the anonymization computer may determine a batch of distance differences based on the batch of nearest neighbor distances and the batch of anonymized subsequence differences. The batch of distance differences may include one or more distance differences. In some embodiments, the anonymization computer may determine the batch of distance differences by subtracting each of the one or more nearest neighbor distances from the corresponding anonymized subsequence distance of the one or more anonymized subsequence differences, thereby determining one or more distance differences. The anonymization computer may determine the nearest neighbor loss based on this batch of distance differences, for example, by performing steps 1314 and 1316.

[0131] At step 1314, the anonymization computer may correct the batch of distance differences using, for example, a rectified linear unit (ReLU), thereby producing a corrected batch of distance differences comprising one or more corrected distance differences. Subsequently, at step 1316, the anonymization computer may determine the sum of the corrected batch of distance differences. The nearest neighbor loss may include this sum of the corrected batch of distance differences.

[0132] Return to reference Fig.10 At step 1006, the anonymization computer may determine the relevance loss, which is also referred to as the privacy loss. Fig. 13CAn exemplary process for determining the correlation loss is described. In general, the correlation loss involves comparing each (first) anonymized subsequence in the first batch of anonymized subsequences with a corresponding private subsequence in the private time series data sequence (which may be referred to as a "target subsequence", e.g., Figure 7 The correlation between the (first) anonymized subsequence in the batch of (first) anonymized subsequences and the private subsequence in the private sequence of time series data values ​​may be minimized when the (first) anonymized subsequence in the batch of (first) anonymized subsequences is uncorrelated with the private subsequence in the private sequence of time series data values ​​if each anonymized subsequence and its corresponding target subsequence are uncorrelated. If each anonymized subsequence and its corresponding target subsequence are uncorrelated, then it may be difficult or impossible to determine any time series data value from the sequence of private time series data values ​​given the sequence of anonymized time series data values. Therefore, the correlation loss may be minimized when the (first) anonymized subsequence in the batch of (first) anonymized subsequences is uncorrelated with the private subsequence in the sequence of private time series data.

[0133] In some embodiments, the formula To define the correlation loss (privacy loss) corresponding to a specific (first) time series data subsequence. Fig.15 As shown in , the privacy loss can be determined by evaluating the correlation between a private time series data subsequence (e.g., private subsequence 1506) from a private time series data sequence 1502 (e.g., a private subsequence from a batch of target subsequences) and an anonymized time series data subsequence (e.g., anonymized subsequence 108) from anonymized time series data sequence 1504. The private time series data subsequence and the corresponding anonymized time series data subsequence can have equal subsequence lengths m1510 and can be defined by, for example, an indicator i∈I of the batch of (first) anonymized subsequence indicators.

[0134] There are various methods or procedures that can be used to determine the Pearson correlation between subsequences of time series data. Fig. 13C One such method is described. At step 1318, the anonymization computer may determine a batch of correlation distances using the batch of anonymized subsequences and the batch of target subsequences. The batch of correlation distances may include one or more correlation distances. Each of the one or more correlation distances may include a distance between an anonymized subsequence in the batch of anonymized subsequences and a corresponding target subsequence in the batch of target subsequences. The batch of correlation distances may include Euclidean distances or z-normalized Euclidean distances and may be determined using any suitable method for determining Euclidean distances or z-normalized Euclidean distances.

[0135] At step 1320, the anonymization computer may determine a correlation loss based on the batch of correlation distances and the subsequence lengths. As described above, in some embodiments, the correlation loss may be equal to the squared Pearson correlation coefficient, which may correspond to the correlation between the batch of (first) anonymized subsequences and the batch of target subsequences. Anonymizing computers can use the formula A correlation loss (corresponding to individual (first) anonymized subsequences in the first batch of anonymized subsequences) is determined based on the batch of correlation distances and the subsequence length m. The anonymization computer may perform this process for each (first) anonymized subsequence in the batch of (first) anonymized subsequences and then determine the aggregate correlation loss as the average of the resulting losses. However, it should be understood that the anonymization computer may use any other suitable method or formula to determine the correlation loss.

[0136] Return to reference Fig.10 In some embodiments, in addition to the nearest neighbor loss and non-nearest neighbor loss described above, the multiple losses may also include an optional decoration loss (also referred to as complexity loss). The anonymization computer may determine this decoration loss at step 1008. In some embodiments, the anonymization computer may determine this decoration loss based on one or more private subsequence complexity values ​​(e.g., Figure 7 In some embodiments, the anonymization computer may additionally use the second batch of anonymized subsequences and the second batch of anonymized subsequence indicators to determine the decoration loss.

[0137] In some embodiments, the decoration loss may include a first complexity loss Second complexity loss and nearest neighbor complexity loss In some embodiments, this weighted combination may be referred to as a "second weighted combination" to distinguish it from the weighted combination used to determine the combined loss (which may be referred to as a "first weighted combination"). The anonymization computer may determine these complexity losses in steps 1010-1014 and then determine the decoration loss by combining these complexity losses in step 1016.

[0138] At step 1010, the anonymization computer may determine a first complexity loss based on the first anonymized subsequences, the first anonymized subsequence indicators, and the one or more private subsequence complexity values. The first complexity loss may correspond to a first batch of anonymized subsequences, and the one or more private subsequence complexity values ​​may correspond to one or more private subsequences in the private time series data subsequences that may have been anonymized earlier by the anonymizing computer, e.g., Figure 7 Step 706 determines. Fig.16A An exemplary process for determining the first complexity loss is described. In general, the formula To determine the first anonymized time series data subsequence The first complexity loss The Complexity(·) function computes the complexity of its input using methods such as those described in [9]. i,m ) may include the corresponding target subsequence complexity value, which may be obtained from the vector stored in C m The complexity value of one or more private subsequences is determined as described above with reference to Figure 7 As described in step 706 of .

[0139] For more details, see Fig.16A At step 1602, the anonymization computer may use one or more private subsequence complexity values ​​C m and the first group of anonymized subsequence indicators I to determine one or more first target subsequence complexity values, for example, by using I to C m Indexing, that is, C m [I] These one or more first target subsequence complexity values ​​may correspond to Complexity(T) presented in the first complexity loss formula described above. i,m )item.

[0140] At step 1604, the anonymization computer may determine a first anonymized subsequence complexity value for each first anonymized subsequence, thereby determining one or more first anonymized subsequence complexity values. The anonymization computer may determine each first anonymized subsequence complexity value by performing steps 1606-1610, as described below.

[0141] At step 1606, the anonymization computer may determine one or more first sequence differences based on the first set of anonymized subsequences. Each of the one or more first sequence differences may include a difference between a first anonymized subsequence time series data value of the first anonymized subsequence and a sequentially first anonymized time series data value of the first anonymized subsequence, i.e., If necessary, the anonymization computer may z-normalize the first anonymized sequence before determining the one or more first sequence differences.

[0142] At step 1608, the anonymization computer may determine one or more squared first order differences by squaring each of the one or more first order differences, ie,

[0143] At step 1610, the anonymization computer may determine the sum of one or more squared first order differences, ie, The corresponding first anonymized subsequence complexity value may include this sum of one or more squared first order differences. As described above, steps 1606-1610 generally correspond to a process for determining a first anonymized subsequence complexity value for a single first anonymized subsequence. Thus, as described above, steps 1606-1610 may be performed for each first anonymized subsequence in the first batch of anonymized subsequences to determine one or more first anonymized subsequence complexity values.

[0144] At step 1612, the anonymization computer may determine a first complexity loss based on the first anonymized subsequence complexity value and the first target complexity value. In some embodiments, the anonymization computer may determine one or more first anonymized subsequence complexity values With a first target subsequence complexity value Complexity(T i,m ), and the first complexity loss A first mean square error may be included.

[0145] Return to reference Fig.10 At step 1012, the anonymization computer may determine a second complexity loss based on the second batch of anonymized subsequences, the second batch of anonymized subsequence indicators, and the one or more private subsequence complexity values. The second complexity loss may correspond to the second batch of anonymized subsequences, and (as described above) the one or more private subsequence complexity values ​​may correspond to the one or more private subsequences of the private time series data subsequence. Fig. 16B An exemplary process for determining the second complexity loss is described. In general, the formula To determine the second anonymized time series data subsequence The second complexity loss Complexity(T k,m ) may include a corresponding target subsequence complexity value, which may be based on the complexity value stored in the vector Cm The complexity value of one or more private subsequences is determined, for example, in Figure 7 is determined by the anonymization computer in step 706 of the flowchart of .

[0146] For more details, see Fig. 16B At step 1612, the anonymization computer may use one or more private subsequence complexity values ​​C m and a second batch of anonymized subsequence indicators K to determine one or more second target subsequence complexity values, for example, by using K to C m Indexing, that is, C m [K] These one or more second target subsequence complexity values ​​may correspond to Complexity(T) presented in the second complexity loss formula described above. k,m )item.

[0147] At step 1616, the anonymization computer may determine a second anonymized subsequence complexity value for each second anonymized subsequence, thereby determining one or more second anonymized subsequence complexity values. The anonymization computer may determine each second anonymized subsequence complexity value by executing steps 1618-1622.

[0148] At step 1618, the anonymization computer may determine one or more second sequence differences based on the second batch of anonymized subsequences. Each of the one or more second sequence differences may include a difference between a second anonymized subsequence time series data value of the second anonymized subsequence and a sequential second anonymized time series data value of the second anonymized subsequence, i.e., If necessary, the anonymization computer may z-normalize the second anonymized sequence before determining the one or more second sequence differences.

[0149] At step 1620, the anonymization computer may determine one or more squared second order differences by squaring each of the one or more second order differences, ie,

[0150] At step 1622, the anonymization computer may determine the sum of one or more squared second order differences, ie, The corresponding second anonymized subsequence complexity value may include this sum of one or more squared second order differences. As described above, steps 1618-1622 generally correspond to a process for determining a second anonymized subsequence complexity value for a single second anonymized subsequence. Thus, steps 1618-1622 may be performed for each second anonymized subsequence in the second batch of anonymized subsequences to determine one or more second anonymized subsequence complexity values.

[0151] At step 1624, the anonymization computer may determine a second complexity loss based on the second anonymized subsequence complexity value and the second target complexity value. In some embodiments, the anonymization computer may determine one or more second anonymized subsequence complexity values with a second target subsequence complexity value The second mean square error between the two, and the second complexity loss A second mean square error may be included.

[0152] Return to reference Fig.10 At step 1014, the anonymization computer may determine a nearest neighbor complexity loss based on the batch of nearest neighbor subsequences, the batch of nearest neighbor subsequence indicators, and the one or more private subsequence complexity values. The nearest neighbor complexity loss may correspond to the batch of nearest neighbor subsequences, and (as described above) one or more private subsequence complexity values ​​may correspond to one or more private subsequences of the private time series data subsequence. Fig. 16C An exemplary process for determining a nearest neighbor complexity loss is described.

[0153] In general, the formula To determine the nearest neighbor anonymized time series data subsequence The nearest neighbor complexity loss Complexity(T j,m ) may include a corresponding target subsequence complexity value, which may be obtained from the complexity value stored in the vector C m The complexity value of one or more private subsequences in the .

[0154] For more details, see Fig. 16C At step 1626, the anonymization computer may use one or more private subsequence complexity values ​​C m and a batch of nearest neighbor subsequence indicators J to determine one or more target nearest neighbor subsequence complexity values, for example, by using J to C m Indexing, that is, C m[J] These one or more target nearest neighbor subsequence complexity values ​​may correspond to the Complexity(T) presented in the nearest neighbor complexity loss formula described above. j,m )item.

[0155] At step 1628, the anonymization computer may determine a nearest neighbor subsequence complexity value for each nearest neighbor subsequence, thereby determining one or more nearest neighbor subsequence complexity values. The anonymization computer may determine each nearest neighbor subsequence complexity value by executing steps 1630-1634.

[0156] At step 1630, the anonymization computer may determine one or more nearest neighbor sequence differences based on the batch of nearest neighbor subsequences. Each of the one or more nearest neighbor sequence differences may include a difference between a nearest neighbor subsequence time series data value of the nearest neighbor subsequence and a sequential nearest neighbor time series data value of the nearest neighbor subsequence, i.e., If desired, the anonymization computer may z-normalize the nearest neighbor sequence before determining one or more nearest neighbor sequence differences.

[0157] At step 1632, the anonymization computer may determine one or more squared nearest neighbor order differences by squaring each of the one or more nearest neighbor order differences, ie,

[0158] At step 1634, the anonymization computer may determine the sum of one or more squared nearest neighbor order differences, i.e., The corresponding nearest neighbor subsequence complexity value may include this sum of one or more squared nearest neighbor order differences. As described above, steps 1630-1634 generally correspond to a process for determining a nearest neighbor subsequence complexity value for a single nearest neighbor subsequence. Therefore, as described above, steps 1630-1634 may be performed for each nearest neighbor subsequence in the batch of nearest neighbor subsequences to determine one or more nearest neighbor subsequence complexity values.

[0159] At step 1636, the anonymization computer may determine a nearest neighbor complexity loss based on the nearest neighbor subsequence complexity value and the target nearest neighbor complexity value. In some embodiments, the anonymization computer may determine one or more nearest neighbor subsequence complexity values The nearest neighbor subsequence complexity value with a target The nearest neighbor mean square error between , and the nearest neighbor complexity loss The nearest neighbor mean square error may be included.

[0160] Return to reference Fig.10At step 1016, the anonymization computer may determine a weighted combination of the first complexity loss, the second complexity loss, and the nearest neighbor complexity loss (sometimes referred to as a "second weighted combination"). Decoration Loss This weighted combination may be included. The anonymization computer may use any suitable weighting terms, which may include hyperparameters of an anonymization method according to an embodiment. In some embodiments, the first complexity loss, the second complexity loss, and the nearest neighbor complexity loss may be equally weighted.

[0161] At step 1018, having determined a plurality of losses, the anonymization computer may determine a combined loss as a weighted combination of the plurality of losses. In some embodiments, this weighted combination (sometimes referred to as a "first weighted combination") may include a weighted combination of a nearest neighbor loss, a non-nearest neighbor loss, a correlation loss, and a decoration loss. The anonymization computer may use, for example, The formula to determine the combined loss is Where α, β, and γ may include weighted hyperparameters for controlling the relative importance of each individual loss in the weighted combination of losses. In some embodiments, weighted hyperparameters may be used, such as α=1, β=2, and γ=1, however, other weighted hyperparameters may also be used to determine the combined loss.

[0162] Return to reference Figure 7 , the loss has been determined, and in step 718, the anonymization computer can update the anonymized time series data sequence based on the loss, thereby completing the iteration of the iterative process. In some embodiments, updating the anonymized time series data sequence includes updating the anonymized time series data sequence using a small batch of stochastic gradient descent. The anonymization computer can determine the gradient of the loss relative to multiple batches of anonymized time series data subsequences, and then determine the gradient update, which can be used to update the anonymized time series data sequence. The gradient update can correspond to a change in the anonymized time series data sequence, and the change causes the maximum reduction (or expected maximum reduction) in the loss in subsequent iterations of the iterative process. In some embodiments, updating the anonymized time series data sequence can also include z-normalizing the anonymized time series data sequence after using stochastic gradient descent to update the anonymized time series data sequence. Optionally, z-normalizing the anonymized time series data sequence in this way can improve the convergence of the iterative process.

[0163] At step 720, the computer system may repeat the iterative process until a termination condition is satisfied, for example, by returning to step 710 and repeating steps 710-720 (e.g., by sampling a new batch of anonymized subsequences and target subsequences at step 712 (which may be different from the batches of subsequences sampled in the current iteration), determining a new batch of nearest neighbor subsequences at step 714, determining the loss at step 716, and updating the anonymized time series data sequence based on the loss at step 718).

[0164] In some embodiments, if the total number of iterations is equal to or exceeds a predetermined number of iterations n iter , then the termination condition may be satisfied. This predetermined number of iterations may include hyperparameters of the anonymization method according to an embodiment, and may be determined, for example, by a data scientist or other domain expert who implements the method according to an embodiment using an anonymization computer (e.g., by configuring the anonymization computer to execute the method according to an embodiment). In other embodiments, the termination condition may be satisfied if the anonymized time series data sequences converge, for example, if the change between the anonymized time series data sequences becomes less than a threshold change or otherwise approaches a magnitude of zero. In some embodiments, if the resulting anonymized time series data sequences are under-trained (e.g., the absolute value of the correlation is not small enough, which may be caused by a low learning rate or a predetermined number of iterations n). iter The iterative process can be repeated for subsequent training sessions using the anonymized time series data sequence as input (instead of the private time series data sequence). Completing the iterative method can result in the generation of a final time series data sequence, which can be output by the anonymization computer, for example, to an operator of the anonymization computer, to a client computer or a publishing system, or to an anonymization evaluation computer to evaluate the effectiveness of the anonymization method according to an embodiment.

[0165] In some embodiments, at step 722, the final anonymized time series data sequence may be analyzed and compared with the private time series data sequence, for example, to evaluate the anonymization method. Fig.11 and 12An exemplary anonymization evaluation method is described in more detail. Additionally or alternatively, the anonymization computer may, for example, provide the final anonymized time series data sequence to the client computer in step 724. In some embodiments, providing the anonymized time series data sequence may include the anonymization computer sending the anonymized time series data sequence to the client computer. Alternatively, sending the anonymized time series data sequence to the client computer may include publishing the anonymized time series data sequence (e.g., on a publishing system such as publishing system 206). After the anonymized time series data sequence has been published, the client computer may access the anonymized time series data sequence. Once the client computer has acquired the anonymized time series data sequence, the client computer (or the operator of the client computer, such as a data scientist) may perform analysis on the anonymized time series data sequence instead of the private time series data sequence. In this way, the privacy of the data subject corresponding to the private time series data sequence can be protected, and data scientists or other researchers can still draw useful conclusions by analyzing the anonymized time series data sequence.

[0166] As described above, at step 722, the anonymization computer (or another computer system, such as Figure 2 The anonymization evaluation computer 210 depicted in FIG. 2 can evaluate the effectiveness of the anonymization method according to the embodiment and the anonymized time series data sequence. Fig.11 The block diagram and Fig.12 The flowchart depicts an exemplary analysis method. Fig.11 This analysis method is generally outlined. Fig.11 As depicted in , a private time series data sequence 1102 may be anonymized using a method according to an embodiment (i.e., TSAUMP 1104) to produce an anonymized time series data sequence 1106. Then, a task method 1108 may be applied to both the private time series data sequence 1102 and the anonymized time series data sequence 1106. Examples of task methods include motif mining, inconsistency mining, anomaly detection, segmentation, and clustering. The results of the task method 1108 may include an anonymized time series method output 1110 and a private time series method output 1112. For example, if the task method 1108 is an anomaly detection task method, the anonymized time series method output 1110 may include a list of anomalies detected in the anonymized time series data sequence 1106. Similarly, the private time series method output 1112 may include a list of anomalies detected in the private time series data sequence 1102.

[0167] Thereafter, the anonymized time series method output 1110 and the private time series method output 1112 may be input into a task scoring mechanism 1114. The task scoring mechanism 1114 may be used to score the performance of the task method 1108 on the anonymized time series data sequence 1106 and the private time series data sequence 1102. For example, if the locations of anomalies in the private time series data sequence 1102 are already known (e.g., because the private time series data sequence 1102 includes labeled training data), then the private time series data sequence output score 1118 may evaluate the accuracy of the anomaly detection task method 1108 in identifying these known anomalies in the private time series data sequence 1102. Similarly, the anonymized time series data sequence output score 1116 may evaluate the accuracy of the anomaly detection task method 1108 in identifying these known anomalies in the anonymized time series data sequence 1116. Ideally, if the method according to the embodiment meets the practicality conditions (as described above), the anonymized time series data sequence output score 1116 should be similar to the private time series data sequence output score 1118.

[0168] For more details, see Fig.12 At step 1202, a computer system may receive a private time series data sequence including one or more private time series data values, and an anonymized time series data sequence including one or more anonymized time series data values. This anonymized time series data sequence may be generated by an anonymization computer based on the private time series data sequence using an anonymization method (e.g., as described above). In some embodiments, the computer system may include an anonymization computer, and may effectively receive the anonymized time series data sequence and the private time series data sequence from itself, for example, by retrieving the anonymized time series data sequence and the private time series data sequence from a memory element such as a hard drive. In other embodiments, the computer system may include an anonymization evaluation computer (e.g., such as Figure 2 ), and can receive anonymized time series data sequences and private time series data sequences from, for example, an anonymizing computer.

[0169] At step 1204, the computer system may use an analysis program to analyze the private time series data sequence, thereby generating a private analysis result. This analysis program may include, for example, the analysis program described above with reference to Fig.11 As an example, the private analysis results may include the results of a motif or inconsistency mining task applied to a private time series data sequence. As another example, the private analysis results may include the results of a clustering task applied to a private time series data sequence.

[0170] At step 1206, the computer system may use an analysis program to analyze the anonymized time series data sequence, thereby generating an anonymous analysis result. The analysis program may include the same analysis program applied to the anonymized time series data sequence, such as a motif or inconsistency mining task, or a clustering task. If the practicality condition has been met, the anonymous analysis result may be similar to the private analysis result.

[0171] At step 1208, the computer system may generate a private score based on the private analysis results and the scoring mechanism, such as Fig.11 The scoring mechanism can generate a private score that generally indicates the performance (e.g., accuracy and precision) of the analysis program on the private time series data sequence. For example, if the analysis program is an anomaly detection method and the location of the anomaly in the private time series data sequence is known in advance, the scoring mechanism can generate a private score based on the difference between the private analysis result and the expected private analysis result based on the known anomaly location.

[0172] At step 1210, the computer system may generate an anonymous score based on the anonymous analysis results and the scoring mechanism. The scoring mechanism may generate an anonymous score that generally indicates the performance (e.g., accuracy and precision) of the analysis program on the anonymized time series data sequence. If the practicality condition has been met, the analysis program may achieve similar results for the anonymized time series data sequence and the private time series data sequence. For example, if the analysis program is an anomaly detection method, and the location of the anomaly in the private time series data sequence is known in advance, the scoring mechanism may generate an anonymous score based on the difference between the anonymous analysis results and the expected private analysis results based on the known anomaly locations.

[0173] At step 1212, the computer system can evaluate the anonymization method by comparing the private score to the anonymous score. This can be accomplished in a variety of ways. For example, the computer system can subtract the private score from the anonymized score, for example, to determine a performance difference between the anonymized time series data sequence and the private time series data sequence. A smaller difference (e.g., closer to zero) can indicate better performance of the anonymization method, while a larger difference can indicate worse performance of the anonymization method.

[0174] As described above, various anonymization evaluation methods according to embodiments are used to conduct a series of experiments in order to test the effectiveness of anonymization methods according to embodiments of the present disclosure. These experiments involve several data analysis tasks, such as motif mining, inconsistency mining, segmentation, and clustering. Additional experiments are performed to evaluate the above-mentioned anonymization evaluation methods. Figure 1That is, this experiment evaluates whether it is possible to design a model that infers sensitive information such as gender (or age) from ECG data, whether the anonymized time series data sequences generated using the method according to the embodiment can prevent such models from inferring sensitive gender or age-related information, and whether the anonymized time series data sequences are suitable for common time series analysis tasks, such as anomaly detection.

[0175] For motif mining and inconsistency mining experiments (see below Fig.17 ), a set of “toy” time series data sequences were constructed to perform some of these experiments (described in more detail in motif graph 1726 and inconsistency graph 1728 of ). The toy time series data sequences were constructed using techniques similar to those found in

[47] . Motifs and inconsistencies were extracted from sequences in the ECG200 dataset and inserted into random positions in two background signals. For the motif experiments, private time series data sequences were generated by inserting the motif into a background signal comprising a sawtooth wave of length 10,000 and a small amount of Gaussian noise. For the inconsistency experiments, private time series data sequences were generated by inserting the inconsistency into a background signal comprising a noiseless sawtooth wave. When calculating the matrix profile for each of these toy sequences, twice the length of the foreground time series was used as the matrix profile subsequence length. In these experiments, a motif was specifically defined as the subsequence in the time series with the smallest distance to its nearest neighbor

[28] , and an inconsistency was defined as the subsequence in the time series with the largest distance to its nearest neighbor.

[0176] In these experiments, the method according to the embodiment is used to generate anonymized time series data sequences corresponding to the motif mining experiment and anonymized time series data sequences corresponding to the inconsistency mining experiment. The usefulness of these anonymized time series data sequences is evaluated by comparing the matrix profile of the anonymized time series data sequences with the matrix profile of their corresponding private time series data sequences. This is achieved by determining whether the indices of the maximum motif and the maximum inconsistency in the two matrix profiles are the same. In these experiments, the difference between the reported index and the ground truth index is normalized by the length of the time series.

[0177] Fig.17The results of these experiments are generally summarized. In general, the motif graph 1726 corresponds to the results of the motif mining experiment, and the inconsistency graph 1728 corresponds to the results of the inconsistency mining experiment. The exemplary private time series data sequence 1702 is constructed using the method described above and includes two motifs 1706. This private time series data sequence 1702 is used to generate an anonymized time series data sequence 1704 using an anonymization method according to an embodiment. Like the private time series data sequence 1702, the anonymized time series data sequence 1708 also includes two motifs 1708.

[0178] A matrix profile 1710 corresponding to the private time series data sequence 1702 and a matrix profile 1712 corresponding to the anonymized time series data sequence 1704 are shown. Fig.17 As shown in , matrix profiles 1710 and 1712 are substantially similar and both indicate the locations of motifs 1706 and 1708 at substantially the same index. Based on the difference in the index of the maximum motif and the maximum inconsistency as indicated by the matrix profile 1710 corresponding to the private time series data sequence 1702 and the matrix profile 1712 corresponding to the anonymized time series data sequence 1704, scores were generated and averaged over 100 experimental runs. For the motif mining task, the median score was 0.0046 and the average score was 0.072.

[0179] As described above, the inconsistency graph 1728 generally corresponds to the results of the inconsistency mining experiment. The ECG200 training set is used to construct the private time series data sequence 1714, as described above. From each training set, the first sequence of each category is selected and regarded as inconsistent. These inconsistencies are inserted into random positions in the noiseless sawtooth wave, and the random position is any position ten to fifteen times longer than the inconsistency. Anonymized time series data sequence 1716 is generated from the private time series data sequence 1714 using the method according to the embodiment. After the definition of inconsistency provided above, the experiment involves determining whether the maximum inconsistency index is similar in both the matrix profile 1722 corresponding to the private time series data sequence 1714 and the matrix profile 1724 corresponding to the anonymized time series data sequence 1716. The score is determined for 100 experimental runs, and the score corresponds to the difference between the maximum inconsistency between the matrix profile 1722 and the matrix profile 1724. For the inconsistency mining task, the median score is 0.0036 and the average score is 0.0243.

[0180] The low mean and median scores for both the motif mining and inconsistency mining experiments indicate that the matrix profiles generated from the anonymized time series data sequences are similar to the matrix profiles generated from the corresponding private time series data sequences. This indicates that the anonymized time series data sequences (generated using the method according to the embodiment) can successfully replace the private time series data sequences for motif mining and inconsistency mining tasks.

[0181] As described below, experiments were conducted to evaluate the above Figure 1 Some statements made. As a review, Figure 1 Used to describe potential risks associated with publishing a sequence of private time series data, for example, a malicious entity may be able to determine sensitive information from the sequence of private time series data, even if such information is not included in the sequence of private time series data. As described above, a malicious individual may conceivably train model 108 to infer private information, such as gender information, from a sequence of private ECG data. Figure 1 It is also used to describe potential use cases of embodiments of the present disclosure, for example, anonymized time series data sequences generated using methods according to embodiments can be used for data analysis tasks, and models used to determine private information from private time series data sequences will not be able to determine such information from anonymized time series data sequences. Therefore, anonymized time series data sequences can be used to protect private or other sensitive information.

[0182] Therefore, experiments were conducted to (1) evaluate whether it is possible to build a model to detect personal information from ECG data, (2) evaluate whether the anonymized time series data sequences generated using the method according to the embodiment can reduce the risk of revealing personal information, and (3) evaluate whether the anonymized time series data sequences generated using the method according to the embodiment can achieve results comparable to those of the corresponding private time series data sequences for the time series anomaly detection task.

[0183] These experiments were conducted using data from the MIT-BIH long-term ECG database

[17] . This database contains ECG data corresponding to seven patients. A support vector machine (SVM) [13, 31] gender classifier and an SVM age classifier were constructed using 1,000 samples randomly extracted from the first 100,000 data points of each patient. The length of each sample was 100, and a total of 7,000 training samples (1,000 samples for each of the seven patients) were extracted from the database. The gender classifier and age classifier were trained as binary classifiers, where the gender categories were defined as male and female, and the age categories were defined as over 60 years old and under 60 years old. The default SVM settings of Scikit-learn

[31] were used to construct gender and age binary classifiers. These gender and age binary classifiers were used to evaluate whether it is possible to build a model to detect personal information from ECG data, and to evaluate whether the anonymized time series data sequences generated using the method according to the embodiment can reduce the risk of revealing personal information.

[0184] In addition, 1,000 samples were randomly extracted from the second 100,000 data points for each patient. In addition, 7,000 test samples were extracted from both the original (private) time series data sequence and the anonymized time series data sequence generated using the method according to the embodiment. To ensure a fair comparison, samples were extracted from the same time position of both the private time series data sequence and the anonymized time series data sequence.

[0185] Since both the age and gender classifiers are binary classifiers, the F1 score is used as a performance measure. When the classifier is applied to a test sample from the private time series data sequence, the F1 score for gender is 0.8585 and the F1 score for age is 0.9276. In other words, even if gender information and age information are not included in the private time series data sequence (or are not included in the dataset from which the private time series data sequence is derived), a malicious individual may be able to determine such information using a model built based on public domain data. However, when the classifier is applied to a test sample from the anonymized time series data sequence, the F1 score drops to 0.4635 for gender and to 0.3618 for age, indicating that the malicious individual cannot reliably determine this information from the anonymized time series data sequence, thereby indicating that this sensitive personal information is protected by the anonymization method according to the embodiment.

[0186] In addition, a time series anomaly detection benchmark experiment similar to that of Yeh et al.

[44] was conducted to evaluate whether the anonymized time series data sequences generated using the method according to the embodiment achieve comparable results to the corresponding private time series data sequences in the time series anomaly detection task. Using normal heartbeats from the first 50,000 data points as training data and normal heartbeats from the second 50,000 data points as test data, the second 100,000 data points of each of the seven patients were extracted for the experiment. The anomaly detection toolbox was applied to both the private time series data sequences and the anonymized time series data sequences. The "area under the receiver operating characteristic curve" (AUC) is used to measure the quality of the anomaly score when compared to the ground truth labeling. The performance of the 12 methods on both the private time series data sequences and the anonymized time series data sequences (average AUC for all seven patients) is shown in Table 1 below.

[0187] private Anonymized LOF 0.9531 0.9444 IForest 0.7272 0.6977 OCSVM 0.8006 0.8256 AutoReg 0.5114 0.4964 AE 0.9383 0.8882 VAE 0.8771 0.8695 DeepSVDD 0.6167 0.6228 AnoGAN 0.5773 0.4703 LSTM 0.4859 0.4861 GRU 0.4867 0.4857 DAGMM 0.6443 0.6438 MP 0.9294 0.9387

[0188] AUC is used instead of F1 score because the anomaly scores returned by the evaluated methods need to be converted to binary predictions in order to evaluate the F1 score. As described by Kim et al.

[23] , the binarization process for time series anomaly detection is itself a challenging problem. Therefore, the AUC score is used to avoid the additional complications that arise when converting anomaly scores to binary predictions. With the exception of AnoGAN, the same time series anomaly detection methods achieve similar performance on both private time series data sequences and anonymized time series data sequences. One possible reason for the inconsistency associated with AnoGAN is that the loss function used in AnoGAN is known to be unstable [5, 6]. The experimental results reported in Table 1 show that the anonymized time series data sequences generated using the method according to the embodiment achieve comparable results to the corresponding private time series data sequences in the time series anomaly detection task.

[0189] In addition, experiments related to time series segmentation were performed and various segmentation methods were benchmarked, including fast low-cost single-energy semantic segmentation (FLUSS)

[15] , binary segmentation (Binseg) [8], BottomUp

[21] , KernelCPD [7, 12], and window-based change point detection (Window). Table 2 below summarizes how well these methods perform on the UCR segmentation dataset

[15] , as well as how well these methods perform on anonymized time series data sequences generated using methods according to embodiments. The values ​​in each column include the mean and median segmentation performance measures PM derived from 32 different time series. seg (Proposed by

[15] ). The segmentation performance measure can be calculated using the following formula: in refers to the predicted split point of the model, refers to the ground truth, and L is the length of the time series. The value can be viewed as a notion of how far the prediction is from its closest ground truth, being a constant with respect to L.

[0190]

[0191] Table 2 shows small to moderate differences between the mean segmentation performance measures and median segmentation performance measures for the private time series data sequence (i.e., the UCR segmentation dataset) and the anonymized time series data sequence, indicating that the anonymization method according to the embodiment can generate anonymized time series data sequence that can be used for segmentation tasks.

[0192] In addition, clustering experiments are performed, which are briefly outlined below. As performed in

[47] and previous experiments, private time series data sequences are constructed by generating background sequences of random walks or random noise and embedded samples from the UCR archive in the foreground. The boundary positions of each inserted sample are recorded. After applying the anonymization method according to the embodiment to each sequence, anonymized time series data subsequences with the original samples inserted are extracted. The original data are compared with the corresponding anonymized subsequence clusters, which proves that the data points maintain their cluster assignments, indicating that the method according to the embodiment can generate anonymized time series data sequences that can be used for clustering tasks. Using the method according to the embodiment, private time series data time series sequences can be anonymized so that the matrix profile information is retained, but any anonymized motifs or inconsistent shapes have zero cross-correlation with the corresponding private motifs or inconsistent shapes.

[0193] You can refer to Fig.18 To better understand an anonymization computer (e.g., a computer system that can perform an anonymization method according to an embodiment), the figure shows an exemplary anonymization computer 1800 including a processor 1802, a communication interface 1804, and a computer-readable medium 1806. The computer-readable medium 1806 can be non-transitory and coupled to the processor 1802. The computer-readable medium 1806 can contain data, code, and / or software modules that can be used by the anonymization computer 1800 to implement some methods according to the embodiments. These data, code, and / or software modules may include a communication module 1808, a matrix profile module 1810, a complexity module 1812, a random number generation module 1814, a sampling module 1816, an indexing module 1818, a loss calculation module 1820, a normalization module 1822, an update module 1824, an anonymization evaluation module 1826, and one or more private time series data sequences 1828.

[0194] It should be understood that Fig.18The specific software modules depicted in the figure are mainly selected for the purpose of explaining some methods, steps or other operations according to the embodiments, and Fig.18 Only one of many configurations of an effective anonymization computer 1800 is shown. In many cases, a single monolithic software application may execute the Fig.18 Some or all of the functions performed by the software modules depicted in the .

[0195] Processor 1802 may include any suitable one or more data computing devices. Processor 1802 is capable of interpreting code and executing instructions stored on computer-readable medium 1806. Processor 1802 may include a central processing unit (CPU) operating on a reduced instruction set (or any other suitable instruction set), and may include a single-core or multi-core processor. Processor 1802 may also include an arithmetic logic unit (ALU), a cache memory, and any other structures or components typically associated with a processor (e.g., processor 1802). A further description of the processor and a list of some exemplary processors are provided above in the terminology section.

[0196] The communication interface 1804 may include any interface via which the anonymizing computer 1800 may communicate with other systems, devices, computers, or entities, such as client computers, publishing systems, anonymizing evaluation computers, or private data sources (e.g., data administrators), for example, as depicted in FIG. 2 . Examples of communication interfaces include wired interfaces such as USB, Ethernet, or FireWire, and wireless interfaces such as Bluetooth or Wi-Fi receivers. The anonymizing computer 1800 may have multiple communication interfaces 1804. As an example, the anonymizing computer 1800 may communicate via an Ethernet interface as well as a USB interface. The communication interface 1804 may enable the anonymizing computer 1800 to communicate via a communication network such as the Internet.

[0197] The communication module 1808 may include code, software, or instructions that may be interpreted and executed by the processor 1802. This software may be used by the anonymization computer 1800 to communicate with other computers, devices, and entities, such as client computers, publishing systems, private data sources, anonymization evaluation computers, etc. In particular, the anonymization computer 1800 may use the communication module 1808 to receive private time series data sequences (e.g., from a data source), and to send anonymized time series data sequences (e.g., to a client computer, or to a publishing system for publication).

[0198] The matrix profile module 1810 may include code, software or instructions that can be interpreted and executed by the processor 1802 to perform any of the matrix profile-based operations described above, such as generating or otherwise determining a matrix profile and matrix profile index corresponding to the time series data sequence. The matrix profile module 1810 may include code corresponding to any number of suitable methods (e.g., the SCAMP method

[49] ) for determining, for example, self-connection or AB connection to calculate a matrix profile.

[0199] The complexity module 1812 may include code, software, or instructions that may be interpreted and executed by the processor 1802 to determine a complexity metric corresponding to a sequence or subsequence of time series data. The anonymization computer 1800 may use the complexity module 1812 to calculate the decoration loss or complexity loss, as described above.

[0200] The random number generation module 1814 may include code, software, or instructions that can be interpreted and executed by the processor 1802 to generate random numbers. The anonymization computer 1800 may use the random number generation module 1814 to initialize an anonymized time series data sequence and / or generate a random index for sampling a subsequence of the time series data, as described above. The random number generation module 1814 may implement any suitable random number generation method or methods, including a cryptographically secure random number generator.

[0201] The sampling module 1816 may include code, software, or instructions that may be interpreted and executed by the processor 1802 to sample a subsequence of time series data, such as a first anonymized subsequence of time series data and a second anonymized subsequence of time series data, as described above. The sampling module 1816 may be used by the anonymization computer in conjunction with the indexing module 1818, which may include code, software, or instructions that may be interpreted and executed by the processor 1802 to index time series data sequences and subsequences using an index or indicator. Likewise, the sampling module 1816 may be used in conjunction with the random number generation module 1814 for this purpose. For example, the anonymization computer 1800 may use the random number generation module 1814 to generate a random number that may be used as an indicator for sampling a subsequence of time series data using the sampling module 1816 and the indexing module 1818.

[0202] The loss calculation module 1820 may include code, software or instructions that can be interpreted and executed by the processor 1802 to calculate the loss or loss value. As described above, in some embodiments, the loss may include a combination loss, which may include, for example, a combination of privacy loss (or relevance loss), utility loss (which itself may include a combination of nearest neighbor loss and non-nearest neighbor loss), and decoration loss (or complexity loss, which itself may include a combination of first complexity loss, second complexity loss and nearest neighbor complexity loss). The anonymization computer 1800 can use the loss calculation module 1820 to calculate and combine these and other losses, for example, using the methods described above.

[0203] The normalization module 1822 may include code, software, or instructions that may be interpreted and executed by the processor 1802 to normalize the time series data sequences and subsequences. The anonymization computer 1802 may use the normalization module 1822 to z-normalize the time series data sequences or subsequences (or use any other suitable normalization method). Using the normalization module 1822 to normalize the time series data sequences or subsequences may enable the anonymization computer 1800 to calculate z-normalized Euclidean distances, or other data that may be used to perform methods according to embodiments, as described above.

[0204] The update module 1824 may include code, software, or instructions that can be interpreted and executed by the processor 1802 to update the anonymized time series data sequence during the iterative process described above. The anonymization computer 1800 may use the update module 1824 to perform, for example, mini-batch stochastic gradient descent to update the anonymized time series data sequence based on the gradient determined using the loss (which may be determined by the anonymization computer 1800 using the loss calculation module 1820, as described above). The update module 1824 may be used in conjunction with the normalization module 1822, for example, when using the update module 1824 to update the anonymized time series data sequence, and the anonymization computer 1800 may also use the normalization module 1822 to z-normalize the anonymized time series data sequence.

[0205] The anonymization evaluation module 1826 may include code, software, or instructions that can be interpreted and executed by the processor 1802 to analyze the effectiveness of the anonymization method. Figure 2, and described in more detail above, the computer-readable medium 1806 may store an anonymization evaluation module 1826. The anonymization evaluation module 1826 may enable the anonymization computer 1800 to perform a data analysis method on both the anonymized time series data sequence and the private time series data sequence, and perform a scoring method on the results, thereby evaluating the effectiveness of the anonymization method or the anonymized time series data sequence produced by the anonymization method.

[0206] In addition, the computer-readable medium 1806 may store one or more private time series data sequences 1828. These one or more private time series data sequences may be temporarily stored (e.g., during the execution of a method according to an embodiment) and may be removed or otherwise deleted from the computer-readable medium 1806 once the method according to an embodiment is completed, for example, if the anonymization computer 1800 receives one or more private time series data sequences from an external data source (e.g., a data administrator). Alternatively, however, the anonymization computer 1800 may store the one or more private time series data sequences permanently or for a longer period of time, for example, where the anonymization computer 1800 is owned and operated by a data administrator. The one or more private time series data sequences may be stored in a secure memory element of the computer-readable medium, for example, in order to prevent the one or more private time series data sequences from being acquired by a malicious entity.

[0207] Any computer system mentioned herein can use any suitable number of subsystems. In some embodiments, the computer system includes a single computer device, wherein the subsystem can be a part of the computer device. In other embodiments, the computer system can include multiple computer devices, each of which is a subsystem with internal components.

[0208] A computer system may include multiple components or subsystems connected together, for example, via external interfaces or via internal interfaces. In some embodiments, computer systems, subsystems, or devices may communicate via a network. In such cases, one computer may be considered a client and another computer may be considered a server, where each computer may be part of the same computer system. The client and server may each include multiple systems, subsystems, or components.

[0209] It should be understood that any embodiment of the present invention can be implemented in the form of control logic using hardware (e.g., an application specific integrated circuit or a field programmable gate array) and / or using computer software, wherein a general-purpose programmable processor is modular or integrated. As used herein, a processor includes a single-core processor, a multi-core processor on the same integrated chip, or multiple processing units on a single circuit board or networked. Based on the disclosure and the teachings provided herein, a person of ordinary skill in the art will know and understand other ways and / or methods of implementing embodiments of the present invention using hardware and combinations of hardware and software.

[0210] Any software component or function described in this application may be implemented as software code, which is executed by a processor using any suitable computer language such as Java, C, C++, C#, Objective-C, Swift, or a scripting language such as Perl or Python, using, for example, conventional or object-oriented techniques. The software code may be stored as a series of instructions or commands on a computer-readable medium for storage and / or transmission, suitable media including random access memory (RAM), read-only memory (ROM), magnetic media such as a hard drive or floppy disk, or optical media such as a compact disk (CD) or a digital versatile disk (DVD), flash memory, etc. The computer-readable medium may be any combination of such storage devices or transmission devices.

[0211] Such programs can also be encoded and sent using a carrier signal suitable for transmitting via a wired network, an optical network and / or a wireless network that meets multiple protocols including the Internet. Therefore, a computer-readable medium according to an embodiment of the present invention can be created using a data signal encoded with such a program. The computer-readable medium encoded with program code can be packaged together with a compatible device, or provided separately from other devices (e.g., downloaded via the Internet). Any such computer-readable medium can reside on or within a single computer product (e.g., a hard disk drive, a CD or an entire computer system), and can be present on or within different computer products in a system or network. A computer system can include a monitor, a printer or other suitable display for providing any result mentioned herein to a user.

[0212] Any method described herein can be performed completely or in part with a computer system comprising one or more processors that can be configured to perform the steps. Therefore, an embodiment can relate to a computer system that is configured to perform the steps of any method described herein, may have different components that perform corresponding steps or corresponding step groups. Although presented with numbered steps, the method steps herein can also be performed simultaneously or in different orders. In addition, the part of these steps can be used together with the part of other steps of other methods. In addition, all or part of the step can be optional. In addition, any step of any method can be performed with module, circuit or other means for performing these steps.

[0213] Without departing from the spirit and scope of the embodiments of the present invention, the specific details of the specific embodiments can be combined in any suitable manner. However, other embodiments of the present invention may relate to specific embodiments related to each individual aspect or a specific combination of these individual aspects. The above description of the exemplary embodiments of the present invention has been presented for the purpose of illustration and description. It is not intended to be exhaustive, or to limit the present invention to the precise form of description, and many modifications and variations are possible according to the teachings above. These embodiments are selected and described in order to best explain the principles of the present invention and their practical application, so that those skilled in the art can best utilize the present invention in various embodiments, and carry out various modifications suitable for the intended specific use.

[0214] The above description is illustrative rather than restrictive. After reading this disclosure, many variations of the present invention will become apparent to those skilled in the art. Therefore, the scope of the present invention should not be determined with reference to the above description, but should be determined with reference to the pending claims together with their full scope or equivalents.

[0215] One or more features from any embodiment may be combined with one or more features of any other embodiment without departing from the scope of the present invention.

[0216] Unless expressly indicated to the contrary, the recitation of "a," "an," or "the" is intended to mean "one or more." Unless expressly indicated to the contrary, the use of "or" is intended to mean an inclusive or rather than an exclusive or.

[0217] All patents, patent applications, publications, and descriptions mentioned herein are incorporated by reference in their entirety for all purposes. No admission is made that they are prior art.

[0218] References

[0219] [1] 2020, Personal Information Protection Act. www.pipc.go.kr / cmt / main / english.do

[0220] [2] What is GDPR, the EU's new Data Protection Law? (What is GDPR, the EU's new Data Protection Law?) https: / / gdpr.eu / what-is-gdpr /

[0221] [3] Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. 2016. Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, 308–318.

[0222] [4] Simon Duque Anton, Lia Ahrens, Daniel Fraunholz, and Hans Dieter Schotten. 2018. Time is of the essence: Machine learning-based intrusion detection in industrial timeseries data. 2018 IEEE International Conference on Data Mining Workshops (ICDMW), IEEE, 1–6.

[0223] [5]Martin Arjovsky and Léon Bottou. 2017. Towards principled methods for training generative adversarial networks. arXiv preprint arXiv:1701.04862 (2017).

[0224] [6]Martin Arjovsky, Soumith Chintala, and Léon Bottou. 2017. Wasserstein generative adversarial networks. In International Conference on Machine Learning, PMLR, 214–223.

[0225] [7] Sylvain Arlot, Alain Celisse, and Zaid Harchaoui. 2019. A kernel multiple change-point algorithm via model selection. Journal of Machine Learning Research 20, 162 (2019).

[0226] [8] Jushan Bai. 1997. Estimating multiple breaks one at a time. Econometrics 13, 3 (1997), 315-352.

[0227] [9] Gustavo EAPA Batista, Xiaoyue Wang, and Eamonn J Keogh. 2011. A complexity-invariant distance measure for timeseries. In Proceedings of the 2011 SIAM International Conference on Data Mining, SIAM, 699–710.

[0228]

[10] Ane Blázquez-García, Angel Conde, Usue Mori, and Jose A Lozano. 2021. A review on outlier / anomaly detection in time series data. ACM Computing Surveys (CSUR) 54, 3 (2021), 1–33.

[0229]

[11] Jianneng Cao, Panagiotis Karras, Chedy and Kian-Lee Tan. 2010. ρ-uncertainty: inference-proof transaction anonymization. Journal of the VLDB Endowment Foundation (PVLDB) 3, 1 (2010), 1033-1044.

[0230]

[12] Alain Celisse, Guillemette Marot, Morgane Pierre-Jean, and G.J. Rigaill. 2018. New efficient algorithms for multiple change-point detection with reproducing kernels. Computational Statistics and Data Analysis 128 (2018), 200-220.

[0231]

[13] Chih-Chung Chang and Chih-Jen Lin. 2011. LIBSVM: a library for support vector machines. ACM Transactions on Intelligent Systems and Technologies (TIST) 2, 3 (2011), 1–27.

[0232]

[14] Philippe Esling and Carlos Agon. 2012. Time-series data mining. ACM Computing Surveys (CSUR) 45, 1 (2012), 1–34.

[0233]

[15] Shaghayegh Gharghabi, Yifei Ding, Chin-Chia Michael Yeh, Kaveh Kamgar, Liudmila Ulanova, and Eamonn Keogh. 2017. Matrix profile VIII: domain agnostic online semantic segmentation at superhuman performance levels. In 2017 IEEE International Conference on Data Mining (ICDM), IEEE, 117–126.

[0234]

[16] Shaghayegh Gharghabi, Chin-Chia Michael Yeh, Yifei Ding, Wei Ding, Paul Hibbing, Samuel LaMunion, Andrew Kaplan, Scott E Crouter, and Eamonn Keogh. 2019. Domain agnostic online semantic segmentation for multi-dimensional time series. Data Mining and Knowledge Discovery 33, 1 (2019), 96–130.

[0235]

[17] Ary L Goldberger, Luis AN Amaral, Leon Glass, Jeffrey M Hausdorff, Plamen Ch Ivanov, Roger G Mark, Joseph E Mietus, George B Moody, Chung-Kang Peng, and H Eugene Stanley. 2000. PhysioBank, PhysioToolkit, and PhysioNet: components of a new research resource for complex physiologic signals. Circulation 101, 23 (2000), e215-e220.

[0236]

[18] Chris Holder, Matthew Middlehurst, and Anthony Bagnall. 2022. A Review and Evaluation of ElasticDistance Functions for Time Series Clustering. arXiv preprint arXiv:2205.15181 (2022).

[0237]

[19] Hassan Ismail Fawaz, Germain Forestier, Jonathan Weber, Lhassane Idoumghar, and Pierre-Alain Muller. 2019. Deep learning for time series classification: a review. Data Mining and Knowledge Discovery 33, 4 (2019), 917–963.

[0238]

[20] Eamonn Keogh. 2022, UCR Matrix Profile Page. https: / / www.cs.ucr.edu / ~eamonn / MatrixProfile.html

[0239]

[21] Eamonn Keogh, Selina Chu, David Hart, and Michael Pazzani. 2004. Segmenting time series: A survey and novel approach. In Data Mining in Time Series Databases, World Scientific, 1–21.

[0240]

[22] Stephan Kessler, Erik Buchmann, Thorben Burghardt and Klemens 2014. Pattern-sensitive time-series anonymization and its application to energy-consumption data. Open Journal of Information Systems (OJIS) 1, 1 (2014), 3-22.

[0241]

[23] Siwon Kim, Kukjin Choi, Hyun-Soo Choi, Byunghan Lee, and Sungroh Yoon. 2021. Towards a Rigorous Evaluation of Time-series Anomaly Detection. arXiv preprint arXiv:2109.05257 (2021).

[0242]

[24] Kwei-Herng Lai, Daochen Zha, Guanchu Wang, Junjie Xu, Yue Zhao, Devesh Kumar, Yile Chen, Purav Zumkhawaka, Minyang Wan, Diego Martinez et al. 2021. TODS: An automated time series outlier detection system. In Proceedings of the AAAI Conference on Artificial Intelligence, vol. 35, 16060–16062.

[0243]

[25] Yue Lu, Renjie Wu, Abdullah Mueen, Maria A Zuluaga, and Eamonn Keogh. 2022. Matrix Profile XXIV: Scaling Time Series Anomaly Detection to Trillions of Datapoints and Ultra-fast Arriving Data Streams. In Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, 1173–1182.

[0244]

[26] Frank Madrid, Shima Imani, Ryan Mercer, Zachary Zimmerman, Nader Shakibay, and Eamonn Keogh. 2019. Matrix profile xx: Finding and visualizing time series motifs of all lengths using the matrix profile. In 2019 IEEE International Conference on Big Knowledge (ICBK), IEEE, 175–182.

[0245]

[27] Mehdi Mirza and Simon Osindero. 2014. Conditional generative adversarial nets. arXiv preprint arXiv:1411.1784 (2014).

[0246]

[28] Abdullah Mueen, Eamonn Keogh, Qiang Zhu, Sydney Cash, and Brandon Westover. 2009. Exact discovery of time series motifs. In Proceedings of the 2009 SIAM International Conference on Data Mining, SIAM, 473–484.

[0247]

[29] Civil Rights Office. 2022. HIPPA Home. https: / / www.hhs.gov / hipaa / index.html

[0248]

[30] Adam Paszke, Sam Gross, Francisco Massa, Adam Lerer, James Bradbury, Gregory Chanan, Trevor Killeen, Zeming Lin, Natalia Gimelshein, Luca Antiga, et al. 2019. Pytorch: An imperative style, high-performance deep learning library. Advances in neural information processing systems 32 (2019).

[0249]

[31] Fabian Pedregosa, Varoquaux, Alexandre Gramfort, Vincent Michel, Bertrand Thirion, Olivier Grisel, Mathieu Blondel, Peter Prettenhofer, Ron Weiss, Vincent Dubourg, et al. 2011. Scikit-learn: Machine learning in Python. Journal of Machine Learning Research 12 (2011), 2825–2830.

[0250]

[32] Thanawin Rakthanmanon, Bilson Campana, Abdullah Mueen, GustavoBatista, Brandon Westover, Qiang Zhu, Jesin Zakaria, and Eamonn Keogh. 2012. Searching and mining trillions of time series subsequences under dynamic time warping. In Proceedings of the 18th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, 262–270.

[0251]

[33] Dymitr Ruta, Ling Cen, and Ernesto Damiani. 2015. Fast summarization and anonymization of multivariate big timeseries. In 2015 IEEE International Conference on Big Data (Big Data), IEEE, 1901–1904.

[0252]

[34] Nader Shakibay Senobari, Gareth J Funning, Eamonn Keogh, Yan Zhu, Chin-Chia Michael Yeh, Zachary Zimmerman, and Abdullah Mueen. 2019. Super-efficient cross-correlation (SEC-C): A fast matched filtering code suitable for desktop computers. Seismological Research Letters 90, 1 (2019), 322–334.

[0253]

[35] Lidan Shou, Xuan Shang, Ke Chen, Gang Chen, and Chao Zhang. 2011. Supporting pattern-preserving anonymization for time-series data. IEEE Transactions on Knowledge and Data Engineering 25, 4 (2011), 877–892.

[0254]

[36] Latanya Sweeney. 2002. k-anonymity: A model for protecting privacy. International Journal of Uncertainty, Fuzziness, and Knowledge-Based Systems 10, 05 (2002), 557-570.

[0255]

[37] Laurens Van der Maaten and Geoffrey Hinton. 2008. Visualizing data using t-SNE. Journal of Machine Learning Research 9, 11 (2008).

[0256]

[38] Shuo Wang, Carsten Rudolph, Surya Nepal, Marthie Grobler, and Shangyu Chen. 2020. PART-GAN: privacy-preserving time-series sharing. In International Conference on Artificial Neural Networks, Springer, 578–593.

[0257]

[39] Yabo Xu, Ke Wang, Ada Wai-Chee Fu, and Philip S Yu. 2008. Anonymizing transaction databases for publication. In Proceedings of the 14th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, 767–775.

[0258]

[40] Chin-Chia Michael Yeh. 2018. Towards a near universal time series data mining tool: Introducing the matrix profile. University of California, Riverside.

[0259]

[41] Chin-Chia Michael Yeh, Nickolas Kavantzas, and Eamonn Keogh. 2017. Matrix profile IV: using weakly labeled time series to predict outcomes. VLDB Endowment Journal 10, 12 (2017), 1802–1812.

[0260]

[42] Chin-Chia Michael Yeh, Nickolas Kavantzas, and Eamonn Keogh. 2017. Matrix profile VI: Meaningful multidimensional motif discovery. In 2017 IEEE International Conference on Data Mining (ICDM), IEEE, 565–574.

[0261]

[43] Chin-Chia Michael Yeh, Helga Van Herle, and Eamonn Keogh. 2016. Matrix profile III: the matrix profile allows visualization of salient subsequences in massive timeseries. In 2016 IEEE 16th International Conference on Data Mining (ICDM), IEEE, 579–588.

[0262]

[44] Chin-Chia Michael Yeh, Yan Zheng, Junpeng Wang, Huiyuan Chen, Zhongfang Zhuang, Wei Zhang, and Eamonn Keogh. 2022. Error-bounded Approximate Time Series Joins using Compact Dictionary Representations of Time Series. In Proceedings of the 2022 SIAM International Conference on Data Mining (SDM), SIAM, 181–189.

[0263]

[45] Chin-Chia Michael Yeh, Yan Zhu, Liudmila Ulanova, Nurjahan Begum, Yifei Ding, Hoang Anh Dau, Diego Furtado Silva, Abdullah Mueen, and Eamonn Keogh. 2016. Matrix profile I: all pairs similarity joins for time series: a unifying view that includes motifs, discords and shapelets. In 2016 IEEE 16th International Conference on Data Mining (ICDM), IEEE, 1317–1322.

[0264]

[46] Chin-Chia Michael Yeh, Yan Zhu, Liudmila Ulanova, Nurjahan Begum, Yifei Ding, Hoang Anh Dau, Zachary Zimmerman, Diego Furtado Silva, Abdullah Mueen, and Eamonn Keogh. 2018. Time series joins, motifs, discords and shapelets: a unifying view that exploits the matrix profile. Data Mining and Knowledge Discovery 32, 1 (2018), 83–123.

[0265]

[47] Yan Zhu, Shaghayegh Gharghabi, Diego Furtado Silva, Hoang Anh Dau, Chin-Chia Michael Yeh, Nader Shakibay Senobari, Abdulaziz Almaslukh, Kaveh Kamgar, Zachary Zimmerman, Gareth Funning, et al. 2020. The Swiss army knife of timeseries data mining: ten useful things you can do with the matrix profile and ten lines of code. Data Mining and Knowledge Discovery 34, 4 (2020), 949–979.

[0266]

[48] ​​Yan Zhu, Chin-Chia Michael Yeh, Zachary Zimmerman, Kaveh Kamgar, and Eamonn Keogh. 2018. Matrixprofile XI: SCRIMP++: time series motif discovery at interactive speeds. In 2018 IEEE International Conference on Data Mining (ICDM), IEEE, 837–846.

[0267]

[49] Zachary Zimmerman, Kaveh Kamgar, Nader Shakibay Senobari, Brian Crites, Gareth Funning, Philip Brisk, and Eamonn Keogh. 2019. Matrix profile XIV: scaling time series motif discovery with GPUs to break a quintillion pairwise comparisons a day and beyond. In Proceedings of the ACM Symposium on Cloud Computing, 74–86.

Claims

1. A method comprising: receiving, by an anonymizing computer, a private time series data sequence comprising one or more private time series data values; determining, by the anonymization computer, a matrix profile and a matrix profile index based on the sequence of private time series data; initializing, by the anonymization computer, an anonymized time series data sequence comprising one or more anonymized time series data values; An iterative process is performed by the anonymization computer to update the anonymized time series data sequence, wherein the iterative process comprises: sampling, by the anonymization computer, a batch of anonymized subsequences including one or more anonymized subsequences from the anonymized time series data sequence, determining, by the anonymization computer, a batch of anonymized subsequence indicators corresponding to the batch of anonymized subsequences, wherein the batch of anonymized subsequence indicators includes one or more anonymized subsequence indicators, determining, by the anonymization computer, a loss based on the batch of anonymized subsequences, the batch of anonymized subsequence indicators, the sequence of private time series data, the matrix profile, and the matrix profile index, and updating, by the anonymization computer, the anonymized time series data sequence based on the loss; Repeating the iterative process by the anonymization computer until a termination condition has been met, thereby generating a final anonymized time series data sequence; and The final anonymized time series data sequence is provided by the anonymization computer to a client computer.

2. The method of claim 1 , wherein updating the anonymized time series data sequence comprises updating the anonymized time series data sequence using mini-batch stochastic gradient descent by the anonymization computer, and wherein the termination condition is satisfied if the total number of iterations is equal to or exceeds a predetermined number of iterations, or the termination condition is satisfied if the anonymized time series data sequence converges.

3. The method of claim 1 , wherein providing the final anonymized time series data sequence to the client computer comprises sending the final anonymized time series data sequence to the client computer by the anonymization computer, or comprises publishing the final anonymized time series data sequence by the anonymization computer, wherein the client computer accesses the final anonymized time series data sequence after the final anonymized time series data sequence has been published.

4. The method of claim 1, wherein the loss comprises a combined loss, wherein the combined loss comprises a weighted combination of multiple losses, wherein the multiple losses comprise a nearest neighbor loss and a correlation loss, and wherein the iterative process further comprises: determining, by the anonymization computer, the nearest neighbor loss; as well as The relevance loss is determined by the anonymization computer.

5. The method of claim 4, wherein determining the nearest neighbor loss comprises: determining, by the anonymization computer, a batch of nearest neighbor indicators using the matrix profile index and the batch of anonymized subsequence indicators, wherein the batch of nearest neighbor indicators includes one or more nearest neighbor indicators; determining, by the anonymization computer, a batch of nearest neighbor subsequences using the anonymized sequence of time series data and the batch of nearest neighbor indicators; determining, by the anonymization computer, a batch of nearest neighbor distances including one or more nearest neighbor distances based on the batch of anonymized subsequences and the batch of nearest neighbor subsequences; determining, by the anonymization computer, a batch of target nearest neighbor distances including one or more target nearest neighbor distances using the batch of anonymized subsequence indicators and the matrix profile; as well as The nearest neighbor loss is determined by the anonymization computer based on the batch of nearest neighbor distances and the batch of target nearest neighbor distances.

6. The method of claim 5, wherein determining the nearest neighbor loss comprises determining, by the anonymization computer, a mean squared error between the batch of nearest neighbor distances and the batch of target nearest neighbor distances, wherein the nearest neighbor loss comprises the mean squared error.

7. The method of claim 4, wherein determining the relevance loss comprises: identifying, by the anonymization computer, a batch of target subsequences using the batch of anonymized subsequence indicators and the private time series data sequence, wherein the batch of target subsequences includes one or more private subsequences from the private time series data sequence; as well as The relevance loss is determined by the anonymization computer based on the batch of anonymized subsequences and the batch of target subsequences, wherein the relevance loss is proportional to the relevance between the batch of anonymized subsequences and the batch of target subsequences.

8. The method of claim 7, wherein the correlation loss is equal to a squared Pearson correlation coefficient, wherein the squared Pearson correlation coefficient corresponds to the correlation between the batch of anonymized subsequences and the batch of target subsequences.

9. The method of claim 7, wherein determining the relevance loss based on the batch of anonymized subsequences and the batch of target subsequences comprises: determining, by the anonymization computer, a batch of correlation distances comprising one or more correlation distances using the batch of anonymized subsequences and the batch of target subsequences, wherein each correlation distance of the one or more correlation distances comprises a distance between an anonymized subsequence in the batch of anonymized subsequences and a corresponding target subsequence in the batch of target subsequences; as well as The relevance loss is determined by the anonymization computer based on the batch of relevance distances and a predetermined subsequence length.

10. The method of claim 4, wherein the plurality of losses additionally comprises a non-nearest neighbor loss, wherein the batch of anonymized subsequences comprises a first batch of anonymized subsequences, wherein the batch of anonymized subsequence indicators comprises a first batch of anonymized subsequence indicators, and wherein the iterative process further comprises: Sampling, by the anonymization computer, a second batch of anonymized subsequences including one or more second anonymized subsequences from the anonymized time series data sequence, wherein the second batch of anonymized subsequences is different from the first batch of anonymized subsequences; determining, by the anonymization computer, a second batch of anonymized subsequence indicators corresponding to the second batch of anonymized subsequences, wherein the second batch of anonymized subsequence indicators includes one or more second anonymized subsequence indicators; determining, by the anonymization computer, a batch of nearest neighbor indicators using the matrix profile index and the first batch of anonymized subsequence indicators, wherein the batch of nearest neighbor indicators includes one or more nearest neighbor indicators; determining, by the anonymization computer, a batch of nearest neighbor subsequences using the anonymized sequence of time series data and the batch of nearest neighbor indicators; as well as The non-nearest neighbor loss is determined by the anonymization computer based on the first batch of anonymized subsequences, the second batch of anonymized subsequences, and the batch of nearest neighbor subsequences.

11. The method of claim 10, wherein determining the non-nearest neighbor loss based on the first batch of anonymized subsequences and the second batch of anonymized subsequences comprises: determining, by the anonymization computer, a batch of nearest neighbor distances comprising one or more nearest neighbor distances based on the first batch of anonymized subsequences and the batch of nearest neighbor subsequences; determining, by the anonymization computer, a batch of anonymized subsequence distances including one or more anonymized subsequence distances using the first batch of anonymized subsequences and the second batch of anonymized subsequences; determining, by the anonymization computer, a batch of distance differences based on the batch of nearest neighbor distances and the batch of anonymized subsequence distances, wherein the batch of distance differences comprises one or more distance differences; as well as The non-nearest neighbor loss is determined by the anonymization computer based on the batch of distance differences.

12. The method of claim 11, wherein determining the non-nearest neighbor loss based on the batch of distance differences comprises: correcting, by the anonymization computer, the batch of distance differences using a corrected linear unit, thereby producing a corrected batch of distance differences comprising one or more corrected distance differences; and A sum of the corrected batch of distance differences is determined by the anonymization computer, wherein the non-nearest neighbor loss comprises the sum of the corrected batch of distance differences.

13. The method of claim 4, wherein the plurality of losses additionally includes a decoration loss, and wherein the method further comprises determining the decoration loss by the anonymization computer.

14. The method according to claim 13, wherein: said weighted combination of said plurality of losses comprises a first weighted combination; The batch of anonymized subsequences includes a first batch of anonymized subsequences; The batch of anonymized subsequence indicators includes a first batch of anonymized subsequence indicators; The iterative process also includes: sampling, by the anonymization computer, a second batch of anonymized subsequences including one or more second anonymized subsequences from the anonymized time series data sequence, determining, by the anonymization computer, a second batch of anonymized subsequence indicators corresponding to the second batch of anonymized subsequences, wherein the second batch of anonymized subsequence indicators includes one or more second anonymized subsequence indicators; and Determining the decoration loss includes: determining, by the anonymization computer, a first complexity loss based on the first anonymized subsequences, the first anonymized subsequence indicators, and one or more private subsequence complexity values, wherein the one or more private subsequence complexity values ​​correspond to one or more private subsequences of the private time series data sequence, and wherein the first complexity loss corresponds to the first anonymized subsequences, determining, by the anonymization computer, a second complexity loss based on the second batch of anonymized subsequences, the second batch of anonymized subsequence indicators, and the one or more private subsequence complexity values, wherein the second complexity loss corresponds to the second batch of anonymized subsequences, determining, by the anonymization computer, a nearest neighbor complexity loss based on a batch of nearest neighbor subsequences, a batch of nearest neighbor subsequence indicators, and the one or more private subsequence complexity values, wherein the nearest neighbor complexity loss corresponds to the batch of nearest neighbor subsequences, and A second weighted combination of the first complexity loss, the second complexity loss, and the nearest neighbor complexity loss is determined by the anonymization computer, wherein the decoration loss comprises the second weighted combination.

15. The method according to claim 14, further comprising: determining, by the anonymization computer, a total number of private subsequences in the private time series data sequence based on a predetermined subsequence length; as well as For each private subsequence in the one or more private subsequences, the anonymization computer determines the corresponding private subsequence complexity value by performing the following operations, thereby determining the one or more private subsequence complexity values: determining, by the anonymization computer, a private subsequence mean and a private subsequence standard deviation based on the private subsequences, normalizing the private subsequence by the anonymization computer based on the private subsequence mean and the private subsequence standard deviation, thereby generating a normalized private subsequence, determining, by the anonymization computer, one or more private sequence differences, wherein each of the one or more private sequence differences comprises a difference between a normalized private subsequence time series data value and a sequentially normalized private subsequence time series data value, determining, by the anonymization computer, one or more squared private sequence differences by squaring each of the one or more private sequence differences, and A sum of the one or more squared private sequence differences is determined by the anonymization computer, wherein the corresponding private subsequence complexity value comprises the sum of the one or more squared private sequence differences.

16. The method of claim 14, wherein: Determining the first complexity loss includes: determining, by the anonymization computer, one or more first target subsequence complexity values ​​using the one or more private subsequence complexity values ​​and the first set of anonymized subsequence indicators, for each first anonymized subsequence in the first batch of anonymized subsequences, determining by the anonymization computer a corresponding first anonymized subsequence complexity value, thereby determining one or more first anonymized subsequence complexity values, and determining, by the anonymization computer, a first mean square error between the one or more first anonymized subsequence complexity values ​​and the one or more first target subsequence complexity values, wherein the first complexity loss comprises the first mean square error; Determining the second complexity loss includes: determining, by the anonymization computer, one or more second target subsequence complexity values ​​using the one or more private subsequence complexity values ​​and the second batch of anonymized subsequence indicators, for each second anonymized subsequence in the second batch of anonymized subsequences, determining, by the anonymization computer, a corresponding second anonymized subsequence complexity value, thereby determining one or more second anonymized subsequence complexity values, and determining, by the anonymization computer, a second mean square error between the one or more second anonymized subsequence complexity values ​​and the one or more second target subsequence complexity values, wherein the second complexity loss comprises the second mean square error; and Determining the nearest neighbor complexity loss includes: determining, by the anonymization computer, one or more target nearest neighbor subsequence complexity values ​​using the one or more private subsequence complexity values ​​and the batch of nearest neighbor subsequence indicators, For each nearest neighbor subsequence in the batch of nearest neighbor subsequences, determining, by the anonymization computer, a corresponding nearest neighbor subsequence complexity value, thereby determining one or more nearest neighbor subsequence complexity values, and A nearest neighbor mean square error between the one or more nearest neighbor subsequence complexity values ​​and the one or more target nearest neighbor subsequence complexity values ​​is determined by the anonymization computer, wherein the nearest neighbor complexity loss comprises the nearest neighbor mean square error.

17. The method of claim 16, wherein: Determining the corresponding first anonymized subsequence complexity value comprises: determining, by the anonymization computer, one or more first sequential differences, wherein each of the one or more first sequential differences comprises a difference between a first anonymized subsequence time series data value of the first anonymized subsequence and a sequentially first anonymized time series data value of the first anonymized subsequence, determining, by the anonymization computer, one or more squared first order differences by squaring each of the one or more first order differences, and determining, by the anonymization computer, a sum of the one or more squared first order differences, wherein the corresponding first anonymized subsequence complexity value comprises the sum of the one or more squared first order differences; Determining the corresponding second anonymized subsequence complexity value comprises: determining, by the anonymization computer, one or more second sequential differences, wherein each of the one or more second sequential differences comprises a difference between a second anonymized subsequence time series data value of a second anonymized subsequence and a sequential second anonymized time series data value of the second anonymized subsequence, determining, by the anonymization computer, one or more squared second order differences by squaring each of the one or more second order differences, and determining, by the anonymization computer, a sum of the one or more squared second order differences, wherein the corresponding second anonymized subsequence complexity value comprises the sum of the one or more squared second order differences; and Determining the corresponding nearest neighbor subsequence complexity value includes: determining, by the anonymization computer, one or more nearest neighbor order differences, wherein each of the one or more nearest neighbor order differences comprises a difference between a nearest neighbor subsequence time series data value of the nearest neighbor subsequence and a sequential nearest neighbor subsequence time series data value of the nearest neighbor subsequence, determining, by the anonymization computer, one or more squared nearest neighbor order differences by squaring each of the one or more nearest neighbor order differences, and A sum of the one or more squared nearest neighbor sequence differences is determined by the anonymization computer, wherein the corresponding nearest neighbor subsequence complexity value comprises the sum of the one or more squared nearest neighbor sequence differences.

18. An anonymizing computer comprising: processor; as well as A non-transitory computer readable medium coupled to the processor, the non-transitory computer readable medium comprising code or instructions executable by the anonymizing computer for performing a method comprising: receiving a private time series data sequence comprising one or more private time series data values; determining a matrix profile and a matrix profile index based on the private time series data sequence; Initializing an anonymized time series data sequence including one or more anonymized time series data values; An iterative process is performed to update the anonymized time series data sequence, wherein the iterative process comprises: sampling a batch of anonymized subsequences including one or more anonymized subsequences from the anonymized time series data sequence, determining a batch of anonymized subsequence indicators corresponding to the batch of anonymized subsequences, wherein the batch of anonymized subsequence indicators includes one or more anonymized subsequence indicators, determining a loss based on the batch of anonymized subsequences, the batch of anonymized subsequence indicators, the sequence of private time series data, the matrix profile, and the matrix profile index, and updating the anonymized time series data sequence based on the loss; Repeating the iterative process until a termination condition is met, thereby generating a final anonymized time series data sequence; and The final anonymized time series data sequence is provided to a client computer.

19. A method comprising: Receiving, by a computer system, a private time series data sequence including one or more private time series data values ​​and an anonymized time series data sequence including one or more anonymized time series data values, wherein the anonymized time series data sequence is generated by an anonymization computer based on the private time series data sequence using an anonymization method; Analyzing the private time series data sequence by the computer system using an analysis program, thereby generating a private analysis result; The computer system uses the analysis program to analyze the anonymized time series data sequence, thereby generating an anonymous analysis result; generating, by the computer system, a personal score based on the personal analysis result and a scoring mechanism; generating, by the computer system, an anonymous score based on the anonymous analysis result and the scoring mechanism; as well as The anonymization method is evaluated by the computer system by comparing the private score to the anonymous score.

20. The method of claim 19, wherein the private time series data sequence comprises user health data, utility data, computer data, or financial data.

Images