Track data publishing method and system based on privacy protection

Abstract

The invention provides a trajectory data publishing method and system based on privacy protection, and belongs to the technical field of trajectory privacy protection, the scheme not only protects user privacy from a space-time dimension, but also considers semantic privacy of a position point, and further improves the security of privacy protection; meanwhile, according to the scheme, the sensitivity of different stay points to different users is measured through indexes such as global access frequency, personal access frequency and radiation sensitivity, personalized privacy budget distribution is provided for the users according to the sensitivity, and therefore personalized requirements are met while privacy is guaranteed, and user experience is improved. According to the scheme provided by the invention, the privacy security of the user is ensured, and meanwhile, the personalized requirement is met.

Description

Technical Field

[0001] The present invention belongs to the technical field of trajectory privacy protection, and in particular relates to a trajectory data publishing method and system based on privacy protection. Background Art

[0002] With the continuous development of wireless communication and positioning technologies, location-based services (LBS) are increasingly widely used in various fields, including intelligent transportation, urban management, network optimization, etc. Relying on the accurate location information provided by GPS (Global Positioning System), LBS not only helps users more intuitively understand and master the surrounding geographical information, but also can provide personalized services, thus significantly improving efficiency and optimizing resource management. However, with the popularization of LBS, the generation of a large amount of trajectory data has also brought challenges to privacy protection. These data deeply embed rich personal privacy information. The extensive collection and publication of trajectory data have increased the risk of privacy leakage. Attackers can infer sensitive information of users from the publicly available trajectory data through means such as inference attacks and re-identification attacks, and even use this information to seek improper benefits, threatening the property and life safety of users. Therefore, the privacy protection of trajectory data has become a key problem that needs to be solved urgently in the development of LBS technology.

[0003] Existing trajectory privacy protection technologies mainly focus on the spatio-temporal dimension. Although these works protect users' privacy to a certain extent in the spatio-temporal dimension, they often neglect the semantic information of trajectories and are unable to effectively cope with semantic attacks to comprehensively protect users' semantic privacy. In fact, the semantic information of trajectories contains a large amount of sensitive information such as individuals' habits and lifestyles. Therefore, it is crucial to protect semantic information when releasing synthetic trajectories. At the same time, with the rapid development of big data and LBS technologies, many application scenarios have put forward higher requirements for the privacy protection of users' trajectory data: on the one hand, it is necessary to prevent malicious attackers from inferring users' sensitive information from the processed trajectories, and on the other hand, it is also necessary to ensure that the processed trajectories still have high integrity and data availability (data utility). For example, in the intelligent transportation system, while ensuring that the driving trajectory will not be misused or leaked, the location data is also used to optimize routes and traffic flow; on the social platform, excessive disclosure may lead to the tracking or analysis of users' activities. However, location information is closely related to social behavior, and the lack of location information will make it impossible to provide effective recommendation services; in the e-commerce platform, it is required that the location data is not leaked, and at the same time, it also relies on these data to optimize the delivery service. Traditional data privacy protection technologies include generalization and cryptography technologies, etc. Among them, generalization reduces the risk of privacy leakage by reducing data precision. Specifically, the generalization technology blurs the accurate location information of users into a larger range of regions or categories to prevent attackers from inferring the specific location of users from the publicly available data. However, this method cannot effectively resist background knowledge attacks, and the generalized location or trajectory may lack a sense of reality and is easily recognized as false information, thus affecting the privacy protection effect. In addition, while reducing data precision to protect privacy, the generalization technology also weakens the usability of the data and cannot balance privacy protection and data utility; the cryptography technology uses appropriate encryption technologies to protect users' location privacy when using services. The encryption operation usually occurs before the user sends location data to the LBS provider and before the LBS provider returns the result to the user, using cryptographic encryption technology to avoid the leakage of location privacy during the user's search for services. However, the main disadvantage of this type of method is the high storage and computing power consumption, which seriously affects the performance of the terminal. In addition, when dealing with large-scale data, this type of method may also face scalability problems, making it difficult to balance privacy protection and efficiency in practical applications.

[0004] Differential privacy, as an emerging privacy protection technology, ensures the privacy of individual data by introducing noise into location data, providing strong mathematical guarantees. While protecting privacy, it can maintain relatively high data utility and has shown great potential in theoretical research and practical applications. Its main advantage lies in being able to achieve a good balance between privacy protection and data availability. However, effectively applying differential privacy technology to trajectory data publishing still faces many challenges: First, protecting trajectory privacy only from the spatio-temporal dimension often ignores the semantic information contained in the trajectory, which may lead to the exposure of user privacy (i.e., insufficient semantic privacy protection). Second, homogenously processing all location points in the trajectory without fully considering the sensitivity differences of different location points for different users makes it difficult to achieve personalized perturbation protection (i.e., insufficient personalized perturbation); in addition, in trajectory data protection, the characteristics of semantic attributes are not fully combined to balance the relationship between privacy protection and data utility, which may cause privacy leakage or a decrease in data availability (i.e., imbalance between privacy protection and data utility). These problems pose higher requirements and challenges for the practical application of differential privacy in trajectory data protection. Summary of the Invention

[0005] Embodiments of the present invention provide a method and system for publishing trajectory data based on privacy protection to solve the problems in existing solutions that when applying differential privacy technology to trajectory data publishing, protecting trajectory privacy only from the spatio-temporal dimension often ignores the semantic information contained in the trajectory, resulting in insufficient semantic privacy protection; and homogenously processing all location points in the trajectory without fully considering the sensitivity differences of different location points for different users, making it difficult to achieve personalized perturbation protection; and in trajectory data protection, the characteristics of semantic attributes are not fully combined to balance the relationship between privacy protection and data utility, easily causing privacy leakage or a decrease in data availability.

[0006] According to the first aspect of the embodiments of the present invention, a method for publishing trajectory data based on privacy protection is provided, including:

[0007] Converting the original user trajectory sequence to be published into a sequence of stay points;

[0008] For the stay points in the sequence of stay points, measure the sensitivity of each stay point from three aspects: global access frequency, personal access frequency, and radiation sensitivity to obtain the sensitivity of the user to each stay point; allocate the privacy budget for each stay point based on the obtained sensitivity;

[0009] According to the allocated privacy budget, the stay points in the stay point sequence are perturbed using the planar Laplace mechanism to obtain a candidate set of perturbed points that satisfy geographical indistinguishability, and perturbed points are selected from the candidate set of perturbed points through semantic similarity matching to replace the true stay points;

[0010] Based on the perturbed stay point sequence, trajectory modeling is performed through a conditional Markov model to obtain the trajectory data to be released.

[0011] Furthermore, the global access frequency, personal access frequency, and radiation sensitivity are specifically expressed as:

[0012] The global access frequency is expressed as:

[0013] The personal access frequency is expressed as:

[0014] The radiation sensitivity is expressed as:

[0015] Wherein, is the global access frequency, and E(s) is the entropy value of the stay point; is the personal access frequency, and n i is the total number of times user i visits stay point s, and M is the total number of stay points of user i; R i is the radiation sensitivity, r is the preset radius threshold, and D ij is the equivalent distance between each interest point j in the set of interest points corresponding to stay point i and stay point i, A is the set of interest points within the radius r, and PoI j is the j-th interest point in the set of interest points, is the global access frequency of interest point j.

[0016] Furthermore, the sensitivity of each stay point is measured from three aspects: global access frequency, personal access frequency, and radiation sensitivity to obtain the sensitivity of the user to each stay point. Specifically, based on the obtained global access frequency, personal access frequency, and radiation sensitivity, the contributions of the global access frequency, personal access frequency, and radiation sensitivity to the stay point sensitivity are calculated respectively to obtain the contribution value of the global access frequency to the stay point sensitivity, the contribution value of the personal access frequency to the stay point sensitivity, and the contribution value of the radiation sensitivity to the stay point sensitivity. Based on the obtained contribution values, the main component analysis is used to integrate each contribution value to obtain the sensitivity score of the user to each stay point.

[0017] Furthermore, the privacy budget allocation for each stay point is based on the obtained sensitivity, specifically as follows:

[0018] Based on the obtained user sensitivity scores for each stay point, the average sensitivity of each stay point sequence is calculated;

[0019] Allocate a privacy budget for each stop point sequence based on the proportion of the average sensitivity of each stop point sequence in the sum of the average sensitivity of all stop point sequences;

[0020] Based on the privacy budget allocation of each stay point sequence, a privacy budget is allocated for each stay point according to the proportion of the sensitivity of each stay point in the total sensitivity of the sequence to which it belongs.

[0021] Furthermore, the privacy budget allocation is specifically expressed as follows:

[0022]

[0023]

[0024] in, is the sequence of stop points [G s ] j The i-th stop point s ji Privacy budget, is the jth stop point sequence [G s ] j The privacy budget of ∈ is the global privacy budget, AvgS([G s ] j ) is the sequence [G s ] j The average sensitivity, S(s ji ) is the i-th stop point s in the j-th sequence ji SumAvgS is the average sensitivity of all stay point sequences.

[0025] Furthermore, the method of selecting a disturbance point from the disturbance point candidate set to replace the real stay point by semantic similarity matching is specifically as follows:

[0026] Calculate the average sensitivity of each stop point in the trajectory to be released, and divide the stop points into two categories according to the average sensitivity, including high-sensitivity stop points and low-sensitivity stop points;

[0027] For high-sensitivity stay points, the point closest to the average sensitivity in the stay point candidate set after disturbance is selected as the final disturbance point;

[0028] For low-sensitivity stay points, the point with the highest semantic similarity is selected from the perturbed stay point candidate set as the final perturbed stay point.

[0029] Further, a stop point in the stop point sequence represents a geographical area where the user stays within a preset distance threshold for a time exceeding a preset time threshold. The stop point is represented as a set of location data, arrival time, and departure time. Moreover, each stop point in the stop point sequence is associated with semantic information indicating the distribution of points of interest around the stop point.

[0030] According to a second aspect of the embodiments of the present invention, there is provided a trajectory data publishing system based on privacy protection, including:

[0031] A data acquisition unit, which is used to convert the original user trajectory sequence to be published into a stop point sequence;

[0032] A privacy budget allocation unit, which is used to measure the sensitivity of each stop point in the stop point sequence from three aspects: global access frequency, personal access frequency, and radiation sensitivity, so as to obtain the sensitivity of the user to each stop point; and allocate the privacy budget for each stop point based on the obtained sensitivity;

[0033] A stop point sequence perturbation unit, which is used to perturb the stop points in the stop point sequence by using the planar Laplace mechanism according to the allocated privacy budget to obtain a candidate set of perturbed points that satisfies geographical indistinguishability, and select a perturbed point from the candidate set of perturbed points through semantic similarity matching to replace the real stop point;

[0034] A trajectory generation unit, which is used to perform trajectory modeling based on the perturbed stop point sequence through a conditional Markov model to obtain the trajectory data to be published.

[0035] According to a third aspect of the embodiments of the present invention, there is provided an electronic device, including a memory, a processor, and a computer program running on the memory. When the processor executes the program, the method for publishing trajectory data based on privacy protection as described above is implemented.

[0036] According to a fourth aspect of the embodiments of the present invention, there is provided a non-transitory computer-readable storage medium, on which a computer program is stored. When the program is executed by a processor, the method for publishing trajectory data based on privacy protection as described above is implemented.

[0037] The above one or more technical solutions have the following beneficial effects:

[0038] (1) The present invention provides a method and system for publishing trajectory data based on privacy protection. The proposed solution not only protects user privacy from the spatio-temporal dimension but also considers the semantic privacy of location points, further enhancing the security of privacy protection. Meanwhile, the solution measures the sensitivity of different stay points to different users through indicators such as global access frequency, individual access frequency, and radiation sensitivity, and provides personalized privacy budget allocation for users according to the sensitivity, thereby meeting personalized needs while ensuring privacy. This makes the solution of the present invention meet personalized requirements while ensuring the privacy and security of users.

[0039] (2) While providing higher security, the solution of the present invention also ensures the utility of the synthetic trajectory, enabling it to meet the data analysis of downstream tasks. Meanwhile, by means of technologies such as differential privacy mechanism and conditional Markov modeling, the solution of the present invention provides an efficient and easy-to-implement privacy protection solution, which is particularly suitable for the scenario of trajectory data publishing and has a relatively small increase in computational complexity.

[0040] Advantages of additional aspects of the present invention will be given in part in the following description, become apparent in part from the following description, or be learned through the practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] The accompanying drawings forming a part of this specification are used to provide a further understanding of the present invention. The schematic embodiments and descriptions thereof of the present invention are used to explain the present invention and do not constitute an improper limitation of the present invention.

[0042] Figure 1 It is a schematic diagram of the overall processing framework of the method for publishing trajectory data based on privacy protection described in the embodiments of the present invention;

[0043] Figure 2 It is a flowchart of the method for publishing trajectory data based on privacy protection described in the embodiments of the present invention;

[0044] Figure 3 It is a schematic diagram of the structure of the system for publishing trajectory data based on privacy protection described in the embodiments of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0045] It should be noted that the following detailed description is exemplary and is intended to provide further explanation of the present invention. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by those of ordinary skill in the technical field to which the present invention belongs.

[0046] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit the exemplary embodiments according to the present invention.

[0047] Without conflict, the embodiments in the present invention and the features in the embodiments may be combined with each other.

[0048] It should be noted that for the following embodiments of the solution of the present invention, the acquisition of all data is based on compliance with laws and regulations and user consent, and the data is legally applied.

[0049] Embodiment 1:

[0050] This embodiment provides a method for publishing trajectory data based on privacy protection. As Figure 1 shown, the overall framework schematic diagram is presented. In one or more embodiments, as Figure 2 shown, the method specifically includes the following processing steps:

[0051] Step 100: Convert the original user trajectory sequence to be published into a sequence of stop points;

[0052] In specific implementation, the stop points in the sequence of stop points represent geographical areas where the user stays within a preset distance threshold for more than a preset time threshold. The stop points are represented as a set of location data, arrival time, and departure time. Moreover, each stop point in the sequence of stop points is associated with semantic information indicating the distribution of points of interest (PoIs) around the stop point.

[0053] Specifically, step 100 specifically includes the following processing process:

[0054] Convert the original user trajectory sequence to be published into a sequence of stop points, and use the PoI (Point of Interest) distribution within the stop point threshold to characterize the semantic attributes of the stop points. Using the sequence of stop points instead of the original trajectory sequence can not only better protect user privacy but also reduce interference with the original trajectory data, thus facilitating a better balance between privacy protection and data availability. Specifically, the definition of the sequence of stop points G can be expressed as:

[0055] G = {(s 1 , POI 1 ), (s 2 , POI 2 ), …, (s m , POI m )}

[0056] Meanwhile, define the set of stop points to represent the sequence of stop points without semantic information, where m is the number of stop points in the set of stop points. The POI i in the sequence of stop points G represents the PoI distribution around the stop point s i and is used to characterize the semantic information of the stop point. Each stop point s represents that the user is within a certain distance threshold θd The residence time exceeds the time threshold θ t in a geographical area. In the original trajectory, a stop point s is a set composed of a group of consecutive trajectory points L = {l i , l i+1 , …, l j}. For any point l k (i ≤ k ≤ j) in the set L, the distance Dist(l i , l i , l k ) ≤ θ d . For the last point l j of the set, the distance Dist(l i , l i , l j ) > θ d , and the time interval Int(l i .t, l j .t) ≥ θ t .

[0057] Therefore, the stop point s is represented as s = (x, y, t a , t l ), where x represents the average longitude of the point set L, y represents the average latitude of the point set L, t a represents the time when the user arrives at the stop point s, and t l represents the time when the user leaves the stop point s.

[0058] Step 200: For the stop points in the stop point sequence, measure the sensitivity of each stop point from three aspects: global access frequency, personal access frequency, and radiation sensitivity, to obtain the sensitivity of the user to each stop point; allocate the privacy budget for each stop point based on the obtained sensitivity;

[0059] In a specific implementation, the global access frequency, personal access frequency, and radiation sensitivity are specifically:

[0060] The global access frequency is expressed as:

[0061] The personal access frequency is expressed as:

[0062] The radiation sensitivity is expressed as:

[0063] Among them, is the global access frequency, and E(s) is the entropy value of the stop point; is the personal access frequency, and n i is the total number of times user i visits the stop point s, and M is the total number of stop points of user i; Ri is the radiation sensitivity, r is the preset radius threshold, D ij is the equivalent distance between each point of interest j in the set of points of interest corresponding to the stop point i and the stop point i, A is the set of points of interest within the radius r, PoI j is the jth interest point in the interest point set, is the global visit frequency of interest point j.

[0064] In a specific implementation, the sensitivity of the stop point is measured from three aspects: global visit frequency, personal visit frequency and radiation sensitivity, to obtain the user's sensitivity to each stop point. Specifically, based on the obtained global visit frequency, personal visit frequency and radiation sensitivity, the contribution of the global visit frequency, personal visit frequency and radiation sensitivity to the stop point sensitivity is calculated respectively to obtain the contribution value of the global visit frequency to the stop point sensitivity, the contribution value of the personal visit frequency to the stop point sensitivity and the contribution value of the radiation sensitivity to the stop point sensitivity. Based on the obtained contribution values, the principal component analysis is used to integrate the contribution values ​​to obtain the user's sensitivity score to each stop point.

[0065] In a specific implementation, the privacy budget allocation for each stop point is performed based on the obtained sensitivity, specifically:

[0066] Based on the obtained user sensitivity scores for each stay point, the average sensitivity of each stay point sequence is calculated;

[0067] Allocate a privacy budget for each stop point sequence based on the proportion of the average sensitivity of each stop point sequence in the sum of the average sensitivity of all stop point sequences;

[0068] Based on the privacy budget allocation of each stay point sequence, a privacy budget is allocated for each stay point according to the proportion of the sensitivity of each stay point in the total sensitivity of the sequence to which it belongs.

[0069] Specifically, step 200 includes the following processing steps:

[0070] Based on the sequence of stay points obtained in step S100, the sensitivity of the stay points is measured from three aspects: global visit frequency, personal visit frequency and radiation sensitivity. Through these three influencing factors, the sensitivity of the stay points can be measured more comprehensively.

[0071] In a specific implementation, in order to fuse these three impact factors at different scales into a comprehensive index, the solution in this embodiment adopts the Principal Component Analysis (PCA). Through PCA, multiple related variables are transformed into several principal components, and each principal component represents the most information in the original data. The three factors of global access frequency, personal access frequency, and radiation sensitivity are integrated into one principal component through PCA, so as to obtain the final sensitivity score for each stop point. At the same time, based on the measured sensitivity score, a corresponding privacy budget is personalized for each stop point. Specifically, stop points with higher sensitivity should be allocated a lower privacy budget to provide more stringent privacy protection; while stop points with lower sensitivity can be allocated a higher privacy budget to reduce excessive restrictions on data availability, thus achieving a balance between privacy protection and data utility.

[0072] The following provides a detailed description of the above three impact factors and their fusion:

[0073] (1) Global access frequency

[0074] The global access frequency reflects the degree of congestion of a location, usually referring to the number of visits or access density of the location in the entire dataset. For locations with sparse population (such as private residences), their global access frequency is low, but if users visit such locations, it may reveal highly sensitive information about their private lives. Therefore, the sensitivity of these locations is relatively high.

[0075] Definition of global access frequency:

[0076] Let R(s) = {u 1 , u 2 , …, u w} represent the set of users who have visited the stop point s in the trajectory dataset, and w represent the number of users who have visited the stop point s.

[0077] The entropy value can reflect the distribution uniformity of the visits to the stop point. The larger the entropy value, the more uniform the visits to the stop point; conversely, the more concentrated. The entropy value of the stop point s is expressed as where n i represents the total number of visits of user u to the stop point s, represents the total number of visits of all users to the stop point s, and w represents the number of users who have visited the stop point s. Here, log represents the logarithmic function with base 10. The global access frequency of the stop point s is defined as follows:

[0078]

[0079] To ensure that the differences in sensitivity between different locations are more reasonable and significant, and to meet the actual needs of privacy protection, the following formula is defined to measure the contribution of the global access frequency to sensitivity:

[0080]

[0081] The above formula uses logarithmic transformation to smooth the sensitivity in areas with high global access frequency, ensuring that as the global access frequency increases, the sensitivity gradually decreases, meeting the requirements of privacy protection. Here, log represents the logarithmic function with base 10.

[0082] (2) Personal access frequency

[0083] The personal access frequency focuses on the access behavior of a single user and reflects the user's preference for a certain stop point. If a user frequently visits a certain stop point, this may not only reveal their personal interests and living habits, but also expose more of their private information, thereby increasing the sensitivity of this stop point.

[0084] Definition of personal access frequency:

[0085] Let \(R(u)=\{[G s 1 ,[G s 2 ,…,[G s j \}\) represent the sequence of all stop points of user \(u\), let \(n i \) represent the number of visits of user \(u\) at stop point \(s\), define \(g i \) to represent the number of stop points contained in the \(i\)-th stop point sequence \([G s i \) of user \(u\), then represents the total number of stop points of user \(u\). The personal access frequency of stop point \(s\) is expressed as follows:

[0086]

[0087] Define the following formula to measure the contribution of personal access frequency to sensitivity:

[0088]

[0089] where, log represents the logarithmic function with base 10.

[0090] This formula ensures strict protection of high-frequency stop points during the privacy protection process by performing logarithmic transformation on the personal access frequency and introducing a negative sign, while keeping the sensitivity of low-frequency stop points relatively low. This method effectively balances the contradiction between privacy protection and data availability while protecting user privacy.​​​​

[0091] (3) Radiation sensitivity

[0092] The radiation sensitivity takes into account the potential impact of each PoI around the stop point in the area on its sensitivity. Even if a stop point has no direct geographical or functional connection with a sensitive PoI, being close to these sensitive areas may increase the risk of user privacy leakage. Therefore, the sensitivity of these stop points may increase due to the influence of the surrounding environment.

[0093] Definition of radiation sensitivity:

[0094] First, according to the set radius threshold r, obtain the set A of PoIs around the stop point s i A = {PoI j |d ij < r}, where d ij is the Euclidean distance between the stop point s i and the point of interest PoI j . Then, map each PoI in the set and the stop point together into an undirected graph. At the same time, use the number of nodes c ij to represent the total number of network nodes passed on the path when calculating the shortest path between the stop point s i and the point of interest PoI j . These nodes are intersections in the traffic road network or key positions in other geographical networks, reflecting the number of intermediate positions required to pass from the stop point to the point of interest. When measuring the radiation sensitivity, the path length not only considers the Euclidean distance d ij , but also needs to consider the complexity of the path (i.e., the number of nodes c ij ) passed on the path. Therefore, the equivalent distance between each PoI in the set and the stop point s i is denoted as D ij = d ij (c ij - 1). The radiation sensitivity of the stop point s i is expressed as follows:

[0095]

[0096] where, is the global access frequency of the point of interest j, which is calculated through the calculation formula of the global access frequency. Define the following formula to measure the contribution of the radiation sensitivity to the sensitivity:

[0097] ω R (s) = log(1 + R i )

[0098] where log is the logarithmic function with base 10.

[0099] Then, based on the three contribution values obtained from the above process, the final dwelling point sensitivity is calculated using PCA (Principal Component Analysis) to allocate the privacy budget. PCA can integrate data in multiple dimensions into several principal components. This method retains the most important variations in the data without discarding any original dimensions. PCA automatically assigns weights by linearly combining different factors and determines their importance based on their contribution to the data variance. This method avoids the bias caused by manual weight assignment, simplifies the calculation, and improves the processing efficiency.

[0100] Before applying PCA, it is necessary to standardize the data to ensure that the scale differences between the three influencing factors do not have too much impact on the final result. Standardization can adjust the data to zero mean and unit variance:

[0101]

[0102]

[0103]

[0104] where μ P , μ F and μ R are the means of the contributions corresponding to the three influencing factors, and σ P , σ F and σ R are their respective standard deviations.

[0105] Next, apply PCA to reduce the dimension of the influencing factors. The goal of PCA is to project the data onto a set of orthogonal axes (principal components) to capture the largest variance in the data. First, calculate the covariance matrix of the standardized data:

[0106]

[0107] Then perform eigenvalue decomposition on the covariance matrix to obtain the eigenvalues and their corresponding eigenvectors. By selecting the principal components that can explain the largest variance in the data, the importance of the principal components in the sensitivity metric is determined. The final sensitivity S is calculated by the linear combination of three standardized sensitivity measurement values, where a 1 , a 2 and a 3 are the components of the eigenvector, representing the contribution degrees of the three influencing factors (global access frequency, personal access frequency, radiation sensitivity) to the overall sensitivity:

[0108]

[0109] After measuring the sensitivity of each stop point, the privacy budget is allocated according to the sensitivity to achieve personalized perturbation. Specifically, the average sensitivity of each stop point sequence is calculated first, and the privacy budget is allocated to each stop point sequence according to its proportion in the sum of the average sensitivity of all stop point sequences. The higher the average sensitivity, the smaller the allocated privacy budget.

[0110] Specifically, the jth stop point sequence [G s ] j The privacy budget allocation is expressed as follows:

[0111]

[0112] Among them, ∈ is the global privacy budget, AvgS([G s ] j ) is the sequence [G s ] j The average sensitivity of is defined as: m is the sequence [G s ] j The number of stop points in ji ) is the i-th stop point s in the j-th sequence ji SumAvgS is the sum of the average sensitivities of all stay point sequences, defined as: N is the number of stop point sequences.

[0113] Then, a corresponding privacy budget is allocated to each stop point according to the proportion of its sensitivity to the total sensitivity of the sequence to which it belongs.

[0114] Specifically, the stop point sequence [G s ] j The i-th stop point s ji The privacy budget allocation is expressed as follows:

[0115]

[0116] Step 300: According to the allocated privacy budget, the stay points in the stay point sequence are perturbed using the planar Laplace mechanism to obtain a candidate set of perturbed points that satisfy geographic indistinguishability, and perturbed points are selected from the candidate set of perturbed points to replace the real stay points through semantic similarity matching;

[0117] In a specific implementation, the method of selecting a disturbance point from the disturbance point candidate set to replace the real stay point by semantic similarity matching is specifically as follows:

[0118] Calculate the average sensitivity of each stop point in the trajectory to be released, and divide the stop points into two categories according to the average sensitivity, including high-sensitivity stop points and low-sensitivity stop points;

[0119] For high-sensitivity stop points, select a point with a moderate similarity (i.e., closest to the average sensitivity in the set of stop point candidates after perturbation) from the set of stop point candidates after perturbation as the final perturbed point;

[0120] For low-sensitivity stop points, select the point with the highest semantic similarity from the set of stop point candidates after perturbation as the final perturbed stop point.

[0121] Specifically, step 300 specifically includes the following processing procedures:

[0122] According to the privacy budget allocated in step S200, use the planar Laplace mechanism to generate multiple location points that satisfy geographical indistinguishability. This mechanism achieves geographical indistinguishability by adding controlled noise around the user's true location, making it difficult to distinguish the location information between any two points. Specifically:

[0123] Given the privacy budget ∈ and the actual location x 0 , the probability density function (PDF) of the noise mechanism at any other point x is:

[0124]

[0125] The above function is a planar Laplace function centered on x 0 , where as the normalization factor, d(x 0 , x) is the Euclidean distance between point x and the original location x 0 .

[0126] Furthermore, to facilitate sampling from the distribution represented by the above function, represent the location x in polar coordinates (r, θ). This representation only depends on the distance between x and x 0 , making it easier to independently process the distance and angle. Among them, the angle θ is uniformly sampled from the interval [0, 2π), and the sampling of the distance r is based on the cumulative distribution function C ∈ (r), and this function is expressed as:

[0127] C ∈ (r) = 1 - (1 + ∈r)e -∈r

[0128] It can be understood that by sampling from a uniform distribution and using the inverse function the value of r can be determined.

[0129] Therefore, after determining the regional radius r that satisfies geographical indistinguishability, the planar Laplace mechanism can be used to generate multiple noisy locations. However, since the points generated by the Laplace mechanism do not always actually exist, to ensure the rationality and authenticity of the trajectory, these generated points need to be screened through the road network, and the real and reasonable points are retained as the candidate set of the perturbed stay points. For example, some points may fall within buildings, water bodies, or other inaccessible areas. To solve this problem, the road network can be used to filter and adjust these noisy points to ensure that they fall within the actually accessible road network. Therefore, the generated noisy points are screened through the road network, and only the real and accessible locations are retained and then stored in the candidate set.

[0130] Then, OpenStreetMap (i.e., OSM) is used to obtain the road network data covering the target area. For each generated noisy point, the map service API (Application Programming Interface) is used to query the nearest road, and the noisy point is adjusted to that road. The above settings ensure that the adjusted points fall on valid roads and avoid areas such as private roads or traffic-free zones. In more embodiments, additional filtering can also be applied to remove location points that are on the road but may not be suitable for use (for example, points located on remote or infrequently used roads).

[0131] After processing, the filtered points are added to the candidate set (these points satisfy geographical indistinguishability and at the same time ensure that these points correspond to real and accessible locations).

[0132] Subsequently, using the semantic similarity matching mechanism, the final perturbed points are selected from the candidate set to obtain the sequence of perturbed stay points. Among them, the semantic similarity matching measures the semantic similarity between the candidate perturbed locations and the original stay points through a scoring function. The higher the similarity, the higher the score.

[0133] In one or more embodiments, the semantic similarity matching mechanism is specifically:

[0134] First, calculate the average sensitivity of each stop point in the trajectory to be released, and classify the stop points into two categories according to the average sensitivity: high-sensitivity stop points and low-sensitivity stop points. The selection mechanisms for these two types of stop points are different. For high-sensitivity stop points, the perturbed location should have a low semantic similarity with the original stop point to better protect its semantic privacy. However, to ensure the utility of the false trajectory, some semantic attributes still need to be retained. Therefore, instead of simply choosing the point with the lowest semantic similarity, a point with a moderate similarity (i.e., closest to the average sensitivity in the stop point candidate set) is selected as the final perturbed point. For low-sensitivity stop points, the semantic similarity between the original location and the perturbed location can be relatively high to retain data utility, and the point with the highest semantic similarity is finally selected as the final perturbed stop point.

[0135] In a specific implementation, to measure the semantic similarity between stop points, the solution in this embodiment uses a method of information theory to measure the semantic similarity by comparing the PoI distributions of two locations. The PoI distribution of each location shows the proportion of different types of points of interest (such as restaurants, parks, hospitals, etc.) around that location. The similarity between them is evaluated by calculating the mutual information of the PoI distributions of the two locations. The formula is as follows:

[0136]

[0137] where x 0 represents the original stop point location, x represents the perturbed location generated by the privacy mechanism, and respectively represent the PoI distributions of the original stop point x 0 and the perturbed point x, is the set of all possible types of points of interest, p is the type of point of interest in the set P, P(p∣x 0 ) and P(p∣x) are the conditional probabilities of the type of point of interest p at the original location x 0 and the perturbed location x, that is, the occurrence probability of each type of PoI at these locations.

[0138] For the original stop point and each candidate perturbed location, calculate the mutual information to help select the final perturbed location. The mutual information reflects the similarity between the PoI distributions of the original location and the perturbed location. The larger the mutual information value, the more similar the PoI distributions of the original location and the perturbed location, that is, the more information these two locations share. If the PoI distributions of the original location and the perturbed location are highly similar, it means that even if the geographical location is hidden or perturbed, the attacker can still speculate on the user's activities or interests at the original location, resulting in a higher semantic privacy risk. After this step, the sequence of perturbed stop points is obtained.

[0139] Step 400: Based on the perturbed sequence of stop points, perform trajectory modeling through a conditional Markov model to obtain the trajectory data to be released.

[0140] Specifically, the said Step 400 specifically includes the following processing procedures:

[0141] Based on the perturbed sequence of stop points, synthesize a complete trajectory through a conditional Markov model. Specifically: For the perturbed sequence of stop points, it can be regarded as consisting of a starting point, multiple intermediate stop points, and an ending point. Since human travel activities are usually affected by various factors, there is often a certain distance dependence in the trajectory, that is, there is a relatively fixed movement pattern. Therefore, a conditional Markov model is used to model the life trajectory to capture the long dependence in the trajectory. On this basis, use the established model for trajectory prediction and continuously optimize through iteration to generate a complete trajectory.

[0142] Definition of conditional Markov sequence: The main components of the sequence of stop points include the starting point, intermediate stop points, ending point, and their evolution processes. Assume that the starting point, all intermediate stop points, and the ending point are known. A complete trajectory is represented by the sequence [G s . If [G s is a CM (Conditional Markov) sequence, then for and satisfying 1 ≤ j < k < m, and the following relationship holds:

[0143]

[0144] Among them, represents the state information from the 1st position to the jth position in the trajectory sequence [G s , s j represents the state information at the jth position, F(·|·) is the conditional cumulative distribution function (CDF), used to model the probability distribution of each state point to capture the dependence of each point in the trajectory. ξ k represents the state variable at the kth position in the sequence, and R d represents the d-dimensional real vector space.

[0145] According to this definition, the state ξ at the kth position in the sequence kis conditional on all key points (start point, intermediate stop points, and end point). Given the state of the j-th position point and the states of all key points, the state of the l-th position point is conditionally independent of the states of all position points before the j-th position point. In other words, the trajectory segment from the j-th position point to the k-th position point depends only on the state of the j-th position point and the states of the key points in [[G s , provided that the states of these key points have been determined.

[0146] According to the CM sequence, the probability density function of the CM sequence can be used to model the known stop points, while the conditional probability density function based on the known stop points is used to model the unknown part, so as to capture the long-term dependencies in the trajectory. According to the definition of the CM sequence, a state transition process from one point to another must be established. For human motion, this process can be described by a dynamic model, the complexity of which depends on the nature of the motion. The core of the dynamic model is the state update equation, which describes how the system state evolves over time. For each non-key point l i , that is, those points that are not predefined as key points (start point, intermediate stop points, and end point), the state can be updated by the following equation:

[0147]

[0148] where, represents a transition matrix, which describes the natural state transition from the previous point l i-1 to the current point l i . represents the combined influence of all stop points in the trajectory on the non-key point l i , represents the transition matrix of the influence of stop points on non-key points, which is used to capture how each stop point in the trajectory affects subsequent trajectory points, represents the state vector of these key points, and m is the number of stop points in the set of stop points.

[0149] This means that each non-key point depends not only on its previous point but also on the stop points in the trajectory. That is, in the state update process, the current state is affected by two parts: the first part is the transition from the previous state (controlled by the state transition matrix ), and the second part is the influence of the stop points in the entire trajectory on the current point, and these influences are weighted by s . Finally, random noise is also included in the state update, which is used to model the uncertainty in the system and is usually assumed to be Gaussian white noise.

[0150] It should be noted here that represents the state transition matrix, which captures the changing pattern of human body movement from one position to the next in physical space. In the above formula functions to predict the state change of the current point l i-1 based on the state of the previous point l i .

[0151] The dynamic model established based on the CM sequence depends on the physical laws governing the system and the current state to predict future states, and can effectively describe the evolution process of the system. However, in practical applications, the dynamic model often cannot handle random measurement errors and external noises. The solution described in this embodiment introduces a Kalman filter to assist the prediction of the dynamic model. The Kalman filter is a recursive algorithm that can combine the prediction of the dynamic model with actual measurement data, estimate the system state in real time, and is good at dealing with measurement noises and system uncertainties. By balancing the predicted value and the measured value, the Kalman filter provides the best state estimate for the dynamic model, thereby performing real-time error correction based on the prediction of the dynamic model. This combination ensures that even in the presence of noises and measurement errors, the trajectory estimation can still remain accurate. The combination of the dynamic model and the Kalman filter makes the trajectory prediction have both theoretical basis and can adapt to the random changes in real-world data.

[0152] Embodiment 2:

[0153] As Figure 3 shown, the solution described in this embodiment provides a trajectory data publishing system based on privacy protection, including:

[0154] A data acquisition unit, which is used to convert the original user trajectory sequence to be published into a sequence of stay points;

[0155] A privacy budget allocation unit, which is used to measure the sensitivity of the stay points in the sequence of stay points from three aspects: global access frequency, personal access frequency, and radiation sensitivity, to obtain the sensitivity of the user to each stay point; and allocate the privacy budget for each stay point based on the obtained sensitivity;

[0156] A stay point sequence perturbation unit, which is used to perturb the stay points in the sequence of stay points using the planar Laplace mechanism according to the allocated privacy budget to obtain a candidate set of perturbed points that satisfies geographical indistinguishability, and select a perturbed point from the candidate set of perturbed points through semantic similarity matching to replace the real stay point;

[0157] A trajectory generation unit, which is used to perform trajectory modeling through a conditional Markov model based on the perturbed sequence of stay points to obtain the trajectory data to be published.

[0158] It can be understood that the system described in this embodiment corresponds to the method embodiment one by one, and its technical details have been described in detail in Embodiment 1, so they will not be elaborated here.

[0159] In more embodiments, there is also provided:

[0160] An electronic device includes a memory, a processor, and computer instructions stored on the memory and running on the processor. When the computer instructions are run by the processor, the methods described in the above embodiments are completed. For the sake of brevity, they will not be elaborated here.

[0161] It should be understood that in this embodiment, the processor may be a central processing unit CPU, and the processor may also be other general-purpose processors, digital signal processors DSP, application-specific integrated circuits ASIC, off-the-shelf programmable gate arrays FPGA, or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0162] The memory may include a read-only memory and a random access memory, and provide instructions and data to the processor. A part of the memory may also include a non-volatile random access memory. For example, the memory may also store information about the device type.

[0163] A computer-readable storage medium is used to store computer instructions. When the computer instructions are executed by the processor, the methods described in the above embodiments are completed.

[0164] The methods in the above embodiments can be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules in the processor. The software modules may be located in mature storage media in the art such as random access memory, flash memory, read-only memory, programmable read-only memory, or electrically erasable programmable memory, registers, etc. This storage medium is located in the memory, and the processor reads the information in the memory and combines its hardware to complete the steps of the above methods. To avoid repetition, it will not be described in detail here.

[0165] Those of ordinary skill in the art can realize that the units and algorithm steps of each example described in combination with this embodiment can be implemented by electronic hardware or a combination of computer software and electronic hardware. Whether these functions are executed in a hardware or software manner depends on the specific application and design constraints of the technical solution. Professional technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of this disclosure.

[0166] The above are only the preferred embodiments of the present disclosure and are not intended to limit the present disclosure. For those skilled in the art, various modifications and variations can be made to the present disclosure. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present disclosure shall be included within the protection scope of the present disclosure.

Claims

1. A trajectory data publishing method based on privacy protection, characterized in that: include: Convert the original trajectory sequence of the user to be published into a sequence of stay points; For the stay points in the stay point sequence, the sensitivity of the stay points is measured from three aspects: global access frequency, personal access frequency, and radiation sensitivity, to obtain the user's sensitivity to each stay point; and a privacy budget is allocated to each stay point based on the obtained sensitivity; According to the allocated privacy budget, the stay points in the stay point sequence are perturbed using the planar Laplace mechanism to obtain a candidate set of perturbed points that satisfy geographic indistinguishability, and perturbed points are selected from the candidate set of perturbed points to replace the real stay points through semantic similarity matching; Based on the sequence of stay points after disturbance, trajectory modeling is performed through the conditional Markov model to obtain the trajectory data to be released.

2. The method for publishing trajectory data based on privacy protection according to claim 1, characterized in that: The global access frequency, personal access frequency and radiation sensitivity are specifically: Global access frequency, expressed as: Individual visit frequency, expressed as: Radiated sensitivity, expressed as: in, is the global visit frequency, E(s) is the entropy value of the stay point; is the individual access frequency, n i is the total number of stay points s visited by user i, M is the total number of stay points of user i; R i is the radiation sensitivity, r is the preset radius threshold, D ij is the equivalent distance between each point of interest j in the set of points of interest corresponding to the stop point i and the stop point i, A is the set of points of interest within the radius r, PoI j is the jth point of interest in the set of points of interest, is the global visit frequency of interest point j.

3. The method for publishing trajectory data based on privacy protection according to claim 1, characterized in that: The sensitivity of the stay point is measured from three aspects: global visit frequency, personal visit frequency and radiation sensitivity, and the user's sensitivity to each stay point is obtained. Specifically, based on the obtained global visit frequency, personal visit frequency and radiation sensitivity, the contribution of the global visit frequency, personal visit frequency and radiation sensitivity to the stay point sensitivity is calculated respectively, and the contribution value of the global visit frequency to the stay point sensitivity, the contribution value of the personal visit frequency to the stay point sensitivity and the contribution value of the radiation sensitivity to the stay point sensitivity are obtained. Based on the obtained contribution values, the various contribution values ​​are integrated through principal component analysis to obtain the user's sensitivity score for each stay point.

4. The method for publishing trajectory data based on privacy protection according to claim 1, characterized in that: The privacy budget allocation for each stop point based on the obtained sensitivity is specifically as follows: Based on the obtained user sensitivity scores for each stay point, the average sensitivity of each stay point sequence is calculated; Allocate a privacy budget for each stop point sequence based on the proportion of the average sensitivity of each stop point sequence in the sum of the average sensitivity of all stop point sequences; Based on the privacy budget allocation of each stay point sequence, a privacy budget is allocated for each stay point according to the proportion of the sensitivity of each stay point in the total sensitivity of the sequence to which it belongs.

5. The method for publishing trajectory data based on privacy protection according to claim 1, characterized in that: The privacy budget allocation is specifically expressed as follows: in, is the sequence of stop points [G s ] j The i-th stop point s ji Privacy budget, is the jth stop point sequence [G s ] j The privacy budget of ∈ is the global privacy budget, AvgS([G s ] j ) is the sequence [G s ] j The average sensitivity, S(s ji ) is the i-th stop point s in the j-th sequence ji SumAvgS is the average sensitivity of all stay point sequences.

6. The method for publishing trajectory data based on privacy protection according to claim 1, characterized in that: The method of selecting a disturbance point from the disturbance point candidate set to replace the real stay point by semantic similarity matching is specifically as follows: Calculate the average sensitivity of each stop point in the trajectory to be released, and divide the stop points into two categories according to the average sensitivity, including high-sensitivity stop points and low-sensitivity stop points; For high-sensitivity stay points, the point closest to the average sensitivity in the stay point candidate set after disturbance is selected as the final disturbance point; For low-sensitivity stay points, the point with the highest semantic similarity is selected from the perturbed stay point candidate set as the final perturbed stay point.

7. The method for publishing trajectory data based on privacy protection according to claim 1, characterized in that: The stay points in the stay point sequence represent geographical areas where the user stays for more than a preset time threshold within a preset distance threshold, and the stay points are represented as a collection of location data, arrival time, and departure time, and each stay point in the stay point sequence is associated with semantic information representing the distribution of points of interest around the stay point.

8. The trajectory data publishing system based on privacy protection is characterized by: include: A data acquisition unit, which is used to convert the original trajectory sequence of the user to be published into a sequence of stay points; a privacy budget allocation unit, which is used to measure the sensitivity of the stay points in the stay point sequence from three aspects: global access frequency, personal access frequency and radiation sensitivity, to obtain the user's sensitivity to each stay point; and allocate a privacy budget to each stay point based on the obtained sensitivity; A stay point sequence perturbation unit, which is used to perturb the stay points in the stay point sequence using a planar Laplace mechanism according to the allocated privacy budget, obtain a candidate set of perturbed points that meet geographic indistinguishability, and select perturbed points from the candidate set of perturbed points to replace real stay points through semantic similarity matching; The trajectory generation unit is used to perform trajectory modeling through a conditional Markov model based on the stay point sequence after the disturbance to obtain trajectory data to be released.

9. An electronic device comprising a memory, a processor and a computer program stored and running on the memory, characterized in that: When the processor executes the program, the privacy protection-based trajectory data publishing method according to any one of claims 1 to 7 is implemented.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method for publishing trajectory data based on privacy protection as described in any one of claims 1 to 7 is implemented.

Images