Hierarchical sampling track privacy protection method and system fusing semantic information

Abstract

The invention belongs to the field of privacy protection, and discloses a hierarchical sampling track privacy protection method and system fusing semantic information. Firstly, in order to solve the problems that an existing road network modeling method is insufficient in semantic information and the direct matching efficiency of a track and a semantic graph is low, a semantic enhanced hierarchical modeling method SEHM is provided; secondly, in order to reduce the deviation of the trajectory before and after disturbance, a random hierarchical sampling and multi-feature fusion disturbance method SHS-MFP is provided, according to the method, a disturbance region is constrained through a random hierarchical sampling mechanism SHS according to a hierarchical index structure SEHM, a Frechet distance-based topology-semantic-space multi-feature fusion trajectory difference measurement standard is constructed, and the disturbance region is optimized; a multi-feature fusion disturbance mechanism MFP is designed, so that a disturbance trajectory which conforms to actual road features and is similar to a real trajectory is generated in a local constraint region at a high probability. And finally, the disturbance track is sent to a server side for release sharing or statistical analysis of track data.

Description

Technical Field

[0001] The present invention belongs to the field of privacy protection, and specifically relates to a privacy protection method for hierarchical sampling trajectories integrating semantic information, which can be used to balance the shared use of data and the privacy protection of users. Background Art

[0002] With the widespread adoption of smart devices and location-aware technologies, location-based services (LBS) have made people's lives more convenient, but they also pose potential privacy threats. For example, many mobile applications continuously collect user trajectory data, even without permission, for purposes such as location tracking, behavioral analysis, and profiling personal preferences and habits. This not only increases the risk of privacy breaches but also potentially undermines public trust in intelligent systems and data sharing mechanisms. Therefore, striking a balance between trajectory data sharing and user privacy protection has become a critical issue in the field of intelligent services and data security.

[0003] Differential privacy is a rigorous privacy-preserving model that has gained increasing attention due to its rigorous mathematical theory and strong background assumptions. This model, by adding random noise, ensures that the published results do not significantly change depending on whether an individual is in the dataset, thereby providing a higher level of semantic security for individual privacy information. This model not only allows for quantitative analysis of the security and availability of the published results but also exhibits resistance to inference attacks, making it widely used in privacy-preserving scenarios. While many differential privacy methods have been developed for trajectory publishing and analysis, these methods rely on trusted data curators to collect users' real trajectories. In contrast, localized differential privacy (LDP) allows users to share perturbations of their local data, eliminating the risk of data leakage from untrusted data curators. However, due to its strict privacy properties, the perturbed location trajectories are not readily available, hindering its practical application. Therefore, how to improve the availability of perturbed trajectories while preserving privacy remains a key challenge for localized differential privacy.

[0004] Existing trajectory privacy protection methods can be divided into traditional trajectory privacy protection methods and semantic information-based trajectory privacy protection methods. Traditional privacy protection methods primarily treat trajectories as a collection of temporally ordered location points. Based on the geometric features between the location points, a mobility model, such as a probabilistic transfer matrix or a hierarchical tree structure, is established. Perturbations are then performed using a localized differential privacy mechanism. These methods rely on the number of location points to allocate the privacy budget multiple times, resulting in excessive noise accumulation in the trajectory, making the perturbed location points invalid or unable to match the real road network, and thus having low practical usability. Semantic information-based trajectory privacy protection methods primarily use public maps as prior knowledge, modeling the road network as a graph structure with intersections as nodes and the spatiotemporal distances between nodes as edge weights. Trajectories are mapped to graph paths and perturbations are performed under the constraints of the graph, avoiding invalid location points and improving the usability of the perturbed trajectory. However, modeling based solely on the spatiotemporal characteristics of public maps presents the following problems: First, semantic modeling is insufficient. Existing methods rely solely on nodes such as intersections and the spatiotemporal distances between them for modeling, ignoring key semantic information such as publicly available road attributes (e.g., speed limits, directionality) and the distribution of points of interest (POIs). This results in graph models failing to fully represent the complexity and diversity of real-world road networks. Second, there is a conflict between computational efficiency and usability. Directly incorporating multidimensional semantic information into the graph structure significantly increases the node dimensions and edge weights of the graph, leading to an explosion in the candidate trajectory space, reducing trajectory matching efficiency, and potentially generating perturbed trajectories that deviate from true mobility patterns, impacting the usability of perturbed trajectories. Third, a single trajectory difference metric impacts the usability of perturbation mechanisms. Existing perturbation mechanisms typically measure trajectory similarity solely based on the spatiotemporal distances between nodes and calculate the output probability of the perturbed trajectory accordingly. This ignores the topological structure, semantic features, and spatial morphology of the trajectories in the graph. As a result, even if the perturbed trajectories are statistically "similar," they still deviate significantly from the true trajectories in real road networks. This results in low usability of the perturbed trajectories, making them difficult to meet practical application requirements. Summary of the Invention

[0005] This paper aims to propose a hierarchical sampling-based trajectory privacy protection method integrating semantic information (HTPS). First, a semantic-enhanced hierarchical modeling method (SEHM) is proposed. For the first time, semantic information such as road attributes and point of interest distribution is integrated into graph weights to construct a weighted graph model. A multi-granularity hierarchical index structure is constructed based on the R-tree to achieve coarse-grained region screening and fine-grained path matching. While enhancing the semantic representation ability, it also reduces the trajectory matching range and candidate trajectory space, thereby improving efficiency. Second, a perturbation method based on stochastic hierarchical sampling and multi-feature fusion (SHS-MFP) is proposed. This method overcomes the low trajectory availability problem caused by the perturbation mechanism based on a single spatiotemporal distance trajectory difference metric. The perturbation area is constrained by the stochastic hierarchical sampling mechanism (SHS). Based on the semantic information of public data and the characteristics of the trajectory itself, a multi-feature fusion perturbation mechanism (SHS-MFP) is designed. The HTPS method only requires a single privacy budget allocation, which improves the accuracy and availability of the perturbed trajectory and achieves an effective balance between privacy protection and data availability. In addition, the HTPS method is theoretically proven to meet the requirements of the privacy protection and data availability. -LDP and gives an upper bound on the error.

[0006] The HTPS method consists of two main components: a semantically enhanced hierarchical modeling method (SEHM) and a perturbation method (SHS-MFP) based on random hierarchical sampling and multi-feature fusion. On the server side, to address the lack of semantic information in existing road network modeling methods and the low efficiency of direct matching of trajectories with semantic graphs, a semantically enhanced hierarchical modeling method (SEHM) is proposed. This method fully utilizes public data with road attributes, such as public maps, point of interest distribution, and intersections, to extract geometric location and semantic information, construct graph nodes, model them based on road attributes (such as length, direction, speed limit, etc.), calculate edge weights, and thus construct a weighted graph with reachability. Combined with an R-tree hierarchical index structure, the semantic graph is hierarchically organized at multiple granularities, enabling coarse-grained region screening and fine-grained path matching. This narrows the search space for trajectory matching and improves query efficiency. On the user side, to reduce the deviation between pre- and post-perturbation trajectories, a perturbation method combining random hierarchical sampling and multi-feature fusion (SHS-MFP) is proposed. Based on the hierarchical index structure (SEHM), this method constrains the perturbation region through a random hierarchical sampling mechanism (SHS). A trajectory difference metric based on the Fréchet distance is constructed using topological, semantic, and spatial multi-feature fusion. The multi-feature fusion perturbation mechanism (MFP) is designed to generate perturbed trajectories that conform to actual road characteristics and are similar to the real trajectory with high probability within the local constrained region. This ensures the usability of the perturbed trajectory and its effective matching with the displayed road network. Finally, the perturbed trajectory is sent to the server for trajectory data sharing or statistical analysis.

[0007] The hierarchical sampling trajectory privacy protection method HTPS that integrates semantic information provided by the present invention has the following specific implementation steps: Step 1. Model the public data using the semantically enhanced hierarchical modeling method SEHM; Step 1.1. Define edge weights and construct a semantically weighted graph. Step 1.2. Build a hierarchical index structure for the graph; Step 2. Based on the modeling structure, the user's trajectory data is perturbed using the perturbation method SHS-MFP, which combines random hierarchical sampling with multi-feature fusion. Step 2.1. Use the random hierarchical sampling mechanism (SHS) to obtain a node in one of the layers in a way that satisfies differential privacy, and impose local region constraints on the trajectory perturbation. Step 2.2. Use the multi-feature fusion perturbation mechanism MFP to obtain the perturbation trajectory in a way that satisfies differential privacy within the constrained area.

[0008] Furthermore, step 1.1 is implemented as follows: Based on public data, the road network is converted into a weighted graph with rich semantics to accurately describe the characteristics of real roads. First, the graph nodes are determined based on key elements in the road network, such as intersections and points of interest, to ensure that the nodes can cover the location information and corresponding semantic information of the starting and ending points of the trajectory. Secondly, since the existing method of calculating edge weights mainly takes the spatiotemporal distance between nodes as the actual distance, it ignores the connectivity and accessibility in the actual road, thus affecting the accuracy of the semantic graph. Therefore, considering the geometric distance between nodes, road direction, speed limit and other factors, the edge weights are reasonably defined so that the distance between location points is more in line with actual needs. Node and The weight between is shown in formula (1): (1) in, Indicates the coefficient of the influencing factor, balancing the relative importance of each factor in the weight calculation, ; Represents the geometric distance between nodes; Indicates the directional reachability between nodes, is the direction coefficient of the node, if the node to One-way reachable, then and ; Indicates the shortest time between nodes, The speed limit for the road section.

[0009] In addition, in the process of edge weight calculation, the inconsistent dimensions of influencing factors such as geometric distance, directionality, and speed limit may cause some indicators to have too great an impact on the results, thereby affecting the accuracy of the semantic graph structure in describing the road network. Therefore, the calculation method of edge weight is further normalized, as shown in formula (2): (2) in, Indicates a point to The normalized set distance of Represents any two adjacent points on the graph and The maximum geometric distance between and All belong to the vertex set of the graph, that is ; represents the normalized directional reachability, express and The maximum directional distance between them; represents the normalized shortest reachable time, express and The shortest achievable time between them.

[0010] Through the above weight definitions, the real road network can be modeled as a semantically weighted graph to accurately express the complexity and diversity of the road network.

[0011] Furthermore, step 1.2 of constructing the hierarchical index structure of the graph specifically includes: Given a partition threshold , using the hierarchical structure of the R-tree to partition the semantic graph spatially and construct a semantic graph with a hierarchical index structure The information stored in each node mainly includes the minimum bounding rectangle (MBR) The subgraph corresponding to the region , .like Figure 2 As shown, the R-tree can effectively divide the graph into multiple manageable areas, where the root node stores the entire public map. The MBR, the corresponding semantic graph, and the MBRs of its child nodes; the intermediate node stores the local MBR, the corresponding semantic graph, and the MBRs of its child nodes; the leaf node stores the MBR of the smallest unit and the corresponding semantic graph.

[0012] Therefore, by matching the path with the MBR recorded in the node in the R-tree, the trajectory can be quickly determined. The corresponding path node set.

[0013] Furthermore, in step 2.1, the random hierarchical sampling mechanism SHS is used to obtain a node information of one of the levels in a way that satisfies LDP, and to perform local area constraints for the perturbation of the trajectory; Given a user trajectory , the MBR of this trajectory is , traverse Get contains A collection of nodes , express According to the level. It can be seen that the area represented by the nodes of the hierarchical structure gradually decreases from top to bottom, and the availability of the perturbation trajectory within the constraint range gradually increases. Therefore, a random hierarchical sampling mechanism is designed, as shown in formula (3), to sample the level close to the leaf node with a high probability. According to It can be seen that the node hierarchy set is .

[0014] (3) in, Indicates that through the random hierarchical sampling mechanism SHS The disturbance output is The probability of represents the privacy budget consumed by the random hierarchical sampling mechanism SHS; Indicates the Layer and L1 distance between layers; Indicates the maximum sensitivity, that is, any two levels are The maximum difference in L1 distance between layers.

[0015] Furthermore, in step 2.2, the perturbation mechanism MFP of multi-feature fusion is used to obtain the perturbation trajectory in the constrained area in a way that satisfies LDP.

[0016] If the node output by the SHS mechanism is , the design of its perturbation mechanism mainly considers the subgraph The problem is how to reasonably measure the differences between trajectories, and how to output perturbation trajectories with a high degree of similarity to the true trajectory with high probability.

[0017] Based on the Fréchet distance, a comprehensive trajectory difference metric is constructed by combining the edge weight information of the semantic graph and the morphological characteristics of the trajectory itself, which provides a more accurate and reliable basis for the analysis of trajectory differences.

[0018] according to The trajectory can be mapped into a sequence of path nodes on the semantic graph. Given two trajectories and , , ,but and The difference in trajectory between As shown in formula (4): (4) in, and is an adjustable parameter to flexibly control the Fréchet distance based on edge weights and morphological differences The proportion of effects on trajectory differences. and As shown in formulas (5) and (6): (5) in, and It is a function with monotonically increasing properties and path constraints; represents the normalized edge weight, as shown in formula (2). Represents trajectory and The maximum distance of the optimal match under the constraints of the semantic weighted graph, , the smaller the value, the smaller the difference between the two trajectories.

[0019] (6) in, . Represents trajectory and The absolute value of the morphological difference, , the smaller the value, the smaller the difference between the two trajectories.

[0020] Then, combined with the trajectory similarity metric, we can see that In the candidate trajectory and the true trajectory The difference is , Represents a set of candidate trajectories The number of candidate trajectories in , and The higher the difference, The larger the value of Based on this, a perturbation mechanism is designed to output a trajectory with a high degree of similarity to the true trajectory with a high probability. The probability setting is shown in formula (7): (7) in, represents the privacy budget consumed by the perturbation mechanism MFP of multi-feature fusion; express The complementary function of and The value of and The sensitivity increases with the increase of similarity .

[0021] In summary, given the true trajectory , the disturbance trajectory can be obtained by formula (3) and formula (7).

[0022] Furthermore, the present invention also includes privacy and availability analysis; wherein privacy is proved based on the concept and properties of LDP, and availability is measured based on the uncertainty of the perturbation mechanism.

[0023] Privacy analysis: First, according to step 2.1, given a user trajectory and privacy budget ,according to The minimum rectangular bounding box and , which can be included A collection of nodes , express The node level set is .make , , according to the definition of LDP and the perturbation mechanism of formula (3), the following inequality holds:

[0024] in, Represents the output value of the SHS algorithm, and express and The values ​​of all belong to the set And the maximum has a different value.

[0025] Secondly, according to step 2.1, for the trajectory and privacy budget , according to the output of SHS , we can get candidate trajectories And the corresponding trajectory difference set .make , , according to the definition of differential privacy and the perturbation mechanism of formula (7), the following inequality holds:

[0026] in, Represents the output value of the MFP algorithm, and express and The values ​​of all belong to the set And at most one value is different.

[0027] In summary, according to the combination properties of LDP, the perturbation trajectory obtained by the SHS-MFP method Process satisfaction -LDP, , and the HTPS method satisfies -LDP.

[0028] Usability analysis: based on user trajectory and privacy budget ,according to The minimum rectangular bounding box and , which can be included A collection of nodes , let the SHS mechanism take the first The probability of the layer is recorded as , and then we can get the randomly sampled hierarchical area , first calculate in the subgraph The error of the perturbation trajectory is obtained through the MFP mechanism.

[0029] According to user trajectory and privacy budget According to the maximum likelihood principle, we can know that The output disturbance trajectory is The probability estimator for:

[0030] in, for arrive According to formula (7), the observation probability of , .

[0031] Then we get the estimated The error:

[0032]

[0033] in, Indicates the j Subgraph of layer The number of candidate trajectories in is positively correlated with the level of the hierarchy, that is, the higher the level, The bigger.

[0034] Therefore, combined with formula (3), the sampling probability of the SHS mechanism can be obtained and the error of the estimator of the MFP mechanism , the overall error of the HTPS method can be obtained as follows:

[0035]

[0036]

[0037] in, , express The number of levels, Indicates in Layer subgraph The number of candidate trajectories within .

[0038] Therefore, according to Taylor expansion, the upper bound of the error is further obtained as , that is, the error and privacy budget of the HTPS method Related to the number of candidate trajectories.

[0039] In a second aspect, the present invention further provides a privacy protection system for hierarchical sampling trajectories integrating semantic information, comprising the following modules: The semantically enhanced hierarchical modeling module is used to model public data using the semantically enhanced hierarchical modeling method, specifically including: The semantic weighted graph construction submodule is used to convert the road network into a semantic weighted graph based on public data to accurately describe the real road characteristics; The hierarchical index structure construction submodule is used to construct a semantic graph with a hierarchical index structure and determine the corresponding path node set between the trajectory and the semantic graph; The data perturbation module is used to perturb the user's trajectory data based on the modeling structure using a perturbation method that combines random hierarchical sampling and multi-feature fusion. Specifically, it includes: The random hierarchical sampling submodule is used to obtain the node information of one layer in a way that satisfies differential privacy by using the random hierarchical sampling mechanism, and to perform local area constraints on trajectory disturbances. The multi-feature fusion perturbation submodule is used to obtain the perturbation trajectory in a constrained area in a way that satisfies differential privacy using the perturbation mechanism of multi-feature fusion.

[0040] Compared with existing localized trajectory privacy protection technologies based on differential privacy, the advantages of the present invention are as follows: while achieving trajectory privacy protection, it systematically organizes and models semantic information to ensure that the perturbed trajectory has good usability and computational efficiency. That is, while ensuring the privacy and usability of trajectory data, it reduces the computational cost, making it more advantageous in large-scale trajectory data processing and real-time applications. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1 It is a general schematic diagram of the privacy protection method of hierarchical sampling trajectory by integrating semantic information implemented in the present invention.

[0042] Figure 2 Schematic diagram of the semantically enhanced hierarchical modeling method implemented in the present invention.

[0043] Figure 3 It is a schematic diagram of the perturbation mechanism for implementing multi-feature fusion in the present invention.

[0044] Figure 4 2 is a comparative experimental result diagram of an embodiment of the present invention. DETAILED DESCRIPTION

[0045] To further clarify the technical solutions, advantages, and objectives of this invention, the following detailed description of the embodiments of the present invention is provided in conjunction with the accompanying figures. Since this invention addresses the issue of balancing trajectory data sharing and user privacy, the server constructs a semantically enhanced hierarchical model structure and shares it with the user. The user then perturbs their trajectory data based on this structure and sends the perturbed trajectory to the server.

[0046] like Figure 1 As shown, the present invention provides a privacy protection method for hierarchical sampling trajectories integrating semantic information, comprising the following steps: Step 1: Model the public data using the semantically enhanced hierarchical modeling method SEHM; In step 1.1, based on public map data, we define graph node and edge weights and transform the actual road network into a weighted graph with rich semantics to accurately describe the real road characteristics.

[0047] First, the graph nodes are determined based on key elements in the road network, such as intersections and points of interest, to ensure that the nodes can cover the location information and corresponding semantic information of the starting and ending points of the trajectory. Secondly, since the existing method of calculating edge weights mainly uses the spatiotemporal distance between nodes as the actual distance, it ignores the connectivity and accessibility in the actual road, thus affecting the accuracy of the semantic graph. Therefore, considering the geometric distance between nodes, road direction, speed limit and other factors, the edge weights are reasonably defined so that the distance between location points is more in line with actual needs. Node and The weight between them is shown in formula (1): (1) in, Indicates the coefficient of the influencing factor, balancing the relative importance of each factor in the weight calculation, ; Represents the geometric distance between nodes; Indicates the directional reachability between nodes, is the direction coefficient of the node, if the node to One-way reachable, then and ; Indicates the shortest time between nodes, The speed limit for the road section.

[0048] In addition, in the process of edge weight calculation, the inconsistent dimensions of influencing factors such as geometric distance, directionality, and speed limit may cause some indicators to have too great an impact on the results, thereby affecting the accuracy of the semantic graph structure in describing the road network. Therefore, the calculation method of edge weight is further normalized, as shown in formula (2): (2) in, Indicates a point to The normalized set distance of Represents any two adjacent points on the graph and The maximum geometric distance between and All belong to the vertex set of the graph, that is ; represents the normalized directional reachability, express and The maximum directional distance between them; represents the normalized shortest reachable time, express and The shortest achievable time between them.

[0049] Through the above weight definitions, the real road network can be modeled as a semantically weighted graph to accurately express the complexity and diversity of the road network.

[0050] Step 1.2, build a hierarchical index structure of the graph; Given a partition threshold , using the hierarchical structure of the R-tree to partition the semantic graph spatially and construct a semantic graph with a hierarchical index structure The information stored in each node mainly includes the minimum bounding rectangle (MBR) and the corresponding subgraph , Represents the hierarchical index of the tree. Figure 2 As shown, the R-tree can effectively divide the graph into multiple manageable areas, where the root node stores the entire public map. MBR, corresponding semantic graph , and its child nodes The MBR of the intermediate node stores the local MBR, the corresponding semantic graph, and the MBR of its child node; the leaf node stores the MBR of the smallest unit and the corresponding semantic graph. For example, the second layer The MBR of the first node is , the corresponding semantic subgraph Mainly by the node A weighted directed graph composed of Representation node and The edge weights between Indicates the The attribute information of each node, such as semantic labels, point of interest types, administrative division information, etc.

[0051] Therefore, by matching the path with the MBR recorded in the node in the R-tree, the trajectory can be quickly determined. The corresponding path node set.

[0052] Step 2: Based on the modeling structure, the user's trajectory data is perturbed using the perturbation method SHS-MFP, which combines random hierarchical sampling with multi-feature fusion. Step 2.1, use the random hierarchical sampling mechanism SHS to obtain a node information of one level in a way that satisfies LDP, and perform local area constraints for the trajectory perturbation; Given a user trajectory , the MBR of this trajectory is , traverse Get contains A collection of nodes , express According to the level. It can be seen that the area represented by the nodes of the hierarchical structure gradually decreases from top to bottom, and the availability of the perturbation trajectory within the constraint range gradually increases. Therefore, a random hierarchical sampling mechanism is designed, as shown in formula (3), which samples the layers close to the leaf nodes with a high probability and outputs the layers close to the root nodes with a lower probability. According to It can be seen that the node hierarchy set is , Indicates the number of tree structure levels.

[0053] (3) in, Indicates that the SHS mechanism will The disturbance output is probability; represents the privacy budget consumed by the random hierarchical sampling mechanism SHS; Indicates the Layer and L1 distance between layers; Indicates the maximum sensitivity, that is, any two levels (such as and ) respectively with The maximum difference in L1 distance between layers.

[0054] In step 2.2, the perturbation trajectory is obtained in the constrained area by using the multi-feature fusion perturbation mechanism MFP in a way that satisfies LDP (Local Differential Privacy, LDP for short).

[0055] If the node output by the SHS mechanism is , the design of its perturbation mechanism mainly considers the subgraph The problem is how to reasonably measure the differences between trajectories, and how to output perturbation trajectories with a high degree of similarity to the true trajectory with high probability.

[0056] Because existing trajectory difference calculations rely solely on spatiotemporal distances and ignore the topological structure, semantic features, and morphological characteristics of the semantic graph, they fail to systematically and comprehensively represent the true differences between trajectories. The Fréchet distance, which accounts for trajectory dependencies and continuity constraints, is commonly used to measure the similarity between two trajectories. Based on this, we propose a comprehensive trajectory difference metric based on the Fréchet distance, combining edge weight information from the semantic graph with the morphological features of the trajectories themselves. This provides a more accurate and reliable basis for trajectory difference analysis.

[0057] according to The trajectory can be mapped into a sequence of path nodes on the semantic graph. Given two trajectories and , , , and Represents the trajectory and The number of location points included, then and The difference in trajectory between As shown in formula (4): (4) in, and is an adjustable parameter to flexibly control the Fréchet distance based on edge weights and morphological differences The proportion of effects on trajectory differences. and As shown in formulas (5) and (6): (5) in, and is a function with monotonically increasing and path constraints, and its forms are and ,Right now , and ,also, For monotone matching path, from the trajectory and From the starting point to the end point of the trajectory Forming a monotone matching path; represents the normalized edge weight, as shown in formula (2). Represents trajectory and The maximum distance of the optimal match under the constraints of the semantic weighted graph, , the smaller the value, the smaller the difference between the two trajectories.

[0058] (6) in, It is a commonly used road shape calculation method in geographic information systems, which mainly includes the length coefficient and angle coefficient of the trajectory. Represents trajectory and The absolute value of the morphological difference, , the smaller the value, the smaller the difference between the two trajectories.

[0059] Then, combined with the trajectory similarity metric, we can see that In the candidate trajectory set and the true trajectory The difference is , Represents a set of candidate trajectories The number of candidate trajectories in , and The higher the difference, The larger the value of Based on this, a perturbation mechanism is designed to output a trajectory with a high degree of similarity to the true trajectory with a high probability. The probability setting is shown in formula (7): (7) in, represents the privacy budget consumed by the perturbation mechanism MFP of multi-feature fusion; express The complementary function of and The value of and The sensitivity increases with the increase of similarity .

[0060] In addition, in extreme cases, the number of position points of the candidate trajectory and the real trajectory may differ greatly, which makes the process of constructing the candidate trajectory set time-consuming. Therefore, in the experiment, the number of position points is selected between The candidate trajectories between , in order to calculate the output probability of their perturbation trajectories. Figure 3 As shown, given , the number of position points of its candidate trajectory ranges from , then respectively , , The probability output perturbation trajectory of , , and , and the candidate trajectory Although the shape is similar, if the number of position points exceeds the selection range, it will not be output.

[0061] In summary, given the true trajectory , the disturbance trajectory can be obtained by formula (3) and formula (7).

[0062] Steps 1 and 2 are the main implementation methods of this invention. Since the main content of this invention is to design a perturbation mechanism with small perturbation error based on a semantically enhanced hierarchical model and prove its privacy and usability, the privacy and usability of the HTPS method will be analyzed next. Since the perturbation mechanism is mainly involved in the SHS-MFP method in step 2, the privacy and usability of the SHS-MFP method will be analyzed. The privacy of the method is mainly proved based on the concept and properties of LDP, and the usability is mainly measured based on the uncertainty of the perturbation mechanism.

[0063] Privacy analysis: First, according to the definition and properties of LDP, we prove that the SHS-MFP method in step 2 satisfies -LDP, and then prove that the overall HTPS method satisfies ε -LDP.

[0064] First, the definition of LDP is: Assume that u and For the same value range Any two different data, given a random algorithm , For the output domain, if exist u and The probability of any identical output result on satisfies the following inequality, then A satisfy -LDP.

[0065] (8) in, Budget for privacy and , controls the degree of privacy protection. The smaller the value of this parameter, the higher the degree of privacy protection.

[0066] The properties of LDP are: combination property and post-processing property. Among them, the combination property is: if there is satisfy LDP Algorithm ,but The sequence combination on a given dataset satisfies -LDP, ; The post-processing property is: given a data set and any one that satisfies -LDP algorithm , for any algorithm , Does not necessarily satisfy LDP, then there is satisfy -LDP. The main way to implement LDP is by adding ε Related noise mechanisms.

[0067] First, according to step 2.1, given a user trajectory and privacy budget ,according to The minimum rectangular bounding box and , which can be included A collection of nodes , express The node level set is .make , , according to the definition of LDP and the perturbation mechanism of formula (3), the following inequality holds: (9) in, Represents the output value of the SHS algorithm, and express and The values ​​of all belong to the set And the maximum has a different value.

[0068] Secondly, according to step 2.1, for the trajectory and privacy budget , according to the output of SHS , we can get candidate trajectories And the corresponding trajectory difference set .make , , according to the definition of LDP and the perturbation mechanism of formula (7), the following inequality holds: (10) in, Represents the output value of the MFP algorithm, and express and The values ​​of all belong to the set And at most one value is different.

[0069] In summary, according to the combination properties of LDP, the perturbation trajectory obtained by the SHS-MFP method Process satisfaction -LDP, , and the HTPS method satisfies -LDP.

[0070] Usability analysis: First, prove the error of the SHS-MFP method in step 2, and then prove the error of the overall HTPS method. and privacy budget ,according to The minimum rectangular bounding box and , which can be included A collection of nodes , since the area represented by the nodes from top to bottom of the hierarchy gradually decreases, the availability of the perturbation trajectory within the constraint range gradually increases, so that the SHS mechanism adopts the first The probability of the layer is recorded as , according to formula (7):

[0071] (11)

[0072] According to the above probability, the hierarchical area of ​​random sampling can be obtained . Then calculate in the subgraph The error of the perturbation trajectory is obtained through the MFP mechanism.

[0073] According to user trajectory and privacy budget , in the subgraph Calculate disturbance trajectory within the region According to the maximum likelihood principle, we know that The output disturbance trajectory is The probability estimator for: (12) in, for arrive The observation probability of , according to formula (10), , .

[0074] Then we get the estimated The error:

[0075] (13) in, Indicates the j Subgraph of layer The number of candidate trajectories in is positively correlated with the level of the hierarchy, that is, the higher the level, The bigger.

[0076] In summary, the overall error of the HTPS method is as follows:

[0077]

[0078]

[0079] in, , express The number of levels, Indicates in Layer subgraph The number of candidate trajectories within .

[0080] Therefore, according to Taylor expansion, the upper bound of the error is further obtained as , that is, the error and privacy budget of the HTPS method Related to the number of candidate trajectories.

[0081] The above content describes the specific implementation of the present invention. In order to further verify the effectiveness of the method, the Geolife dataset is used to measure the usability and efficiency of the HTPS method. The dataset contains 14,650 GPS tracks of 182 users in a certain place over the past five years. The privacy budget is selected. They are 0.01, 0.1, 1, 5, 10 respectively. , According to the upper bound of the error, the allocation of the privacy budget satisfies When the error is low, then set , The accuracy of HTPS, PLTS, ATP, NGRAM, and Baseline methods is measured using trajectory difference (ATD), query error (QARE), and heatmap statistical distribution (HSD). The efficiency of the methods is measured using the average perturbation time of the trajectory. ATP and Baseline are existing methods that do not consider the semantic information of public data, while PLTS and NGRAM are existing methods that combine public data to design perturbation mechanisms.

[0082] (1) Parameter selection. Fixed privacy budget , randomly select 20% of the trajectories for testing. When changes occur, the trend of the average trajectory difference ATD of HTPS and the algorithm execution efficiency RT is compared. Figure 4 (a) It can be seen that when When it is about 100, the comprehensive average trajectory difference and computational efficiency reach the optimal level, indicating that the threshold achieves a good balance between accuracy and computational overhead.

[0083] (2) Comparison of query error QARE. Fixed ,Change ,Comparison of HTPS and related methods PLTS, ATP, NGRAM, and Basline's QARE, among which, Take 0.01, 0.1, 1, 5, and 10 respectively. Figure 4 (b) It can be seen that with With the increase of , the QARE of all methods shows a downward trend, indicating that the query error is smaller. The QARE of HTPS is lower than that of existing methods, especially in When is relatively small, it indicates that HTPS has higher availability in responding to queries and has better availability in responding to regional queries.

[0084] (3) Heatmap statistical distribution HSD comparison. Fixed , , the HSD of HTPS is compared with that of related methods PLTS, ATP, NGRAM, and Basline, and the local visualization results are shown in Figure 4 (c). The heat map color and count scale show that the HSD of HTPS is close to the real trajectory. The main reason is that the HTPS method only allocates the privacy budget once, and part of it is For random hierarchical sampling, a smaller constrained area can be selected with a higher probability. The perturbation mechanism used to design feature fusion ensures that the perturbed trajectory is similar to the true trajectory in terms of spatial distribution, morphological structure, and topological relationship, thereby reducing the deviation of the overall distribution statistics. Therefore, HTPS has higher practical value in practical application scenarios such as traffic detection and population statistics.

[0085] (4) Efficiency RT comparison. Fixed , , randomly selected 20% of users, and compared the efficiency of HTPS and the methods PLTS and NGRAM that combine public data semantic information, respectively using RT avg , RT lower_bound and RT upper_bound The average execution time, the execution time of the shortest trajectory, and the execution time of the longest trajectory are shown in Table 1. HTPS is significantly lower than both the PLTS and NGRAM methods, demonstrating its high efficiency and reduced computational cost, making it particularly advantageous for large-scale trajectory data processing and real-time applications.

[0086] Table 1 GeoLife dataset (unit: s )

[0087] In another embodiment of the present invention, the present invention further provides a privacy protection system for hierarchical sampling trajectories integrating semantic information, including the following modules: The semantically enhanced hierarchical modeling module is used to model public data using the semantically enhanced hierarchical modeling method, specifically including: The semantic weighted graph construction submodule is used to convert the road network into a semantic weighted graph based on public data to accurately describe the real road characteristics; The hierarchical index structure construction submodule is used to construct a semantic graph with a hierarchical index structure and determine the corresponding path node set between the trajectory and the semantic graph; The data perturbation module is used to perturb the user's trajectory data based on the modeling structure using a perturbation method that combines random hierarchical sampling and multi-feature fusion. Specifically, it includes: The random hierarchical sampling submodule is used to obtain the node information of one layer in a way that satisfies differential privacy by using the random hierarchical sampling mechanism, and to perform local area constraints on trajectory disturbances. The multi-feature fusion perturbation submodule is used to obtain the perturbation trajectory in a constrained area in a way that satisfies differential privacy using the perturbation mechanism of multi-feature fusion.

[0088] The specific implementation method of each module is the same as that of each step and will not be described in detail in the embodiment of the present invention.

[0089] The specific embodiments described herein are merely illustrative of the spirit of the present invention. Persons skilled in the art may make various modifications, additions, or substitutions to the described specific embodiments without departing from the spirit of the present invention or exceeding the scope of the appended claims.

Claims

1. A privacy protection method for hierarchical sampling trajectories integrating semantic information, characterized by: The following steps are involved: Step 1: Model the public data using a semantically enhanced hierarchical modeling approach, specifically including: Step 1.

1. Based on publicly available data, convert the road network into a semantically weighted graph to accurately describe real-world road characteristics. Step 1.

2. Construct a semantic graph with a hierarchical index structure and determine the corresponding path node set between the trajectory and the semantic graph; Step 2: Based on the modeling structure, the user's trajectory data is perturbed using a perturbation method that combines random hierarchical sampling with multi-feature fusion. Specifically, the method includes: Step 2.1: Use the random hierarchical sampling mechanism to obtain the node information of one of the layers in a way that satisfies differential privacy, and perform local area constraints on the trajectory disturbance; In step 2.2, the perturbation mechanism of multi-feature fusion is used to obtain the perturbation trajectory in the constrained area in a way that satisfies differential privacy.

2. The privacy protection method for hierarchical sampling trajectories integrating semantic information according to claim 1, characterized in that: In step 1.1, we first determine the graph nodes based on the key elements of the road network, including intersections and points of interest, to ensure that the nodes can cover the location information and corresponding semantic information of the starting and ending points of the trajectory; secondly, we comprehensively consider the geometric distance between nodes, road direction, speed limit factors, and reasonably define the edge weights, thereby converting the road network into a semantic weighted graph. and The weight between them is shown in formula (1): （1） in, Indicates the coefficient of the influencing factor, balancing the relative importance of each factor in the weight calculation, ; Represents the geometric distance between nodes; Indicates the directional reachability between nodes, is the direction coefficient of the node, if the node to One-way reachable, then and ; Indicates the shortest time between nodes, The speed limit for the road section.

3. The privacy protection method for hierarchical sampling trajectories integrating semantic information according to claim 2, characterized in that: In the edge weight calculation process, the edge weight calculation method is further normalized, as shown in formula (2): （2） in, Indicates a point to The normalized set distance of Represents any two adjacent points on the graph and The maximum geometric distance between and All belong to the vertex set of the graph, that is ; represents the normalized directional reachability, express and The maximum directional distance between them; represents the normalized shortest reachable time, express and The shortest achievable time between them.

4. The privacy protection method for hierarchical sampling trajectories integrating semantic information according to claim 1, characterized in that: The specific implementation of step 1.2 is as follows: Given a partition threshold , using the hierarchical structure of the R-tree to partition the semantic weighted graph space and construct a semantic graph with a hierarchical index structure , the information stored in each node includes the minimum rectangular boundary and the corresponding subgraph , Represents a hierarchical index of a tree; the root node stores the entire public map The minimum rectangular boundary of the node, the corresponding semantic graph, and the minimum rectangular boundary of its child nodes; the intermediate node stores the local minimum rectangular boundary, the corresponding semantic graph, and the minimum rectangular boundary of its child nodes; the leaf node stores the minimum rectangular boundary of the smallest unit and the corresponding semantic graph; by matching the path with the minimum rectangular boundary recorded by the node in the R tree, the trajectory is quickly determined to be The corresponding path node set.

5. The privacy protection method for hierarchical sampling trajectories integrating semantic information according to claim 1, characterized in that: Step 2.1 is implemented as follows: Given a user trajectory , the minimum rectangular boundary of the trajectory is , traverse Get contains A collection of nodes , express Design a random level sampling mechanism, as shown in formula (3), to sample the level close to the leaf node with a high probability, according to It can be seen that the node hierarchy set is , Indicates the number of tree structure layers; （3） in, Indicates that through the random hierarchical sampling mechanism SHS The disturbance output is probability; represents the privacy budget consumed by the random hierarchical sampling mechanism SHS; Indicates the Layer and L1 distance between layers; Indicates the maximum sensitivity, that is, any two levels are The maximum difference in L1 distance between layers.

6. The privacy protection method for hierarchical sampling trajectories integrating semantic information according to claim 5, characterized in that: The specific implementation of step 2.2 is as follows: If the node output by the random hierarchical sampling mechanism SHS is ,according to The trajectory can be mapped into a sequence of path nodes on the semantic graph. Given two trajectories and , , and Represents the trajectory and The number of location points included, ,calculate and The difference in trajectories between Then, combined with the trajectory similarity metric, we can see that In the candidate trajectory and the true trajectory The difference is , Represents a set of candidate trajectories The number of candidate trajectories in , and The higher the difference, The larger the value of Based on this, a perturbation mechanism is designed to output a trajectory with a high degree of similarity to the true trajectory with a high probability. The probability setting is shown in formula (7): （7） in, represents the privacy budget consumed by the perturbation mechanism MFP of multi-feature fusion; express The complementary function of and The value of and The sensitivity increases with the increase of similarity ; Therefore, given the true trajectory , the disturbance trajectory can be obtained by formula (3) and formula (7).

7. The privacy protection method for hierarchical sampling trajectories integrating semantic information according to claim 6, characterized in that: Trajectory and The difference in trajectory between As shown in formula (4): （4） in, and is an adjustable parameter to flexibly control the Fréchet distance based on edge weights and morphological differences The proportion of effects on trajectory differences.

8. The privacy protection method for hierarchical sampling trajectories integrating semantic information according to claim 7, characterized in that: and The calculation of is shown in formulas (5) and (6): （5） in, and It is a function with monotonically increasing properties and path constraints; represents the normalized edge weight; Represents trajectory and The maximum distance of the optimal match under the constraints of the semantic weighted graph, , the smaller its value is, the smaller the difference between the two trajectories is; （6） in, ; Represents trajectory and The absolute value of the morphological difference, , the smaller the value, the smaller the difference between the two trajectories.

9. The privacy protection method for hierarchical sampling trajectories integrating semantic information according to claim 1, characterized in that: It also includes privacy and availability analysis; privacy is proved based on the concepts and properties of LDP, and availability is measured based on the uncertainty of the perturbation mechanism.

10. A privacy protection method system for hierarchical sampling trajectories integrating semantic information, characterized in that: Includes the following modules: The semantically enhanced hierarchical modeling module is used to model public data using the semantically enhanced hierarchical modeling method, specifically including: The semantic weighted graph construction submodule is used to convert the road network into a semantic weighted graph based on public data to accurately describe the real road characteristics; The hierarchical index structure construction submodule is used to construct a semantic graph with a hierarchical index structure and determine the corresponding path node set between the trajectory and the semantic graph; The data perturbation module is used to perturb the user's trajectory data based on the modeling structure using a perturbation method that combines random hierarchical sampling and multi-feature fusion. Specifically, it includes: The random hierarchical sampling submodule is used to obtain the node information of one layer in a way that satisfies differential privacy by using the random hierarchical sampling mechanism, and to perform local area constraints on trajectory disturbances. The multi-feature fusion perturbation submodule is used to obtain the perturbation trajectory in a constrained area in a way that satisfies differential privacy using the perturbation mechanism of multi-feature fusion.

Images