Trajectory data privacy publishing method and device, computer device, and storage medium

Abstract

The application discloses a trajectory data privacy publishing method and device, computer equipment and a storage medium, the method comprising: obtaining an original trajectory data set, and performing random sampling on the original trajectory data set to obtain a sampled trajectory data set; obtaining a trajectory space range corresponding to the sampled trajectory data set, and dividing the trajectory space range into a plurality of space regions; grouping each trajectory data in the sampled trajectory data set to obtain an aggregated trajectory data group; performing path classification on the sampled trajectory data set to obtain a path initial clustering group; and applying an exponential DP mechanism to data cleaning on the path initial clustering group to obtain a path target data group. The application can alleviate the utility loss of key semantic information caused by unified processing of the whole trajectory by decomposing the trajectory into a start point-end point pair and a path, and respectively using k-anonymization based on random sampling and the exponential DP mechanism for differential processing, thereby improving the privacy publishing effect of the trajectory data.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and in particular to a method, apparatus, computer equipment, and storage medium for the privacy-preserving publication of trajectory data. Background Technology

[0002] With the acceleration of urbanization and the widespread application of digital technologies, the digital cockpit of the city brain, as an important tool for urban management and decision-making, is gradually becoming a core component of smart city construction. The digital cockpit of the city brain is a core tool for smart city construction. By integrating and analyzing massive amounts of urban data, including traffic flow, population movement, and environmental monitoring, it provides real-time and comprehensive decision support for city managers to optimize urban resource allocation and improve urban operational efficiency.

[0003] Trajectory data, as an important spatiotemporal data type, records the movement paths of various objects (people, vehicles, etc.) in a city's geographic space, containing rich information (such as traffic flow and population activity patterns). It is a key data source for the digital cockpit of the city's smart city and has extremely important value for fields such as traffic management and urban planning. However, trajectory data contains precise personal location information, and the leakage of this information (such as residential address, workplace, and travel habits) could pose potential security risks to individuals. Therefore, when processing and publishing trajectory data, it is necessary to ensure that the data's utility meets the needs of urban management and analysis while protecting personal privacy. This has become an urgent problem to be solved in the current digital transformation of cities.

[0004] In the field of trajectory privacy publishing, privacy issues have received considerable attention. The main approach of existing research is to discretize the trajectory into location points and then protect the privacy of these points. Related methods can be broadly categorized into two types:

[0005] (a) Positional generalization based on syntactic anonymity

[0006] Location generalization methods reduce the risk of privacy leaks by replacing fine-grained, precise coordinates with coarse-grained regions. Trajectory k-anonymity protects privacy by removing specific portions of a trajectory, making each trajectory indistinguishable from the trajectories of at least K-1 other individuals. L-diversity and t-closeness further extend trajectory k-anonymity by maintaining data diversity to protect sensitive information. Specific methods such as NWA, W4M, and GLOVE achieve trajectory anonymization through different technical means.

[0007] (ii) Perturbation method based on differential privacy (DP)

[0008] Differential privacy is a privacy protection technique that adds random noise to data to ensure the privacy of individual data records while maintaining the overall statistical properties of the data. Perturbation methods, which add random noise to trajectory data to ensure privacy, have rigorous mathematical support. Perturbation methods protect the privacy of trajectory data from two main perspectives: first, by individually perturbing the location points; and second, by processing the entire trajectory as a whole. Specifically:

[0009] (1) Individually Disturbed Location Points: Some scholars have proposed the concept of GeoInd, extending the concept of DP to spatial distance metrics to protect the privacy of individual location points. Currently, there are several specially designed DP mechanisms that can achieve GeoInd by adding noise to the location;

[0010] (2) Holistic Trajectory Processing: Trajectories can also be viewed as a whole, such as spatial distribution, tree models, or sequence models. For example, trajectory records can be aggregated into regions and generated for publication through DP perturbation and post-sampling. Tree models and sequence models can also perform trajectory feature extraction in DP-based trajectory publishing and support progressive data processing. The hierarchical DP framework achieves overall DP compliance by processing and progressively transforming trajectory data in layers and ensuring that each step meets DP requirements.

[0011] Furthermore, deep learning models are also used for trajectory data publishing. By learning features of the trajectory dataset, such as spatial distribution and shape, these models can generate trajectories similar to real data. Subsequently, differential privacy protection is achieved by injecting random noise using dynamic programming (DP) techniques during the synthesis process.

[0012] Existing privacy-preserving solutions treat each trajectory as a whole, applying the same privacy processing methods to all parts of the trajectory. However, the diverse analytical needs of digital cockpits bring different privacy and utility requirements to different parts of the trajectory. Therefore, a single privacy data processing method cannot simultaneously support multiple differentiated privacy and utility requirements, and thus cannot fully support the diverse analytical needs of digital cockpits.

[0013] Currently, some automated models rely on either strict assumptions or simple optimization metrics when determining privacy processing schemes. However, in practice, users tend to adjust privacy processing schemes themselves to maximize data utility while meeting basic privacy protection requirements.

[0014] Existing interactive privacy publishing methods primarily target less complex scenarios (such as publishing tabular data), focusing only on demonstrating the data changes resulting from privacy processing to the publisher. Therefore, they cannot effectively support data privacy and utility analysis in complex urban environments, nor can they effectively support adjustments to privacy schemes. For example, GraphProtector allows users to assign utility rules to graph nodes and evaluate results based on these rules. DPVisCreator guides visualization authors to select data patterns based on desired utility and reflects these patterns in the published visualization through Bayesian networks. Other research focuses on demonstrating the degree of data utility preservation to aid privacy protection processes. Generally, quantitative methods provide users with intuitive insights into utility changes. Users can leverage their understanding of data utility to evaluate schemes and adjust parameters interactively. Furthermore, PSI (Ψ) can display the absolute and correlated losses between the original and transformed data, helping users adjust their privacy budget allocation. ViP utilizes uncertainty visualization to depict the relationship between privacy and utility.

[0015] In summary, the existing technology mainly has the following problems:

[0016] (1) Ignoring semantic information: Existing trajectory privacy publishing technologies treat the trajectory as a whole and adopt a uniform processing method. However, different parts of the trajectory contain different semantic information, and the data utility requirements for each part of the trajectory are different in different application scenarios. For example, in regional functional analysis, the focus is mainly on the distribution of the trajectory's starting and ending points; while in traffic flow analysis, accurate path distribution information is required. This one-size-fits-all approach cannot meet multiple analysis needs at the same time;

[0017] (2) Lack of Geographic Context: Existing interactive privacy publishing technologies are mainly designed for general data formats and lack consideration for displaying geographic context information. Trajectory data records an individual's movement in geographic space, and the geographic information of each location (such as city or rural areas) has an important impact on the utility and privacy protection of the data. Incorporating geographic context information into the published data allows users to associate the trajectory with geographic features, thereby improving the usability of the data. However, existing interactive privacy publishing technologies lack this consideration and cannot effectively demonstrate the interaction between trajectory privacy processing mechanisms and the geographic environment, limiting users' understanding of the privacy protection effect;

[0018] (3) Lack of interpretability: There are often complex relationships between the input parameters and output results of privacy-preserving models. Without intermediate information, it is difficult for users to intuitively understand the specific impact of adjusting input parameters on the output results. However, existing interactive privacy publishing technologies mainly focus on showing users the impact of different privacy protection methods on the final output data, failing to provide intermediate information on data processing. This lack of information makes it difficult for users to understand the relationship between changes in model input and changes in model output, and cannot provide effective assistance for users to evaluate and adjust privacy protection methods. Summary of the Invention

[0019] This invention provides a method, apparatus, computer device, and storage medium for privacy-based publication of trajectory data, aiming to improve the privacy-based publication effect of trajectory data.

[0020] In a first aspect, embodiments of the present invention provide a method for privacy-preserving the publication of trajectory data, comprising:

[0021] Obtain the original trajectory dataset and randomly sample the original trajectory dataset to obtain the sampled trajectory dataset;

[0022] Obtain the trajectory spatial range corresponding to the sampled trajectory dataset, and divide the trajectory spatial range into multiple spatial regions;

[0023] Based on the spatial region, the trajectory data in the sampled trajectory dataset are grouped to obtain aggregated trajectory data groups;

[0024] Based on the aggregated trajectory data group, the sampled trajectory dataset is classified into paths to obtain the initial path cluster group;

[0025] The initial cluster group of the path is cleaned using the exponential dynamics (DP) mechanism to obtain the target data group of the path.

[0026] The trajectory data is published with privacy in combination with the aggregated trajectory data group and the path target data group.

[0027] Secondly, embodiments of the present invention provide a trajectory data privacy publishing device, comprising:

[0028] The trajectory sampling unit is used to acquire the original trajectory dataset and randomly sample the original trajectory dataset to obtain a sampled trajectory dataset.

[0029] A spatial partitioning unit is used to obtain the trajectory spatial range corresponding to the sampled trajectory dataset and divide the trajectory spatial range into multiple spatial regions.

[0030] The trajectory grouping unit is used to group the trajectory data in the sampled trajectory dataset based on the spatial region to obtain an aggregated trajectory data group;

[0031] The path classification unit is used to classify the sampled trajectory dataset based on the aggregated trajectory data group to obtain an initial path cluster group.

[0032] The data cleaning unit is used to clean the initial cluster group of the path by applying the exponential DP mechanism to obtain the target data group of the path.

[0033] The privacy publishing unit is used to publish trajectory data privacy by combining the aggregated trajectory data group and the path target data group.

[0034] Thirdly, embodiments of the present invention provide a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the trajectory data privacy publishing method as described in the first aspect.

[0035] Fourthly, embodiments of the present invention provide a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the trajectory data privacy publishing method as described in the first aspect.

[0036] This invention provides a method, apparatus, computer device, and storage medium for privacy-based release of trajectory data. The method includes: acquiring an original trajectory dataset and randomly sampling the original dataset to obtain a sampled trajectory dataset; acquiring the spatial range corresponding to the sampled trajectory dataset and dividing the spatial range into multiple spatial regions; grouping the trajectory data in the sampled trajectory dataset based on the spatial regions to obtain an aggregated trajectory data group; classifying the sampled trajectory dataset into paths based on the aggregated trajectory data group to obtain an initial path cluster group; applying an exponential dynamic programming (DP) mechanism to clean the initial path cluster group to obtain a target path data group; and combining the aggregated trajectory data group and the target path data group to perform privacy-based release of trajectory data. The privacy-based release method for trajectory data provided by this invention decomposes the trajectory into origin-endpoint (OD) pairs and paths, and uses k-anonymization based on random sampling and exponential dynamic programming (DP) mechanisms for differentiated processing, effectively mitigating the loss of utility of key semantic information (such as OD distribution, path continuity, and legitimacy) caused by the uniform processing of the entire trajectory in traditional methods, thereby improving the privacy-based release effect of trajectory data. Attached Figure Description

[0037] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0038] Figure 1 A flowchart illustrating a method for privacy-preserving trajectory data publication provided in an embodiment of the present invention;

[0039] Figure 2 A schematic diagram illustrating the principle architecture of a trajectory data privacy publishing method provided in an embodiment of the present invention;

[0040] Figure 3 This is a schematic block diagram of a trajectory data privacy publishing device provided in an embodiment of the present invention. Detailed Implementation

[0041] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0042] It should be understood that, when used in this specification and the appended claims, the terms "comprising" and "including" indicate the presence of the described features, integrals, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or collections thereof.

[0043] It should also be understood that the terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to limit the invention. As used in this specification and the appended claims, the singular forms “a,” “an,” and “the” are intended to include the plural forms unless the context clearly indicates otherwise.

[0044] It should also be further understood that the term "and / or" as used in this specification and the appended claims refers to any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.

[0045] Please see below. Figure 1 The present invention provides a method for privacy-preserving trajectory data publishing, which specifically includes steps S101 to S106.

[0046] Step S101: Obtain the original trajectory dataset and randomly sample the original trajectory dataset to obtain the sampled trajectory dataset;

[0047] Step S102: Obtain the trajectory spatial range corresponding to the sampled trajectory dataset, and divide the trajectory spatial range into multiple spatial regions;

[0048] Step S103: Based on the spatial region, group the trajectory data in the sampled trajectory dataset to obtain an aggregated trajectory data group;

[0049] Step S104: Based on the aggregated trajectory data group, perform path classification on the sampled trajectory dataset to obtain the initial path cluster group;

[0050] Step S105: Apply the exponential DP mechanism to clean the initial cluster group of the path to obtain the target data group of the path;

[0051] Step S106: Combine the aggregated trajectory data group and the path target data group to publish the trajectory data with privacy settings.

[0052] To support the diverse and differentiated privacy and utility needs of the data cockpit, this embodiment treats the trajectory as a combination of origin-endpoint pairs (ODs) and the paths connecting them, processing them separately. Figure 2 First, the original trajectory dataset is randomly sampled to obtain a sampled trajectory dataset. This random sampling provides the necessary conditions for differential privacy protection, and the random sampling process is controlled by the sampling rate β. Next, the spatial range of the sampled trajectory dataset is determined and divided into multiple spatial regions. Based on these spatial regions, the trajectory data in the sampled trajectory dataset is grouped to form aggregated trajectory data groups, achieving origin-destination anonymization (OD Anonymization). Then, the aggregated trajectory data groups are classified into initial path clusters, and an exponential dynamic programming (DP) mechanism is applied to clean the initial path clusters, resulting in path target data groups, achieving path anonymization. Finally, the aggregated trajectory data groups and path target data groups are combined for privacy-preserving trajectory data publication.

[0053] It should be noted that, to support analytical tasks such as flow analysis, the paths published in this embodiment have a set of accurate coordinate locations. Unlike start-end points, specific coordinates are required here, rather than aggregated regions. The compliance requirements of path analysis tasks also drive this embodiment to treat the paths as a noise-sensitive dataset. If this embodiment simply offsets path points to nearby locations, the trajectory might traverse areas that are otherwise impassable, rendering the data utility of the trajectory even less than if it were offset to a more distant location. Therefore, using general noise injection methods is unsuitable for path coordinates. To ensure the legality and completeness of the trajectory data, this embodiment treats the paths as categorized data and has developed corresponding path classification methods.

[0054] The trajectory data privacy publishing method proposed in this embodiment can provide strong support for diverse data analysis in the City Brain data dashboard. Furthermore, the trajectory data privacy publishing method proposed in this embodiment has the following characteristics:

[0055] (1) Layered privacy protection framework. The trajectory is decomposed into origin-end point (OD) pairs and path, and k-anonymity and road network-based exponential dynamic programming (DP) mechanisms are used respectively to achieve... -DP. Its core lies in overcoming the problem of data utility loss caused by traditional methods by decoupling privacy processing methods for different parts of the trajectory. If competitors need to simultaneously meet the analytical needs of multiple scenarios, they will also adopt similar mechanisms; otherwise, they cannot meet differentiated privacy and utility requirements.

[0056] (2) POI-based region segmentation mechanism. This mechanism utilizes POI categories (e.g., residential areas, industrial areas) in the dataset to guide K-means clustering and Voronoi segmentation, avoiding the data leakage risk caused by directly relying on the original trajectory points. Its core lies in solving the heterogeneous fusion problem of POI and trajectory data. If competitors need to balance the utility of region segmentation with privacy protection, they may also adopt similar mechanisms.

[0057] (3) A legal path generation mechanism based on road networks. By combining Hausdorff distance and road network constraints, a legal center path is generated for each path classification, overcoming the illegal trajectory problem caused by traditional noise injection. Its core lies in designing an efficient path micro-cluster extraction algorithm. If competitors need to balance the legality of the center path and the similarity of paths within the group, they also need to perform similar legal center path generation based on road network constraints.

[0058] Furthermore, it should be noted that the trajectory data privacy publishing method provided in this embodiment treats the trajectory as a combination of origin-destination pairs (ODs) and intermediate paths. By extending the hierarchical DP framework, different privacy protection schemes can be applied separately based on the semantic information contained in different parts of the trajectory, thus supporting more flexible and differentiated privacy scheme adjustments. For example, in regional function analysis, this embodiment focuses on the distribution of the trajectory's origin and destination; while in traffic flow analysis, it precisely processes path distribution information. This flexible approach can simultaneously support the analysis needs of different scenarios, avoiding the limitations of the previous one-size-fits-all approach.

[0059] Furthermore, the trajectory data privacy publishing method provided in this embodiment not only focuses on data changes but also integrates the geospatial environment of the trajectory data, enabling users to associate trajectories with geographical features. The system considers geographical information at various locations (e.g., urban and rural areas), thereby improving data usability. By demonstrating the interaction between the trajectory privacy processing mechanism and the geographical environment, users can better understand the effectiveness of the privacy protection mechanism.

[0060] Furthermore, the trajectory data privacy publishing method provided in this embodiment offers users intermediate information about the trajectory data processing, allowing them to adjust their privacy plans based on the intermediate results. It also emphasizes incorporating human knowledge into dynamic and scenario-sensitive publishing processes. Through this mechanism, users can clearly understand the relationship between changes in model output, thereby enabling them to more effectively evaluate and adjust their privacy protection plans.

[0061] In one embodiment, step S102 includes:

[0062] Obtain points of interest for a specified category, and use the K-means algorithm to cluster the coordinates of the points of interest into n clusters;

[0063] Based on the centroid of the cluster, the trajectory space is divided into multiple non-overlapping spatial regions using the Voronoi partitioning method.

[0064] In this embodiment, when dividing the trajectory space into multiple spatial regions, users can use Points of Interest (POIs) of specified categories in a public dataset to divide the spatial range corresponding to the sampled trajectory data into non-overlapping regions based on these POIs. Here, POIs represent the function of a region and are widely used in trajectory analysis and other fields. By dividing regions based on POIs of specific categories (such as restaurants, shopping malls, hospitals, etc.), the location details relevant to the trajectory analysis task can be preserved. Specifically, this embodiment uses the K-means algorithm to cluster the coordinates of POIs into n clusters, and applies the Voronoi diagram partitioning method to delineate the regions at the centroids of the clusters. The Voronoi partitioning method is a geometric partitioning method that divides space into multiple regions, each containing a generating point (e.g., the centroid of a POI cluster), where the distance from all points within the region to this generating point is less than the distance to other generating points. The default number of regions, n, can be obtained by dividing the total area of ​​the range by a predetermined region area. It should be noted that dividing regions based on the original trajectory points can lead to zoning instability, and this privacy risk requires additional privacy budgeting to mitigate. Therefore, this embodiment effectively integrates the heterogeneous information of POI and trajectory data through a region division mechanism based on points of interest (POIs). This preserves key location details for trajectory analysis while avoiding the data leakage risks that may arise from directly relying on the original trajectory points. Furthermore, this embodiment allows users to specify categories of POIs in public datasets according to their actual needs, thereby further enhancing the flexibility and specificity of privacy protection.

[0065] In one embodiment, step S103 includes:

[0066] The sampled trajectory data in the dataset are grouped according to a preset aggregation strategy to obtain the aggregated trajectory data group; wherein, the preset aggregation strategy is that the starting point and the ending point in each aggregated trajectory data group are located in the same spatial region.

[0067] In this embodiment, when grouping trajectories, the trajectory data is divided and aggregated into multiple aggregated trajectory data groups based on the spatial region division results. This ensures that the start and end points of each group of trajectory data are located within the same spatial region, facilitating finer-grained privacy processing in subsequent steps. This approach ensures that the analytical value of the trajectory data is preserved to the maximum extent while protecting privacy. For example, in traffic flow analysis, trajectory data within each spatial region can be independently statistically analyzed, revealing traffic flow patterns and characteristics in different areas. Furthermore, this grouping method helps to more accurately apply differential privacy mechanisms in subsequent steps, achieving a stronger privacy protection effect.

[0068] Furthermore, the method for publishing trajectory data with privacy also includes:

[0069] Obtain the number of trajectories in each of the aggregated trajectory data groups;

[0070] Compare the number of trajectories with a preset number threshold;

[0071] If the number of trajectories is lower than a preset threshold, the corresponding aggregated trajectory data group will be removed.

[0072] In this embodiment, when performing origin-endpoint anonymization, k-anonymization requires filtering high-risk trajectories to avoid privacy leaks. Therefore, by checking the number of trajectories in each group and comparing it to a preset threshold (e.g., k), if a group has fewer than k trajectories, that group will be directly deleted. This avoids the risk of privacy leaks due to an insufficient number of trajectories.

[0073] In one embodiment, step S104 includes:

[0074] The sampled trajectory dataset is classified into paths according to a preset clustering strategy to obtain the initial clustering groups of the paths; wherein, the preset clustering strategy is to group paths that connect the same start-end pair into the same group.

[0075] In this embodiment, when classifying the sampled trajectory dataset to obtain initial path clusters, paths connecting the same origin-destination (OD) pairs are grouped into the same group so that these paths can be further anonymized in subsequent steps. For example, in traffic flow analysis, paths connecting the same origin and destination can be independently statistically analyzed to reveal traffic flow patterns and characteristics on specific paths.

[0076] Furthermore, step S104 also includes:

[0077] A grid search is performed on the sampled trajectory dataset, and the number of clusters is generated based on the results of the grid search;

[0078] Hausdorff distance is used to calculate the path data differences in the sampled trajectory dataset;

[0079] High-density path segments with a density higher than a preset density threshold are extracted from the sampled trajectory dataset, and the high-density path segments are used as micro-clusters. Then, based on road grid constraints, the high-density path segments are spliced ​​into a legal path.

[0080] The legal paths are set as class centroids, and the hierarchical clustering method is used to classify the paths in the sampled trajectory dataset by combining the number of clusters and the differences in path data to obtain the initial path cluster groups.

[0081] This embodiment groups paths connecting the same origin-endpoint (OD) pairs together and then further categorizes these paths. Specifically, to mitigate utility loss caused by categorization, the central path of each category should be similar to all original paths in that category. To control the size of each category and the similarity of data within each category, this embodiment uses hierarchical clustering to extract categories. It is worth noting that this embodiment uses Hausdorff distance (a method for measuring the similarity between two point sets, widely used in path similarity analysis by comparing the shape and position of two point sets) to calculate the data differences between two paths. Simultaneously, it uses a grid search based on cluster silhouette score (an index for evaluating clustering effectiveness, which combines cluster compactness and separation to intuitively reflect the quality of clustering results; higher values ​​indicate better results) to recommend a default number of clusters, ensuring that each cluster forms a path class. Furthermore, in this embodiment, the class center point is determined for each class based on the paths within each class. Specifically, high-density path segments are first extracted as micro-clusters, and then these segments are connected according to a road grid to generate a valid path as the class center point. The number of extracted segments is determined by the average length of the trajectories in the same group; the longer the path, the more segments are extracted.

[0082] In one embodiment, step S105 includes:

[0083] Obtain the Hausdorff distance between each path in the initial cluster group of each path;

[0084] The quality function is set according to the Hausdorf distance, and the maximum difference between different path categories in the initial cluster group of each path is obtained. Then, the maximum difference is set as the sensitivity of the quality function.

[0085] The path target data group is obtained by selecting and classifying each path in the initial cluster group based on the probability ratio sampling method and injecting perturbation.

[0086] In this embodiment, when cleaning categorical data using the Exponential DP Mechanism (a differential privacy technique that injects noise through probability ratio sampling), for a set of paths whose start and end points are in the same region, probability ratio sampling is used to classify each path and inject perturbation. Furthermore, to maintain distributional utility, this embodiment sets the quality function u to the Hausdorff distance between clusters, which reflects the differences between paths, and uses the maximum difference between categories within the same group as the sensitivity of u. In this way, privacy can be protected while preserving the data's distribution characteristics as much as possible, ensuring that the processed data still has high analytical value. These data sets protect user privacy while retaining sufficient trajectory information for subsequent analysis.

[0087] In summary, the trajectory data privacy publishing method provided in this embodiment can bring the following beneficial effects to the construction of data dashboards:

[0088] (1) Layered privacy protection and preservation of differentiated utility. The trajectory data privacy publishing method provided in this embodiment decomposes the trajectory into two parts: origin-end point (OD) pairs and path. It uses k-anonymization based on random sampling and exponential DP mechanism for differentiated processing, which effectively alleviates the utility loss of key semantic information (such as OD distribution, path continuity and legitimacy) caused by the uniform processing of the entire trajectory in traditional methods.

[0089] (2) Improve trajectory legitimacy and data availability. The trajectory data privacy publishing method provided in this embodiment adopts legal path clustering (micro-cluster extraction and connection) based on road network in path anonymization, which avoids illegal trajectories caused by traditional noise injection (such as vehicles crossing train tracks), and solves the problem that traditional methods directly disturb coordinates and easily destroy the continuity of trajectory space;

[0090] (3) Enhance privacy protection and system defense capabilities. The trajectory data privacy publishing method provided in this embodiment combines k-anonymity and differential privacy in sequence, theoretically satisfying ( This approach, using DP, addresses the vulnerability of existing methods to background knowledge attacks and significantly reduces the success rate of such attacks.

[0091] In a practical application scenario, the trajectory data privacy publishing method provided in this embodiment is used to achieve regional logistics demand analysis based on the operation trajectory of delivery vehicles. Specifically:

[0092] (1) Data preparation

[0093] The original dataset was selected from the courier delivery vehicle trajectory data of a certain city within a certain month. It contains about 1 million trajectory records and records the delivery route of the delivery vehicle, including the starting point (courier station), the destination (customer address), and the coordinates and timestamps of each location point along the way.

[0094] (2) Start-end anonymization

[0095] Random sampling of trajectories: The sampling rate was set to 0.3, and approximately 300,000 trajectories were extracted from the original dataset to introduce uncertainty and provide conditions for achieving differential privacy protection;

[0096] Urban space is divided into approximately 30 non-overlapping spatial regions based on the categories of Points of Interest (POIs) such as "express delivery outlets", "commercial areas", "residential areas", "natural villages", and "resident resettlement areas" labeled in the existing dataset. K-means is used to cluster the coordinates of these POIs, and Voronoi is further applied to the centroid of each cluster to further divide the region.

[0097] Aggregate start and end points: Group each trajectory according to the regions where the start and end points are located;

[0098] Remove high-risk tracks: Set the anonymization parameter to 15, check the number of tracks in each start-end pair, and delete all data in the group if the number is less than 15 to avoid privacy leaks.

[0099] (3) Path anonymization

[0100] The paths are further classified: For each group of trajectories, clustering is used for classification. In this embodiment, a recommended value for the number of clusters is obtained based on grid search, and a center path is generated for each path;

[0101] Generating legitimate center paths: In order to overcome the impact of traditional noise injection methods on path legitimacy, high-density path segments are extracted as micro-clusters, and these segments are connected under the constraints of the road network to form legitimate center paths;

[0102] The classification data is cleaned based on the DP mechanism: the Hausdorff distance is used as the quality function u, and the maximum difference of u between classes in the same group is used as the sensitivity of u. Then, the classification is selected for each path and perturbation is injected according to the probability ratio sampling.

[0103] (4) Analysis task support

[0104] Regional logistics density analysis: By statistically analyzing the number of origin-destination pairs, this analysis identifies logistics density between different regions and pinpoints areas with high logistics demand. For example, a high number of origin or destination pairs in certain commercial or industrial areas indicates frequent logistics activity and a need for more logistics resources.

[0105] Logistics delivery route optimization: By analyzing processed data, and ensuring the legitimacy of the routes, frequently used routes are identified. For example, comparing certain routes with different origins and destinations reveals a high degree of overlap, indicating that these may be efficient delivery routes that can be used to optimize route selection and recommendation.

[0106] Analysis of the temporal distribution of logistics demand: Since the specific timestamps were not processed during privacy handling, the temporal distribution of logistics demand can be roughly inferred based on the time distribution of trajectory data. For example, some areas may have higher logistics demand in the afternoon of the weekday, while the distribution of logistics demand on weekends is more even. This has strong reference value for the dynamic allocation of manpower and equipment in the logistics industry.

[0107] In another practical application scenario, the trajectory data privacy publishing method provided in this embodiment is used to analyze residents' short-distance transportation demand based on the operating trajectories of shared bicycles. Specifically:

[0108] (1) Data preparation

[0109] The original dataset was selected from the shared bicycle operation trajectory data of a certain city in a certain quarter. It contains more than 5 million trajectory data, recording the riding trajectory of shared bicycles, including the starting point (borrowing point), the ending point (returning point), and the coordinates and timestamps of each point along the way.

[0110] (2) Start-end anonymization

[0111] Random sampling of trajectories: The sampling rate was set to 0.15, and approximately 750,000 trajectories were extracted from the original dataset to introduce uncertainty and provide conditions for differential privacy protection;

[0112] Urban space segmentation: This embodiment divides the city into approximately 20 non-overlapping regions based on the categories of points of interest (POIs) such as “subway station”, “bus station”, “school”, and “park” labeled in the existing dataset. K-means is used to cluster the coordinates of these POIs, and then Voronoi is applied to the centroid of each cluster to further segment the regions.

[0113] Aggregate start and end points: Group each trajectory according to the regions where the start and end points are located;

[0114] Remove high-risk tracks: Set the anonymization parameter to 10, check the number of tracks in each start-end pair, and delete all data in the group if the number is less than 10 to avoid privacy leaks.

[0115] (3) Path anonymization

[0116] Further classification of each path group: For each trajectory group, classification is performed using clustering. A recommended value for the number of clusters is obtained based on grid search, and a center path is generated for each path.

[0117] Generating legitimate center paths: In order to overcome the impact of traditional noise injection methods on path legitimacy, high-density path segments are extracted as micro-clusters, and these segments are connected under the constraints of the road network to form legitimate center paths;

[0118] The classification data is cleaned based on the DP mechanism: the Hausdorff distance is used as the quality function u, and the maximum difference of u between classes in the same group is used as the sensitivity of u. Then, the classification is selected for each path and perturbation is injected according to the probability ratio sampling.

[0119] (4) Analysis task support

[0120] Short-distance transportation demand analysis: By analyzing the distribution of origin and destination points of routes, hotspots of transportation demand can be identified. For example, a high number of origin points near a residential area indicates a strong demand for bicycles in that area; a high number of destination points in an industrial zone indicates a large stock of bicycles in that area. Further analysis of timestamps reveals the distribution of bicycle demand in different areas of the city at different times.

[0121] Vehicle allocation optimization: Based on the distribution of peak usage areas and times, predict the vehicle demand and number of idle vehicles in different areas at different times. For example, during morning and evening rush hours, vehicles can be redeployed from areas with more idle vehicles to areas with high demand, achieving efficient utilization of individual vehicle resources.

[0122] Figure 3 This is a schematic block diagram of a trajectory data privacy publishing device 300 provided in an embodiment of the present invention. The device 300 includes:

[0123] The trajectory sampling unit 301 is used to acquire the original trajectory dataset and randomly sample the original trajectory dataset to obtain a sampled trajectory dataset.

[0124] The spatial partitioning unit 302 is used to obtain the trajectory spatial range corresponding to the sampled trajectory dataset and divide the trajectory spatial range into multiple spatial regions.

[0125] The trajectory grouping unit 303 is used to group the trajectory data in the sampled trajectory dataset based on the spatial region to obtain an aggregated trajectory data group;

[0126] The path classification unit 304 is used to classify the sampled trajectory dataset based on the aggregated trajectory data group to obtain an initial path cluster group.

[0127] Data cleaning unit 305 is used to clean the initial cluster group of the path by applying the exponential DP mechanism to obtain the target data group of the path.

[0128] Privacy publishing unit 306 is used to publish trajectory data privacy by combining the aggregated trajectory data group and the path target data group.

[0129] In one embodiment, the space partitioning unit 302 includes:

[0130] The point of interest acquisition unit is used to acquire points of interest of a specified category and to cluster the coordinates of the points of interest into n clusters using the K-means algorithm;

[0131] The range division unit is used to divide the trajectory space range into multiple non-overlapping spatial regions based on the centroid of the cluster using the Voronoi partitioning method.

[0132] In one embodiment, the trajectory grouping unit 303 includes:

[0133] The strategy grouping unit is used to group the trajectory data in the sampled trajectory dataset according to a preset aggregation strategy to obtain the aggregated trajectory data group; wherein, the preset aggregation strategy is that the starting point and the ending point in each aggregated trajectory data group are located in the same spatial region.

[0134] In one embodiment, the trajectory data privacy publishing device 300 further includes:

[0135] A quantity acquisition unit is used to acquire the number of trajectories in each of the aggregated trajectory data groups;

[0136] A quantity comparison unit is used to compare the number of trajectories with a preset quantity threshold.

[0137] The data elimination unit is used to eliminate the corresponding aggregated trajectory data group if the number of trajectories is lower than a preset number threshold.

[0138] In one embodiment, the path classification unit 304 includes:

[0139] The strategy classification unit is used to classify the sampled trajectory dataset into paths according to a preset clustering strategy to obtain the initial clustering groups of the paths; wherein, the preset clustering strategy is to group paths that connect the same start-end pair into the same group.

[0140] In one embodiment, the path classification unit 304 further includes:

[0141] A grid search unit is used to perform a grid search on the sampled trajectory dataset and generate the number of clusters based on the results of the grid search.

[0142] The difference calculation unit is used to calculate the path data differences in the sampled trajectory dataset using Hausdorff distance;

[0143] The segment splicing unit is used to extract high-density path segments with a density higher than a preset density threshold from the sampled trajectory dataset, and to use the high-density path segments as micro-clusters. Then, based on road grid constraints, the high-density path segments are spliced ​​into a legal path.

[0144] A hierarchical clustering unit is used to set the legal paths as class centers and, in combination with the number of clusters and the differences in path data, to classify the paths in the sampled trajectory dataset using a hierarchical clustering method to obtain initial path cluster groups.

[0145] In one embodiment, the data cleaning unit 305 includes:

[0146] The distance acquisition unit is used to acquire the Hausdorf distance between each path in each initial clustering group of the path;

[0147] The function setting unit is used to set a quality function based on the Hausdorff distance, obtain the maximum difference between different path categories in the initial cluster group of each path, and then set the maximum difference as the sensitivity of the quality function.

[0148] The classification perturbation unit is used to select and classify each path in the initial cluster group of the path based on the probability ratio sampling method and inject perturbation to obtain the target data group of the path.

[0149] Since the embodiments of the apparatus and the embodiments of the method correspond to each other, please refer to the description of the embodiments of the method for the embodiments of the apparatus, which will not be repeated here.

[0150] This invention also provides a computer-readable storage medium storing a computer program thereon, which, when executed, can perform the steps provided in the above embodiments. The storage medium may include various media capable of storing program code, such as a USB flash drive, a portable hard drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0151] This invention also provides a computer device, which may include a memory and a processor. The memory stores a computer program, and when the processor calls the computer program in the memory, it can implement the steps provided in the above embodiments. Of course, the computer device may also include various network interfaces, power supplies, and other components.

[0152] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the systems disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the descriptions are relatively simple; relevant parts can be referred to in the method section. It should be noted that those skilled in the art can make various improvements and modifications to this application without departing from the principles of this application, and these improvements and modifications also fall within the protection scope of the claims of this application.

[0153] It should also be noted that, in this specification, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

Claims

1. A method for privacy-preserving the publication of trajectory data, characterized in that, include: Obtain the original trajectory dataset and randomly sample the original trajectory dataset to obtain the sampled trajectory dataset; Obtain the trajectory spatial range corresponding to the sampled trajectory dataset, and divide the trajectory spatial range into multiple spatial regions; Based on the spatial region, the trajectory data in the sampled trajectory dataset are grouped to obtain aggregated trajectory data groups; Based on the aggregated trajectory data group, the sampled trajectory dataset is classified into paths to obtain the initial path cluster group; The initial cluster group of the path is cleaned using the exponential dynamics (DP) mechanism to obtain the target data group of the path. The trajectory data is published with privacy in combination with the aggregated trajectory data group and the path target data group; The step of obtaining the trajectory spatial range corresponding to the sampled trajectory dataset and dividing the trajectory spatial range into multiple spatial regions includes: Obtain points of interest for a specified category, and use the K-means algorithm to cluster the coordinates of the points of interest into n clusters; Based on the centroid of the cluster, the trajectory space range is divided into multiple non-overlapping spatial regions using the Voronoi partitioning method. Based on the spatial region, the trajectory data in the sampled trajectory dataset are grouped to obtain an aggregated trajectory data group, including: The sampled trajectory data in the dataset are grouped according to a preset aggregation strategy to obtain the aggregated trajectory data group; wherein, the preset aggregation strategy is that the starting point and the ending point in each aggregated trajectory data group are located in the same spatial region.

2. The method for publishing trajectory data with privacy according to claim 1, characterized in that, Also includes: Obtain the number of trajectories in each of the aggregated trajectory data groups; Compare the number of trajectories with a preset number threshold; If the number of trajectories is lower than a preset threshold, the corresponding aggregated trajectory data group will be removed.

3. The method for publishing trajectory data with privacy according to claim 1, characterized in that, The step of classifying the sampled trajectory dataset based on the aggregated trajectory data group to obtain an initial path cluster group includes: The sampled trajectory dataset is classified into paths according to a preset clustering strategy to obtain the initial clustering groups of the paths; wherein, the preset clustering strategy is to group paths that connect the same start-end pair into the same group.

4. The method for publishing trajectory data with privacy according to claim 1, characterized in that, The step of classifying the sampled trajectory dataset based on the aggregated trajectory data group to obtain an initial path cluster group further includes: A grid search is performed on the sampled trajectory dataset, and the number of clusters is generated based on the results of the grid search; Hausdorff distance is used to calculate the path data differences in the sampled trajectory dataset; High-density path segments with a density higher than a preset density threshold are extracted from the sampled trajectory dataset, and the high-density path segments are used as micro-clusters. Then, based on road grid constraints, the high-density path segments are spliced ​​into a legal path. The legal paths are set as class centroids, and the hierarchical clustering method is used to classify the paths in the sampled trajectory dataset by combining the number of clusters and the differences in path data to obtain the initial path cluster groups.

5. The method for publishing trajectory data with privacy according to claim 1, characterized in that, The applied index DP mechanism is used to clean the initial cluster group of the path to obtain the target data group of the path, including: Obtain the Hausdorff distance between each path in the initial cluster group of each path; The quality function is set according to the Hausdorf distance, and the maximum difference between different path categories in the initial cluster group of each path is obtained. Then, the maximum difference is set as the sensitivity of the quality function. The path target data group is obtained by selecting and classifying each path in the initial cluster group based on the probability ratio sampling method and injecting perturbation.

6. A trajectory data privacy publishing device, characterized in that, include: The trajectory sampling unit is used to acquire the original trajectory dataset and randomly sample the original trajectory dataset to obtain a sampled trajectory dataset. A spatial partitioning unit is used to obtain the trajectory spatial range corresponding to the sampled trajectory dataset and divide the trajectory spatial range into multiple spatial regions. The trajectory grouping unit is used to group the trajectory data in the sampled trajectory dataset based on the spatial region to obtain an aggregated trajectory data group; The path classification unit is used to classify the sampled trajectory dataset based on the aggregated trajectory data group to obtain an initial path cluster group. The data cleaning unit is used to clean the initial cluster group of the path by applying the exponential DP mechanism to obtain the target data group of the path. A privacy publishing unit is used to publish trajectory data privacy by combining the aggregated trajectory data group and the path target data group; The spatial partitioning unit includes: The point of interest acquisition unit is used to acquire points of interest of a specified category and to cluster the coordinates of the points of interest into n clusters using the K-means algorithm; The range division unit is used to divide the trajectory space range into multiple non-overlapping spatial regions based on the centroid of the cluster using the Voronoi partitioning method. The trajectory grouping unit includes: The strategy grouping unit is used to group the trajectory data in the sampled trajectory dataset according to a preset aggregation strategy to obtain the aggregated trajectory data group; wherein, the preset aggregation strategy is that the starting point and the ending point in each aggregated trajectory data group are located in the same spatial region.

7. A computer device, characterized in that, It includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the trajectory data privacy publishing method as described in any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the trajectory data privacy publishing method as described in any one of claims 1 to 5.

Images