Vehicle trajectory data de-identification method and system based on differential privacy

Abstract

The present application belongs to the technical field of data privacy protection, and particularly relates to a vehicle trajectory data desensitization method and system based on differential privacy, comprising the following steps: obtaining a single vehicle trajectory, mapping the single vehicle trajectory to a geographic grid, determining a passing grid unit and at least one staying grid unit, and extracting a staying coordinate set corresponding to the staying grid unit; determining a centroid coordinate of the staying coordinate set, respectively calculating a spatial dispersion feature and a time offset feature of the staying coordinate set based on the centroid coordinate, combining the obtained historical access feature to generate a multi-dimensional staying feature; and determining the staying grid unit based on the multi-dimensional staying feature to obtain a sensitive class label. The present application accurately distinguishes real sensitive stays from passing areas, solves the privacy budget mismatch problem caused by equal noise addition, and realizes perfect consideration of rigorous protection of high-sensitive data and availability of macro trajectory analysis.

Description

Technical Field

[0001] This invention belongs to the field of data privacy protection technology, specifically relating to a method and system for de-identifying vehicle trajectory data based on differential privacy. Background Technology

[0002] With the rapid development of intelligent transportation and the ride-hailing industry, traffic management departments and travel service platforms have accumulated massive amounts of vehicle satellite positioning trajectory data in their daily operations. This trajectory data contains extremely high macro-statistical value, and regularly releasing anonymized historical trajectory data to third-party traffic analysis agencies has become a crucial step in studying road network congestion patterns, urban public transportation planning, and route optimization modeling. However, during the data release process, the raw trajectory data, containing detailed timestamps and high-precision latitude and longitude coordinates, easily exposes highly sensitive location information such as the driver's or passenger's residence and workplace. Therefore, a reliable data anonymization scheme is urgently needed to perform privacy protection processing on continuous trajectory coordinates before release, meeting the dual application requirements of data security compliance and macro-statistical usability.

[0003] To meet the aforementioned requirements for anonymizing and publishing trajectory data, the most commonly used traditional technique in the industry is coordinate noise addition based on a globally uniform differential privacy mechanism. This approach typically treats the entire vehicle trajectory as a homogeneous data sequence, applying an equal amount of Laplace or Gaussian noise to each location point on the trajectory within a given global privacy budget. In practice, this traditional technique does not distinguish the vehicle's movement state in different geographical areas, directly applying a uniformly set spatial sensitivity scale parameter to perform indiscriminate perturbation on the entire trajectory sequence. This causes the original coordinates to randomly shift within a certain physical range, making it difficult for attackers to directly obtain accurate historical geographic coordinates.

[0004] However, the aforementioned traditional techniques using equal noise injection have significant drawbacks. Because this technique completely ignores the vast difference in privacy leakage risk between areas where vehicles frequently stop and areas where they regularly pass through, it leads to a severe misallocation of privacy budget allocation. On the one hand, indiscriminate equal noise causes redundant interference to low-sensitivity passing points, excessively impairing the overall path continuity and macroscopic statistical availability of the trajectory. On the other hand, for high-sensitivity stopping points with high-frequency access characteristics, this equally allocated protection is extremely weak and insufficient to effectively resist inference attacks by third parties performing density clustering analysis on multiple historical trajectory stopping points. Existing technologies cannot simultaneously address the key defense of high-risk nodes and the data availability of low-risk nodes within the same trajectory; this is precisely the core technical challenge that urgently needs to be solved in this field. Summary of the Invention

[0005] This invention provides a method and system for de-identifying vehicle trajectory data based on differential privacy, in order to solve the technical problem that existing equal noise addition schemes lead to a mismatch in privacy budgets and cannot simultaneously address the key defense of high-risk nodes and the availability of data from low-risk nodes.

[0006] In a first aspect, the present invention provides a method for de-identifying vehicle trajectory data based on differential privacy, comprising the following steps: Obtain a single vehicle trajectory, map the single vehicle trajectory to a geographic grid, determine the passing grid cell and at least one stopping grid cell, and extract the stopping coordinate set corresponding to the stopping grid cell; Determine the centroid coordinates of the dwell coordinate set, calculate the spatial distribution features and temporal offset features of the dwell coordinate set based on the centroid coordinates, and generate multidimensional dwell features by combining the obtained historical access features. Sensitive class labels are obtained by determining the dwell grid cells based on multi-dimensional dwell features; Based on the total global privacy constraints, the stay budget allocation value is calculated for the corresponding stay grid unit according to the sensitive class label, and the transit budget allocation value is calculated for the transit grid unit; Differential privacy noise is injected into the corresponding coordinate points within the dwelling grid cell based on the dwelling budget allocation value, and differential privacy noise is injected into the corresponding coordinate points within the passing grid cell based on the passing budget allocation value, so as to obtain and output the target desensitized trajectory.

[0007] Its effect is that it uses grid mapping and dwell feature extraction to structure the trajectory, evaluates sensitivity based on multi-dimensional dwell features to adaptively allocate the budget, and finally performs differentiated noise addition, which effectively overcomes the privacy budget mismatch caused by equal noise addition and accurately matches the protection strength and actual sensitivity requirements.

[0008] Furthermore, the individual vehicle trajectory is mapped to a geographic grid, determining the passing grid cells and at least one stopping grid cell, and extracting the stopping coordinate set corresponding to the stopping grid cell, including: Assign the latitude and longitude coordinates of a single vehicle trajectory to the corresponding geographic grid; Retrieve a sequence of coordinate points within a single geographic grid whose continuous time span is not less than a first time threshold to obtain candidate dwell segments; In response to two candidate dwell segments satisfying the condition of temporal continuity and the geographical grids to which they belong satisfying the condition of spatial adjacency, the candidate dwell segments are merged to obtain the dwell coordinate set; Geographic grids that have not triggered the merging condition are identified as transit grid cells, and geographic grids that have completed the merging are identified as stationary grid cells.

[0009] Its effect is that by filtering over a continuous time span and merging spatial adjacency conditions, candidate dwell segments and transit units are accurately separated. This eliminates the interference of extremely long trajectories and occasional location drift on the global analysis, and provides a highly standardized and high-confidence underlying data structure for subsequent feature calculation and budget allocation.

[0010] Furthermore, based on the centroid coordinates, the spatial distribution features and temporal offset features of the dwell coordinate set are calculated respectively. Combined with the acquired historical visit features, multi-dimensional dwell features are generated, including: Calculate the first Euclidean distance from each coordinate point in the stationary coordinate set to the centroid coordinates; The variance of all first Euclidean distances is calculated as the dwell displacement variance, and the mean of all first Euclidean distances is calculated as the coordinate dispersion. Spatial dispersion features are constructed using the dwell displacement variance and coordinate dispersion. The coordinate set of the station is divided into a first half and a second half in chronological order. The second Euclidean distance between the local centroids of the first half of the coordinate set and the local centroids of the second half of the coordinate set is calculated as the centroid stability, and the temporal offset feature is constructed using the centroid stability. Spatial distribution features, temporal offset features, and historical visit features are combined to generate multidimensional dwell features.

[0011] Its effect is that, based on the centroid coordinates, the variance and mean of the first Euclidean distance and the second Euclidean distance of the front and rear local centroids are calculated respectively, which comprehensively describes the vehicle motion state from three dimensions: overall dispersion amplitude, extreme value resistance and directional drift, providing complete and complementary data flow support for the determination of sensitive class labels.

[0012] Furthermore, the multidimensional dwell features also include historical visit features, and the method further includes a step for obtaining historical visit features: From the historical trajectory database, count the number of first trajectories in which dwell events occurred within the dwell grid cell and its spatially adjacent grid cells; The total number of second trajectories contained in the historical trajectory database is statistically significant. The ratio of the number of first trajectories to the total number of second trajectories is calculated to obtain the dwell repeatability, and the dwell repeatability is determined as a historical visit feature.

[0013] Furthermore, based on multi-dimensional dwell features, the dwell grid cells are determined to obtain sensitive class labels, including: Compare whether the variance of dwell displacement, coordinate dispersion, and centroid stability are lower than the corresponding preset feature upper bounds; The total number of feature items below the preset upper limit is counted to obtain the real-time judgment score; A second-order judgment logic is constructed based on the real-time judgment score and historical access characteristics to perform sensitivity judgment and obtain sensitive class labels.

[0014] Furthermore, based on the real-time judgment score and historical access characteristics, a second-order judgment logic is constructed to perform sensitivity judgment and obtain sensitive class labels, including: Highly sensitive labels are identified based on the real-time judgment score being no lower than the judgment score threshold and the historical access characteristics being no lower than the repetition threshold. In response to a real-time judgment score that is not lower than the judgment score threshold and a historical access feature that is lower than the repetition threshold, or a real-time judgment score that is lower than the judgment score threshold and a historical access feature that is not lower than the repetition threshold, a sensitive label is identified. In response to a real-time judgment score that is lower than the judgment score threshold and a historical access feature that is lower than the repetition threshold, a low-sensitivity label is identified. The label with the highest sensitivity level under the same single vehicle trajectory will be used as the final sensitivity class label.

[0015] Its effects are as follows: by combining real-time judgment scores with historical access features to construct a second-order logic tree, and by introducing the frequency of historical behavior for cross-correction, it effectively reduces the random error when judging a single trajectory in isolation, and significantly enhances the robustness of identifying real high-sensitivity stopping points and occasional congestion points.

[0016] Furthermore, based on the total global privacy constraints, a stay budget allocation value is calculated for the corresponding stay grid cell according to the sensitive class label, and a transit budget allocation value is calculated for the transit grid cell, including: The total amount of global privacy constraints is allocated according to a preset split ratio to construct a stay budget allocation pool and a transit budget allocation pool; For multiple consecutive passing grid cells, the spatial curvature parameters are calculated, and cells with spatial curvature parameters greater than the curvature threshold are retained to obtain the core passing cells; The toll budget allocation pool is divided equally among all core toll units to obtain the toll budget allocation value; Based on the level ratio of sensitive category tags, the corresponding stay budget allocation value is calculated from the stay budget allocation pool.

[0017] Furthermore, based on the level ratio of sensitive category tags, the corresponding stay budget allocation value is calculated from the stay budget allocation pool, including: Based on the proportion of sensitive category tags at each level in the dwell grid cell, the basic allocation share is calculated from the dwell budget allocation pool; Based on the allocation adjustment operator corresponding to the sensitive class label, a multiplication operation is performed on the basic allocation share to adjust it and obtain the stay budget allocation value; Among them, the higher the sensitivity level of the sensitive class label, the smaller the value of the corresponding allocation adjustment operator, so that the highly sensitive area can obtain a smaller numerical limit.

[0018] Furthermore, after adjusting the basic allocation share by multiplication based on the allocation adjustment operator corresponding to the sensitive class label to obtain the remaining budget allocation value, the process also includes: Calculate the range of all stay budget allocation values, and divide the range by the mean to obtain the budget allocation gradient; In response to the budget allocation gradient falling below the preset lower bound, the allocation adjustment operator corresponding to the highest sensitivity level is adjusted downwards; Repeat the steps of multiplying the basic allocation share and calculating the budget allocation gradient until the budget allocation gradient is not lower than the preset lower bound, and obtain the final stay budget allocation value.

[0019] Its effect is as follows: it constructs a closed-loop monitoring system for budget allocation gradient based on range and mean, and dynamically adjusts the highest sensitivity level adjustment operator when the gradient is below the lower bound, avoiding the failure of differentiated protection caused by multiple rounds of quota scaling, and ensuring the absolute safety bottom line of highly sensitive data under limited global computing power.

[0020] Secondly, the present invention provides a vehicle trajectory data desensitization system based on differential privacy, including a memory and a processor. The memory stores computer program instructions, and when the computer program instructions are executed by the processor, the above-mentioned vehicle trajectory data desensitization method based on differential privacy is implemented.

[0021] The beneficial effects are as follows: This invention extracts a set of dwell coordinates based on geographic grid division and integrates spatial distribution and temporal offset features to construct multi-dimensional dwell features, thereby accurately determining the sensitive category of grid units; then, it dynamically and differentially allocates the global privacy budget according to the sensitive category and applies differential privacy noise of corresponding scale, achieving accurate differentiation between real sensitive dwellings and passive congestion dwellings, enabling high-sensitivity areas to receive stricter protection and low-sensitivity crossing areas to retain higher coordinate accuracy, significantly improving the overall security and macroscopic analysis usability of desensitized trajectories under global privacy constraints. Attached Figure Description

[0022] Figure 1 This is a flowchart of a method for de-identifying vehicle trajectory data based on differential privacy.

[0023] Figure 2 A schematic diagram of the adaptive adjustment process for allocating gradients to the privacy budget. Detailed Implementation

[0024] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0025] To better understand the technical solution of this invention, the application scenario of the technical solution involved in this embodiment is first described. Ride-hailing platforms or urban traffic management departments accumulate a large amount of vehicle satellite positioning trajectory data in their daily operations. When releasing anonymized historical trajectory data to third-party traffic analysis agencies for road network congestion pattern research and route optimization modeling, differential privacy anonymization processing must be performed on the original trajectory. Existing technologies often apply an equal amount of Laplace noise to all location points on the trajectory, which ignores the significant difference in privacy risks between high-frequency stopping areas and passing areas, resulting in insufficient protection of highly sensitive stopping points. The technical solution provided by this invention is applicable to the batch anonymization processing stage before trajectory data is released, performing the process on each trajectory to be released individually, effectively preventing third parties from reconstructing highly sensitive location information through cluster analysis of stopping points in multiple trajectories.

[0026] An embodiment of the vehicle trajectory data anonymization method based on differential privacy provided by this invention: like Figure 1 As shown, the vehicle trajectory data anonymization method based on differential privacy includes the following steps: S101, obtain a single vehicle trajectory, map the single vehicle trajectory to a geographic grid, determine the passing grid cell and at least one stopping grid cell, and extract the stopping coordinate set corresponding to the stopping grid cell.

[0027] In one embodiment, the continuous location stream of a vehicle is pre-segmented. A continuous sequence of coordinates where the time interval between adjacent coordinate points exceeds a set threshold (e.g., 30 minutes), or where the vehicle's operational status changes, is segmented into independent single vehicle trajectories. This prevents extremely long trajectories from excessively diluting the privacy budget in subsequent steps. Given the fundamental role of this major step in the entire data processing flow, the need for refined extraction of trajectory segments naturally arises to accurately separate the potential stationary state from the simple driving state of a vehicle in both spatial and temporal dimensions. The latitude and longitude coordinates within a single vehicle trajectory are assigned to the corresponding geographic grid. A sequence of coordinate points with a continuous time span not less than a first time threshold is retrieved within a single geographic grid to obtain candidate stationary segments. In response to two candidate stationary segments satisfying the temporal continuity condition and their assigned geographic grids satisfying the spatial adjacency condition, the candidate stationary segments are merged to obtain a stationary coordinate set. Geographic grids that do not trigger the merging condition are identified as transit grid units, and merged geographic grids are identified as stationary grid units.

[0028] It should be noted that before assigning the latitude and longitude coordinates within a single vehicle trajectory to the geographic grid, all latitude and longitude coordinates are converted to planar projected coordinates, transforming them into Cartesian coordinates in meters. Preferably, the geographic grid is a regular square grid with a side length of 100 meters, determined based on the average spacing of urban main roads. Each geographic grid is uniquely identified by the coordinates of its lower left corner vertex. For the extraction of candidate stopping segments, preferably, the first time threshold is set to 3 minutes, based on the fact that the longest waiting period for traffic lights at urban intersections is usually no more than 3 minutes. Therefore, a sequence of coordinate points with continuous stops exceeding 3 minutes has the value of further distinguishing between genuine stops and congested stops. Furthermore, if two candidate stopping segments are consecutive in time or the interval does not exceed 30 seconds (meeting the condition of temporal continuity), and their respective geographic grids share edges or corners (meeting the condition of spatial adjacency), then the two candidate stopping segments are merged. The merged set of coordinate points is the union of the two candidate stopping segments and is sorted by time. The merging process is iterated until merging can no longer continue, ultimately generating a set of stopping coordinates. If the number of coordinate points in the dwell coordinate set is less than 6, they are marked for later use because the confidence of subsequent index calculations is insufficient. For grids in the trajectory that do not trigger the above dwell conditions, their privacy sensitivity is low, and they are directly identified as passing grid cells in this step, without the need to perform dwell type determination on them later.

[0029] By using both time thresholds and spatial grids, the system accurately separated the original latitude and longitude sequences into a structured set of stationary coordinates and transit grid cells. This not only overcame the interference of extremely long trajectories and occasional location drift on the global analysis, but also accurately identified highly valuable stationary areas from massive amounts of data, thus constructing a standardized underlying data structure for subsequent calculation of multidimensional features and budget allocation.

[0030] S102, determine the centroid coordinates of the dwell coordinate set, calculate the spatial distribution characteristics and temporal offset characteristics of the dwell coordinate set based on the centroid coordinates, and generate multidimensional dwell characteristics by combining the obtained historical access characteristics.

[0031] In one embodiment, to comprehensively characterize the vehicle's motion state within a specific area from two orthogonal dimensions—spatial dispersion amplitude and temporal positional drift—and provide a quantitative data foundation for accurately distinguishing between actual stops and congested traffic, deep feature mining is required on the extracted coordinate data. The process involves calculating the first Euclidean distance from each coordinate point within the stop coordinate set to the centroid coordinate; calculating the variance of all first Euclidean distances as the stop displacement variance, and calculating the mean of all first Euclidean distances as the coordinate dispersion; constructing spatial dispersion features using the stop displacement variance and coordinate dispersion; dividing the stop coordinate set into a first half and a second half in chronological order; calculating the second Euclidean distance between the local centroids of the first and second half coordinate sets as centroid stability; constructing temporal offset features using centroid stability; and merging the spatial dispersion features, temporal offset features, and historical access features to generate multidimensional stop features.

[0032] First, the mean longitude and mean latitude values ​​of all coordinate points within the stationary coordinate set are taken to obtain the centroid coordinates of the stationary coordinate set. The centroid coordinates are the shared data hub in this step and are calculated only once to avoid wasting computational resources. Then, the first Euclidean distance from each coordinate point in the set to the centroid coordinates is calculated using the standard Euclidean distance formula. The stationary displacement variance is calculated using the standard variance formula for this set of distances, and the coordinate dispersion is calculated using the standard mean formula. The stationary displacement variance is more sensitive to individual satellite positioning gross errors with large deviations, while the coordinate dispersion has a stronger resistance to occasional gross errors. Both variance and mean together describe the spatial clustering of the coordinate point group, mutually reinforcing each other. Furthermore, the local centroids of the first and second halves of the coordinate set are also obtained by taking the corresponding mean longitude and latitude values. The second Euclidean distance between the two local centroids is calculated using the standard Euclidean distance formula to obtain the centroid stability. Centroid stability measures the temporal drift between the centers of two segments of space. When vehicles are moving slowly in congestion, this second Euclidean distance increases significantly with the product of the creep speed and the time span.

[0033] In another embodiment, to compensate for the potential random errors in isolated trajectory determination, the vehicle's past periodic behavioral habits are introduced as an effective supplement to spatial and temporal features, thereby further improving the feature dimensions. The multi-dimensional dwell feature also includes historical visit features. The method further includes the step of obtaining historical visit features: from the historical trajectory database, counting the number of first trajectories where dwell events occur within the dwell grid cell and its spatially adjacent grid cells; counting the total number of second trajectories contained in the historical trajectory database; calculating the ratio of the number of first trajectories to the total number of second trajectories to obtain the dwell repeatability, and determining the dwell repeatability as the historical visit feature.

[0034] It should be noted that the ratio of the number of first trajectories to the total number of second trajectories, calculated using a standard ratio formula, is used as the dwell repeatability. When the total number of second trajectories is lower than a set threshold, such as 14, an insufficient confidence flag is recorded for the dwell repeatability of that dwell grid cell. The lower limit of 14 corresponds to the minimum sample size covering two weeks of daily travel, and this hyperparameter is determined based on the data distribution of the actual available historical data for the vehicle. Preferably, when the total number of second trajectories for the vehicle is 0, the dwell repeatability of all dwell events is uniformly assigned a value of 0.2 and an insufficient confidence flag is recorded, using a conservative approach to prevent highly sensitive locations from being incorrectly underestimated due to a lack of historical data during the system's cold start phase.

[0035] Using the centroid coordinates as the core hub, this step simultaneously generates three real-time motion features: the variance of dwell displacement representing the overall dispersion, the coordinate dispersion representing extreme value resistance, and the centroid stability representing directional drift. It also integrates the dwell repetition representing historical habits to construct a highly structured multidimensional dwell feature, providing data flow support for the subsequent determination of sensitive class labels from three dimensions: space, time, and history.

[0036] S103, based on multi-dimensional dwell features, the dwell grid cells are determined to obtain sensitive class labels.

[0037] In one embodiment, to effectively distinguish between genuine sensitive stopping locations and involuntary stopping locations caused by road congestion, it is necessary to comprehensively quantify and evaluate the various features extracted in the early stages, and construct a transformation mechanism from continuous numerical features to discrete judgment results. This involves comparing whether the variance of the stopping displacement, coordinate dispersion, and centroid stability are lower than the corresponding preset feature upper bounds; counting the total number of feature items lower than the preset feature upper bounds to obtain a real-time judgment score; and constructing a second-order judgment logic based on the real-time judgment score and historical access features to perform sensitivity judgment and obtain a sensitive class label.

[0038] The preset feature upper bound includes three independent threshold parameters. For example, the preset feature upper bound corresponding to the variance of stationary displacement is 25 square meters, which covers the maximum error range of civilian satellite positioning and is determined based on the displacement variance data of historically known real stationary samples. The preset feature upper bound corresponding to coordinate dispersion is 4 meters, which is consistent with the upper bound of civilian satellite positioning error. The preset feature upper bound corresponding to centroid stability is 10 meters, which corresponds to the minimum distinguishable displacement of the centroids of congested vehicles moving at the lowest creeping speed within the time window. The judgment method of statistically counting the total number of feature items below the preset feature upper bound, rather than weighted summation, is to prevent a single indicator from having a decisive impact on the judgment conclusion due to occasional gross errors in satellite positioning. Only when most dimensions of the above three orthogonal dimensions of the indicator simultaneously point to a stationary state is the real-time judgment score robust. It can be determined that the real-time judgment score ranges from 0 to 3 points.

[0039] After obtaining the real-time judgment score, to further reduce the randomness of the current feature judgment of a single trajectory, a historical dimension needs to be introduced for cross-validation and correction, thereby completing the complete closed loop of the second-order judgment logic. A high-sensitivity label is determined when the real-time judgment score is not lower than the judgment score threshold and the historical access features are not lower than the repetition threshold; a medium-sensitivity label is determined when the real-time judgment score is not lower than the judgment score threshold and the historical access features are lower than the repetition threshold, or when the real-time judgment score is lower than the judgment score threshold and the historical access features are not lower than the repetition threshold; a low-sensitivity label is determined when the real-time judgment score is lower than the judgment score threshold and the historical access features are lower than the repetition threshold; the label with the highest sensitivity level under the same single vehicle trajectory is taken as the final sensitivity class label.

[0040] Understandably, the preferred score threshold is set to 2 points, and the preferred repetition threshold is set to 0.4. The specific values ​​of the repetition thresholds are determined based on the sample distribution data of known sensitive locations. When the current behavioral characteristics match genuine stays but the historical visit frequency is low, it is identified as a medium-sensitive label to conservatively handle newly emerging sensitive locations. When historical evidence supports high sensitivity but the current behavioral characteristics show suspected instability, it is also identified as a medium-sensitive label. For multiple stay events belonging to the same geographic grid within the same trajectory, the highest sensitivity level label is selected as the final output, following the priority order of high sensitivity label > medium sensitivity label > low sensitivity label. This rule ensures that the strength of privacy protection is not weakened by an occasional low sensitivity determination among multiple stays.

[0041] By accurately converting multidimensional dwell features into sensitive class labels for each dwell grid unit, and through a two-layer logic of real-time feature threshold filtering and historical access frequency cross-correction, robust distinction is achieved between genuine sensitive dwellings and congestion-induced passive dwellings. This solves the problem of privacy budget mismatch caused by the indistinguishability of dwelling types in traditional equal noise schemes.

[0042] S104. Based on the total global privacy constraint, calculate the stay budget allocation value for the corresponding stay grid cell according to the sensitive class label, and calculate the transit budget allocation value for the transit grid cell.

[0043] In one embodiment, leveraging the global resource scheduling role of this major step in the system and drawing upon the core concept of adaptive quantization in image compression, to allocate coarser output precision to areas with higher information protection requirements while retaining sufficient coordinate precision in areas with lower privacy risks, it is necessary to scientifically decompose and topologically coordinate the total global privacy constraints of the entire trajectory. The total global privacy constraints are allocated according to a preset decomposition ratio, constructing a dwell budget allocation pool and a transit budget allocation pool. For multiple consecutive transit grid units, spatial curvature parameters are calculated, and units with spatial curvature parameters greater than a curvature threshold are retained to obtain core transit units. The transit budget allocation pool is then evenly divided among all core transit units to obtain transit budget allocation values. Based on the level ratio of sensitive class labels, the corresponding dwell budget allocation value is calculated from the dwell budget allocation pool.

[0044] It should be noted that the total global privacy constraint is the overall differential privacy constraint limit for a single vehicle trajectory. Its specific value is determined based on the privacy protection level requirements of the data publisher. For example, for scenarios involving external public release, its value is set between 0.5 and 1.0. The total global privacy constraint is divided into two sub-budget pools according to a preset split ratio. Preferably, the stop budget allocation pool accounts for 70%, and the transit budget allocation pool accounts for 30%. This ratio is determined based on the average ratio of stop points to transit points in historical trajectories, ensuring that the protection focus leans towards the stop area. To prevent long-distance trajectories from containing too many transit grid cells, leading to extreme budget dilution, this step performs spatial topology thinning on continuous transit grid cells. Specifically, the spatial curvature parameters of the trajectory segments composed of continuous transit grid cells are calculated sequentially. Redundant cells on approximately straight driving segments are removed, and only inflection point grids with spatial curvature parameters greater than the curvature threshold are retained as core transit cells. The toll budget allocation pool is calculated equally among these core toll units to obtain the toll budget allocation value. Redundant units that are not retained no longer consume budget and are discarded during output.

[0045] In another embodiment, for units with different levels of sensitivity within the dwelling area, in order to convert discrete sensitive class tags into specific quantified values ​​and achieve refined differentiated protection, it is necessary to further clarify the computing power share calculation mechanism within the dwelling budget allocation pool. Based on the proportion of sensitive class tags at each level in the dwelling grid unit, a basic allocation share is calculated from the dwelling budget allocation pool; according to the allocation adjustment operator corresponding to the sensitive class tag, a multiplicative operation is performed on the basic allocation share to adjust it, resulting in the dwelling budget allocation value; wherein, the higher the sensitivity level of the sensitive class tag, the smaller the value of the corresponding allocation adjustment operator, so that the highly sensitive area receives a smaller numerical limit.

[0046] The basic allocation share for each category is determined by the ratio of the number of units corresponding to each level of sensitive category label to the total number of dwelling grid units. The preferred settings for the allocation adjustment operators are: 40% for high-sensitivity labels, 100% for medium-sensitivity labels, and 200% for low-sensitivity labels. The logic behind these values ​​is to ensure that high-sensitivity areas receive minimal numerical limits, resulting in noise amplitude in the subsequent noise addition stage that is approximately five times that of low-sensitivity road coordinates. This ratio perfectly covers the geographic ambiguity requirements at the urban residential level.

[0047] In another embodiment, when multiple types of dwelling grid cells exist, to prevent multiple rounds of proportional scaling from causing the budgets of each cell to become equal, leading to a degradation or even failure of the differentiated protection effect, an adaptive budget gradient cyclic verification mechanism is constructed. The range of all dwelling budget allocation values ​​is calculated, and the range is divided by the mean to obtain the budget allocation gradient. In response to the budget allocation gradient falling below a preset gradient lower bound, the allocation adjustment operator corresponding to the highest sensitivity level is lowered. The multiplication adjustment step of the basic allocation share and the step of calculating the budget allocation gradient are repeatedly executed until the budget allocation gradient is not lower than the preset gradient lower bound, thus obtaining the final dwelling budget allocation value.

[0048] It should be noted that, in order to quantitatively evaluate the rationality of the current allocation results and to avoid privacy protection from becoming an equal distribution, the budget allocation gradient satisfies the following relationship:

[0049] In the formula, Characterize the budget allocation gradient; The range characterizes all remaining budget allocation values, and its physical meaning is the maximum difference in the global allocation limit, that is, the difference between the maximum allocation value and the minimum allocation value; This represents the mean of all stay budget allocations.

[0050] Understandably, the preset gradient lower bound is preferably set to 1.0. This lower bound ensures that the budget difference between highly sensitive and low-sensitive units remains at a reasonable level, not lower than the mean. If the currently calculated and extracted budget allocation gradient value is lower than 1.0, it reflects insufficient protection of data differentiation among units. In this case, the algorithm automatically adjusts the allocation adjustment operator corresponding to the highest sensitivity level by 10% as the single-step compensation step size through independent variable tuning, and re-introduces it into the loop. This loop continuously amplifies the range value until the extracted budget allocation gradient value is not lower than 1.0, or the number of loops reaches the preset maximum of 100. Through this independent variable tuning and dependent variable closed-loop monitoring mechanism, both the absolute safety lower bound of sensitive data is guaranteed, and a solid and reliable mathematical and physical law support is provided for the gradient allocation of the entire budget pool.

[0051] By drawing on the step-size differentiation logic of adaptive quantization, the sensitive class labels of each geographic grid are accurately and dynamically transformed into specific and reasonable budget allocation values. Through adaptive closed-loop verification of budget allocation gradient based on range, highly sensitive dwelling areas robustly obtain stricter protection limits under global privacy constraints, while low-sensitivity transit areas retain a higher share of data availability. In engineering practice, a perfect balance between data security and macro-availability is achieved.

[0052] S105, based on the stay budget allocation value, inject differential privacy noise into the corresponding coordinate points in the stay grid cell, and based on the transit budget allocation value, inject differential privacy noise into the corresponding coordinate points in the transit grid cell, to obtain and output the target desensitized trajectory.

[0053] In one embodiment, considering this major step as the data output terminal of the entire de-identification scheme, in order to truly realize the differentiated privacy budget calculated in the preceding steps as random perturbations at the physical level of coordinate points and complete the generation of de-identified data that combines security and high availability, the specific need for coordinate transformation and noise restoration of the original coordinates naturally arises. The latitude and longitude coordinates within the dwell grid cells and transit grid cells are transformed by planar projection to obtain Cartesian coordinates; the first scale parameter and the second scale parameter are obtained by dividing the diagonal length of the geographic grid by the dwell budget allocation value and the transit budget allocation value, respectively; based on the first scale parameter and the second scale parameter, Laplacian noise is injected into the corresponding Cartesian coordinates to obtain noisy coordinates; the noisy coordinates are then subjected to inverse transformation and combined according to the original time sequence to obtain and output the target de-identified trajectory.

[0054] It should be noted that before injecting noise, it is essential to ensure that the noise addition calculations for all coordinates are performed within a unified metric space. Therefore, the latitude and longitude coordinates within the dwell and transit grid cells are converted to planar projected coordinates to obtain Cartesian coordinates in meters. Subsequently, since the differential privacy mechanism requires that the noise scale be proportional to spatial sensitivity and inversely proportional to the privacy budget, this scheme uses the diagonal length of the geographic grid to characterize the global sensitivity of the geospatial space. By performing standard division operations, the diagonal length of the geographic grid is divided by the dwell budget allocation value and the transit budget allocation value, respectively, to obtain the first scale parameter and the second scale parameter. After obtaining the above scale parameters, Laplacian noise conforming to the corresponding scale is generated according to the standard Laplacian mechanism and directly superimposed onto the corresponding Cartesian coordinates to obtain the noisy coordinates. Specifically, for highly sensitive stopping areas, due to their smaller stopping budget allocation values, the calculated first-scale parameter is too large, resulting in a corresponding increase in the injected noise amplitude, causing the noisy coordinates to deviate significantly from the true location. Conversely, for low-sensitivity crossing areas, due to their larger crossing budget allocation values, the calculated second-scale parameter is too small, allowing the noisy coordinates to closely approximate the actual driving path. Finally, all noisy coordinates undergo an inverse planar projection transformation to restore the original latitude and longitude data format. The scattered coordinate points are then strictly recombined in chronological order based on the original timestamps, and the final output desensitized trajectory is pushed to a third-party platform.

[0055] The differentiated budget allocation strategy established in the early stage was accurately transformed into actual coordinate point perturbation operations. This not only completed the physical layer transformation closed loop from raw data to desensitized data, but also effectively resisted clustering inference attacks targeting highly sensitive locations while preserving the trajectory continuity of the transit area to the greatest extent, thus taking into account both data security and analytical usability at the engineering application level.

[0056] like Figure 2 As shown, the process of gradually increasing the budget allocation gradient to above the preset lower bound by cyclically adjusting the allocation adjustment operator is demonstrated. This mechanism ensures that there is a sufficient protection gap between high-sensitivity regions and low-sensitivity regions, avoiding the equalization of differential privacy protection.

[0057] An embodiment of the vehicle trajectory data anonymization system based on differential privacy provided by this invention: The differential privacy-based vehicle trajectory data anonymization system includes a processor and a memory. The memory stores computer program instructions, which, when executed by the processor, implement the aforementioned differential privacy-based vehicle trajectory data anonymization method.

[0058] The differential privacy-based vehicle trajectory data anonymization system also includes other components well-known to those skilled in the art, such as communication interfaces. Their settings and functions are known in the art and will not be described in detail here.

[0059] In this invention, the aforementioned memory can be any tangible medium containing or storing a program that can be used or combined with an instruction execution system, apparatus, or device. For example, a computer-readable storage medium can be any suitable magnetic or magneto-optical storage medium, such as Resistive Random Access Memory (RRAM), Dynamic Random Access Memory (DRAM), Static Random Access Memory (SRAM), Enhanced Dynamic Random Access Memory (EDRAM), High-Bandwidth Memory (HBM), Hybrid Memory Cube (HMC), etc., or any other medium that can be used to store desired information and can be accessed by an application, module, or both. Any such computer storage medium can be part of a device or accessible to or connected to a device. Any application or module described in this invention can be implemented using computer-readable / executable instructions stored or otherwise maintained by such a computer-readable medium.

[0060] The above are all preferred embodiments of the present invention and are not intended to limit the scope of protection of the present invention. Therefore, all equivalent changes made in accordance with the structure, shape and principle of the present invention should be covered within the scope of protection of the present invention.

Claims

1. A method for de-identifying vehicle trajectory data based on differential privacy, characterized in that, Includes the following steps: Obtain a single vehicle trajectory, map the single vehicle trajectory to a geographic grid, determine the passing grid cell and at least one stopping grid cell, and extract the stopping coordinate set corresponding to the stopping grid cell; Determine the centroid coordinates of the dwell coordinate set, calculate the spatial distribution features and temporal offset features of the dwell coordinate set based on the centroid coordinates, and generate multidimensional dwell features by combining the obtained historical access features. Sensitive class labels are obtained by determining the dwell grid cells based on multi-dimensional dwell features; Based on the total global privacy constraints, the stay budget allocation value is calculated for the corresponding stay grid unit according to the sensitive class label, and the transit budget allocation value is calculated for the transit grid unit; Differential privacy noise is injected into the corresponding coordinate points within the dwelling grid cell based on the dwelling budget allocation value, and differential privacy noise is injected into the corresponding coordinate points within the passing grid cell based on the passing budget allocation value, so as to obtain and output the target desensitized trajectory.

2. The vehicle trajectory data anonymization method based on differential privacy according to claim 1, characterized in that, Map a single vehicle trajectory to a geographic grid, determine the passing grid cells and at least one stopping grid cell, and extract the stopping coordinate set corresponding to the stopping grid cell, including: Assign the latitude and longitude coordinates of a single vehicle trajectory to the corresponding geographic grid; Retrieve a sequence of coordinate points within a single geographic grid whose continuous time span is not less than a first time threshold to obtain candidate dwell segments; In response to two candidate dwell segments satisfying the condition of temporal continuity and the geographical grids to which they belong satisfying the condition of spatial adjacency, the candidate dwell segments are merged to obtain the dwell coordinate set; Geographic grids that have not triggered the merging condition are identified as transit grid cells, and geographic grids that have completed the merging are identified as stationary grid cells.

3. The vehicle trajectory data anonymization method based on differential privacy according to claim 1, characterized in that, Based on the centroid coordinates, the spatial distribution features and temporal offset features of the dwell coordinate set are calculated respectively. Combined with the obtained historical visit features, multi-dimensional dwell features are generated, including: Calculate the first Euclidean distance from each coordinate point in the stationary coordinate set to the centroid coordinates; The variance of all first Euclidean distances is calculated as the dwell displacement variance, and the mean of all first Euclidean distances is calculated as the coordinate dispersion. Spatial dispersion features are constructed using the dwell displacement variance and coordinate dispersion. The coordinate set of the station is divided into a first half and a second half in chronological order. The second Euclidean distance between the local centroids of the first half of the coordinate set and the local centroids of the second half of the coordinate set is calculated as the centroid stability, and the temporal offset feature is constructed using the centroid stability. Spatial distribution features, temporal offset features, and historical visit features are combined to generate multidimensional dwell features.

4. The vehicle trajectory data anonymization method based on differential privacy according to claim 1 or 3, characterized in that, Multidimensional dwell features also include historical visit features, and the method further includes a step for obtaining historical visit features: From the historical trajectory database, count the number of first trajectories in which dwell events occurred within the dwell grid cell and its spatially adjacent grid cells; The total number of second trajectories contained in the historical trajectory database is statistically significant. The ratio of the number of first trajectories to the total number of second trajectories is calculated to obtain the dwell repeatability, and the dwell repeatability is determined as a historical visit feature.

5. The vehicle trajectory data anonymization method based on differential privacy according to claim 3, characterized in that, Based on multi-dimensional dwell characteristics, dwell grid cells are determined to obtain sensitive class labels, including: Compare whether the variance of dwell displacement, coordinate dispersion, and centroid stability are lower than the corresponding preset feature upper bounds; The total number of feature items below the preset upper limit is counted to obtain the real-time judgment score; A second-order judgment logic is constructed based on the real-time judgment score and historical access characteristics to perform sensitivity judgment and obtain sensitive class labels.

6. The vehicle trajectory data anonymization method based on differential privacy according to claim 5, characterized in that, Based on real-time judgment scores and historical access characteristics, a second-order judgment logic is constructed to perform sensitivity judgment and obtain sensitive class labels, including: Highly sensitive labels are identified based on the real-time judgment score being no lower than the judgment score threshold and the historical access characteristics being no lower than the repetition threshold. In response to a real-time judgment score that is not lower than the judgment score threshold and a historical access feature that is lower than the repetition threshold, or a real-time judgment score that is lower than the judgment score threshold and a historical access feature that is not lower than the repetition threshold, a sensitive label is identified. In response to a real-time judgment score that is lower than the judgment score threshold and a historical access feature that is lower than the repetition threshold, a low-sensitivity label is identified. The label with the highest sensitivity level under the same single vehicle trajectory will be used as the final sensitivity class label.

7. The vehicle trajectory data anonymization method based on differential privacy according to claim 1, characterized in that, Based on the total global privacy constraints, the dwell budget allocation value is calculated for the corresponding dwell grid cell according to the sensitive class label, and the transit budget allocation value is calculated for the transit grid cell, including: The total amount of global privacy constraints is allocated according to a preset split ratio to construct a stay budget allocation pool and a transit budget allocation pool; For multiple consecutive passing grid cells, the spatial curvature parameters are calculated, and cells with spatial curvature parameters greater than the curvature threshold are retained to obtain the core passing cells; The toll budget allocation pool is divided equally among all core toll units to obtain the toll budget allocation value; Based on the level ratio of sensitive category tags, the corresponding stay budget allocation value is calculated from the stay budget allocation pool.

8. The vehicle trajectory data anonymization method based on differential privacy according to claim 7, characterized in that, Based on the level ratio of sensitive category tags, the corresponding stay budget allocation value is calculated from the stay budget allocation pool, including: Based on the proportion of sensitive category tags at each level in the dwell grid cell, the basic allocation share is calculated from the dwell budget allocation pool; Based on the allocation adjustment operator corresponding to the sensitive class label, a multiplication operation is performed on the basic allocation share to adjust it and obtain the stay budget allocation value; Among them, the higher the sensitivity level of the sensitive class label, the smaller the value of the corresponding allocation adjustment operator, so that the highly sensitive area can obtain a smaller numerical limit.

9. The vehicle trajectory data anonymization method based on differential privacy according to claim 8, characterized in that, After adjusting the basic allocation share using the allocation adjustment operator corresponding to the sensitive class label, and obtaining the remaining budget allocation value, the following steps are also included: Calculate the range of all stay budget allocation values, and divide the range by the mean to obtain the budget allocation gradient; In response to the budget allocation gradient falling below the preset lower bound, the allocation adjustment operator corresponding to the highest sensitivity level is adjusted downwards; Repeat the steps of multiplying the basic allocation share and calculating the budget allocation gradient until the budget allocation gradient is not lower than the preset lower bound, and obtain the final stay budget allocation value.

10. A vehicle trajectory data anonymization system based on differential privacy, characterized in that, It includes a memory and a processor, wherein the memory stores computer program instructions, and when the computer program instructions are executed by the processor, the vehicle trajectory data desensitization method based on differential privacy as described in any one of claims 1-9 is implemented.

Images