Space-time trajectory data differential privacy protection method and related device

Abstract

The application belongs to the field of spatiotemporal data privacy security protection, and discloses a kind of spatiotemporal trajectory data differential privacy protection method and related equipment, wherein the method comprises: obtaining city spatiotemporal movement graph structure data, using Laplace mechanism disturbance on node flow density and calculating density standard value;Screening high-risk nodes, Laplace disturbance is carried out on the number of times of transfer to calculate the transfer probability distribution;Determine special transfer mode in combination with transfer risk score, density standard value and node privacy risk score, and obtain path by applying exponential mechanism for re-routing;Comprehensive disturbed flow density, transfer times and re-routing path, calculate and normalize the transfer probability distribution of node, obtain encrypted data, the present application eliminates user correlation through multi-level differential privacy protection, improves the privacy of user trajectory.

Description

Technical Field

[0001] This invention relates to the field of spatiotemporal data privacy and security protection, and in particular to a method and related equipment for differential privacy protection of spatiotemporal trajectory data. Background Technology

[0002] The widespread adoption of mobile positioning devices and the smart internet has led to the collection and application of vast amounts of movement trajectory data from various vehicles, such as pedestrians, cars, delivery robots, and drones. While the applications of trajectory data are extensive, they may also pose privacy and security risks.

[0003] Currently, the main methods for protecting the privacy of trajectory data are to use mechanical models or deep learning models to generate synthetic data that is similar to the original data, and then release the anonymized synthetic data to replace the original data.

[0004] Among the current mainstream methods in mechanical models, K-anonymity and differential privacy are the two main approaches. K-anonymity of trajectory is difficult to resist background knowledge attacks, while differential privacy-based methods protect the data by perturbing the trajectory data in different data dimensions, information granularity and encryption units to meet differential privacy standards, thereby effectively resisting re-identification and association attacks.

[0005] However, differential privacy techniques are typically combined with spatiotemporal data analysis methods. Under differential privacy standards, perturbations are applied based on the spatiotemporal features of the trajectory, followed by trajectory generalization or reconstruction. Limitations include incomplete protection due to subjective feature selection, difficulty in handling inherent feature correlations such as user relationships and time dependencies, and vulnerability to Bayesian inference attacks. Generative neural networks synthesize realistic trajectories by learning multidimensional feature distributions and deep human movement patterns. While achieving high data fidelity, these techniques require large amounts of training data, which introduces privacy risks, potentially leading to model reverse engineering attacks, and lacks formal privacy guarantees. Summary of the Invention

[0006] In order to at least solve one of the technical problems existing in the prior art, the present invention provides a method and related equipment for differential privacy protection of spatiotemporal trajectory data.

[0007] One aspect of the present invention provides a method for differential privacy protection of spatiotemporal trajectory data, comprising: Obtain urban spatiotemporal movement graph structure data, which includes nodes and edges. Nodes are used to represent discretized spatiotemporal units and include traffic density information and node privacy risk scores. Edges are used to represent direct transfer relationships between nodes and include the number of transfers and transfer risk scores. The Laplace mechanism is used to perform differential privacy perturbation on the traffic density information of nodes. Based on the traffic density information of all nodes after differential privacy perturbation, the standard value of density is calculated. High-risk nodes are selected from all nodes based on a preset privacy risk score. The number of transfers of high-risk nodes is perturbed by the Laplace mechanism. The transfer probability distribution of high-risk nodes is calculated based on the number of transfers after the perturbation. Based on the transfer risk score of the transfer edge, the density standard value of the target node, and the node privacy risk score of the target node in the urban spatiotemporal movement graph structure data, special transfer patterns are determined. For special transfer patterns, a utility function with an applied exponential mechanism is used for rerouting to obtain the path from each node to the target node; The flow density obtained from differential privacy perturbation, the number of transfers obtained from transfer probability perturbation, and the path of the target node obtained from rerouting are calculated and normalized to obtain encrypted urban spatiotemporal mobility graph structure data.

[0008] According to the aforementioned spatiotemporal trajectory data differential privacy protection method, the urban spatiotemporal movement map structure data is obtained by statistical analysis of the original trajectory data, and the urban spatiotemporal movement map structure data is a spatiotemporal octree.

[0009] According to the aforementioned spatiotemporal trajectory data differential privacy protection method, the traffic density information of nodes is differentially privacy-perturbed using the Laplace mechanism. Based on the traffic density information of all nodes after differential privacy perturbation, a density standard value is calculated, including: Obtain the privacy budget for differential privacy perturbations, and calculate the node's sensitivity based on its hierarchical position. for: ; in, The total number of levels in the spacetime octree. The current level depth of the node; The scale parameter of the Laplace distribution is calculated based on the node's sensitivity and the privacy budget of the differential privacy perturbation. Noise is then added to the node based on the scale parameter of the Laplace distribution to obtain the noisy traffic density information of the node. for: ; in, This provides the original traffic density information for the nodes. For node indexing, This indicates that the value is 0 and the scale parameter is... Random variables sampled from a Laplace distribution, ,in Privacy budgeting for differential privacy perturbations; After perturbing the traffic density information of all nodes, Z-score normalization is performed to obtain the Z-value of all nodes. for: ; in, This represents the average value of the flow density information after adding noise. The standard deviation of the flow density information after adding noise. This indicates the standard value of density.

[0010] According to the aforementioned spatiotemporal trajectory data differential privacy protection method, high-risk nodes are selected from all nodes based on a preset privacy risk score. The transition probability of high-risk nodes is perturbed using a Laplace mechanism. Based on the perturbed transition probability, the transition probability distribution of high-risk nodes is calculated, including: All nodes are traversed, and nodes with a higher than the preset privacy risk score are identified as high-contribution nodes; Traverse the edges from the starting node to the target node of the high-risk node, extract the transition count of the edges from the starting node to the target node, and use the Laplace mechanism to perturb the transition probability to obtain the noisy transition count. for: ; in, This represents the number of transitions along the edge from the starting node to the target node. For the target node, where The scale parameter and , This indicates that the value is 0 and the scale parameter is... Random variables sampled from a Laplace distribution, Privacy budget representing the perturbation of transition probability; After the transition counts of all outgoing edges of all high-risk nodes have been perturbed, the transition probability distribution of the nodes is recalculated. for: ; in, The number of transitions after adding noise. As the starting node, For the current target node, For nodes The indices of all reachable target nodes, summation terms Represents a node The sum of noisy transitions pointing to all reachable target nodes; when the summation term is greater than 0, This indicates that the node is in operation before the trajectory ends. Transfer to node The conditional probability.

[0011] According to the aforementioned spatiotemporal trajectory data differential privacy protection method, special transfer patterns are determined based on the transfer risk scores of transfer edges in the urban spatiotemporal movement map structure data, the density standard value of the target node, and the node privacy risk score of the target node, including: Traverse all transition edges in the urban spatiotemporal movement graph structure data Based on the transfer risk score of the transfer edge Target node Density standard value obtained by differential privacy perturbation and the risk score of the target node itself Perform the following judgment: like and It is then identified as the first risk category of the special transfer pattern, used to characterize the node. The space unit leads to a low-traffic private area; like and and It is then identified as the second risk category of the special transfer pattern, used to characterize the node. The spatial units participated in group-related hot-topic events; like and This is then identified as a third risk category of special transfer patterns, used to characterize nodes. Individual deviation events of spatial units during group movement.

[0012] According to the aforementioned spatiotemporal trajectory data differential privacy protection method, a utility function with an applied exponential mechanism is used for rerouting in special transfer patterns to obtain the path from each node to the target node, including: For each risk category in the special pattern, a candidate target set is constructed, and a utility function with an applied index mechanism is adopted according to the risk category. For each candidate node in the candidate target set Calculate the utility score: ; ; ; in, , and These correspond to the first risk category, the second risk category, and the third risk category, respectively. For the candidate target set corresponding to the current risk category, These are candidate nodes to be scored. The nodes to be traversed when normalizing the candidate target set; Candidate nodes The normalized value of the noisy traffic density within the candidate target set. Candidate nodes k Node privacy risk score, Candidate nodes The normalized value of the transfer risk score within the candidate target set; values ​​45 and 35 are the preset risk normalization reference values ​​for the first and second risk categories, respectively. The term represents the maximum value of the corresponding risk deviation within the candidate target set; The probability of a candidate node being selected as the new target node is determined based on its utility score. for: ; in, For privacy budgets related to rerouting, Sensitivity to the utility function; The original transition edge count value, the probability Assign the path from the starting node to the selected new target node.

[0013] According to the aforementioned spatiotemporal trajectory data differential privacy protection method, the flow density obtained from differential privacy perturbation, the number of transfers obtained from transfer probability perturbation, and the path to the target node obtained from rerouting are used to calculate and normalize the transfer probability distribution of the node, resulting in encrypted urban spatiotemporal movement map structure data, including: The nodes of the urban spatiotemporal movement map structure data are traversed, and the noise-added transfer count value of each outgoing edge after the transfer probability perturbation, the rerouting transfer count value of each edge of the new path after the special transfer mode is rerouted, and the trajectory end count value of each node are obtained and summarized respectively. For any starting node, the noisy transfer count value of the corresponding target node is merged with the rerouting transfer count value to obtain the final transfer count value of each target node; the sum of the final transfer count values ​​of each target node is used as the denominator for normalization to obtain the final transfer probability; the trajectory end probability is obtained by the ratio of the trajectory end count value to the total number of all transfer events and end events of that node; the encrypted urban spatiotemporal movement map structure data is obtained based on the updated final transfer probability and trajectory end probability.

[0014] Another aspect of the present invention provides a spatiotemporal trajectory data differential privacy protection device, comprising: The first module is used to acquire urban spatiotemporal movement map structure data, which includes nodes and edges. Nodes are used to represent discretized spatiotemporal units and include traffic density information and node privacy risk scores. Edges are used to represent direct transfer relationships between nodes and include the number of transfers and transfer risk scores. The second module is used to perform differential privacy perturbation on the traffic density information of nodes using the Laplace mechanism, and calculates the standard value of density based on the traffic density information of all nodes after differential privacy perturbation. The third module is used to filter all nodes according to a preset privacy risk score to obtain high-risk nodes. The number of transfers of high-risk nodes is perturbed by the Laplace mechanism. Based on the number of transfers after the perturbation of the transfer probability, the transfer probability distribution of high-risk nodes is calculated. The fourth module is used to determine special transfer patterns based on the transfer risk scores of transfer edges, the density standard values ​​of target nodes, and the node privacy risk scores of target nodes in the urban spatiotemporal movement map structure data. The fifth module is used to reroute special transfer patterns using a utility function with an applied exponential mechanism to obtain the path from each node to the target node. The sixth module is used to calculate and normalize the flow density obtained by differential privacy perturbation, the number of transfers obtained by transfer probability perturbation, and the path of the target node obtained by rerouting to obtain encrypted urban spatiotemporal mobility graph structure data.

[0015] Another aspect of the present invention provides an electronic device, including a processor and a memory; The memory is used to store programs; The processor executes the program to implement the method as described above.

[0016] This invention also discloses a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device can read the computer instructions from the computer-readable storage medium and execute the computer instructions, causing the computer device to perform the methods described above.

[0017] The beneficial effects of this invention are as follows: It expands the original trajectory data privacy protection unit from the past user level, trajectory level, event level, and W-window level to the urban geographic spatiotemporal unit scene level (STW). It constructs the interaction mode between urban spatiotemporal scenes through the crowd movement pattern, embedding the driving factors and semantic features of different scenes on human travel, and realizes multi-level differential privacy protection from trajectory to individual movement behavior, and then to urban spatiotemporal scene movement unit. It can prevent attacks on specific users by observing specific urban areas and the interaction patterns between areas, and can further eliminate user correlation and time correlation in trajectory data, thereby improving the privacy of user trajectory. Attached Figure Description

[0018] Figure 1 This is a schematic diagram of the spatiotemporal trajectory data differential privacy protection method according to an embodiment of the present invention; Figure 2 This is a diagram of the original T-Drive data from an embodiment of the present invention; Figure 3 This is a diagram showing the processing results of the method according to an embodiment of the present invention; Figure 4 This is a Pareto rank-percentile fractional graph according to an embodiment of the present invention; Figure 5 This is the privacy budget of an embodiment of the present invention. -Pareto rank chart; Figure 6 This is a schematic diagram of a spatiotemporal trajectory data differential privacy protection device according to an embodiment of the present invention. Detailed Implementation

[0019] The embodiments of the present invention are described in detail below, examples of which are shown in the accompanying drawings. Throughout the description, the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions. In the following description, suffixes such as "module," "part," or "unit" used to denote elements are used only for the purpose of illustrative purposes and have no specific meaning in themselves. Therefore, "module," "part," or "unit" can be used interchangeably. Terms such as "first," "second," etc., are used only to distinguish technical features and should not be construed as indicating or implying relative importance, or implicitly indicating the number of indicated technical features, or implicitly indicating the sequential relationship of the indicated technical features. In the following description, the consecutive reference numerals for method steps are for ease of review and understanding. Adjusting the implementation order of steps, in conjunction with the overall technical solution of the present invention and the logical relationship between the various steps, will not affect the technical effect achieved by the technical solution of the present invention. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and should not be construed as limiting the present invention.

[0020] refer to Figure 1 , Figure 1 This invention relates to a spatiotemporal trajectory data differential privacy protection method, comprising: S100, acquire urban spatiotemporal movement graph structure data, which includes nodes and edges. Nodes are used to represent discretized spatiotemporal units and include traffic density information and node privacy risk scores. Edges are used to represent direct transfer relationships between nodes and include the number of transfers and transfer risk scores.

[0021] In some embodiments, the urban spatiotemporal movement map structure data is obtained by statistical analysis of the original trajectory data, and the urban spatiotemporal movement map structure data is a spatiotemporal octree.

[0022] It should be noted that the technical solution of this invention conforms to the two-stage framework (STW model, Spatiotemporal Windows) that requires differential privacy. It dynamically perturbs the trajectory distribution of different risk levels through spatiotemporal calculation, generates dynamic trajectories in the crowd movement pattern, and finally generates synthetic trajectories.

[0023] Furthermore, the differential privacy protection model foundation of this embodiment of the invention includes: An OW privacy unit refers to a single user's statistical contribution to a specific spatiotemporal octree node (OW) (including its presence density and subsequent transfer behavior). This invention protects the addition and deletion of OW units, rather than the entire trajectory.

[0024] OW adjacency is defined as follows: if two datasets differ by exactly one OW privacy unit, they are considered adjacent datasets. This serves as the benchmark for all subsequent sensitivity calculations.

[0025] It should be noted that the OW privacy unit is not merely a constraint on differential privacy, but rather directly constitutes the basic data unit of the urban spatiotemporal movement graph structure data. Specifically, each spatiotemporal octagonal leaf node is mapped to a node in the urban spatiotemporal movement graph; a user's appearance in this OW unit contributes 1 to the traffic density count of that node; the same user is processed sequentially by OW units over time. Enter OW unit At that time, directed edges are formed in the graph. And contribute 1 to the transition count on that side; when the OW cell is the endpoint of the trajectory, contribute 1 to the node. The trajectory ends, contributing 1 to the count.

[0026] Therefore, the first stage involves perturbing the traffic density on the graph nodes corresponding to the OW and updating the density standard value. The second stage involves perturbing the transfer count on the directed edges formed between OWs and rerouting special transfers based on node density, node risk, and edge risk. The OW adjacency relationship simultaneously limits the range of node and edge counts that can be affected by a single adjacent database change, used to determine the sensitivity of the Laplace and exponential mechanisms. Thus, the OW unit simultaneously undertakes three roles: graph structure representation granularity, perturbation execution granularity, and privacy budget accounting granularity.

[0027] S200 uses the Laplace mechanism to perform differential privacy perturbation on the traffic density information of nodes, and calculates the standard density value based on the traffic density information of all nodes after differential privacy perturbation.

[0028] For example, refer to Figure 2 This is a diagram of the original T-Drive data from an embodiment of the present invention. Figure 2 Taking the processing of the T-Drive taxi trajectory dataset as an example, and Figure 3 This is a diagram showing the processing results of the method according to an embodiment of the present invention.

[0029] In this embodiment, the dataset is preprocessed and constructed into a spatiotemporal octree structure, which is a specific instance of the spatiotemporal movement graph processed by this method. Subsequently, three core differential privacy protection steps are executed in sequence: node traffic density perturbation, high-risk node transfer probability perturbation, and special transfer mode rerouting. Finally, an encrypted graph structure model is output, which can be used for subsequent secure trajectory synthesis or other analysis applications.

[0030] Figure 2 The technical solution of this embodiment loads a pre-constructed spatiotemporal octree model file containing all statistical information of the T-Drive dataset. For all leaf nodes in this model, differential privacy perturbations are performed on their traffic density information attributes; in the overall steps, settings are... ,Right now = =1; The order law of differential privacy is followed between each step, and the parallel law is followed between the perturbations in each spatiotemporal unit in the subsequent high-risk node transfer probability perturbation and the differential privacy rerouting of special transfer modes.

[0031] In this embodiment, the privacy budget allocated for this step Set to 0.5. For each leaf node in the octree. (Consistent with the nodes in the urban spatiotemporal movement map structure data), the magnitude of its Laplace noise depends on the sensitivity of that node. The sensitivity is dynamically calculated based on the node's level in the tree: ; in, The total number of levels in the spacetime octree. This represents the current level depth of the node.

[0032] Calculate the scale parameter of the Laplace distribution based on sensitivity and privacy budget. Subsequently, for the nodes original density Add noise to obtain the density with added noise. : ; in, This indicates a value with a mean of 0 and a scale parameter of . Random variables sampled from a Laplace distribution, after the density of all leaf nodes is perturbed, are based on these new density value sets. Recalculate and update the Z-Score values ​​of all leaf nodes. : ; in, and These represent the mean and standard deviation of all the density values ​​after adding noise, respectively.

[0033] S300 filters all nodes based on a preset privacy risk score to identify high-risk nodes. The number of transfers for high-risk nodes is perturbed using a Laplace mechanism. Based on the number of transfers after the perturbation, the transfer probability distribution of high-risk nodes is calculated.

[0034] In some embodiments, all nodes are traversed, and nodes with a privacy risk score higher than a preset threshold are identified as high-contribution nodes.

[0035] Preferably, the preset privacy risk score is set to 60, that is... nodes Nodes identified as high-risk, among which The node is represented Privacy risk score.

[0036] Traverse the edges from the starting node to the target node of the high-risk node, extract the transition count of the edges from the starting node to the target node, and use the Laplace mechanism to perturb the transition probability to obtain the noisy transition count. for: ; in, This represents the number of transitions along the edge from the starting node to the target node. For the target node, where The scale parameter and , This indicates that the value is 0 and the scale parameter is... Random variables sampled from a Laplace distribution, A privacy budget representing the perturbation of transition probability, exemplified by =0.25, since this is for the raw count, the sensitivity of this operation is 1.

[0037] After the perturbation of the transition counts of all outgoing edges of all high-risk nodes is complete, based on these new count values... Recalculate the transition probability distribution of the nodes. for: ; in, The number of transitions after adding noise. As the starting node, For the current target node, For nodes The indices of all reachable target nodes, summation terms Represents a node The sum of noisy transitions pointing to all reachable target nodes; when the summation term is greater than 0, This indicates that the node is in operation before the trajectory ends. Transfer to node The conditional probability.

[0038] S400 determines special transfer patterns based on the transfer risk scores of transfer edges, the density standard values ​​of target nodes, and the node privacy risk scores of target nodes in the urban spatiotemporal movement map structure data.

[0039] In some embodiments, all transition edges in the urban spatiotemporal movement graph structure data are traversed. Based on the transfer risk score of the transfer edge Target node Density standard value obtained by differential privacy perturbation and the risk score of the target node itself Perform the following judgment: like and It is then identified as the first risk category of the special transfer pattern, used to characterize the node. The space unit leads to a low-traffic private area; like and and It is then identified as the second risk category of the special transfer pattern, used to characterize the node. The spatial units participated in group-related hot-topic events; like and This is then identified as a third risk category of special transfer patterns, used to characterize nodes. The spatial unit is the individual deviation event during group movement, such as a sudden traffic accident on a road with high traffic volume causing a small number of vehicles to stop moving.

[0040] In this embodiment, the privacy budget of differential privacy rerouting Set it to 0.25.

[0041] S500 uses a utility function with an applied exponential mechanism to reroute special transfer modes, obtaining the path from each node to the target node.

[0042] Furthermore, for each risk category in the special pattern, a candidate target set is constructed, and a utility function with an applied index mechanism is adopted according to the risk category. For each candidate node in the candidate target set Calculate the utility score: ; ; ; in, , and These correspond to the first risk category, the second risk category, and the third risk category, respectively. For the candidate target set corresponding to the current risk category, These are candidate nodes to be scored. The nodes to be traversed when normalizing the candidate target set; Candidate nodes The normalized value of the noisy traffic density within the candidate target set. Candidate nodes k Node privacy risk score, Candidate nodes The normalized value of the transfer risk score within the candidate target set; values ​​45 and 35 are the preset risk normalization reference values ​​for the first and second risk categories, respectively. The term represents the maximum value of the corresponding risk deviation within the candidate target set.

[0043] It should be noted that, due to the risk score Treated as a constant (sensitivity is 0), utility function sensitivity The sensitivity equal to the normalized density, i.e. In this embodiment, the probability of a candidate node being selected as the new target node can be determined based on its utility score. for: ; in, For privacy budgets related to rerouting, Sensitivity to the utility function; The original transition edge count value, the probability Assign it to the path from the starting node to one or more new target nodes.

[0044] S600 calculates and normalizes the flow density obtained from differential privacy perturbation, the number of transfers obtained from transfer probability perturbation, and the path of the target node obtained from rerouting to obtain encrypted urban spatiotemporal mobility map structure data.

[0045] In some embodiments, the method further includes traversing the nodes of the urban spatiotemporal movement map structure data, obtaining and summarizing the noisy transfer count values ​​of each outgoing edge after the transfer probability perturbation, the rerouting transfer count values ​​of each edge assigned to the new path after rerouting for special transfer modes, and the trajectory end count value of each node; for any starting node, merging the noisy transfer count value of the corresponding target node with the rerouting transfer count value to obtain the final transfer count value of each target node; normalizing the sum of the final transfer count values ​​of each target node as the denominator to obtain the final transfer probability; and obtaining the trajectory end probability by the ratio of the trajectory end count value to the total number of all transfer events and end events of the node; and obtaining the encrypted urban spatiotemporal movement map structure data based on the updated final transfer probability and trajectory end probability.

[0046] For example, the node update result includes a complete model of all encrypted attributes, which is finally output and saved as a separate model file. When representing a user trajectory, this trajectory is protected for privacy by the technical solution of this embodiment.

[0047] The differential privacy guarantee method of this invention is based on the definition of STW-level privacy. Its direct protection object is not the original trajectory, but rather the original trajectory dataset. Constructed urban spatiotemporal mobility model Under this definition, privacy databases are viewed as octree models. It itself, which records the actual statistical parameters of each spatiotemporal unit (node) in the model. Two octree models. and They are considered adjacent if they are each composed of two adjacent datasets. and Constructed, among which Compare Increase or decrease exactly one OW privacy unit (i.e., the statistical contribution of a single user to a specific spatiotemporal node).

[0048] First, in the first-stage global density perturbation, privacy is guaranteed by applying the Laplace mechanism. The privacy of this mechanism depends on its sensitivity to the query function. The correct derivation. In this embodiment, the derivation of sensitivity starts from the deepest layer ( Starting from the leaf node of ), due to its volume The addition or removal of an OW unit changes its internal count by at most 1, therefore the density sensitivity of this level is... Based on the geometric structure of the octree and the geometric properties of OW units as linear elements projected in space, a single trajectory is related to the parent node (hierarchy). The effect of density is approximately equal to its effect on child nodes (level). One-quarter of the impact, i.e. Furthermore, by expanding this recursive relation, we obtain a result applicable to any level. The general formula for the density sensitivity of nodes.

[0049] Because this phase correctly uses the Laplace mechanism and derives a rigorous upper bound on the sensitivity for its query function, its implementation can provide... - Guarantee of differential privacy.

[0050] Subsequently, in the second-stage targeted transfer model perturbation, its privacy guarantee is based on a core assumption: in this stage, we treat a single OW unit as the smallest encrypted unit of differential privacy, that is, data is divided through spatiotemporal units, assuming no correlation between units. In sensitivity calculation, the privacy risk score is preset as an inherent attribute of the unit, because different urban spatiotemporal scenarios have specific driving factors for population movement, inherently containing related privacy. This stage sequentially includes two perturbation operations. For the transfer count perturbation of high-risk nodes, the method of this embodiment adopts the Laplace mechanism. Since adding or deleting a trajectory at most affects a specific transfer count value of 1, its sensitivity is... When correctly set to 1, this operation can provide - Guarantee of differential privacy. For structural perturbations of high-risk transfer patterns, the method in this embodiment employs an exponential mechanism, and the key to its privacy guarantee lies in the sensitivity of the utility function. The derivation is based on the assumption that "risk score is an inherent attribute of the region," the sensitivity of the risk component is 0, and the total sensitivity is... It is entirely determined by the density components. Through normalization analysis and worst-case determination, the theoretically rigorous global sensitivity is finally obtained as follows: This operation can provide - Guarantee of differential privacy. Since both perturbation operations in this phase access the same privacy database. According to the sequential combination theorem, stage two as a whole can provide - Guarantee of differential privacy. For multiple high-risk nodes across the city, since the OW unit is bound to a specific spatial node, the data subsets involved in the processing of different nodes are spatially disjoint. According to the parallel combinatorial theorem of differential privacy, the total privacy overhead in this stage is determined by the maximum overhead of a single processing step, rather than being cumulative.

[0051] Ultimately, the privacy guarantees of the overall framework are established by correctly applying the sequential combination theorem. Since both Phase 1 and Phase 2 computations access the same privacy database ( These do not satisfy the prerequisite of dataset partitioning required for parallel combination; therefore, applying the sequential combination theorem is the only correct choice. According to this theorem, one... -DP algorithm and a -DP algorithm (where Its overall privacy protection level is Therefore, the method proposed in the embodiments of the present invention has been rigorously proven to meet the differential privacy requirements.

[0052] refer to Figure 4 ,in Figure 4 This is a Pareto rank ranking graph from an embodiment of the present invention, which illustrates the performance of multiple trajectory generation algorithms in three core metrics: fidelity, privacy, and utility. The method in this embodiment successfully breaks through this conventional dilemma. While ensuring extremely high privacy, it still maintains extremely high utility and acceptable fidelity, which are extremely valuable characteristics in practical applications. The advantage of the method in this embodiment does not lie in pursuing the ultimate peak of a single metric, but in its versatility and robustness. It avoids the problem of overall performance collapse caused by other methods pursuing the ultimate in a single point (such as DiffTraj and AdaTrace). It successfully finds the optimal balance between data authenticity, privacy security, and data availability, making it the most reliable and efficient solution in actual deployment.

[0053] Further reference Figure 5 This is the privacy budget of an embodiment of the present invention. - Pareto rank chart, where Privacy protection algorithms are used in extremely high-intensity ( ) and moderate intensity ( It performs well under privacy protection. Especially in... At the same time, it can better balance privacy and utility, and achieve Pareto optimal overall performance.

[0054] Figure 6This is a schematic diagram of a spatiotemporal trajectory data differential privacy protection device according to an embodiment of the present invention. The device includes a first module 610, a second module 620, a third module 630, a fourth module 640, a fifth module 650, and a sixth module 660.

[0055] The system comprises three modules: The first module acquires urban spatiotemporal movement map structure data, which includes nodes and edges. Nodes represent discretized spatiotemporal units and include traffic density information and a node privacy risk score. Edges represent direct transfer relationships between nodes and include the number of transfers and a transfer risk score. The second module performs differential privacy perturbation on the traffic density information of nodes using a Laplace mechanism and calculates a standard density value based on the traffic density information of all nodes after the differential privacy perturbation. The third module filters all nodes based on a preset privacy risk score to identify high-risk nodes and uses a Laplace mechanism to calculate the transfer probability of the number of transfers of high-risk nodes. The system employs a series of modules: a perturbation module to calculate the transfer probability distribution of high-risk nodes based on the number of transfers after perturbation of the transfer probability; a third module to determine special transfer patterns based on the transfer risk scores of transfer edges, the density standard value of target nodes, and the node privacy risk scores of target nodes in the urban spatiotemporal mobility graph structure data; a fourth module to reroute special transfer patterns using a utility function with an applied index mechanism to obtain the path from each node to the target node; and a fifth module to calculate and normalize the transfer probability distribution of nodes based on the traffic density obtained from differential privacy perturbation, the number of transfers obtained from transfer probability perturbation, and the path to the target node obtained from rerouting, thereby obtaining encrypted urban spatiotemporal mobility graph structure data.

[0056] For example, with the cooperation of the first, second, third, fourth, fifth, and sixth modules in the device, the embodiment device can implement any of the aforementioned spatiotemporal trajectory data differential privacy protection methods, namely, acquiring urban spatiotemporal movement map structure data, wherein the urban spatiotemporal movement map structure data includes nodes and edges, wherein nodes are used to represent discretized spatiotemporal units, and nodes include traffic density information and node privacy risk scores, and edges are used to represent direct transfer relationships between nodes, and edges include transfer counts and transfer risk scores; differential privacy perturbation is performed on the traffic density information of nodes using the Laplace mechanism, and density standard values ​​are calculated based on the traffic density information of all nodes after differential privacy perturbation; and all nodes are subjected to a preset privacy risk... High-risk nodes are identified through score screening. The number of transfers for high-risk nodes is perturbed using a Laplace mechanism. Based on the number of transfers after perturbing, the transfer probability distribution of high-risk nodes is calculated. Special transfer patterns are determined based on the transfer risk scores of transfer edges, the standard density value of target nodes, and the node privacy risk scores of target nodes in the urban spatiotemporal mobility graph structure data. For special transfer patterns, a utility function with an applied index mechanism is used for rerouting to obtain the path from each node to the target node. The transfer probability distribution of nodes is calculated and normalized using the traffic density obtained from differential privacy perturbation, the number of transfers obtained from transfer probability perturbation, and the path to the target node obtained from rerouting, resulting in encrypted urban spatiotemporal mobility graph structure data. The beneficial effects of this invention are as follows: It expands the original trajectory data privacy protection unit from the past user level, trajectory level, event level, and W-window level to the urban geographic spatiotemporal unit scene level (STW). It constructs the interaction mode between urban spatiotemporal scenes through the crowd movement pattern, embedding the driving factors and semantic features of different scenes on human travel, and realizes multi-level differential privacy protection from trajectory to individual movement behavior, and then to urban spatiotemporal scene movement unit. It can prevent attacks on specific users by observing specific urban areas and the interaction patterns between areas, and can further eliminate user correlation and time correlation in trajectory data, thereby improving the privacy of user trajectory.

[0057] This invention also provides an electronic device, which includes a processor and a memory; The memory stores the program; The processor executes a program to perform the aforementioned spatiotemporal trajectory data differential privacy protection method; the electronic device has the function of carrying and running the software system for spatiotemporal trajectory data differential privacy protection provided in the embodiments of the present invention, such as a personal computer, minicomputer, mainframe, workstation, network or distributed computing environment, standalone or integrated computer platform, or communicating with charged particle tools or other imaging devices, etc.

[0058] This invention also provides a computer-readable storage medium storing a program that is executed by a processor to implement the spatiotemporal trajectory data differential privacy protection method described above.

[0059] In some alternative embodiments, the functions / operations mentioned in the block diagrams may not occur in the order shown in the operation diagrams. For example, depending on the functions / operations involved, two consecutively shown blocks may actually be executed substantially simultaneously, or the blocks may sometimes be executed in reverse order. Furthermore, the embodiments presented and described in the flowcharts of this invention are provided by way of example to provide a more comprehensive understanding of the technology. The disclosed methods are not limited to the operations and logic flows presented in the embodiments of this invention. Alternative embodiments are contemplated, in which the order of various operations is changed and sub-operations described as part of a larger operation are executed independently.

[0060] This invention also discloses a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device can read the computer instructions from the computer-readable storage medium and execute the computer instructions, causing the computer device to perform the aforementioned spatiotemporal trajectory data differential privacy protection method.

[0061] Furthermore, although the invention has been described in the context of functional modules, it should be understood that, unless otherwise stated, one or more of the described functions and / or features may be integrated into a single physical device and / or software module, or one or more functions and / or features may be implemented in a separate physical device or software module. It is also understood that a detailed discussion of the actual implementation of each module is unnecessary for understanding the invention. Rather, considering the properties, functions, and internal relationships of the various functional modules in the apparatus disclosed in the embodiments of the invention, the actual implementation of the module will be understood within the scope of conventional skill of an engineer. Therefore, those skilled in the art can implement the invention as set forth in the claims using ordinary techniques without excessive experimentation. It is also understood that the specific concepts disclosed are merely illustrative and are not intended to limit the scope of the invention, which is determined by the full scope of the appended claims and their equivalents.

[0062] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, essentially, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0063] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-included system, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can be any means that can include, store, communicate, propagate, or transmit programs for use by, or in conjunction with, an instruction execution system, apparatus, or device.

[0064] More specific examples of computer-readable media (a non-exhaustive list) include: electrical connections (electronic devices) having one or more wires, portable computer disk drives (magnetic devices), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Furthermore, computer-readable media can even be paper or other suitable media on which the program can be printed, because the program can be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, interpreting, or otherwise processing as necessary, and then stored in computer memory.

[0065] It should be understood that various parts of the present invention can be implemented in hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented in software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0066] In the description of this specification, references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0067] Although embodiments of the invention have been shown and described, those skilled in the art will understand that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the claims and their equivalents.

[0068] The above is a detailed description of the preferred embodiments of the present invention, but the present invention is not limited to the embodiments described. Those skilled in the art can make various equivalent modifications or substitutions without departing from the spirit of the present invention, and these equivalent modifications or substitutions are all included within the scope defined by the claims of this application.

Claims

1. A method for differential privacy protection of spatiotemporal trajectory data, characterized in that, include: Obtain urban spatiotemporal movement graph structure data, which includes nodes and edges. Nodes are used to represent discretized spatiotemporal units and include traffic density information and node privacy risk scores. Edges are used to represent direct transfer relationships between nodes and include the number of transfers and transfer risk scores. The Laplace mechanism is used to perform differential privacy perturbation on the traffic density information of nodes. Based on the traffic density information of all nodes after differential privacy perturbation, the standard value of density is calculated. High-risk nodes are selected from all nodes based on a preset privacy risk score. The number of transfers of high-risk nodes is perturbed by the Laplace mechanism. The transfer probability distribution of high-risk nodes is calculated based on the number of transfers after the perturbation. Based on the transfer risk score of the transfer edge, the density standard value of the target node, and the node privacy risk score of the target node in the urban spatiotemporal movement graph structure data, special transfer patterns are determined. For special transfer patterns, a utility function with an applied exponential mechanism is used for rerouting to obtain the path from each node to the target node; The flow density obtained from differential privacy perturbation, the number of transfers obtained from transfer probability perturbation, and the path of the target node obtained from rerouting are calculated and normalized to obtain encrypted urban spatiotemporal mobility graph structure data.

2. The spatiotemporal trajectory data differential privacy protection method according to claim 1, characterized in that, The urban spatiotemporal movement map structure data is obtained through statistical analysis of the original trajectory data, and the urban spatiotemporal movement map structure data is a spatiotemporal octree.

3. The spatiotemporal trajectory data differential privacy protection method according to claim 2, characterized in that, The traffic density information of the nodes is subjected to differential privacy perturbation using the Laplace mechanism. Based on the traffic density information of all nodes after differential privacy perturbation, a standard density value is calculated, including: Obtain the privacy budget for differential privacy perturbations, and calculate the node's sensitivity based on its hierarchical position. for: in, The total number of levels in the spacetime octree. The current level depth of the node; The scale parameter of the Laplace distribution is calculated based on the node's sensitivity and the privacy budget of the differential privacy perturbation. Noise is then added to the node based on the scale parameter of the Laplace distribution to obtain the noisy traffic density information of the node. for: in, This provides the original traffic density information for the nodes. For node indexing, This indicates that the value is 0 and the scale parameter is... Random variables sampled from the Laplace distribution, ,in Privacy budgeting for differential privacy perturbations; After perturbing the traffic density information of all nodes, Z-score normalization is performed to obtain the Z-value of all nodes. for: in, This represents the average value of the flow density information after adding noise. The standard deviation of the flow density information after adding noise. This indicates the standard value of density.

4. The spatiotemporal trajectory data differential privacy protection method according to claim 2, characterized in that, The process involves filtering all nodes based on a preset privacy risk score to identify high-risk nodes. The number of transitions for these high-risk nodes is then perturbed using a Laplace mechanism to influence the transition probability. Based on the perturbed number of transitions, the transition probability distribution of the high-risk nodes is calculated, including: All nodes are traversed, and nodes with a higher than the preset privacy risk score are identified as high-contribution nodes; Traverse the edges from the starting node to the target node of the high-risk node, extract the transition count of the edges from the starting node to the target node, and use the Laplace mechanism to perturb the transition probability to obtain the noisy transition count. for: in, This represents the number of transitions along the edge from the starting node to the target node. For the target node, where The scale parameter and , This indicates that the value is 0 and the scale parameter is... Random variables sampled from the Laplace distribution, Privacy budget representing the perturbation of transition probability; After the transition counts of all outgoing edges of all high-risk nodes have been perturbed, the transition probability distribution of the nodes is recalculated. for: in, The number of transitions after adding noise. As the starting node, For the current target node, For nodes The indices of all reachable target nodes, summation terms Represents a node The sum of noisy transitions pointing to all reachable target nodes; when the summation term is greater than 0, This indicates that the node is in operation before the trajectory ends. Transfer to node The conditional probability.

5. The spatiotemporal trajectory data differential privacy protection method according to claim 1, characterized in that, The method for determining special transfer patterns based on the transfer risk scores of transfer edges in the urban spatiotemporal movement map structure data, the density standard value of the target node, and the node privacy risk score of the target node includes: Traverse all transition edges in the city spatiotemporal movement graph structure data Based on the transfer risk score of the transfer edge Target Node Density standard value obtained by differential privacy perturbation and the risk score of the target node itself Perform the following judgment: like and It is then identified as the first risk category of the special transfer pattern, used to characterize the node. The space unit leads to a low-traffic private area; like and and It is then identified as the second risk category of the special transfer pattern, used to characterize the node. The spatial units participated in group-related hot-topic events; like and This is then identified as a third risk category of special transfer patterns, used to characterize nodes. Individual deviation events of spatial units during group movement.

6. The spatiotemporal trajectory data differential privacy protection method according to claim 5, characterized in that, The rerouting of special transfer patterns using a utility function with an exponential mechanism to obtain the path from each node to the target node includes: For each risk category in the special pattern, a candidate target set is constructed, and a utility function with an applied index mechanism is used according to the risk category. For each candidate node in the candidate target set Calculate the utility score: in, , and These correspond to the first risk category, the second risk category, and the third risk category, respectively. For the candidate target set corresponding to the current risk category, These are candidate nodes to be scored. The nodes to be traversed when normalizing the candidate target set; Candidate nodes The normalized value of the noisy traffic density within the candidate target set. Candidate nodes k Node privacy risk score, Candidate nodes The normalized value of the transfer risk score within the candidate target set; values ​​45 and 35 are the preset risk normalization reference values ​​for the first and second risk categories, respectively. The term represents the maximum value of the corresponding risk deviation within the candidate target set; The probability of a candidate node being selected as the new target node is determined based on its utility score. for: in, For privacy budgets related to rerouting, Sensitivity to the utility function; The original transition edge count value, the probability Assign the path from the starting node to the selected new target node.

7. The method for differential privacy protection of spatiotemporal trajectory data according to claim 6, characterized in that, The flow density obtained from differential privacy perturbation, the number of transfers obtained from transfer probability perturbation, and the path to the target node obtained from rerouting are calculated and normalized to obtain encrypted urban spatiotemporal mobility map structure data, including: The nodes of the urban spatiotemporal movement map structure data are traversed, and the noise-added transfer count value of each outgoing edge after the transfer probability perturbation, the rerouting transfer count value of each edge of the new path after the special transfer mode is rerouted, and the trajectory end count value of each node are obtained and summarized respectively. For any starting node, the noisy transfer count value of the corresponding target node is merged with the rerouting transfer count value to obtain the final transfer count value of each target node; the sum of the final transfer count values ​​of each target node is used as the denominator for normalization to obtain the final transfer probability; the trajectory end probability is obtained by the ratio of the trajectory end count value to the total number of all transfer events and end events of that node; the encrypted urban spatiotemporal movement map structure data is obtained based on the updated final transfer probability and trajectory end probability.

8. A spatiotemporal trajectory data differential privacy protection device, characterized in that, include: The first module is used to acquire urban spatiotemporal movement map structure data, which includes nodes and edges. Nodes are used to represent discretized spatiotemporal units and include traffic density information and node privacy risk scores. Edges are used to represent direct transfer relationships between nodes and include the number of transfers and transfer risk scores. The second module is used to perform differential privacy perturbation on the traffic density information of nodes using the Laplace mechanism, and calculates the standard value of density based on the traffic density information of all nodes after differential privacy perturbation. The third module is used to filter all nodes according to a preset privacy risk score to obtain high-risk nodes. The number of transfers of high-risk nodes is perturbed by the Laplace mechanism. Based on the number of transfers after the perturbation of the transfer probability, the transfer probability distribution of high-risk nodes is calculated. The fourth module is used to determine special transfer patterns based on the transfer risk scores of transfer edges, the density standard values ​​of target nodes, and the node privacy risk scores of target nodes in the urban spatiotemporal movement map structure data. The fifth module is used to reroute special transfer patterns using a utility function with an applied exponential mechanism to obtain the path from each node to the target node. The sixth module is used to calculate and normalize the flow density obtained by differential privacy perturbation, the number of transfers obtained by transfer probability perturbation, and the path of the target node obtained by rerouting to obtain encrypted urban spatiotemporal mobility graph structure data.

9. An electronic device, characterized in that, Including the processor and memory; The memory is used to store programs; The processor executes the program to implement the spatiotemporal trajectory data differential privacy protection method as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The storage medium stores a program, which is executed by a processor to implement the spatiotemporal trajectory data differential privacy protection method as described in any one of claims 1-7.

Images