System and method for de-identification processing of data on basis of machine learning, and computer program therefor

Abstract

This data de-identification processing system may comprise: a database which stores a preset plurality of de-identification algorithms or which stores information for supporting execution of the plurality of de-identification algorithms; an input module for receiving, from a user, input data including information to be de-identified; and an evaluation module for determining optimal de-identification processing of the input data on the basis of the result of processing, by a machine learning-based learning model, data obtained by applying the de-identification algorithms to the input data. When the data de-identification processing system is used, a performance difference according to each processing technique can be checked during de-identification processing for converting sensitive information of data such as personal information into a pseudonym or anonymous form, and an optimized processing algorithm can be derived and provided.

Description

Machine learning-based data de-identification processing system and method and computer program therefor

[0001] The embodiments relate to a data de-identification processing system and method, and a computer program therefor. More specifically, the embodiments relate to a technology for de-identifying sensitive data, such as personal information, by identifying performance differences according to the application of machine learning models for each processing technique, thereby deriving and providing an optimized processing algorithm.

[0002] As demand for data utilization increases in various industries such as big data, machine learning, and artificial intelligence, and as related laws regarding the protection and use of personal information (Personal Information Protection Act, Act on Promotion of Information and Communications Network Utilization and Information Protection, etc., Act on the Use and Protection of Credit Information) are revised in Korea, cases in which information about individuals or their unique identification information (resident registration number, passport number, driver's license number, alien registration number, etc.) is used to use services are increasing.

[0003] In particular, with the new establishment of special provisions regarding the processing of pseudonymized information (Chapter 3, Section 3 of the Personal Information Protection Act) in Korea, the foundation has been established for personal information processors to use pseudonymized personal information within the scope of legitimate processing, even without the consent of the data subject, for purposes such as compiling statistics, scientific research, and preserving public records. Pseudonymized information refers to information that has been pseudonymized, such as by deleting part of the personal information or replacing part or all of it, so that the individual cannot be identified without additional information.

[0004] Additionally, even if other information is used, anonymous information that can no longer identify an individual is no longer treated as personal information and can therefore be used freely without restrictions under relevant laws.

[0005] Therefore, depending on the intended use of the data, a method is required to de-identify sensitive data, such as personal information, into pseudonymized or anonymous information. For personal information in image format, prior art techniques exist for processing input data to render it unidentifiable, as described in Korean Patent No. 10-2126795. However, no research has yet been conducted on methods for de-identifying data in the configuration of data for machine learning or in the configuration of learning networks.

[0006] According to one aspect of the present invention, a data de-identification processing system and a computer program therefor can be provided that can propose optimal de-identification processing by confirming performance differences according to application of a machine learning model for each processing technique in de-identification processing that converts sensitive data such as personal information into pseudonym or anonymity.

[0007] A data de-identification processing system according to one aspect of the present invention comprises: a database configured to store a plurality of preset de-identification algorithms or to store information for supporting the execution of the plurality of de-identification algorithms; an input module configured to receive input data including information to be de-identified from a user; and an evaluation module configured to determine optimal de-identification processing for the input data based on a result of processing data obtained by applying the de-identification algorithm to the input data by a machine learning-based learning model.

[0008] In one embodiment, the optimal de-identification process comprises selecting one of the plurality of de-identification algorithms.

[0009] In one embodiment, the input module is further configured to receive network configuration information defining one or more learning models to be applied to the input data, wherein the optimal de-identification process comprises at least one of: modifying the one or more learning models of the network configuration information and selecting one of the plurality of de-identification algorithms.

[0010] In one embodiment, the evaluation module is further configured to compare the result of processing the input data by the learning model and the result of processing data to which the de-identification algorithm has been applied by the learning model to calculate a loss rate due to de-identification, and determine the optimal de-identification processing based on the loss rate.

[0011] A data de-identification processing system according to one embodiment further includes an analysis module configured to generate analysis information defining the need for de-identification of the input data by searching for a preset string pattern or image from the input data, and to provide the analysis information to the user.

[0012] A data de-identification processing method according to one aspect of the present invention comprises: a step in which a computing device configured to include a communication module, a memory, and a processor stores a plurality of preset de-identification algorithms or information for supporting the execution of the plurality of de-identification algorithms in a database of the computing device; a step in which the computing device receives input data including de-identification target information from a user; a step in which the computing device processes data obtained by applying the de-identification algorithm to the input data using a machine learning-based learning model; and a step in which the computing device determines an optimal de-identification processing for the input data based on a result of the processing step.

[0013] In one embodiment, the step of determining the optimal de-identification process comprises the step of the computing device selecting one of the plurality of de-identification algorithms.

[0014] In one embodiment, the step of receiving the input data comprises the step of the computing device receiving network configuration information defining one or more learning models to be applied to the input data, wherein the optimal de-identification process comprises at least one of: modifying the one or more learning models of the network configuration information and selecting one of the plurality of de-identification algorithms.

[0015] In one embodiment, the step of determining the optimal de-identification processing includes: the step of the computing device comparing the result of processing the input data by the learning model with the result of processing the data to which the de-identification algorithm is applied by the learning model to calculate a loss rate due to de-identification; and the step of the computing device determining the optimal de-identification processing based on the loss rate.

[0016] A data de-identification processing method according to one embodiment further includes a step of generating analysis information defining the need for de-identification of the input data by recognizing a preset string pattern or image from the input data by the computing device; and a step of providing the analysis information to the user by the computing device.

[0017] A computer program according to one aspect of the present invention is combined with hardware to execute the aforementioned data de-identification processing method and can be stored in a computer-readable recording medium.

[0018] According to a data de-identification processing system and method according to one aspect of the present invention, in de-identification processing that converts sensitive data such as personal information into pseudonym or anonymity, data before and after de-identification processing are applied to a machine learning-based learning model, thereby confirming performance degradation according to each processing technique and suggesting an optimized de-identification algorithm to the user, there is an advantage in that it is possible to provide the user with an optimized de-identification algorithm.

[0019] In addition, the data de-identification processing system and method according to one aspect of the present invention is applied to a service platform that allows a user to configure a learning network for machine learning or deep learning based on a graphical user interface (GUI), etc., thereby having the advantage of being able to recommend a learning model and / or de-identification algorithm suitable for the user's purpose and network configuration.

[0020] Furthermore, according to the data de-identification processing system and method according to one aspect of the present invention, there is an advantage in that it can automatically check whether there is information requiring pseudonymization or anonymization in the input data or sensitive information or unique identification information requiring the consent of the information subject for collection and storage of information, and if there is such information requiring de-identification, it can provide the user with analysis information on the same.

[0021] FIG. 1 is a schematic block diagram of a data de-identification processing system according to one embodiment.

[0022] FIG. 2 is a schematic block diagram showing the hardware configuration of a data de-identification processing system according to one embodiment.

[0023] Figure 3 is a flowchart showing each step of a data de-identification processing method according to one embodiment.

[0024] Figure 4a is a flowchart showing each step of a data anonymization processing method according to another embodiment.

[0025] Figure 4b is a flowchart showing each step of a data de-identification processing method according to another embodiment.

[0026] FIGS. 5a and 5b are conceptual diagrams illustrating an exemplary user interface (UI) of a machine learning network configuration platform according to one embodiment.

[0027] FIG. 6 is a conceptual diagram illustrating an exemplary UI for block placement corresponding to an operation layer in a machine learning network configuration platform according to one embodiment.

[0028] FIG. 7 is a conceptual diagram illustrating an exemplary UI for storing and loading blocks in a machine learning network configuration platform according to one embodiment.

[0029] Below, some exemplary embodiments of the present invention will be described in detail.

[0030] FIG. 1 is a schematic block diagram of a data de-identification processing system according to one embodiment.

[0031] Referring to Fig. 1, a data de-identification processing system (2) is configured to receive input data from a user device (1) or a data provision server (3). At this time, the input data refers to data to be processed for the purpose of data classification, detection or prediction of specific information, etc., by a machine learning-based learning model. In addition, the input data may include information that is subject to de-identification, such as personal information. At this time, the data de-identification processing system (2) plays a role in determining the optimal de-identification processing required for de-identification of the input data based on preset de-identification algorithms.

[0032] In this specification, machine learning refers to any arbitrary processing method that includes deep learning in addition to machine learning in the traditional sense, and applies what has been learned to classify and analyze data and make decisions based on information learned from the data.

[0033] In addition, in this specification, de-identification of data means pseudonymizing data containing information related to an individual or other subject of de-identification so that the individual cannot be identified without additional information, such as by deleting part of the information or replacing part or all of the information, or anonymizing data so that the individual can no longer be identified even if other information is used, or processing information related to an individual subject of de-identification so that recovery is impossible in any other arbitrary manner.

[0034] Furthermore, in this specification, the personal information included in the input data before anonymization refers to any information related to the individual who is the data subject, and for example, (i) information that can identify an individual such as name or image, (ii) sensitive information such as genetic information, criminal record information, information on an individual's physical / physiological / behavioral characteristics, or information on race or ethnicity, (iii) unique identification information such as resident registration number, passport number, license number, or alien registration number, etc. may be considered personal information in this specification.

[0035] However, the input data of this specification is not necessarily limited to including information related to an individual, and data including information on any other subject requiring anonymization according to the purpose of the invention may correspond to the input data of this specification.

[0036] The de-identification processing system (2) can receive input data from a user device (1) or a data provision server (3), derive optimal de-identification processing for machine learning-based processing of the input data, and present the result to the user. In one embodiment, the de-identification processing system (2) is communicatively connected to a platform service server (4) that provides a platform for users to configure a learning network for machine learning, and can further receive network configuration information for the learning network created by users through the platform along with the input data, and determine optimal de-identification processing based on the information.

[0037] For the above operation, the data de-identification processing system (2) can be communicatively connected to a user device (1), a data provision server (3), and / or a platform service server (4) via a wired and / or wireless network. In this specification, the communication method via a wired and / or wireless network can be implemented using any communication method that allows objects to network with each other, and is not limited to wired communication, wireless communication, 3G, 4G, or other methods.

[0038] For convenience of explanation, the drawing shows the user device (1), the data provision server (3), and the platform service server (4) as one device each. However, it will be readily understood by those skilled in the art that this is merely exemplary and does not limit the number of actual users using the data de-identification processing system (2) or the number of devices or servers communicating with the data de-identification processing system (2).

[0039] Meanwhile, in another embodiment, the de-identification processing system (2) may further include a platform service server (4) or may be implemented within the platform service server (4) to be configured as a single system. In this case, the de-identification processing system (2) may perform the function of a machine learning network configuration service platform that allows users to set input data, add each operation layer and define the order (or connection) between layers, set parameters for the operation of each layer, etc. through a predetermined user interface (UI), and may also provide an optimization function for data de-identification processing and / or an input data de-identification processing function as part of such a platform. Such network configuration platform function will be described in detail later.

[0040] The user device (1) is a device used by a user utilizing the data de-identification processing system (2). In FIG. 1, the user device (1) is illustrated in the form of a laptop computer, but the types of devices used by users are not limited thereto. For example, users may utilize the data de-identification processing system (2) according to the embodiments through any computing device, such as a mobile communication terminal such as a smartphone, a personal computer, a personal digital assistant (PDA), a tablet, a set-top box for IPTV (Internet Protocol Television), etc.

[0041] Meanwhile, in another embodiment, the data de-identification processing system (2) itself may be implemented in the form of a computing device used by a user, in which case the user device (1) may be omitted.

[0042] The data de-identification processing system (2) according to the embodiments may have aspects that are partially hardware and partially software. For example, the data de-identification processing system (2) may collectively refer to hardware and related software for processing data of a specific format and content or / and exchanging it electronically in order to perform the data de-identification processing method according to the embodiments. In this specification, terms such as "unit," "module," "server," "system," "platform," "device," or "terminal" are intended to refer to a combination of hardware and software driven by the hardware. For example, the hardware herein may be a data processing device including a CPU or other processor. In addition, the software driven by the hardware may refer to a running process, an object, an executable, a thread of execution, a program, etc.

[0043] In one embodiment, the data de-identification processing system (2) further includes an input module (21), a database (DB) (22), and an evaluation module (24). In addition, in one embodiment, the data de-identification processing system (2) further includes an analysis module (23). Furthermore, the DB (22) and modules (21, 23, 24) may be implemented at least partially using the hardware (200) of the data de-identification processing system (2).

[0044] The input module (21) can receive input data requiring anonymization processing from a user. For example, the input module (21) can receive input data from a user device (1), or from a data provision server (3) or platform service server (4) that provides data at the user's request.

[0045] The DB (22) of the data de-identification processing system (2) stores information for executing multiple de-identification algorithms or for supporting the execution of such algorithms. The evaluation module (24) can determine the optimal de-identification processing for input data based on the results of applying these de-identification algorithms to the input data. In addition, the DB (22) can further store one or more machine learning-based learning models to which the input data is applied, or information for supporting the application of the input data to such learning models.

[0046] For example, when only input data is received from a user, the evaluation module (24) applies multiple de-identification algorithms to the input data based on information in the DB (22), and compares the results of applying the data before and after de-identification processing to the learning model, thereby determining a de-identification algorithm that causes relatively less performance degradation of the model due to de-identification processing as the optimal de-identification processing.

[0047] As another example, the data de-identification processing system (2) may further receive network configuration information defining a model to be used by the user through the platform service server (4). In this case, instead of selecting a de-identification algorithm that causes less performance degradation when data before and after de-identification processing is applied to the learning model, the evaluation module (24) may propose an optimal de-identification process by changing the type and / or order of operations that constitute the learning model so that performance degradation is relatively less when the de-identification algorithm is applied to the user's network configuration.

[0048] As another example, the evaluation module (24) may propose a network configuration change as described above as an optimal de-identification process, in addition to selecting a de-identification algorithm to be applied to input data among multiple de-identification algorithms.

[0049] In embodiments of the present invention, loss metrics of conventional machine learning models can be used as criteria for evaluating performance based on the results of applying data before and after de-identification processing to a learning model. For example, metrics defining loss rates include, but are not limited to, Mean Square Error (MSE), Root Mean Square Error (RMSE), Mean Absolute Error (MAE), Mean Absolute Percentage Error (MAPE), cross entropy loss, and f-1 score. Specific de-identification algorithms and losses will be described in detail below.

[0050] In one embodiment, the analysis module (23) may analyze the need for de-identification of input data by searching for specific strings in the input data and provide the user with information indicating the need for de-identification as analysis information. For example, the analysis module (23) may determine the need for de-identification by searching for specific strings or images corresponding to sensitive information or uniquely identifiable information that require the consent of the data subject for the collection and storage of the information.

[0051] In one embodiment, instead of or in addition to suggesting optimal de-identification processing based on performance degradation before and after de-identification processing, the evaluation module (24) may directly apply input data to a de-identification algorithm and learning model determined to be the optimal de-identification processing, thereby generating de-identified data and providing the same to the user. For example, the evaluation module (24) may communicate with the platform service server (4) so ​​as to be called for de-identification processing of data within a network configuration service platform where users can configure machine learning learning models.

[0052] FIG. 2 is a schematic block diagram showing the hardware configuration of a data de-identification processing system according to one embodiment.

[0053] Referring to FIGS. 1 and 2, a data de-identification processing system (2) according to embodiments is implemented in the form of a computing device including hardware (200), wherein the hardware (200) may include a memory (210), a processor (220), a communication module (230), and an input / output unit (240).

[0054] The memory (210) is a non-transitory computer-readable recording medium and may include a permanent mass storage device such as a random access memory (RAM), a read only memory (ROM), a disk drive, a solid state drive (SSD), a flash memory, etc. Here, the non-permanent mass storage device such as a ROM, an SSD, a flash memory, a disk drive, etc. may be included in the above-described device or server as a separate permanent storage device distinct from the memory (210).

[0055] In addition, the memory (210) may store an operating system and at least one program code (for example, a code for a security module installed and operated on the user device (1), etc., or an application installed on the user device (1), etc. to provide a specific service). These software components may be loaded from a computer-readable recording medium separate from the memory (210). This separate computer-readable recording medium may include a computer-readable recording medium such as a floppy drive, a disk, a tape, a DVD / CD-ROM drive, a memory card, etc.

[0056] In another embodiment, the software components may be loaded into the memory (210) via a communication module (230) rather than a computer-readable recording medium. For example, at least one program may be loaded into the memory (210) based on a computer program that is installed by files provided over a network by developers or a file distribution system (e.g., an application store service server) that distributes installation files for applications.

[0057] The processor (220) may be configured to process instructions of a computer program by performing basic arithmetic, logic, and input / output operations. Instructions may be provided to the processor (220) by the memory (210) or the communication module (230). For example, the processor (220) may be configured to execute instructions received according to program code stored in a storage device such as the memory (210).

[0058] The communication module (230) may provide a function for the data de-identification processing system (2) to communicate with the user device (1) and / or the data provision server (3) via a network. In addition, the communication module (230) may provide a function for the data de-identification processing system (2) to communicate with one or more other devices via a wired and / or wireless network. That is, the communication module (230) is a part that realizes each functional module described above with reference to FIG. 1 by having its function controlled by a processor (220) referencing a memory (210).

[0059] The input / output unit (240) may be a means for interfacing with an external input / output device (not shown). For example, external input devices may include devices such as a keyboard, mouse, microphone, camera, etc., and external output devices may include devices such as a display, speaker, haptic feedback device, etc. As another example, the input / output unit (240) may be a means for interfacing with a device that integrates input and output functions, such as a touchscreen.

[0060] In addition, in other embodiments, the hardware (200) may include more components than those illustrated in FIG. 2 depending on the nature of the device to which it is applied. For example, when the hardware (200) is applied to the user device (1), it may be implemented to include at least some of the above-described input / output devices, or may further include other components such as a transceiver, a GPS (Global Positioning System) module, a camera, various sensors, a database, etc. As a more specific example, when the user device is a smartphone, it may be implemented to further include various components that are generally included in a smartphone, such as an acceleration sensor or a gyro sensor, a camera module, various physical buttons, buttons using a touch panel, input / output ports, and a vibrator for vibration.

[0061] The data de-identification processing method described below can be performed by a computing device including the hardware (200) configuration described above with reference to FIG. 2. For example, the data de-identification processing method can be provided to a user in the form of a service based on at least one of an application, software, or other program operating on a user device and / or a server.

[0062] FIG. 3 is a flowchart showing each step of a data de-identification processing method according to one embodiment, and shows an example of a de-identification processing method that can be performed by the data de-identification processing system (2) described above with reference to FIG. 1.

[0063] Referring to Figures 1 and 3, a user can first select learning data and / or evaluation data to be processed via the data de-identification processing system (2) (S101). Learning data refers to labeled data for model learning and generation, and evaluation data refers to data for evaluating classification performance by inputting it into a learned model.

[0064] Next, the user can select a de-identification algorithm to be applied to the training data and / or evaluation data, and a machine learning model to be applied to the data (S103). When selecting a de-identification algorithm, the user can also select one or more de-identification algorithms from among multiple applicable de-identification algorithms through the data de-identification processing system (2). Furthermore, the user can upload the machine learning model to be applied to the data to the data de-identification processing system (2) or create it through a UI provided by the data de-identification processing system (2).

[0065] Next, the data de-identification processing system (2) can calculate losses for each of multiple combinations of a machine learning model and a de-identification algorithm using learning data and / or evaluation data as input data (S104).

[0066] For the above operation, the data de-identification processing system (2) may apply multiple de-identification algorithms to the data or store information capable of supporting the execution of the de-identification algorithms in the data de-identification processing system (2). In this case, supporting the execution of the de-identification algorithm means storing information such as the connection address and API (Application Programming Interface) for a separate external data processing server, thereby enabling the de-identification algorithm to be applied to the data through the server.

[0067] At this time, the de-identification algorithms are intended to perform pseudonymization, anonymization, etc. so that the information subject cannot be identified from the input data. In one embodiment, the data de-identification processing system (2) can use the de-identification algorithms shown in Table 1 below.

[0068] Processing TypeAlgorithmOperation DescriptionGeneralization / CategorizationCategorizationRepresents values ​​within an interval as representative values ​​or classes according to a preset interval.RoundingConverts to representative values ​​by rounding, etc.Upper and lower codingReduces the identifiability by categorizing information at both ends with a small number of distributions in a normal distributionLocal generalizationIf a specific item in the entire information set has a unique value or has high identifiability due to a unique distribution, generalization is applied only to that part to reduce the identifiabilityDeletion / MaskingPartial deletionDeletes some items of data to reduce identifiabilityPartial maskingReplaces part of the data with another problem (e.g., ***)TotalTotal processingReplaces items with a large error range compared to other information with the mean, maximum, minimum, mode, median, etc.Partial totalsTotal processing a specific part (e.g., column) corresponding to one or more items in the information setRandomizationAdd noiseAdd noise such as random numbers (addition or multiplication)OtherHomomorphismSecret distributionWithin a specific data record Distributing sensitive information so that it can be shared among multiple owners. Differential privacy. Quantitatively modeling privacy, calculating and adding a certain amount of noise to the data to maintain statistical data usefulness while removing identifiable information.

[0069] However, the de-identification algorithm illustrated in Table 1 above is merely exemplary, and the data processing techniques available to the data de-identification processing system (2) according to the embodiments to derive optimal de-identification are not limited to the examples illustrated in this specification.

[0070] The data de-identification processing system (2) compares the results of applying the input data after de-identification processing to a machine learning-based learning model for each de-identification algorithm with the results of applying the original input data before de-identification to the same learning model, thereby calculating the loss due to the de-identification processing in the output of the learning model (e.g., classification, prediction, etc.) (S104). The loss can be calculated using performance indicators of the machine learning model, such as MSE, RMSE, MAPE, cross-entropy loss, and f-1 score, and the difference between the performance indicators of the model for the original input data and the performance indicators of the same model for the data after de-identification processing corresponds to the loss rate in this specification.

[0071] The data de-identification processing system (2) can compare the losses of each de-identification algorithm produced in the aforementioned process and determine the de-identification algorithm with the lowest loss rate as the optimal de-identification processing for the corresponding input data (S105). That is, in the present embodiment, the optimal de-identification processing includes selecting one of multiple de-identification algorithms. Information regarding the optimal de-identification processing determined in this manner is provided to the user as an evaluation result (S106), and the user can then determine the de-identification algorithm to apply to the data he or she will handle based on this information.

[0072] FIG. 4a is a flowchart showing each step of a data de-identification processing method according to another embodiment, and shows an embodiment in which a data de-identification processing system according to one embodiment determines data requiring de-identification from input data.

[0073] Referring to FIGS. 1 and 4a, the data de-identification processing system (2) first receives input data, which is the target data for de-identification processing (S201). At this time, the input data may include de-identification target information, such as information related to an individual.

[0074] Next, the analysis module (24) of the data de-identification processing system (2) can extract data candidates requiring de-identification processing from the input data by searching for a predetermined string pattern and / or image, etc. from the input data (S202). For example, the data de-identification processing system (2) can extract the corresponding portion as a data candidate if the input data contains information related to the individual data subject, such as sensitive information or unique identification information requiring the consent of the data subject for information collection and storage, through pattern matching on the input data.

[0075] Next, the de-identification processing system (2) can determine whether the extracted data candidate requires de-identification (S203). For example, even if the data candidate relates to an individual data subject, if the data has been de-identified in advance and entered in a state where the individual cannot be identified, de-identification may not be necessary. If de-identification of the data candidate is not necessary, the data de-identification processing system (2) can output the fact itself in the form of analysis information (S204).

[0076] Additionally, whether or not anonymization is required for extracted data candidates can be determined by receiving additional user input. For example, the anonymization processing system (2) may present data candidates requiring anonymization to the user and receive user input defining whether or not to perform anonymization on each data candidate (S203).

[0077] In one embodiment, the data de-identification processing system (2) receives additional data in text form, such as terms and conditions, consent procedure web pages, etc., received from the information subject or a service provider for the information subject in relation to the input data, and checks whether consent by the information subject has been properly given, whether there are any items of information use for which consent has not been given, etc., based on the input additional data, and may provide the result of the check to the user as part of the analysis information.

[0078] If it is determined that de-identification is required for one or more data candidates, the data de-identification processing system (2) may perform a process of determining an optimal de-identification algorithm for the input data. This may include a process in which the data de-identification processing system (2) preprocesses the input data by applying a plurality of pre-set de-identification algorithms to each of the input data (S205), trains and evaluates a machine learning model using the pre-processed input data (S206), calculates a loss due to de-identification by comparing it with the case where the input data before de-identification was used (S207), and determines and provides a de-identification algorithm with the least loss due to de-identification as the optimal de-identification algorithm (S208, S209). The above process can be easily understood from steps S104 to S106 of the embodiment described above with reference to FIG. 3, and thus a detailed description thereof will be omitted to avoid duplication of explanation.

[0079] Meanwhile, a data de-identification processing system according to one embodiment includes the platform service server (4) described above with reference to FIG. 1 or is configured within the platform service server (4), thereby performing the function of a platform that provides a service that allows users to configure a machine learning network, and a data de-identification processing method according to embodiments of the present invention may be performed as one of the functions of the platform.

[0080] FIG. 4b is a flowchart showing each step of a data de-identification processing method according to another embodiment, and shows an embodiment in which a data de-identification processing system according to one embodiment operates in a manner of further receiving network configuration information through a platform service server, etc. Referring to FIG. 1 and FIG. 4b, a user can set input data through a platform provided by a platform service server (4) and input network configuration information defining a machine learning model, etc. that the user wants to use. The data de-identification processing system (2) receives input data and the user's network configuration information from the platform service server (4) (S301, S302), and can support de-identification processing for the input data based on the input data.

[0081] In one embodiment, the data de-identification processing system (2) can analyze data risk based on whether the input data contains information requiring de-identification processing, whether the input data contains information requiring consent from the data subject, and / or whether the input data contains information that cannot be utilized at all (S303). If the analysis result indicates no data risk, the result indicating that no further processing of the input data is required can be output to the user as analysis information (S305). However, if the analysis result indicates a risk (S304), the support process for data de-identification processing described below can be performed.

[0082] More specifically, the data de-identification processing system (2) performs a simulation of applying multiple de-identification algorithms to input data, and can calculate the performance degradation due to de-identification, i.e., the loss rate, for each algorithm (S306, S307). The above process is identical to the embodiment described above with reference to FIG. 3, and thus a detailed description is omitted.

[0083] Meanwhile, in the embodiment illustrated in FIG. 4b, the data de-identification processing system (2) receives network configuration information to be applied to input data from the user. Therefore, instead of or in parallel with selecting a de-identification algorithm to derive optimal de-identification processing, it is also possible to determine changes to the network configuration to reduce the loss rate (S308). In this case, the changes to the network configuration may include changes to the type of machine learning-based learning model, changes to the type and / or order of one or more operations constituting the learning model, and / or changes to the parameters for each operation.

[0084] The data de-identification processing system (2) can suggest to the user the optimal de-identification processing for network configuration changes and / or selection of a de-identification algorithm as described above.

[0085] In one embodiment, the data de-identification processing system (2) may automatically execute a network configuration change and / or a de-identification algorithm corresponding to optimal de-identification processing to generate data by de-identifying input data. The automatically de-identified data may be provided to the user device (1) from the data de-identification processing system (2), or may be provided to the user through a service provided by the platform service server (4).

[0086] In one embodiment, the evaluation module (24) of the data de-identification processing system (2) may verify the anonymity and / or diversity of input data to ensure complete de-identification processing. For example, in order to become anonymous information, there must be a minimum number of completely identical and different data records (e.g., a natural number k) within the de-identified data (so-called k-anonymity). Based on this, the evaluation module (24) may provide the number of completely identical data records present in the input data after de-identification processing as a verification result, or may repeatedly perform de-identification processing on the input data until a preset number or more of identical data records are included.

[0087] Furthermore, even if anonymized, there is a risk of information exposure if a group of data records with identical characteristics all have identical values ​​in a field. Therefore, even for data records with identical characteristics, each characteristic must be assigned a minimum number of sensitive information (e.g., a natural number i) (so-called i-diversity). Sensitive information, in this case, refers to information about an individual's physical, physiological, or behavioral characteristics, such as medical history, bank balance, or card payment amount.

[0088] Table 2 below shows examples of cases where a set of data records with the same characteristics of [organization code] and [age] has diversity in terms of information on [disease] and cases where it does not.

[0089] Serial number, institution code, age, sex, disease, note, 15100**30s*Diabetes, various diseases mixed together, safe, 25100**30s*Diabetes, 35100**30s*Gastric cancer, 45100**30s*Breast cancer, 51335**40s*Gastric cancer, various diseases mixed together, safe, 61335**40s*Diabetes, 71335**40s*Colon cancer, 81335**40s*Colon cancer, 94327**50s*Hypertension, all vulnerable to the same disease, 104327**50s*Hypertension, 114327**50s*Hypertension, 124327**50s*Hypertension

[0090] Referring to Table 2 above, the evaluation module (24) can verify whether a set of data records having the same non-sensitive attributes (e.g., organization code and age) in the input data after de-identification processing has a plurality of preset sensitive information attributes (e.g., disease) when the set is derived. The evaluation module (24) can provide information as a verification result on whether the input data after de-identification processing satisfies the diversity condition, or can repeatedly perform de-identification processing on the input data until the diversity condition is satisfied. In the example of Table 2, data records 9 to 12 all have the same attribute of disease, so they do not satisfy the diversity condition.

[0091] In one embodiment, the number of identical data records (i.e., a natural number k) that serve as the basis for the aforementioned anonymity verification and the number of attributes within the same group (i.e., a natural number i) that serve as the basis for diversity verification may be set by the user of the data de-identification processing system (2). For example, the data de-identification processing system (2) may receive the values ​​of k and i as de-identification condition information from the user, and automatically repeatedly perform de-identification processing until the number of identical data records and the number of attributes within the same group set by the user are achieved.

[0092] The following FIGS. 5A to 7 illustrate exemplary UIs related to implementation forms in which a data anonymization processing method according to embodiments of the present invention operates in conjunction with a machine learning network configuration platform or is provided as a function of a machine learning network configuration platform.

[0093] FIG. 5a is a conceptual diagram illustrating an exemplary UI for network creation in a machine learning network configuration platform according to one embodiment.

[0094] Referring to FIG. 5a, a user can select a model type of a machine learning network that he or she wants to configure through a UI element (301) provided by a machine learning network configuration platform, such as a traditional machine learning model such as SVM or RF; a statistical model such as ARIMA; or a deep learning model such as RNN, CNN, or LSTM (Long Short Term Memory). In addition, the user can set a time window defining a processing unit of input data through a UI element (302).

[0095] The UI provided by the machine learning network configuration platform includes a work area (303) where the user can place one or more computational layers to be included in the learning network, and the user can add one or more blocks (311-314) within the work area (303) by selecting a UI element (304) for adding blocks. Each block (311-314) can include one or more computational layers corresponding to computational components. The user can configure the network by selecting a UI element (310) to add and place computational components within the block. For example, the computational layer can be added within the block and expressed in the form of a box whose connection can be established by dragging and placing it. In addition, the user can use the blocks (311, 314) to set input data to be processed through the computational components or determine the format (data dimension, file format, etc.) of the result data processed through the network.

[0096] That is, a user can add one or more blocks to the workspace (303), add one or more computational layers to each block, and define the connections between the blocks through commands via the UI. The machine learning network configuration platform can configure a learning network by defining the computational layers to be included in the network and the computational order between them based on the received user input.

[0097] Fig. 5b illustrates an exemplary UI for adding a block, which is displayed when the UI element (304) of Fig. 5a is selected. As illustrated in Fig. 5b, a user can set a name for a block using the UI element (321) and set input data to be received from the block using the UI element (322). The input data may be a starting point for the operation of the block and may designate a preceding block or layer.

[0098] That is, the user can select a learning model to be created using the UI element (301), and add one or more blocks to the learning model using the UI element (304) for adding blocks. In addition, the user can select the UI element (310) to receive a list of selectable computational layers from the machine learning network configuration platform, and add computational components to each block in the work area (303) by selecting the computational layer to be added to the learning network.

[0099] At this time, users can define the computational order of the learning model's computational components by dragging and arranging each block. That is, the machine learning network configuration platform can generate a learning model based on user commands by receiving UI commands that define one or more of the following: creating a block, creating or modifying a computational layer included in a block, or connecting a block to another block.

[0100] Furthermore, users can set parameters required for the operation of the block. These parameters may vary depending on the type of computational layer, and may include, but are not limited to, the number of layers, the number of units per layer, learning rate, initial weights, filter values, kernel size, stride size, and padding mode information.

[0101] Additionally, a user may further input input data containing information requiring anonymization processing into the learning network. For example, the user may set or modify the input data using the work area (303) of the UI illustrated in FIG. 5A. Alternatively, in the machine learning network configuration platform, input data may be input through a UI separate from the network configuration. That is, in one embodiment, the UI of the machine learning network configuration platform may include a first interface element (e.g., a screen, a menu, a tab, etc.) for receiving user input for network configuration and a second interface element (e.g., a screen, a menu, a tab, etc.) for data input.

[0102] FIG. 6 is a conceptual diagram illustrating an exemplary UI for block placement corresponding to an operation layer in a machine learning network configuration platform according to one embodiment.

[0103] Referring to FIG. 6, a user can add blocks (601-603) to a work area by selecting a computation layer using a UI provided by a machine learning network configuration platform according to one embodiment. Furthermore, the user can set parameters for the operation of the computation layer corresponding to each block (601-603). Each block (601-603) and the computation layer included therein illustrated in FIG. 6 are merely exemplary, and each block and computation layer may have various computation names, input and output data types, and parameters as needed.

[0104] As shown, a graphical user interface (GUI) provided by a machine learning network configuration platform displays blocks (601-603) each having a name and input field and including one or more operation layers, and a user can define the connection between each block (601-603) by dragging and dropping each block (601-603) through the GUI, i.e., the operation order between each layer of the learning network so that the output of the layer of the previous block becomes the input of the layer of the next block.

[0105] The shapes of blocks (601-603) illustrated in the drawings of this specification are merely exemplary, and blocks (601-603) may have boxes, circles, or other different shapes according to embodiments.

[0106] Additionally, users can add one or more computational layers to each block (601-603) via the GUI of the machine learning network configuration platform. Once the user determines a subsequent layer, a corresponding box can be added within that block, and the user can also set parameters for the operation of the subsequent layer.

[0107] Additionally, a user using the machine learning network configuration platform can set a reference identifier for each computational layer, and can also create connections and data processing operations between computational layers by setting a reference identifier (e.g., “conv_block”) of another computational layer to be cited in a specific computational layer, as illustrated in box (610) of FIG. 6.

[0108] At this time, the machine learning network configuration platform according to one embodiment includes a data de-identification processing device (2; FIG. 1) or is implemented within the data de-identification processing device (2), so as to determine an optimal de-identification process for processing some information, such as personal information, in the input data and network configuration input by the user so that it cannot be recognized, and can present the result to the user.

[0109] For example, based on input data input by a user and a block (601) of an operation layer for the input data, various de-identification algorithms may be automatically applied to the input data prior to application of the operation layer corresponding to the block (601), and the data before and after the de-identification processing may be applied to the operation of the block (601), thereby providing the user with a de-identification algorithm with the least degradation in performance. The de-identification algorithm determined as the optimal de-identification processing may be displayed in the form of another layer preceding the operation layer added by the user within the block (601) on the UI provided to the user, or may be presented to the user in the form of another block added within the work area preceding the block (601), but is not limited thereto.

[0110] In addition, there may be cases where a change in the configuration of the learning network is necessary for optimal anonymization processing as described above with reference to FIG. 4b. In this case, the machine learning network configuration platform can automatically generate a result of applying an anonymization algorithm as preprocessing prior to the operation of the layer by combining it with another type of computational layer (e.g., RNN, CNN, etc.) belonging to the same type (e.g., deep learning model) as the computational layer input by the user, even if the user adds a specific computational layer called LSTM within the block (601), and compare this result with the result of applying the LSTM computational layer.

[0111] If it is confirmed that using a computational layer other than LSTM results in less performance degradation when applied with a specific anonymization algorithm, the machine learning network configuration platform may suggest a change to the computational layer within block (601) to the user through the UI.

[0112] FIG. 7 is a conceptual diagram illustrating an exemplary UI for storing and loading blocks in a machine learning network configuration platform according to one embodiment.

[0113] Referring to FIG. 7, a user utilizing a machine learning network configuration platform can use a UI element (710) displayed in relation to a specific area (701) to store the contents of the computational layer and related parameters set by the user in the machine learning network configuration platform, or load a pre-saved block. The block information saved by the user may be stored in the DB of the machine learning network configuration platform service system, or / and may be stored in the local storage of the user device of the user utilizing the machine learning network configuration platform.

[0114] The block information stored at this time may include one or more layers. That is, the block information may include information of a single operation layer set by the user, or may include information of multiple interconnected operation layers.

[0115] The operations of the data de-identification processing method according to the embodiments described above may be implemented at least partially as a computer program including commands executed by a processor, and may be recorded on a computer-readable recording medium. The computer-readable recording medium on which the program for implementing the operations of the data de-identification processing method according to the embodiments is recorded includes all types of recording devices that store data that can be read by a computer. Examples of the computer-readable recording medium include ROM, RAM, CD-ROM, magnetic tape, floppy disk, optical data storage device, etc. In addition, the computer-readable recording medium may be distributed across network-connected computer systems, so that the computer-readable code may be stored and executed in a distributed manner. In addition, the functional programs, codes, and code segments for implementing the present embodiment may be easily understood by a person skilled in the art to which the present embodiment belongs.

[0116] While the present invention has been described above with reference to the embodiments illustrated in the drawings, these are merely exemplary, and those skilled in the art will appreciate that various modifications and variations of the embodiments are possible. However, such modifications should be considered within the technical protection scope of the present invention. Therefore, the true technical protection scope of the present invention should be determined by the technical spirit of the appended claims.

[0117] The embodiments relate to a data de-identification processing system and method, and a computer program therefor. More specifically, the embodiments relate to a technology for de-identifying sensitive data, such as personal information, by identifying performance differences according to the application of machine learning models for each processing technique, thereby deriving and providing an optimized processing algorithm.

Claims

1. A database configured to store a plurality of preset de-identification algorithms or to store information to support execution of the plurality of de-identification algorithms; An input module configured to receive input data including de-identified target information from a user; and A data de-identification processing system including an evaluation module configured to determine optimal de-identification processing for the input data based on the results of processing data obtained by applying the de-identification algorithm to the input data using a machine learning-based learning model.

2. In paragraph 1, A data de-identification processing system wherein the above optimal de-identification processing includes selecting one of the plurality of de-identification algorithms.

3. In paragraph 1, The input module is further configured to receive network configuration information defining one or more learning models to be applied to the input data, A data de-identification processing system, wherein the above optimal de-identification processing includes at least one of a change to the one or more learning models of the network configuration information and a selection of any one of the plurality of de-identification algorithms.

4. In paragraph 1, The above evaluation module is a data de-identification processing system further configured to compare the result of processing the input data by the learning model and the result of processing data to which the de-identification algorithm is applied by the learning model to calculate a loss rate due to de-identification, and determine the optimal de-identification processing based on the loss rate.

5. In paragraph 1, A data de-identification processing system further comprising an analysis module configured to generate analysis information defining the need for de-identification of the input data by searching for a preset string pattern or image from the input data, and to provide the analysis information to the user.

6. A computing device comprising a communication module, a memory, and a processor, storing a plurality of preset de-identification algorithms or information for supporting the execution of the plurality of de-identification algorithms in a database of the computing device; A step in which the computing device receives input data including de-identified target information from a user; A step in which the computing device processes data obtained by applying the de-identification algorithm to the input data using a machine learning-based learning model; and A data de-identification processing method comprising a step of determining, by the computing device, an optimal de-identification processing for the input data based on the result of the processing step.

7. In paragraph 6, The step of determining the above optimal anonymization processing is: A step of calculating a loss rate due to de-identification by comparing the result of processing the input data by the learning model and the result of processing the data to which the de-identification algorithm is applied by the learning model, by the computing device; and A data de-identification processing method comprising a step of determining the optimal de-identification processing based on the loss rate by the computing device.

8. In paragraph 6, A step in which the computing device generates analysis information defining the need for anonymization of the input data by recognizing a preset string pattern or image from the input data; and A data de-identification processing method further comprising a step of providing the analysis information to the user by the computing device.

9. A computer program stored on a computer-readable recording medium that is combined with hardware and executes a data de-identification processing method according to any one of Articles 6 to 8.

Images