Achieving anonymity via clustering

Abstract

Publishing data for analysis from a table containing personal records, while maintaining individual privacy, is a problem of increasing importance today. The traditional approach of de-identifying records is to remove identifying fields such as social security number, name etc. However, recent research has shown that a large fraction of the US population can be identified using non-key attributes (called quasi-identifiers) such as date of birth, gender, and zip code [15]. Sweeney [16] proposed the k-anonymity model for privacy where non-key attributes that leak information are suppressed or generalized so that, for every record in the modified table, there are at least k−1 other records having exactly the same values for quasi-identifiers. We propose a new method for anonymizing data records, where quasi-identifiers of data records are first clustered and then cluster centers are published. To ensure privacy of the data records, we impose the constraint 1 This work was done when the authors were Computer Science PhD students at Stanford University. Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. To copy otherwise, to republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. that each cluster must contain no fewer than a pre-specified number of data records. This technique is more general since we have a much larger choice for cluster centers than k-Anonymity. In many cases, it lets us release a lot more information without compromising privacy. We also provide constant-factor approximation algorithms to come up with such a clustering. This is the first set of algorithms for the anonymization problem where the performance is independent of the anonymity parameter k. We further observe that a few outlier points can significantly increase the cost of anonymization. Hence, we extend our algorithms to allow an fraction of points to remain unclustered, i.e., deleted from the anonymized publication. Thus, by not releasing a small fraction of the database records, we can ensure that the data published for analysis has less distortion and hence is more useful. Our approximation algorithms for new clustering objectives are of independent interest and could be applicable in other clustering scenarios as well.

Using Patterns to Form Homogeneous Teams

“…Our research is also related to the work of Aggarwal et al [4] who proposed a new model of data anonymization based on clustering. While they develop several polynomial-time approximation algorithms, their basic modeling idea is-roughly-to cluster the rows of the input matrix and then to publish the "cluster centers"; importantly, it is required that each cluster contains at least k rows, and this corresponds to the k-anonymity concept.…”

On <i>r</i>-Gatherings on the Line

“…Given a set C of n points on the plane an r-gatherclustering is a partition of the points into clusters such that each cluster has at least r points. The r-gatherclustering problem [1] finds an r-gather-clustering minimizing the maximum radius among the clusters, where the radius of a cluster is the minimum radius of the disk which can cover the points in the cluster. A polynomial time 2-approximation algorithm for the problem is known [1].…”

Graph Based Local Recoding for Data Anonymization

“…Most of the local recoding generalization algorithms follow clustering based approach where each cluster should satisfy anonymity requirement [1,2,6,10,14,19,28]. [2] Proposed condensation based approach where the data is condensed into multiple groups having pre-defined size.…”

“…However, the main limitation of this approach is, it produces high information loss because large numbers of records were merged into a single group. Gagan Aggrawal et al proposed r-gather clustering for anonymity where the data records are partitioned into clusters and release the cluster centres, along with their size, radius, and a set of associated sensitive values [14]. Grigorious et al addressed sampling based clustering for balancing the data utility and privacy protection.…”