De-anonymization of Mobility Trajectories: Dissecting the Gaps between Theory and Practice

Abstract

Abstract-Human mobility trajectories are increasingly collected by ISPs to assist academic research and commercial applications. Meanwhile, there is a growing concern that individual trajectories can be de-anonymized when the data is shared, using information from external sources (e.g. online social networks). To understand this risk, prior works either estimate the theoretical privacy bound or simulate de-anonymization attacks on synthetically created (small) datasets. However, it is not clear how well the theoretical estimations are preserved in practice.In this paper, we collected a large-scale ground-truth trajectory dataset from 2,161,500 users of a cellular network, and two matched external trajectory datasets from a large social network (56,683 users) and a check-in/review service (45,790 users) on the same user population. The two sets of large ground-truth data provide a rare opportunity to extensively evaluate a variety of de-anonymization algorithms (7 in total). We find that their performance in the real-world dataset is far from the theoretical bound. Further analysis shows that most algorithms have underestimated the impact of spatio-temporal mismatches between the data from different sources, and the high sparsity of user generated data also contributes to the underperformance. Based on these insights, we propose 4 new algorithms that are specially designed to tolerate spatial or temporal mismatches (or both) and model user behavior. Extensive evaluations show that our algorithms achieve more than 17% performance gain over the best existing algorithms, confirming our insights.

Privacy in trajectory micro-data publishing : a survey

“…In absence of these practical considerations, studies may lead to overpessimistic claims on privacy risks, which are instead mitigated when attacks are run in the wild. The recent work by Wang et al [138], who show that figures on attack success rates in the literature are largely exaggerated when considering closer-to-reality settings, is a first evidence in this sense. However, it is not a definitive one, as the authors still retain many assumptions that simplify the attacker's work.…”

“…The first test at scale is that recently performed by Wang et al [138]. They leverage an impressive collection of large-scale real-world datasets 12 to carry out a comparative analysis of record linkage attacks proposed in the literature, including those by Ma et al [89], Rossi and Musolesi [111], Cecaj et al [27,28], and Riederer et al [110].…”

The Long Road to Computational Location Privacy: A Survey

“…Recently, Wang et al [67] explored the discrepancies between the theory and practice of re-identification attacks. They leveraged a large ground-truth dataset containing 2 million users, and two smaller external datasets collected over the same population to match against the former.…”

“…However, this approach allows to use datasets of any size, for example to assess the scalability of algorithms to largescale datasets. Indeed, very few researchers have access to extremely large datasets (e.g., the dataset with 1.5 million individuals used by De Montjoye et al [62] or the dataset of 2.1 million individuals used by Wang et al [67]).…”

Machine Learning Blunts the Needle of Advanced SQL Injections

“…The group of unsupervised methods based on behaviour analysis are performed in [19]. It is presumed that a web application under attack acts different from regular operation.…”