Microaggregation- and permutation-based anonymization of movement data

Abstract

Movement data, that is, trajectories of mobile objects, are automatically collected in huge quantities by technologies such as GPS, GSM or RFID, among others. Publishing and exploiting such data is essential to improve transportation, to understand the dynamics of the economy in a region, etc. However, there are obvious threats to the privacy of individuals if their trajectories are published in a way which allows re-identification of the individual behind a trajectory. We contribute to the literature on privacy-preserving publication of trajectories by presenting a distance measure for trajectories which naturally considers both spatial and temporal aspects of trajectories, is computable in polynomial time, and can cluster trajectories not defined over the same time span. Our distance measure can be naturally instantiated using other existing similarity measures for trajectories that are appropriate for anonymization purposes. Then, we propose two heuristics for trajectory anonymization which yield anonymized trajectories formed by fully accurate true original locations. The first heuristic is based on trajectory microaggregation using the above distance and on location permutation; it effectively achieves trajectory k-anonymity. The second heuristic is based only on location permutation; it gives up trajectory k-anonymity and aims at location k-diversity. The strong point of the second heuristic is that it takes into account reachability constraints when computing anonymized trajectories. Experimental results on a synthetic data set and a real-life data set are presented; for similar privacy protection levels and most reasonable parameter choices, our two methods offer better utility than comparable previous proposals in the literature.

Privacy in Spatio-Temporal Databases: A Microaggregation-Based Approach

“…To overcome this issue, several trajectory similarity measures and ad-hoc privacy models based on k-anonymity have been proposed [9,12,13,[5][6][7][8]11]. Both aspects of the microaggregation process are discussed in detail next.…”

“…The difference in the sampling rate, which typically lead to differences in the size of the trajectories, should has no effect on the result of the distance measure. Neither the Euclidean-based distances used in [5,7,8] nor the EDR or the Log-cost distances adopted in [6] and [9], respectively, meet this property. Noise resiliancy: Several outlier detection mechanism for spatiotemporal data exist.…”

“…Said differently, a trajectory should not be treated as a set of locations (e.g., see the Hausdorff distance) but as a sequence of locations. Other properties: i) Combine the spatial and the time dimensions (e.g., [7,8]). ii) Meet the triangle inequality (e.g., the Euclidean distance).…”

“…In order to achieve k-anonymity under this assumption, the obfuscation method should transform the trajectories in a cluster in such a way they become indistinguishable. In this regard, different obfuscation methods for trajectory anonymization have been proposed (e.g., generalization [9,12,13], spatial translation [5,6], and permutation [7,8]. )…”

“…We then use a privacy notion similar to the ones adopted in [7,12,9], which are less restrictive than (k, δ)-anonymity [5,6] in the sense that the parameter δ is not required.…”