Privacy Preservation by Disassociation

TL;DR

This paper introduces a novel anonymization technique called disassociation that protects user privacy in sparse multidimensional data by breaking associations between record terms, especially useful for web search query logs.

Contribution

The paper presents the first disassociation-based anonymization method that preserves original data terms while preventing linkage attacks, outperforming existing generalization and differential privacy techniques.

Findings

Disassociation effectively prevents linkage of rare term combinations.

The method outperforms state-of-the-art techniques in preserving data utility.

Experimental results show improved privacy protection on real and synthetic datasets.

Abstract

In this work, we focus on protection against identity disclosure in the publication of sparse multidimensional data. Existing multidimensional anonymization techniquesa) protect the privacy of users either by altering the set of quasi-identifiers of the original data (e.g., by generalization or suppression) or by adding noise (e.g., using differential privacy) and/or (b) assume a clear distinction between sensitive and non-sensitive information and sever the possible linkage. In many real world applications the above techniques are not applicable. For instance, consider web search query logs. Suppressing or generalizing anonymization methods would remove the most valuable information in the dataset: the original query terms. Additionally, web search query logs contain millions of query terms which cannot be categorized as sensitive or non-sensitive since a term may be sensitive for a user and non-sensitive for another. Motivated by this observation, we propose an anonymization technique termed disassociation that preserves the original terms but hides the fact that two or more different terms appear in the same record. We protect the users' privacy by disassociating record terms that participate in identifying combinations. This way the adversary cannot associate with high probability a record with a rare combination of terms. To the best of our knowledge, our proposal is the first to employ such a technique to provide protection against identity disclosure. We propose an anonymization algorithm based on our approach and evaluate its performance on real and synthetic datasets, comparing it against other state-of-the-art methods based on generalization and differential privacy.