An Efficient and Scalable Privacy Preserving Algorithm for Big Data and Data Streams

TL;DR

This paper introduces SEAL, a scalable and efficient privacy-preserving data perturbation algorithm using local differential privacy, suitable for big data streams from cyber-physical systems, balancing privacy and utility.

Contribution

The paper presents SEAL, a novel data perturbation algorithm based on Chebyshev interpolation and Laplacian noise, offering improved speed, scalability, and privacy-utility trade-offs.

Findings

SEAL outperforms existing algorithms in execution speed and scalability.

SEAL maintains high data utility while providing strong privacy guarantees.

Empirical results demonstrate SEAL's resistance to attacks.

Abstract

A vast amount of valuable data is produced and is becoming available for analysis as a result of advancements in smart cyber-physical systems. The data comes from various sources, such as healthcare, smart homes, smart vehicles, and often includes private, potentially sensitive information that needs appropriate sanitization before being released for analysis. The incremental and fast nature of data generation in these systems necessitates scalable privacy-preserving mechanisms with high privacy and utility. However, privacy preservation often comes at the expense of data utility. We propose a new data perturbation algorithm, SEAL (Secure and Efficient data perturbation Algorithm utilizing Local differential privacy), based on Chebyshev interpolation and Laplacian noise, which provides a good balance between privacy and utility with high efficiency and scalability. Empirical comparisons with existing privacy-preserving algorithms show that SEAL excels in execution speed, scalability, accuracy, and attack resistance. SEAL provides flexibility in choosing the best possible privacy parameters, such as the amount of added noise, which can be tailored to the domain and dataset.

Tables

Table 1. Table 1: Short descriptions of the datasets selected for testing.

Dataset	Abbreviation	Number of Records	Number of Attributes	Number of Classes
Wholesale customers333https://archive.ics.uci.edu/ml/datasets/Wholesale+customers	WCDS	440	8	2
Wine Quality444https://archive.ics.uci.edu/ml/datasets/Wine+Quality	WQDS	4898	12	7
Page Blocks Classification 555https://archive.ics.uci.edu/ml/datasets/Page+Blocks+Classification	PBDS	5473	11	5
Letter Recognition666https://archive.ics.uci.edu/ml/datasets/Letter+Recognition	LRDS	20000	17	26
Statlog (Shuttle)777https://archive.ics.uci.edu/ml/datasets/Statlog+%28Shuttle%29	SSDS	58000	9	7
HEPMASS888https://archive.ics.uci.edu/ml/datasets/HEPMASS#	HPDS	3310816	28	2
HIGGS999https://archive.ics.uci.edu/ml/datasets/HIGGS#	HIDS	11000000	28	2

Table 2. Table 2: Classification accuracies obtained when using the original dataset and the datasets perturned by three methods. During the experiments conducted using SEAL, the privacy budget ϵ italic-ϵ \epsilon was maintained at 1 1 1 . The window size w ​ s 𝑤 𝑠 ws was maintained at full length of the corresponding dataset. For example, w ​ s 𝑤 𝑠 ws of SEAL for the LRDS dataset was maintained at 20,000 during the experiments presented in this table. The last row shows the mean ranks returned by the nonparametric statistical comparison test (Friedman’s rank test on the classification accuracies) of the three methods. A larger FMR value represents better classification accuracy.

Dataset	Algorithm	MLP	IBK	SVM	Naive Bayes	J48
LRDS	Original	82.20%	95.96%	82.44%	64.01%	87.92%
	RP	74.04%	87.19%	71.07%	48.41%	64.89%
	GP	79.12%	93.05%	77.92%	59.89%	70.54%
	SEAL	80.59%	93.67%	81.71%	63.10%	85.28%
PBDS	Original	96.25%	96.02%	92.93%	90.85%	96.88%
	RP	92.00%	95.52%	89.99%	35.76%	95.61%
	GP	90.24%	95.67%	89.93%	43.10%	95.49%
	SEAL	96.34%	96.73%	95.59%	86.97%	96.34%
SSDS	Original	99.72%	99.94%	96.83%	91.84%	99.96%
	RP	96.26%	99.80%	88.21%	69.04%	99.51%
	GP	98.73%	99.81%	78.41%	79.18%	99.59%
	SEAL	99.70%	99.21%	98.51%	89.94%	99.87%
WCDS	Original	90.91%	87.95%	87.73%	89.09%	90.23%
	RP	89.09%	85.00%	82.27%	84.55%	86.82%
	GP	91.82%	86.59%	85.00%	84.32%	88.86%
	SEAL	89.32%	86.82%	89.09%	88.41%	86.59%
WQDS	Original	54.94%	64.54%	52.14%	44.67%	59.82%
	RP	47.65%	53.29%	44.88%	32.32%	45.53%
	GP	48.86%	56.88%	44.88%	32.16%	46.43%
	SEAL	53.92%	64.02%	52.02%	47.83%	84.15%
FMR Values	RP: 1.34		GP: 1.86		SEAL: 2.80

Table 3. Table 3: Attack resistance of the algorithms. During the experiments conducted using SEAL, the privacy budget ϵ italic-ϵ \epsilon was maintained at 1 1 1 . The window size w ​ s 𝑤 𝑠 ws was maintained at full length of the corresponding dataset. For example, w ​ s 𝑤 𝑠 ws of SEAL for the LRDS dataset was maintained at 20,000 during the experiments presented in this table. The last row provides Friedman’s mean ranks returned by the nonparametric statistical comparison test on the three methods.

Dataset	Algorithm	$N{I}_{min}$	$N{I}_{avg}$	$IC{A}_{min}$	$IC{A}_{avg}$	$I{O}_{min}$	$I{O}_{avg}$
LRDS	RP	0.8750	1.4490	0.4057	0.6942	0.0945	0.2932
	GP	1.3248	1.6175	0.6402	0.7122	0.0584	0.4314
	SEAL	1.4061	1.4148	0.7024	0.7062	0.6986	0.7056
PBDS	RP	0.7261	1.3368	0.5560	0.6769	0.0001	0.1242
	GP	0.2845	1.4885	0.1525	0.6834	0.0000	0.1048
	SEAL	1.3900	1.4084	0.7008	0.7056	0.6932	0.7031
SSDS	RP	1.2820	1.5015	0.1751	0.5909	0.0021	0.0242
	GP	1.4490	1.6285	0.0062	0.3240	0.0011	0.0111
	SEAL	1.4065	1.4119	0.7038	0.7068	0.7027	0.7068
WCDS	RP	1.0105	1.3098	0.6315	0.7362	0.0000	0.0895
	GP	1.4620	1.7489	0.1069	0.6052	0.0000	0.1003
	SEAL	1.3130	1.3733	0.6775	0.7053	0.6557	0.6930
WQDS	RP	1.2014	1.4957	0.4880	0.7062	0.0057	0.4809
	GP	1.3463	1.6097	0.3630	0.6536	0.0039	0.4025
	SEAL	1.3834	1.4138	0.7018	0.7053	0.6859	0.7026
FMR Values		RP: 1.68		GP: 1.75		SEAL: 2.57

Table 4. Table 4: Scalability results (in seconds) of the three methods for high dimensional data.

Dataset	RP	GP	DC (k=10,000)	SEAL ($ws$=10,000)
HPDS	NC within 100h	NC within 100h	526.1168	97.8238
HIDS	NC within 100h	NC within 100h	6.42E+03	1.02E+03

Equations

$$\left[\begin{array}{c}b\\ m\end{array}\right]={\left[\begin{array}{cc}n& \left({\sum }_{i=1}^n{x}_i\right)\\ \left({\sum }_{i=1}^n{x}_i\right)& \left({\sum }_{i=1}^n{x}_i^2\right)\end{array}\right]}^{-1}\left[\begin{array}{c}{\sum }_{i=1}^n{y}_i\\ {\sum }_{i=1}^n{x}_i{y}_i\end{array}\right]$$

$$Pr[(M(x)\in S)]\le \exp (ϵ)Pr[(M(y)\in S)]+\delta$$

$$Pr[A(v_1)\in Q]\le \exp (ϵ)Pr[A(v_2)\in Q]$$

$$\Delta f=max\{\Vert f(x)-f(y){\Vert }_1\}$$

$$PF(D)=F(D)+Lap(\frac{\Delta f}{ϵ})$$

$$PF(D)=\frac{ϵ}{2\Delta f}{e}^{-\frac{|x-F(D)|}{\Delta F}}$$

$$\hat{f}(x)=a_1{\phi }_1(x)+a_2{\phi }_2(x)+\cdots +a_m{\phi }_m(x)$$

$$CA=B$$

$$C=\left[\begin{array}{cccc}{m}_{11}& m_{12}& m_{13}& m_{14}\\ m_{21}& m_{22}& m_{23}& m_{24}\\ m_{31}& m_{32}& m_{33}& m_{34}\\ m_{41}& m_{42}& m_{43}& m_{44}\text{par}\end{array}\right]$$

$$A={\left[a_1,a_2,a_3,a_4\right]}^T$$

$$B={\left[b_1,b_2,b_3,b_4\right]}^T$$

$$T_n(x)=cosn\theta \text{ when }x=cos\theta$$

$$T_0(x)=1$$

$$T_1(x)=x$$

$$T_2(x)=2x^2-1$$

$$T_3(x)=4x^3-3x$$

$$T_4(x)=8x^4-8x^2+1$$

$$T_{n+1}(x)=2x{T}_n(x)-T_{n-1}(x)$$

$$R^2\equiv \sum {\left[f(x_i,a_1,a_2,\dots ,a_n)-y_i\right]}^2$$

$$E=\sqrt{\frac{1}{n}\sum _{i=1}^n{\left[f(x_i,a_1,a_2,\dots ,a_n)-y_i\right]}^2}$$

$$E=\sqrt{\frac{1}{n}\sum _{i=1}^n{\left[\hat{f}(x_i,a_1,a_2,\dots ,a_n)-y_i\right]}^2}$$

$$\frac{\partial (R^2)}{\partial a_i}=0$$

$$R^2=\sum _{i=1}^n{\left[m{x}_i+b-y_i\right]}^2$$

$$\frac{\partial R^2}{\partial b}=0$$

$$\frac{\partial R^2}{\partial m}=0$$

$$\frac{\partial R^2}{\partial b}=\sum _{i=1}^{n}2\left[m{x}_i+b-y_i\right]$$

$$\frac{\partial R^2}{\partial m}=\sum _{i=1}^{n}2\left[m{x}_i^2+b{x}_i-x_i{y}_i\right]$$

$$\begin{array}{r}nb+\left(\sum _{i=1}^n{x}_i\right)m=\sum _{i=1}^n{y}_i\\ \left(\sum _{i=1}^n{x}_i\right)b+\left(\sum _{i=1}^n{x}_i^2\right)m=\sum _{i=1}^n{x}_i{y}_i\end{array}$$

$$\left[\begin{array}{cc}n& \left({\sum }_{i=1}^n{x}_i\right)\\ \left({\sum }_{i=1}^n{x}_i\right)& \left({\sum }_{i=1}^n{x}_i^2\right)\end{array}\right]\left[\begin{array}{c}b\\ m\end{array}\right]=\left[\begin{array}{c}{\sum }_{i=1}^n{y}_i\\ {\sum }_{i=1}^n{x}_i{y}_i\end{array}\right]$$

$$\left[\begin{array}{c}b\\ m\end{array}\right]={\left[\begin{array}{cc}n& \left({\sum }_{i=1}^n{x}_i\right)\\ \left({\sum }_{i=1}^n{x}_i\right)& \left({\sum }_{i=1}^n{x}_i^2\right)\end{array}\right]}^{-1}\left[\begin{array}{c}{\sum }_{i=1}^n{y}_i\\ {\sum }_{i=1}^n{x}_i{y}_i\end{array}\right]$$

$$\hat{f}(x)=a_1{\phi }_1(x)+a_2{\phi }_2(x)+\cdots +a_m{\phi }_m(x)$$

$${\phi }_1(x)=T_0(x)=1$$

$${\phi }_2(x)=T_1(x)=x$$

Full text

A vast amount of valuable data is produced and is becoming available for analysis as a result of advancements in smart cyber-physical systems. The data comes from various sources, such as healthcare, smart homes, smart vehicles, and often includes private, potentially sensitive information that needs appropriate sanitization before being released for analysis. The incremental and fast nature of data generation in these systems necessitates scalable privacy-preserving mechanisms with high privacy and utility. However, privacy preservation often comes at the expense of data utility. We propose a new data perturbation algorithm, SEAL (Secure and Efficient data perturbation Algorithm utilizing Local differential privacy), based on Chebyshev interpolation and Laplacian noise, which provides a good balance between privacy and utility with high efficiency and scalability. Empirical comparisons with existing privacy-preserving algorithms show that SEAL excels in execution speed, scalability, accuracy, and attack resistance. SEAL provides flexibility in choosing the best possible privacy parameters, such as the amount of added noise, which can be tailored to the domain and dataset.

††journal: Journal of Computers $\&$ Security

1 Introduction

Smart cyber-physical systems (SCPS) such as smart vehicles, smart grid, smart healthcare systems, and smart homes are becoming widely popular due to massive technological advancements in the past few years. These systems often interact with the environment to collect data mainly for analysis, e.g. to allow life activities to be more intelligent, efficient, and reliable [1]. Such data often includes sensitive details, but sharing confidential information with third parties can lead to a privacy breach. From our perspective, privacy can be considered as “Controlled Information Release” [2]. We can define a privacy breach as the release of private/confidential information to an untrusted environment. However, sharing the data with external parties may be necessary for data analysis, such as data mining and machine learning. Smart cyber-physical systems must have the ability to share information while limiting the disclosure of private information to third parties. Privacy-preserving data sharing and privacy-preserving data mining face significant challenges because of the size of the data and the speed at which data are produced. Robust, scalable, and efficient solutions are needed to preserve the privacy of big data and data streams generated by SCPS  [3, 4]. Various solutions for privacy-preserving data mining (PPDM) have been proposed for data sanitization; they aim to ensure confidentiality and privacy of data during data mining  [5, 6, 7, 8].

The two main approaches of PPDM are data perturbation  [9, 10] and encryption  [11, 12]. Although encryption provides a strong notion of security, due to its high computation complexity [13] it can be impractical for PPDM of SCPS-generated big data and data streams. Data perturbation, on the other hand, applies certain modifications such as randomization and noise addition to the original data to preserve privacy [14]. These modification techniques are less complex than cryptographic mechanisms [15]. Data perturbation mechanisms such as noise addition [16] and randomization [17] provide efficient solutions towards PPDM. However, the utility of perturbed data cannot be 100% as data perturbation applies modifications to the original data, and the ability to infer knowledge from the perturbed data can result in a certain level of privacy leak as well. A privacy model [18] describes the limitations to the utility and privacy of a perturbation mechanism. Examples of such earlier privacy models include $k-anonymity$ [19, 20] and $l-diversity$ [21]. However, it has been shown that older privacy models are defenseless against certain types of attacks, such as minimality attacks [22], composition attacks [23] and foreground knowledge [24] attacks. Differential privacy (DP) is a privacy model that provides a robust solution to these issues by rendering maximum privacy via minimizing the chance of private data leak [25, 26, 27, 28]. Nevertheless, current DP mechanisms fail for small databases and have limitations on implementing efficient solutions for data streams and big data. When the database is small, the utility of DP mechanisms diminishes due to insufficient data being available for a reasonable estimation of statistics [29]. At the other end of the scale, when the database is very large or continuously growing like in data streams produced by SCPS, the information leak of DP mechanisms is high due to the availability of too much information [30]. Most perturbation mechanisms tend to leak information when the data is high-dimensional, which is a consequence of the dimensionality curse [31]. Moreover, the significant amount of randomization produced by certain DP algorithms results in low data utility. Existing perturbation mechanisms often ignore the connection between utility and privacy, even though improvement of one leads to deterioration of the other [32]. Furthermore, the inability to efficiently process high volumes of data and data streams makes the existing methods unsuitable for privacy-preservation in smart cyber-physical systems. New approaches which can appropriately answer the complexities in privacy preservation of SCPS generated data are needed.

The main contribution of this paper is a robust and efficient privacy-preserving algorithm for smart cyber-physical systems, which addresses the issues existing perturbation algorithms have. Our solution, SEAL (Secure and Efficient data perturbation Algorithm utilizing Local differential privacy), employs polynomial interpolation and notions of differential privacy. SEAL is a linear perturbation system based on Chebyshev polynomial interpolation, which allows it to work faster than comparable methods. We used generic datasets retrieved from the UCI data repository111https://archive.ics.uci.edu/ml/index.php to evaluate SEAL’s efficiency, scalability, accuracy, and attack resistance. The results indicate that SEAL performs well at privacy-preserving data classification of big data and data streams. SEAL outperforms existing alternative algorithms in efficiency, accuracy, and data privacy, which makes it an excellent solution for smart system data privacy preservation.

The rest of the paper is organized as follows. Section 2 provides a summary of existing related work. The fundamentals of the proposed method are briefly discussed in Section 3. Section 4 describes the technical details of SEAL. Section 5 presents the experimental settings and provides a comparative analysis of the performance and security of PABIDOT. The results are discussed in Section 6, and the paper is concluded in Section 7. Detailed descriptions of the underlying concepts of SEAL are given in the Appendices.

2 Related Work

Smart cyber-physical systems (SCPS) have become an important part of the IT landscape. Often these systems include IoT devices that allow effective and easy acquisition of data in areas such as healthcare, smart cities, smart vehicles, and smart homes [1]. Data mining and analysis are among the primary goals of collecting data from SCPS. The infrastructural extensions of SCPSs have contributed to the exponential growth in the number of IoT sensors, but security is often overlooked, and the devices become a source of privacy leak. The security and privacy concerns of big data and data streams are not entirely new, but require constant attention due to technological advancements of the environments and the devices used [33]. Confidentiality, authentication, and authorization are just a few of the concerns [34, 35, 36]. Many studies have raised the importance of privacy and security of SCPS due to their heavy use of personally identifiable information (PII) [37]. Controlling access via authentication [38], attribute-based encryption [39], temporal and location-based access control [38] and employing constraint-based protocols [40] are some examples of improving privacy of SCPS.

In this paper, our primary target is maintaining privacy when sharing and mining data produced by SCPSs, and the focus is on “controlled information release”. Literature shows different attempts to impose constraints on data release and analysis in order to preserve privacy [41]. Data encryption and data perturbation-based solutions have proven to be more viable for privacy-preserving data publishing and analysis than methods based on authentication and authorization [42]. Some recent examples for encryption based privacy-preserving approaches for cloud computing include PPM  [43], Sca-PBDA [44] and TDPP [45], which provide scalable privacy-preserving data processing infrastructures. However, cryptographic mechanisms are less popular in PPDM for “controlled information release” due to the high computational complexity, hence not suitable for resource-constrained devices. Perturbing the instances of the original data by introducing noise or randomization is called input perturbation [46, 41], whereas perturbing the outputs of a query or analysis using noise addition or rule hiding is called output perturbation. Unidimensional perturbation and multidimensional perturbation [46, 47, 48, 49] are the two main types of input perturbation classes. Examples for unidimensional perturbation include but are not limited to additive perturbation [16], randomized response [50], and swapping [51]. Condensation [52], random rotation [9], geometric perturbation [10], random projection [48], and hybrid perturbation are types of multidimensional perturbation [41]. Microaggregation[53] can be considered as a hybrid perturbation mechanism that possesses both unidimensional and multidimensional perturbation capabilities.

As privacy models evolved, the limits of privacy imposed by particular mechanisms were evaluated [18], and new models were defined to overcome the issues of their predecessors. For example, $l-diversity$ [21] was defined to overcome the shortcomings of $k-anonymity$ [19], then $(\alpha,k)-anonymity$ [54], $t-closeness$ [55] were proposed as further improvements. However, all these models eventually exhibited vulnerabilities to different attacks such as minimality [22], composition [23] and foreground knowledge [24] attacks. Moreover, these models were not scalable enough to address the curse of dimensionality presented by big data and data streams [31, 56], hence resulted in higher privacy leak [31]. In recent years differential privacy (DP) has drawn much attention as a powerful privacy model due to its inherent strong privacy guarantee. Differential privacy that is achieved via output perturbation is known as global differential privacy (GDP), whereas differential privacy achieved using input perturbation is known as local differential privacy (LDP). Laplacian mechanism and randomized response are two of the most frequently employed data perturbation methods used to achieve GDP and LDP [57, 17]. LDP permits full or partial data release allowing the analysis of the perturbed data [58, 59], while GDP requires a trusted curator who enforces differential privacy by applying noise or randomization on results generated by running queries or by analysis of the original data [58]. Nevertheless, LDP algorithms are still at a rudimentary stage when it comes to full or partial data release of real-valued numerical data, and the complexity of selecting the domain of randomization with respect to a single data instance is still a challenge [60, 61, 29]. Consequently, existing DP mechanisms are not suitable for differentially private data release.

Two important characteristics that determine the robustness of a particular perturbation mechanism are the ability to (1) protect against data reconstruction attacks and (2) perform well when high dimensional datasets and data streams are introduced. A data reconstruction attack tries to re-identify the individual owners of the data by reconstructing the original dataset from the perturbed dataset. Data reconstruction attacks are normally custom built for different perturbation methods using the properties of the perturbation mechanisms to restore the original data systematically. Different perturbation scenarios are vulnerable to different data reconstruction attacks. Principal component analysis [62], maximum likelihood estimation [63], known I/O attack [64], ICA attack [65] and known sample attack [64] are some examples of common data reconstruction attacks. For example, additive perturbation is vulnerable to principal component analysis [66] and maximum likelihood estimation [66], whereas multiplicative data perturbation methods are vulnerable to known input/output (I/O) attacks, known sample attacks and ICA attacks. These reconstruction attacks exploit the high information leak due to the dimensionality curse associated with high-dimensional data. In addition to providing extra information to the attacker, high-dimensional data also exponentially increases the amount of necessary computations [31, 21, 9, 10].

The literature shows methods that try to provide privacy-preserving solutions for data streams and big data by addressing the dimensionality curse in data streams. Recent attempts include a method proposing steered microaggregation to anonymize a data stream to achieve $k-anonymity$ [67], but the problem of information leak inherent in $k-anonymity$ in case of high dimensional data can be a shortcoming of the method. Xuyun Zhang et al. [68] introduced a scalable data anonymization with MapReduce for big data privacy preservation. The proposed method first splits an original data set into partitions that contain similar data records in terms of quasi-identifiers and then locally recodes the data partitions by the proximity-aware agglomerative clustering algorithm in parallel which limits producing sufficient utility for data streams such as produced by SCPS. Further, the requirement of advanced processing capabilities precludes its application to resource-constrained devices. Data condensation is another contender for data stream privacy preservation [69]. The problem, in this case, is that when the method parameters are set to achieve high accuracy (using small spatial locality), the privacy of the data often suffers. $P^{2}RoCAl$ is a privacy preservation algorithm that provides high scalability for data streams and big data composed of millions of data records. $P^{2}RoCAl$ is based on data condensation and random geometric transformations. Although $P^{2}RoCAl$ provides linear complexity for the number of tuples, the computational complexity increases exponentially for the number of attributes [70]. PABIDOT is a scalable privacy preservation algorithm for big data  [71]. PABIDOT comes with a new privacy model named $\Phi-separation$, which facilitates full data release with optimum privacy protection. PABIDOT can process millions of records efficiently as it has linear time complexity for the number of instances. However, PABIDOT also shows exponential time complexity for the number of attributes of a dataset [71]. Other examples include the use of a Naive Bayesian Classifier for private data streams [72], and the method to efficiently and effectively track the correlation and autocorrelation structure of multivariate streams and leverage it to add noise to preserve privacy [73]. The latter methods are also vulnerable to data reconstruction attacks such as principal component analysis-based attacks.

The complex dynamics exhibited by SCPS require efficient privacy preservation methods scalable enough to handle exponentially growing databases and data streams such as IoT stream data. Existing privacy-preserving mechanisms have difficulties in maintaining the balance between privacy and utility while providing sufficient efficiency and scalability. This paper tries to fill the gap, and proposes a privacy-preserving algorithm for SCPS which solves the existing issues.

3 Fundamentals

In this section, we provide some background and discuss the fundamentals used in the proposed method (SEAL). Our approach is generating a privacy-preserved version of the dataset in question, and allowing only the generated dataset to be used in any application. We use Chebyshev interpolation based on least square fitting to model a particular input data series, and the model formation is subjected to noise addition using the Laplacian mechanism used in differential privacy. The noise integrated model is then used to synthesize a perturbed data series which approximate the properties of the original input data series.

3.1 Chebyshev Polynomials of the First Kind

For the interpolation of the input dataset, we use Chebyshev Polynomials of the First Kind. These polynomials are a set of orthogonal polynomials as given by Definition 3 (available in A)  [74]. Chebyshev polynomials are a sequence of orthonormal polynomials that can be defined recursively. Polynomial approximation and numerical integration are two of the areas where Chebyshev polynomials are heavily used [74]. More details on Chebyshev polynomials of the first kind can be found in A.

3.2 Least Squares Fitting

Least squares fitting (LSF) is a mathematical procedure which minimizes the sum of squares of the offsets of the points from the curve to find the best-fitting curve to a given set of points. We can use vertical least squares fitting which proceeds by finding the sum of squares of the vertical derivations $R^{2}$ (refer Equation 19 in B) of a set of $n$ data points [75]. To generate a linear fit considering $f(x)=mx+b$, we can minimize the expression of squared error between the estimated values and the original values (refer Equation 23), which proceeds to obtaining the linear system shown in Equation 1 (using Equations 26 and 27). We can solve Equation 1 to find values of $a$ and $b$ to obtain the corresponding linear fit of $f(x)=mx+b$ for a given data series.

[TABLE]

3.3 Differential Privacy

Differential Privacy (DP) is a privacy model that defines the bounds to how much information can be revealed to a third party or adversary about someone’s data being present or absent in a particular database. Conventionally, $\epsilon$ (epsilon) and $\delta$ (delta) are used to denote the level of privacy rendered by a randomized privacy preserving algorithm ($M$) over a particular database ($D$). Let us take two $x$ and $y$ adjacent datasets of $D$, where $y$ differs from $x$ only by one person. Then $M$ satisfies ($\epsilon$, $\delta$)-differential privacy if Equation (2) holds.

Privacy Budget and Privacy Loss ($\epsilon$): $\epsilon$ is called the privacy budget that provides an insight into the privacy loss of a DP algorithm. When the corresponding $\epsilon$ value of a particular differentially private algorithm $A$ is increased, the amount of noise or randomization applied by $A$ on the input data is decreased. The higher the value of $\epsilon$, the higher the privacy loss.

Probability to Fail a.k.a. Probability of Error ($\delta$): $\delta$ is the parameter that accounts for ”bad events” that might result in high privacy loss; $\delta$ is the probability of the output revealing the identity of a particular individual, which can happen $n\times\delta$ times where $n$ is the number of records. To minimize the risk of privacy loss, $n\times\delta$ has to be maintained at a low value. For example, the probability of a bad event is 1% when $\delta=\frac{1}{100\times n}$.

Definition 1**.**

A randomized algorithm $M$ with domain $N^{|X|}$ and range $R$ is ($\epsilon$, $\delta$)-differentially private for $\delta\geq 0$, if for every adjacent $x$, $y$ $\in$ $N^{|X|}$ and for any subset $S\subseteq R$

[TABLE]

3.4 Global vs. Local Differential Privacy

Global differential privacy (GDP) and local differential privacy (LDP) are the two main approaches to differential privacy. In the GDP setting, there is a trusted curator who applies carefully calibrated random noise to the real values returned for a particular query. The GDP setting is also called the trusted curator model [76]. Laplace mechanism and Gaussian mechanism [57] are two of the most frequently used noise generation methods in GDP [57]. A randomized algorithm, $M$ provides $\epsilon$-global differential privacy if for any two adjacent datasets $x,y$ and $S\subseteq R$, $Pr[(M(x)\in S)]\leq\exp(\epsilon)Pr[(M(y)\in S)]+\delta$ (i.e. Equation (2) holds). On the other hand, LDP eliminates the need of a trusted curator by randomizing the data before the curator can access them. Hence, LDP is also called the untrusted curator model  [59]. LDP can also be used by a trusted party to randomize all records in a database at once. LDP algorithms may often produce too noisy data, as noise is applied commonly to achieve individual record privacy. LDP is considered to be a strong and rigorous notion of privacy that provides plausible deniability. Due to the above properties, LDP is deemed to be a state-of-the-art approach for privacy-preserving data collection and distribution. A randomized algorithm $A$ provides $\epsilon$-local differential privacy if Equation (3) holds  [60].

Definition 2**.**

A randomized algorithm $A$ satisfies $\epsilon$-local differential privacy, if for all pairs of inputs $v_{1}$ and $v_{2}$, for all $Q\subseteq Range(A)$ and for ($\epsilon\geq 0$) Equation (3) holds. $Range(A)$ is the set of all possible outputs of the randomized algorithm $A$.

[TABLE]

3.5 Sensitivity

Sensitivity is defined as the maximum influence that a single individual data item can have on the result of a numeric query. Consider a function $f$, the sensitivity ($\Delta f$) of $f$ can be given as in Equation (4) where x and y are two neighboring databases (or in LDP, adjacent records) and $\lVert.\rVert_{1}$ represents the $L1$ norm of a vector [77].

[TABLE]

3.6 Laplace Mechanism

The Laplace mechanism is considered to be one of the most generic mechanisms to achieve differential privacy [57]. Laplace noise can be added to a function output ($F(D)$) as given in Equation (6) to produce a differentially private output. $\Delta f$ denotes the sensitivity of the function $f$. In the local differentially private setting, the scale of the Laplacian noise is equal to $\Delta f/\epsilon$, and the position is the current input value ($F(D)$).

[TABLE]

[TABLE]

4 Our Approach

The proposed method, SEAL, is designed to preserve the privacy of big data and data streams generated by systems such as smart cyber-physical systems. One of our aims was balancing privacy and utility, as they may adversely affect each other. For example, the spatial arrangement of a dataset can potentially contribute to its utility in data mining, as the results generated by the analysis mechanisms such as data classification and clustering are often influenced by the spatial arrangement of the input data. However, the spatial arrangement can be affected when privacy mechanisms apply methods like randomization. In other words, while data perturbation mechanisms improve privacy, at the same time they may reduce utility. Conversely, an increasing utility can detrimentally affect privacy. To address these difficulties, SEAL processes the data in three steps: (1) determine the sensitivity of the dataset to calibrate how much random noise is necessary to provide sufficient privacy, (2) conduct polynomial interpolation with calibrated noise to approximate a noisy function over the original data, and (3) use the approximated function to generate perturbed data. These steps guarantee that SEAL applies enough randomization to preserve privacy while preserving the spatial arrangement of the original data. SEAL uses polynomial interpolation accompanied by noise addition, which is calibrated according to the instructions of differential privacy. We use the first four orders of the Chebyshev polynomial of the first kind in the polynomial interpolation process. Then we calibrate random Laplacian noise to apply a stochastic error to the interpolation process, in order to generate the perturbed data. Figure 1 shows the integration of SEAL in the general purpose data flow of SCPS. As shown in the figure, the data perturbed by the SEAL layer comes directly from the SCPS. That means that the data in the storage module has already gone through SEAL’s privacy preservation process and does not contain any original data.

Figure 2 shows the flow of SEAL where the proposed noisy Chebyshev model (represented by a green note) is used to approximate each of the individual attributes of a particular input dataset or data stream. The approximated noisy function is used to synthesize perturbed data, which is then subjected to random tuple shuffling to reduce the vulnerability to data linkage attacks.

4.1 Privacy-Preserving Polynomial Interpolation for Noisy Chebyshev Model Generation

We approximate an input data series (experimental data) by a functional expression with added randomization in order to inherit the properties of differential privacy. For approximation, our method uses the first four orders of Chebyshev polynomials of the first kind. We systematically add calibrated random Laplacian noise in the interpolation process, i.e. apply randomization to the approximation. Then we use the approximated function to re-generate the dataset in a privacy-preserving manner. We can denote an approximated function $\hat{f}$ of degree $(m-1)$ using Equation 7, where the degree of $(\varphi_{k})$ is $k-1$. For the approximation, we consider the root mean square error (RMSE) $E$ between the estimated values and the original values (refer to Equation 44). We use the first four Chebyshev polynomials of the first kind for the approximation, which limits the number of coefficients to four (we name the coefficients as $a_{1},a_{2},a_{3},$ and $a_{4}$). Now we can minimize $E$ (the RMSE) to obtain an estimated function $\hat{f}^{*}(x)$, thus seeking to minimize the squared error $M(a_{1},a_{2},a_{3},a_{4})$. For more details refer to Equation 45, where $a_{1},a_{2},\dots,a_{m}$ are coefficients and $\varphi_{1}(x),\varphi_{2}(x),\dots,\varphi_{m}(x)$ are Chebyshev polynomials of first kind.

[TABLE]

4.1.1 Introducing privacy to the approximation process utilizing differential privacy (the determination of the sensitivity and the position of Laplacian noise)

We apply the notion of differential privacy to the private data generation process by introducing randomized Laplacian noise to the root mean square error (RMSE) minimization process. Random Laplacian noise introduces a calibrated randomized error in deriving the values for $a_{1},a_{2},a_{3},$ and $a_{4}$ with an error (refer to Equations 52, 55, 58 and 61). We add Laplacian noise with a sensitivity of 1, as the input dataset is normalized within the bounds of 0 and 1, which restricts the minimum output to 0 and maximum output to 1 (refer to Equation (50)). We select the position of Laplacian noise to be 0, as the goal is to keep the local minima of RMSE around 0. We can factorize the noise introduced squared error minimization equations to form a linear system which can be denoted by Equation 8. $C$ is the coefficient matrix obtained from the factorized expressions, $A$ is the coefficient vector obtained from $M$, and $B$ is the constant vector obtained from the factorized expressions (refer Equations 54, 57, 60, and 63 where $m_{ij}$ denote the coefficients and $b_{i}$ denote the constants).

[TABLE]

Where,

[TABLE]

[TABLE]

[TABLE]

Now we solve the corresponding linear system (formed using Equations 65-67), to obtain noisy values for $a_{1},a_{2},a_{3}$, and $a_{4}$ in order to approximate the input data series with a noisy function. The results will differ each time we calculate the values for $a_{1},a_{2},a_{3}$, and $a_{4}$ as we have randomized the process of interpolation by adding randomized Laplacian noise calibrated using a user-defined $\epsilon$ value.

4.2 Algorithmic Steps of SEAL for Static Data and Data Streams

Algorithm 1 presents the systematic flow of steps in randomizing the data to produce a privacy-preserving output. The algorithm accepts input dataset ($D$), privacy budget $\epsilon$ (defined in Equation 51), window size ($ws$) and threshold ($t$) as the input parameters. The window size defines the number of data instances to be perturbed in one cycle of randomization. The window size of a data stream is essential to maintain the speed of the post-processing analysis/modification (e.g. data perturbation, classification, and clustering) done to the data stream [78]. For static data sets, the threshold is maintained with a default value of $-1$. For a static dataset, $t=-1$ ignores that a specific number of perturbed windows need to be released before the whole dataset is completed. In the case of data streams, the window size ($ws$) and the threshold $t$ are useful as $ws$ can be maintained as a data buffer and $t$ can be specified with a certain number to let the algorithm know that it has to release every $t$ number of processed windows. Maintaining $t$ is important for data streams because data streams are growing infinitely in most cases, and the algorithm makes sure that the data is released in predefined intervals.

According to conventional differential privacy, the acceptable values of $\epsilon$ should be within a small range, ideally in the interval of ($0,9$] [79]. Due to the lower sensitivity of the interpolation process, increasing $\epsilon$ greater than $2$ may lower privacy. It is the users’ responsibility to decrease or increase $\epsilon$ depending on the requirements. We suggest an $\epsilon$ of $1$ to have a balance between privacy and utility. If the user chooses an $\epsilon$ value less than $1$, the algorithm will provide higher randomization, hence providing higher privacy and lower utility, whereas lower privacy and a higher utility will be provided in case of an $\epsilon$ value higher than $1$. The selection of $ws$ depends specifically on the size of the particular dataset. A comparably larger $ws$ can be chosen for a large dataset, while $ws$ can be smaller for a small dataset. For a static dataset, $ws$ can range from a smaller value such as one-tenth the size of the dataset to the full size of the dataset. The minimum value of $ws$ should not go down to a small value (e.g. $<100$) because it increases the number of perturbation cycles and introduces an extreme level of randomization to the input dataset, resulting in poor utility. For a data stream, $ws$ is considered as the buffer size and can range from a smaller value to any number of tuples that fit in the memory of the computer. Further discussions on selecting suitable values for $\epsilon$ and $ws$ is provided in Section 5.2.1.

4.3 A use case: SEAL integration in a healthcare smart cyber-physical system

Biomedical and healthcare systems provide numerous opportunities and challenges for SCPS. Intelligent operating rooms and hospitals, image-guided surgery and therapy, fluid flow control for medicine and biological assays and the development of physical and neural prostheses are some of the examples for biomedical and healthcare systems which can be effectively facilitated and improved using SCPS [80]. However, biomedicine and healthcare data can contain a large amount of sensitive, personal information. SEAL provides a practical solution and can impose privacy in such scenarios to limit potential privacy leak from such systems [80].

Figure 3 shows a use case for SEAL integration in a healthcare smart cyber-physical system. Patients can have several sensors attached to them for recording different physical parameters. The recorded data are then transmitted to a central unit which can be any readily available digital device such as a smartphone, a personal computer, or an embedded computer. A large variety of sensors are available today, e.g. glucose monitors, blood pressure monitors [81]. In the proposed setting, we assume that the processing unit that runs SEAL, perturbs all sensitive inputs forwarded to the central unit. As shown in the figure, we assume that the central units do not receive any unperturbed sensitive information, and the data repositories will store only perturbed data, locally or in a remote data center. Data analysts can access and use only the perturbed data to conduct their analyses. Since the data is perturbed, adversarial attacks on privacy will not be successful.

5 Experimental Results

In this section, we discuss the experimental setup, resources used, experiments, and their results. The experiments were conducted using seven datasets retrieved from the UCI data repository222https://archive.ics.uci.edu/ml/index.php. We compare the results of SEAL against the results of rotation perturbation (RP), geometric perturbation (GP) and data condensation (DC). For performance comparison with SEAL, we selected GP and RP when using static datasets, while DC was used with data streams. The main reason for selecting GP, RP, and DC is that they are multidimensional perturbation mechanisms that correlate with the technique used in the linear system of SEAL as given in Equation 64. Figure 4 shows the analytical setup which was used to test the performance of SEAL. We perturbed the input data using SEAL, RP, GP, and DC and conducted data classification experiments on the perturbed data using five different classification algorithms to test and compare utility. We used the default settings of 10 iterations with a noise factor (sigma) of 0.3 to perturb the data using RP and GP. Next, SEAL was tested for its attack resistance against naive inference, known I/O attacks, and ICA-based attacks that are based on data reconstruction. These attacks are more successful against perturbation methods that use matrix multiplications. The attack resistance results of SEAL were then compared with the attack resistance results of RP, GP, and DC. Subsequently, we tested and compared SEAL’s computational complexity and scalability by using two large datasets. Finally, we tested the performance of SEAL on data streams and compared the results with the results of DC.

5.1 Experimental Setup

For the experiments we used a Windows 10 (Home 64-bit, Build 17134) computer with Intel (R) i5-6200U (6th generation) CPU (2 cores with 4 logical threads, 2.3 GHz with turbo up to 2.8 GHz) and 8192 MB RAM. The scalability of the proposed algorithm was tested using a Linux (SUSE Enterprise Server 11 SP4) SGI UV3000 supercomputer, with 64 Intel Haswell 10-core processors, 25MB cache and 8TB of global shared memory connected by SGI’s NUMAlink interconnect. We implemented SEAL in MATLAB R2016b. The experiments on data classification were carried out on Weka 3.6 [82], which is a collection of machine learning algorithms for data mining tasks.

5.1.1 Datasets used in the experiments

A brief description of the datasets is given in Table 1. The dimensions of the datasets used for the performance testing vary from small to extremely large, to check the performance of SEAL in different circumstances. Since the current version of SEAL conducts perturbation only on numerical data; we selected only numerical datasets in which the only attribute containing non-numerical data is the class attribute.

5.1.2 Perturbation methods used for comparison

Random rotation perturbation (RP), geometric data perturbation (GP), and data condensation (DC) are three types of matrix multiplicative perturbation approaches which are considered to provide high utility in classification and clustering [83]. In RP, the original data matrix is multiplied using a random rotation matrix which has the properties of an orthogonal matrix. A rotational matrix $R$ follows the property of $R\times R^{T}=R^{T}\times R=I$, where $I$ is the identity matrix. The application of rotation is repeated until the algorithm converges at the desired level of privacy  [9]. In GP, a random translation matrix is added to the process of perturbation in order to enhance privacy. The method accompanies three components: rotation perturbation, translation perturbation, and distance perturbation  [10]. Due to the isometric nature of transformations, the perturbation process preserves the distance between the tuples, resulting in high utility for classification and clustering. RP and GP can only be used for static datasets in their current setting, due to their recursive approach to deriving the optimal perturbation. DC is specifically introduced for data streams. In DC, data are divided into multiple homogeneous groups of predefined size (accepted as user input) in such a way that the difference between the records in a particular group is minimal, and a certain level of statistical information about different records is maintained. The sanitized data is generated using a uniform random distribution based on the eigenvectors which are generated using the eigendecomposition of the characteristic covariance matrices of each homogeneous group [52].

5.1.3 Classification algorithms used in the experiments

Different classes of classification algorithms employ different classification strategies [84]. To investigate the performance of SEAL with diverse classification methods, we chose five different algorithms as the representative of different classes, namely: Multilayer Perceptron (MLP)  [82], k-Nearest Neighbor (kNN)  [82], Sequential Minimal Optimization (SMO)  [85], Naive Bayes  [82], and J48  [86], and tested SEAL for its utility in terms of classification accuracy. MLP uses back-propagation to classify instances  [82]. kNN is a non-parametric method used for classification  [82]. SMO is an implementation of John Platt’s sequential minimal optimization algorithm for training a support vector classifier  [85]. Naive Bayes is a fast classification algorithm based on probabilistic classifiers  [82]. J48 is an implementation of the decision tree based classification algorithm  [82].

5.2 Performance Evaluation of SEAL

We evaluated the performance of SEAL with regard to classification accuracy, attack resistance, time complexity, scalability, and also looked at data streams. First, we generated perturbed data using SEAL, RP, GP, and DC for the datasets: WCDS, WQDS, PBDS, LRDS, and SSDS (refer to Table 1) under the corresponding settings. The perturbed data were then used to determine classification accuracy and attack resistance for each perturbed dataset. During the classification accuracy experiments, $k$ of k-nearest neighbor (kNN) classification algorithm was kept at $1$. The aggregated results were rated using the nonparametric statistical comparison test, Friedman’s rank test, which is analogous to a standard one-way repeated-measures analysis of variance [87]. We recorded the statistical significance values, and the Friedman’s mean ranks (FMR) returned by the rank test. The time consumption of SEAL was evaluated using runtime complexity analysis. We ran SEAL on two large-scale datasets, HPDS and HIDS, to test its scalability. Finally, the performance of SEAL was tested on data streams by running it on the LRDS dataset, and the results were compared with those produced by DC.

5.2.1 Effect of randomization on the degree of privacy

One of the main features of SEAL is its ability to perturb a dataset while preserving the original shape of data distribution. We ran SEAL on the same data series to detect the effect of randomization in two different instances of perturbation. This experiment is to check and guarantee that SEAL does not publish similar perturbed data when it is applied with the same $\epsilon$ value to the same data on different occasions. This feature enables SEAL to prevent privacy leak via data linkage attacks that are exploiting multiple data releases. As depicted in Figure 5, in two separate applications, SEAL generates two distinct randomized data series, while preserving the shape of the original data series. The left-hand plot of Figure 5 shows the data generated under an $\epsilon$ of $1$, whereas the right-hand plot shows the data generated under an $\epsilon$ of $0.1$. The right plot clearly shows the effect of high randomization under the extreme level of privacy generated by a strict privacy budget ($\epsilon$) of $0.1$.

5.2.2 Dynamics of privacy budget ($\epsilon$) and window size ($ws$)

As explained in Section 5.2.1, smaller $\epsilon$ means higher randomization, which results in decreased utility. Figure 6a shows the change of classification accuracy against an increasing $\epsilon$. As shown in the figure, classification accuracy increases with an increasing privacy budget ($\epsilon$). Figure 6a shows a more predictable pattern of increasing utility (classification accuracy) against increasing $\epsilon$. The choice of a proper $\epsilon$ depends on the application requirements: a case that needs higher privacy should have a smaller $\epsilon$, while a larger $\epsilon$ will provide better utility. As it turns out, two-digit $\epsilon$ values provide no useful privacy. Given that SEAL tries to preserve the shape of the original data distribution, we recommend a range of $0.4$ to $3$ for $\epsilon$ to limit unanticipated privacy leaks. We showed that SEAL provides better privacy and utility than comparable methods under a privacy budget of $1$.

Next, we tested the effect of window size ($ws$) on classification accuracy and the magnitude of randomization performed by SEAL. As shown on Figure 6b, classification accuracy increases when $ws$ increases. When $ws$ is small, the dataset is divided into more groups than when $ws$ is large. When there is more than one group to be perturbed, SEAL applies randomization on each group distinctly. Since each of the groups is subjected to distinct randomization, the higher the number of groups, the larger the perturbation of the dataset. For smaller sizes of $ws$, SEAL will produce higher perturbation, resulting in more noise, reduced accuracy, improved privacy, and better resistance to data reconstruction attacks.

5.2.3 Classification accuracy

Table 2 provides the classification accuracies when using the original dataset and the datasets perturbed by the three methods. During the experiments for classification accuracy, we maintained $\epsilon$ at $1$ and $ws$ at the total length of the dataset. For example, if the dataset contained $n$ number of tuples, $ws$ was maintained at $n$. After producing the classification accuracies, Friedman’s rank test was conducted on the data available in Table 2 to rank the three methods: GP, RP, and SEAL. The mean ranks produced by Friedman’s rank (FR) test are presented in the last row of Table 2101010The FR test returned a $\chi^{2}$ value of 27.6566, a degree of freedom of 2 and a p-value of 9.8731e-07.. The p-value suggests that the difference between the classification accuracies of RP, GP, and SEAL are significantly different. When evaluating FMR values on classification accuracies, a higher rank means that the corresponding method tends to produce better classification results. The mean ranks indicate that SEAL provides comparatively higher classification accuracy. SEAL is capable of providing higher utility in terms of classification accuracy due to its ability to maintain the shape of the original data distribution despite the introduced randomization. Although SEAL provides better performance overall than the other two methods, we can notice that in a few cases (as shown in Table 2) SEAL has produced slightly lower classification accuracies. We assume that this is due to the effect of variable random noise applied by SEAL. However, these lower accuracies are still on par with accuracies produced by the other two methods.

5.2.4 Attack resistance

Table 3 shows the three methods’ (RP, GP, and SEAL) resistance to three attack methods: naive snooping (NI), independent component analysis (ICA) and known I/O attack (IO) [9, 83]. We used the same parameter settings of SEAL ($\epsilon=1$ and $ws$=number of tuples) which were used in classification accuracy experiments for attack resistance analysis as well. IO and ICA data reconstruction attacks try to restore the original data from the perturbed data and are more successful in attacking matrix multiplicative data perturbation. FastICA package  [88] was used to evaluate the effectiveness of ICA-based reconstruction of the perturbed data. We obtained the attack resistance values as standard deviation values of (i) the difference between the normalized original data and the perturbed data for NI, and (ii) the difference between the normalized original data and reconstructed data for ICA and IO. During the IO attack analysis, we assume that around 10% of the original data is known to the adversary. The “$min$” values under each test indicate the minimum guarantee of resistance while “$avg$” values give an impression of the overall resistance.

We evaluated the data available in Table 3 using Friedman’s rank test to generate the mean ranks for GP, RP, and SEAL. The mean ranks produced by Friedman’s rank test are given in the last row of Table 3111111The test statistics: $\chi^{2}$ value of 14.6387, a degree of freedom of 2 and a p-value of 6.6261e-04.. The p-value implies that the difference between the attack resistance values is significantly different. As for the FMR values on attack resistance, a higher rank means that the corresponding method tends to be more attack-resistant. The mean ranks suggest that SEAL provides comparatively higher security than the comparable methods against the privacy attacks.

5.2.5 Time complexity

Algorithm 1 (SEAL) has two loops. One loop is controlled by the number of data partitions resulting from the window size ($ws$), and the number of attributes controls the other loop. In a particular instance of perturbation, these two parameters ($ws$ and the number of attributes) remain constants. Let us take the contribution of both loops to the computational complexity as a constant ($k$). If we evaluate the steps of SEAL from step 11 to step 25, we can see that the highest computational complexity in these steps is $O(n)$, where $n$ is the number of tuples. From this, we can estimate the time complexity of Algorithm 1 to be $O(kn)=O(n)$. We investigated the time consumption against the number of instances and the number of attributes to determine the computational complexity empirically. Figure 7 confirms that the time complexity of SEAL is in fact $O(n)$.

5.2.6 Time complexity comparison

Both RP and GP show $O(n^{2})$ time complexity to perturb one record with $n$ attributes. The total complexity to perturb a dataset of $m$ records is $O(m\times n^{2})$. However, both RP and GP run for $r$ number of iterations (which is taken as a user input) to find the optimal perturbation instance of the dataset within the $r$ iterations. Therefore, the overall complexity is $O(m\times r\times n^{2})$. Under each iteration of $r$, the algorithms run data reconstruction using ICA and known IO attacks to find the vulnerability level of the perturbed dataset. Each attack runs another $k$ number of iterations (which is another user input) to reconstruct $k$ number of instances. Usually, $k$ is much larger than $r$. For one iteration of $k$, IO and ICA contribute a complexity of $O(n\times m)$ [89]. Hence, the overall complexity of RP or GP in producing an optimal perturbed dataset is equal to $O(m^{2}\times r\times k\times n^{3})$ which is a much larger computational complexity compared to the linear computational complexity of SEAL. Figure 8 shows the time consumption plots of the three methods plotted together on the same figure. As shown on the figures, the curves of SEAL lie almost on the x-axis due to its extremely low time consumption compared to the other two methods.

5.2.7 Scalability

We conducted the scalability analysis of SEAL on an SGI UV3000 supercomputer (a detailed specification of the supercomputer is given in Section 5.1). SEAL was tested for its scalability on two large datasets: HPDS and HIDS. The results are given in Table 4. It is apparent that SEAL is more efficient than RP, GP, and DC; in fact, RP and GP did not even converge after 100 hours (the time limit of the batch scripts were set to 100 h). Both RP and GP use recursive loops to achieve optimal perturbation, which slows down the perturbation process. Therefore, RP and GP are not suitable for perturbing big data and data streams. DC is effective in perturbing big data, but SEAL performs better by providing better efficiency and utility.

5.2.8 Performance on data streams

We checked the performance of SEAL on data streams with regard to (i) classification accuracy and (ii) $Minimum$ $STD(D-D^{p})$. The latter provides evidence to the minimum guarantee of attack resistance provided under a particular instance of perturbation. As shown in Figure 9a, the classification accuracy of SEAL increases with increasing buffer size. This property is valuable for the perturbation of infinitely growing data streams generated by systems such as smart cyber-physical systems. The figure indicates that when a data stream grows infinitely, the use of smaller window sizes would negatively affect the utility of the perturbed data. When the window size is large, the utility of the perturbed data is closer to the utility of the original data stream. We can also notice that DC performs poorly in terms of classification accuracy compared to SEAL. It was previously noticed that DC works well only for tiny buffer sizes such as $5$ or $10$ [70]. However, according to Figure 9b, the minimum guarantee of attack resistance drops when the buffer size decreases, which restricts the use of DC with smaller buffer sizes. According to Figure 9b, however, SEAL still provides a consistent minimum guarantee of attack resistance, which allows SEAL to be used with any suitable buffer size.

6 Discussion

The proposed privacy-preserving mechanism (named SEAL) for big data and data streams performs data perturbation based on Chebyshev polynomial interpolation and the application of a Laplacian mechanism for noise addition. SEAL uses the first four orders of Chebyshev polynomials of the first kind for the polynomial interpolation of a particular dataset. Although Legendre polynomials would offer a better approximation of the original data during interpolation, Chebyshev polynomials are simpler to calculate and provide improved privacy; a higher interpolation error, i.e. increased deviation from the original data would intuitively provide greater privacy than Legendre polynomials. Moreover, we intend to maintain the spatial arrangement of the original data, and this requirement is fully satisfied by Chebyshev interpolation. During the interpolation, SEAL adds calibrated noise using the Laplacian mechanism to introduce randomization, and henceforth privacy, to the perturbed data. The Laplacian noise allows the interpolation process to be performed with an anticipated random error for the root mean squared error minimization. We follow the conventions of differential privacy for noise addition, the introduction of noise is in accordance with the characteristic privacy budget $\epsilon$. The privacy budget ($\epsilon$) allows users (data curators) of SEAL to adjust the amount of noise. Smaller values of $\epsilon$ (usually less than 1 but greater than 0) add more noise to generate more randomization, whereas large values of $\epsilon$ add less noise and generate less randomization. The privacy budget is especially useful for multiple data release, where the data curator can apply proper noise in the perturbation process in consecutive data releases. SEAL’s ability to maintain the shape of the original data distribution after noise addition is a clear advantage, and enables SEAL to provide convincingly higher utility than a standard local differentially private algorithm. This characteristic may come at a price, and the privacy enforced by a standard differentially private mechanism can be a little higher than that of SEAL.

The experimental results of SEAL show that it performs well on both static data and data streams. We evaluated SEAL in terms of classification accuracy, attack resistance, time complexity, scalability, and data stream performance. We tested each of these parameters using seven datasets, five classification algorithms, and three attack methods. SEAL outperforms the comparable methods: RP, GP, and DC in all these areas, proving that SEAL is an excellent choice for privacy preservation of data produced by SCPS and related technologies. SEAL produces high utility perturbed data in terms of classification accuracy, due to its ability to preserve the underlying characteristics such as the shape of the original data distribution. Although we apply an extensive amount of noise by using a small $\epsilon$ value, SEAL still tries to maintain the shape of the original data. The experiments show that even in extremely noisy perturbation environments, SEAL can provide higher utility compared to similar perturbation mechanisms, as shown in Section 5.1. SEAL shows excellent resistance with regard to data reconstruction attacks, proving that it offers excellent privacy. SEAL takes several steps to enhance the privacy of the perturbed data, namely (1) approximation through noisy interpolation, (2) scaling/normalization, and (3) data shuffling. These three steps help it outperform the other, similar perturbation mechanisms in terms of privacy.

In Section 5.1 we showed that SEAL has linear time complexity, $O(n)$. This characteristic is crucial for big data and data streams. The scalability experiments confirm that SEAL processes big datasets and data streams very efficiently. As shown in Figure 9, SEAL also offers significantly better utility and attack resistance than data condensation. The amount of time spent by SEAL in processing one data record is around 0.03 to 0.09 milliseconds, which means that SEAL can perturb approximately 11110 to 33330 records per second. We note that runtime speed depends on the computing environment, such as CPU speed, memory speed, and disk IO speeds. The processing speed of SEAL in our experimental setup suits many practical examples of data streams, e.g. Sense your City (CITY)131313Sense your City is an urban environmental monitoring project that used crowd-sourcing to deploy sensors at 7 cities across 3 continents in 2015 with about 12 sensors per city, and it generates 7000 messages/ sec. and NYC Taxi cab (TAXI)141414NYC Taxi cab (TAXI) produces a stream of smart transportation messages at the rate of 4000 messages/sec. The messages arrive from 2M trips taken on 20,355 New York city taxis equipped with GPS in 2013.  [90]. The results clearly demonstrate that SEAL is an efficient and reliable privacy preserving mechanism for practical big data and data stream scenarios.

7 Conclusion

In this paper, we proposed a solution for maintaining data privacy in large-scale data publishing and analysis scenarios, which is becoming an important issue in various environments, such as smart cyber-physical systems. We proposed a novel algorithm named SEAL to perturb data to maintain data privacy. Linear time complexity ($O(n)$) of SEAL allows it to work efficiently with continuously growing data streams and big data. Our experiments and comparisons indicate that SEAL produces higher classification accuracy, efficiency, and scalability while preserving better privacy with higher attack resistance than similar methods. The results prove that SEAL suits the dynamic environments presented by smart cyber-physical environments very well. SEAL can be an effective privacy-preserving mechanism for smart cyber-physical systems such as vehicles, grid, healthcare systems, and homes, as it can effectively perturb continuous data streams generated by sensors monitoring an individual or group of individuals and process them on the edge/fog devices before transmission to cloud systems for further analysis.

The current configuration of SEAL does not allow distributed data perturbation, and it limits the utility only to privacy-preserving data classification. A potential future extension of SEAL can address a distributed perturbation scenario that would allow SEAL to perturb sensor outputs individually while capturing the distinct latencies introduced by the sensors. SEAL could then combine the individually perturbed data using the corresponding timestamps and latencies to produce the privacy-protected data records. Further investigation on privacy parameter tuning would allow extended utility towards other areas such as descriptive statistics.

Appendix A Chebyshev Polynomials of the First Kind

Definition 3**.**

The Chebyshev polynomial $T_{n}(x)$ of the first kind is a polynomial in $x$ of degree $n$, defined by the relation,

[TABLE]

From Equation 12, we can deduce the first five ($n=0,1,2,3,4$) Chebyshev polynomials using Equation 13 to Equation 17, which are normalized such that $T_{n}(1)=1$, and $x\in\left[-1,1\right]$.

[TABLE]

Furthermore, we can represent any Chebyshev polynomial of the first kind using the recurrence relation given in Equation 18, where $T_{0}(x)=1$ and $T_{1}(x)=x$.

[TABLE]

Appendix B Least Square Fitting

In least square fitting, vertical least squares fitting proceeds by finding the sum of squares of the vertical derivations $R^{2}$ (refer Equation 19) of a set of $n$ data points [75].

[TABLE]

Now, we can choose to minimize the quantity given in Equation 20, which can be considered as an average approximation error. This is also referred to as the root mean square error in approximating ${(x_{i},y_{i})}$ by a function $f(x_{i},a_{1},a_{2},\dots,a_{n})$.

[TABLE]

Let’s assume that $f(x)$ is in a known class of functions, $C$. It can be shown that a function $\hat{f}^{*}$ which is most likely to equal to $f$ will also minimize Equation 21 among all functions $\hat{f}(x)$ in $C$. This is called the least squares approximation to the data ${(x_{i},y_{i})}$.

[TABLE]

Minimizing E is equivalent to minimizing $R^{2}$, although the minimum values will be different. Thus we seek to minimize Equation 19, which result in the condition given in Equation 22 for $i=1,\dots,n$.

[TABLE]

Let’s consider $f(x)=mx+b$ for a linear fit. Thus we attempt to minimize Equation 23, where $b$ and $m$ are allowed to vary arbitrarily.

[TABLE]

Now, according to Equation 22, the choices of $b$ and $m$ that minimize $R^{2}$ satisfy, Equation 24 and Equation 25.

[TABLE]

Equation 24 and Equation 25 result in Equation 26 and Equation 27.

[TABLE]

[TABLE]

From Equation 26 and Equation 27, we can generate the linear system shown in Equation 28 which can be represented by the matrix form shown in Equation 29. Now, we can solve Equation 30, to find values of $a$ and $b$ to obtain the corresponding linear fit of $f(x)=mx+b$.

[TABLE]

[TABLE]

So,

[TABLE]

Appendix C Privacy-Preserving Polynomial Model Generation

Consider a dataset {$(x_{i},y_{i})|1\leq i\leq n\}$, and let

[TABLE]

where, $a_{1},a_{2},\dots,a_{m}$ are coefficients and $\varphi_{1}(x),\varphi_{2}(x),\dots,\varphi_{m}(x)$ are Chebeshev polynomials of first kind,

[TABLE]

Assume that the data $\{x_{i}\}$ are chosen from an interval $[\alpha,\beta]$. The Chebyshev polynomials can be modified as given in Equation 35,

[TABLE]

The approximated function $\hat{f}$ of degree $(m-1)$ can be given by Equation 31, where the degree of $(\varphi_{k})$ is $k-1$. We will assume the interval $[\alpha,\beta]=[0,1]$ and construct the model accordingly. According to Equation 36 when $[\alpha,\beta]=[0,1]$, we get Equation 36.

[TABLE]

From Equation 31 and Equation 36 we have the following equations for $m=4$.

[TABLE]

Equation 42 defines $\hat{f}(x)$ when $m=4$.

[TABLE]

Let the actual input be $y_{i},$ where $i=1$ to $n$. The error of the approximated input can be determined by Equation 43.

[TABLE]

We need to determine the values of $a_{1},a_{2},a_{3},$ and $a_{4}$ in such a way that the errors ($e_{i}$) are small. In order to determine the best values for $a_{1},a_{2},a_{3},$ and $a_{4}$, we use the root mean square error given in Equation 44.

[TABLE]

Let’s take the least squares fitting of $\hat{f}(x)$ of the class of functions $C$ which minimizes $E$ as $\hat{f}^{*}(x)$. We can obtain $\hat{f}^{*}(x)$ by minimizing $E$. Thus we seek to minimize $M(a_{1},a_{2},a_{3},a_{4})$ which is given in Equation 45.

[TABLE]

The values of $a_{1},a_{2},a_{3},$ and $a_{4}$ that minimize $M(a_{1},a_{2},a_{3},a_{4})$ will satisfy the expressions given in Equation 46, Equation 47, Equation 48, and Equation 49.

[TABLE]

[TABLE]

[TABLE]

[TABLE]

C.1 Utilizing differential privacy to introduce randomization to the approximation process

To decide the amount of noise, we have to determine the sensitivity of the noise addition process. Given that we add the noise to the approximated values of $\hat{f(x)}$, the sensitivity $(\Delta f)$ can be defined using Equation 50, which is the maximum difference between the highest and the lowest possible output values of $\hat{f(x)}$. Since the input dataset is normalized within the bounds of [math] and $1$, the minimum possible input or output is 0 while the maximum possible input or output is 1. Therefore, we define the sensitivity of the noise addition process to be $1$.

[TABLE]

Now we add random Laplacian to each expression given in Equations 46 - 49, according to Equation 51 with a sensitivity ($\Delta f$) of 1 and a privacy budget of $\epsilon$ as shown in Equations 52, 55, 58 and 61. In the process of adding the Laplacian noise, we choose Laplacian noise with a position (location) of [math] as the idea is to keep the local minima of RMSE around [math] during the process of interpolation. Here we try to randomize the process of obtaining the local minima of the mean squared error to generate the value for the coefficients $(a_{1},a_{2},a_{3},a_{4})$ with randomization. The differentially private Laplacian mechanism can be represented by Equation 51, where $\Delta f$ is the sensitivity of the process, and $\epsilon$ is the privacy budget.

[TABLE]

Equation 52 shows the process of using the Laplacian mechanism to introduce noise to the RMSE minimization of the polynomial interpolation process. Here, we try to introduce an error to the partial derivative of Equation 45 with respect to $a_{1}$. By doing so, it guarantees that Equation 52 contributes with an error to the process of finding the coefficients for $a_{1},a_{2},a_{3},$ and $a_{4}$, which is given in Equation 66. Since the sensitivity ($\Delta f$) of the noise addition process is $1$, as defined in Equation 50, the scale (spread) of the Laplacian noise is $1/\epsilon$. We restrict the position ($\mu$) of the Laplacian noise at [math] as the goal is to achieve the global minima keeping the RMSE at 0 after the randomization.

[TABLE]

After applying the partial derivation on Equation 52 with respect to $a_{1}$, we can obtain Equation 53 which leads to obtaining Equation 54.

[TABLE]

Let’s use $m_{ij}$ to denote the coefficients, and $b_{i}$ to represent the constants in the right hand side of the equal symbol in the factorised Equations 54, 57, 60, and 63.

[TABLE]

We repeat the same process of applying noise in Equation 52 to apply noise to Equation 47.

[TABLE]

After solving Equation 55, we can obtain Equation 56 which leads to obtaining Equation 57.

[TABLE]

[TABLE]

Similarly, we can obtain Equation 60 and Equation 63 after introducing the calibrated Laplacian noise to Equation 48 and Equation 49 respectively.

[TABLE]

[TABLE]

[TABLE]

[TABLE]

[TABLE]

[TABLE]

Let’s consider the coefficients ($m_{ij}$) and the constants ($b_{i}$) in the Equations 54, 57, 60, and 63. Using $m_{ij}$ and $b_{i}$ we can form a linear system which can be denoted by Equation 64.

[TABLE]

Where,

[TABLE]

[TABLE]

[TABLE]