Libra: High-Utility Anonymization of Event Logs for Process Mining via Subsampling

TL;DR

Libra is a novel method for anonymizing event logs in process mining that uses subsampling to improve the privacy-utility tradeoff under differential privacy, enabling more useful data sharing while protecting individual privacy.

Contribution

Libra introduces a subsampling-based approach for differentially private event log anonymization, significantly enhancing utility compared to existing methods.

Findings

Libra achieves higher utility at the same privacy level compared to baseline methods.

Subsampling amplifies privacy, allowing better data utility.

Empirical results confirm improved anonymization effectiveness.

Abstract

Process mining techniques enable analysts to identify and assess process improvement opportunities based on event logs. A common roadblock to process mining is that event logs may contain private information that cannot be used for analysis without consent. An approach to overcome this roadblock is to anonymize the event log so that no individual represented in the original log can be singled out based on the anonymized one. Differential privacy is an anonymization approach that provides this guarantee. A differentially private event log anonymization technique seeks to produce an anonymized log that is as similar as possible to the original one (high utility) while providing a required privacy guarantee. Existing event log anonymization techniques operate by injecting noise into the traces in the log (e.g., duplicating, perturbing, or filtering out some traces). Recent work on differential privacy has shown that a better privacy-utility tradeoff can be achieved by applying subsampling prior to noise injection. In other words, subsampling amplifies privacy. This paper proposes an event log anonymization approach called Libra that exploits this observation. Libra extracts multiple samples of traces from a log, independently injects noise, retains statistically relevant traces from each sample, and composes the samples to produce a differentially private log. An empirical evaluation shows that the proposed approach leads to a considerably higher utility for equivalent privacy guarantees relative to existing baselines.