|
Summary总结
本文的背景是许多组织为了公共卫生和人口研究等目的发布微数据。虽然明确标识个人的属性通常被删除，但这些数据库有时可以与属性上的其他公共数据库连接，以重新标识应该保持匿名的个人。通过互联网提供其他补充数据库，使“加入”攻击更加容易。因此，Kristen Lefevre、David J.Dewitt和Raghu Ramakrishnan在他们的论文中指出，K匿名化是一种通过归纳和/或抑制部分发布的微数据来防止加入攻击的技术。
The background of this paper is that a number of organizations publish microdata for purposes such as public health and demographic research. Although attributes that clearly identify individuals are generally removed, these databases can sometimes be joined with other public databases on attributes to re-identify individuals who were supposed to remain anonymous. “Joining” attacks are made easier by the availability of other, complementary, databases over the Internet. Therefore, Kristen LeFevre, David J.Dewitt and Raghu Ramakrishnan in their paper pointed that the K-anonymization is a technique that prevents joining attacks by generalizing and/or suppressing portions of the released microdata.
本文首先以病人表为例进行分析。在本例中，名称作为移除属性。这种属性组合的独特性导致了一类攻击，通过连接多个（通常是公开可用的）数据集来“重新识别”数据。此外，在这个运行的示例中，攻击可以通过在三个数据集（包括生日、性别和邮政编码）上加入两个数据库来确定一个人的医疗信息。通过这个例子的说明，我们可以看到K匿名是必要的。
其次，本文综述了K-匿名化的泛化和抑制框架，特别是一个称为全域泛化的模型。本节还描述了以前实现最小全域泛化的算法。
第三，介绍了一种基于多维数据模型的全域通用化的实现框架，以及一套算法，这套算法被称为不可识别算法。incognito利用了以前在查询处理文献中用于其他目的的动态编程的两个关键变化：沿维度层次的自底向上聚合和先验聚合计算。
第四，给出了最大规模性能实验的结果，并对最小k-匿名化进行了实验研究。同时，研究结果表明，该算法在数量级上优于以前的算法。结果证明了在大型数据库上执行最小看门化的可行性。
虽然本文的算法和框架主要集中在全域泛化模型上，但也有许多其他的K-匿名模型被提出。然而，这些技术之间的差异还没有清楚地表达出来。因此，在最后，作者对几种替代的K匿名方法进行了统一的分类。In this paper, the authors first use a Patients table as a running example. In this example, the name is as the removing attribute. The uniqueness of such attribute combinations leads to a class of attacks where data is “re-identified” by joining multiple (often publicly-available) data sets. Also, in this running example, the attack is able to determine one person’s medical information by joining the two databases on three data sets including Birthdate, Sex and Zipcode. Through the illustration of this example, we can see that the K-anonymity is necessary.
Second, the authous give an overview of the generalization and suppression framework for k-anonymization, in particular a model called full-domain generalization. Also previous algorithms implementing minimal full-domain generalization has been descriped in this section.
Third, an implementation framework for full-domain generalization using a multi-dimensional data model has been introduced, together with a suite of algorithms and this suite of algorithms is called Incognito. Incognito takes advantage of two key variations of dynamic programming that have been used previously in the query processing literature for other purposes: bottom-up aggregation along dimensional hierarchies and a priori aggregate computation.
Fouth, the results of the largest-scale performance experiments have been presented and the experiments are aware of for minimal k-anonymization. Also, the results show that the Incognito algorithms outperform previous algorithms by up to an order of magnitude. The results demonstrate the feasibility of performing minimal kanonymization on large databases.
Though in this paper the algorithms and framework focus primarily on the full-domain generalization model, there have been a number of other k-anonymization models proposed. However, the differences among these techniques have not been clearly articulated. Therefore, in the last, the authors have done the unifying taxonomy of several alternative approaches to k-anonymization.
Contributions
Totally, there are two contributions in this paper. First, in this paper, the authors develop a core algorithm which is named Incognito according to Samarati and Sweeneny’s generalization framework. The basic Incognito algorithm is used to impletment the Patients table. The authors work hard to optimizations this basic Incognito algorithm. They first introduce the super-roots into this algorithm as Super roots Incognito and second introduce the bottom-up pre-computation to the basic Incognito algorithm as Cube Incognito. The authors in this paper are introducing a set of algorithms for producing minimal full-domain generalizations and the results show that these algorithms perform up to an order of magnitude faster than previous algorithms on two real-life databases. The second contribution is a single taxonomy that categorizes previous models and introduces some promising new alternatives .
Weakness
However, there are weakness of this paper. First, the set of algorithm has been implemented just for the example of Patients table and the results for the experiments may be not correct. Second, the taxnmy of k-anonymization models is according to three main criteria: Generalization vs. Suppression, Global vs. Local recoding and Hierarchy-based vs. Partition-based. There are some models for the taxonomy. However, in this paper, the Incognito algorithm has not been developed for the each model of all the taxonomy categorizing k-anonymization models.
Discussion questions
There are many anonymization mechanism that the data of attributes can be generalized, suppressed or distort. The database in the real life often mucn complexity and refers to much attributes. The question I am much confusing is that how to proof that the full-domain generalization is mimimal if this generalization is K-anonymous besides this simple Patients table.
|
 |
|||
| 网站地图 |
