JP2016133872A - Information anonymity method, information anonymity program and information anonymity device - Google Patents

Abstract

PROBLEM TO BE SOLVED: To suppress reduction of a disclosure amount of pieces of information.SOLUTION: An information anonymity method of an embodiment is configured so that: a computer executes processing for extracting character strings which are common to a number of k or higher of users, from pieces of log data each of which is associated with each of the plural users. The information anonymity method is configured so that, the computer executes processing for grouping the extracted character strings based on an inclusion relationship, and allocating an attribute to each group. The information anonymity method is configured so that, the computer executes processing for, associating the character string in the attribute with the user having the log data including the character string, for every attribute. The computer further executes processing for anonymization of the character string of each attribute, so that, a number of users having a same combination of the character strings of attributes is equal to or higher than k.SELECTED DRAWING: Figure 1

Description

  Embodiments described herein relate generally to an information anonymization method, an information anonymization program, and an information anonymization apparatus.

  In some cases, log data, etc., in which each person's information is stored in each row (record) is converted so that a large amount of information remains, taking into account the protection of each person's privacy, and may be used for secondary purposes in market analysis or the like. One technique for protecting privacy during conversion of log data is data anonymization. In anonymization, one unit (row, record, etc.) of data is processed so as not to have personal identification by replacement / deletion. Personal identification means that a knowledgeable person (for example, a data owner) can uniquely identify his / her data when he / she views the processed data. Specifically, when one unit of data after anonymization is viewed, processing is performed so that the number of data owners can be limited to k or more.

  In k-anonymization, values are replaced and deleted so as to achieve k-anonymity for a two-dimensional table in which one data owner is one row and data is classified into attributes and columns. k-anonymity means that there are k or more rows that can be associated with a combination of attributes set as QI (quasi-identifier).

International Publication No. 2011/145401

  However, there is a problem that if anonymization of data is performed for privacy protection and anonymity is sufficiently secured, the amount of data concealed by anonymization increases, and the amount of information disclosed may be reduced. is there. And if there is much data amount concealed by anonymization, the value of using the data after anonymization may fade at the time of secondary utilization.

  In one aspect, an object is to provide an information anonymization method, an information anonymization program, and an information anonymization device that can prevent a reduction in the amount of information disclosure.

  In the first proposal, in the information anonymization method, the computer executes a process of extracting a character string common to k or more users from log data relating to each of a plurality of users. In the information anonymization method, the computer groups the extracted character strings based on the comprehensive relationship, and executes a process of assigning an attribute to each group. In the information anonymization method, the computer executes a process for associating a character string in the attribute with a user of log data including the character string for each attribute. Further, in the information anonymization method, the computer executes a process of anonymizing the character strings of the respective attributes so that the number of users having the same combination of character strings of the respective attributes becomes k or more.

  According to one embodiment of the present invention, it is possible to prevent a reduction in the amount of information disclosed.

FIG. 1 is a block diagram illustrating the configuration of the information anonymization device according to the embodiment. FIG. 2 is a flowchart illustrating the operation of the information anonymization device according to the embodiment. FIG. 3 is an explanatory diagram illustrating enumeration of word series. FIG. 4 is an explanatory diagram for explaining conversion into tabular data. FIG. 5 is an explanatory diagram for explaining setting of values in the table data. FIG. 6A is an explanatory diagram illustrating setting of values in table data. FIG. 6B is an explanatory diagram illustrating setting of values in table data. FIG. 7A is an explanatory diagram illustrating creation of a generalized hierarchical tree. FIG. 7B is an explanatory diagram illustrating creation of a generalized hierarchical tree. FIG. 8 is an explanatory diagram for explaining the generation of anonymized table data. FIG. 9 is an explanatory diagram illustrating conversion into log data. FIG. 10 is an explanatory diagram illustrating conversion into log data. FIG. 11 is an explanatory diagram illustrating an example of a computer that executes an information anonymization program. FIG. 12 is an explanatory diagram for explaining a difference in the disclosure amount depending on a threshold value in anonymization.

  Hereinafter, an information anonymization method, an information anonymization program, and an information anonymization device according to embodiments will be described with reference to the drawings. In the embodiment, configurations having the same functions are denoted by the same reference numerals, and redundant description is omitted. In addition, the information anonymization method, the information anonymization program, and the information anonymization apparatus which are demonstrated by the following embodiment only show an example, and do not limit embodiment. In addition, the following embodiments may be appropriately combined within a consistent range.

  FIG. 1 is a block diagram illustrating the configuration of the information anonymization device 1 according to the embodiment. As shown in FIG. 1, the information anonymization device 1 is an information processing device such as a PC (Personal Computer), and includes an input unit 10, a control unit 20, and an output unit 30.

  The input unit 10 receives data from an input device such as a keyboard or a mouse, a reading device that reads data from a storage medium such as a CD-ROM or a DVD disk, or a communication device (not shown) that communicates with other devices. Enter. Data that the input unit 10 accepts input includes, for example, log data D10 and a threshold value k. The input log data D10 and threshold value k are referred to by the control unit 20.

  The log data D10 is data describing a history and the like regarding each of a plurality of users. The log data D10 can be handled as text data among data exchanged between companies / company-users such as log data of application / network devices and output data of sensor devices. The log data D10 that can be handled as text data can be divided into elements such as lines and records. In the present embodiment, it is assumed that one log (such as an operation performed by one user) is described in one line in the log data D10. In the anonymization of the log data D10 in the information anonymization apparatus 1, a combination of one unit (row, record, etc.) of the log data D10 is processed so as not to have personal identification.

  The threshold value k is set in accordance with a privacy protection standard so that when the data after anonymizing the log data D10 is viewed so that there is no personal identification, the number of data owners can be limited to only k or more. Threshold. For example, 2 ≦ k ≦ the number of users of the input log data D10 is set as the threshold value k.

  The control unit 20 includes an internal memory for storing a program defining various processing procedures and necessary data, and a CPU (Central Processing Unit) that sequentially executes the program, and executes various processes using these. . The control unit 20 includes a generation unit 21, an anonymization processing unit 22, and a log data conversion unit 23.

  The generation unit 21 includes a table data conversion unit 211 and a generalized hierarchical tree generation unit 212. The table data D21, which is intermediate data for performing k-anonymization of the log data D10 by the anonymization processing unit 22, and A generalized hierarchical tree D22 is generated. The k-anonymization can be applied to the table data D21 which is a two-dimensional table in which one data owner (user) is one row and the data is classified into attributes and columns. The k-anonymity means that there are more than k owner rows that can be supported by attribute combinations set as QIs (quasi-identifiers). In k-anonymization, k-anonymity is achieved for the table data D21. Replace and delete values as you do. For value replacement, a generalized hierarchical tree D22 in which a comprehensive relationship between attributes is shown in a tree structure and a value to be replaced is defined is used. In the replacement using the generalized hierarchical tree D22, information loss can be reduced stepwise by the tree structure (anonymization), compared with deletion, so that information loss can be reduced.

  Here, in the data after anonymization, the part as the original data is called a disclosed part, and the amount of the disclosed part is called a disclosed quantity. The amount of disclosure is expressed by the number of characters and the number of words. When log data after anonymizing so as to satisfy k-anonymity is compared, the more the disclosed amount, the more useful it is in secondary utilization. Therefore, anonymization with a large amount of disclosure is useful for secondary utilization.

  The table data converter 211 refers to the log data D10 and the threshold value k, and converts the log data D10 into table data D21. Specifically, the table data conversion unit 211 performs word division of the log data D10 using existing techniques such as division by delimiters, character type division, and morphological analysis. For example, in character type division, in the case of a line “name = db.path = c: / data” in the log data D10, {name, =, db,. , Path, =, c,:, /, data}.

  The table data conversion unit 211 sets a word series appearing in the log data D10 of k owners or more as attributes (columns) of the table data D21 based on the word division of the log data D10. A word sequence is a combination of words with an order. In this word sequence, adjacent / non-adjacent words are distinguished from the beginning to the end of the line. For example, if the aligned words are not adjacent to each other, the space between them is set as a non-adjacent portion, and the special character string “[GAP]” is used for the expression.

  For example, in the word sequence {name, [GAP], db}, “[GAP]” is not adjacent to “name” and “db”, and one or more between “name” and “db”. Indicates that a word is included. As the special character string indicating the non-adjacent portion, any character string may be used as long as it can be identified later.

  In addition, word sequences may have a comprehensive relationship. For example, {name, [GAP], db} and {name, =, db} have a comprehensive relationship, and {name, [GAP], db} includes {name, =, db}. In this embodiment, a comprehensive side (in the above example, {name, [GAP], db}) is treated as a higher level.

  The table data conversion unit 211 lists all word sequences that can be extracted from each row of the log data D10 that has been divided into words. Specifically, the table data conversion unit 211 assumes two states: a word sequence in which each word is “as is” and “[GAP]”, based on the word sequence after word division. , Output all possible states as a word sequence. As a result, a word sequence raised to the power of 2 [number of words] is output.

  For example, {name, =, db,. }, {Name, =, db,. }, {[GAP], =, db,. }, {[GAP], [GAP], db,. } Is output. Here, when [GAP] continues in the output word series, they are combined into one. For example, {name, =, [GAP], [GAP]} is assumed to be {name, =, [GAP]}. Also, the word series that is {[GAP]} is excluded.

  Next, the table data conversion unit 211 extracts word series appearing more than k owners and sets them in the attribute (column) of the table data D21, and each row of the log data D10 has the most comprehensive relationship among the applicable attributes. It is set in the row of the table data D21 as the value of the upper attribute. In the inclusion relationship, the inclusion side is the higher rank. If there are a plurality of top-level attributes, the top-level attributes are determined based on criteria such as “character string length / number of words” and “number of appearance owners”. Also, the table data conversion unit 211 excludes attributes for which values have already been set, and sets the comprehensive relationship as the value of the highest attribute among the attributes for which values have not been set. Further, if there is no applicable attribute in each line of the log data D10, the line is not set as a value. The table data conversion unit 211 outputs table data D21 in which attributes (columns) and rows are set as table data D21 obtained by converting the log data D10.

  For each attribute of the table data D21, the generalized hierarchical tree generation unit 212 generates a generalized hierarchical tree D22 that shows a comprehensive relationship between attributes in a tree structure. Specifically, the generalized hierarchical tree generation unit 212 generalizes a tree structure in which the word sequence of the target attribute of the table data D21 is a root node and the attribute having the comprehensive relationship of the word sequence from the root node is a node. A hierarchical tree D22 is generated. The generalized hierarchical tree generation unit 212 sets an inclusion side as a parent node in an attribute having inclusion relation. The generalized hierarchical tree generation unit 212 sets all the rows of the input log data D10 and all the attributes of the table data D21 as node candidates. In addition, when there are a plurality of parent node candidates when adding a node, the generalized hierarchical tree generation unit 212 uses a criterion such as “character string length / number of words” or “number of appearance owners” of the word sequence of the parent node. One shall be selected.

  The anonymization processing unit 22 is based on the table data D21 and the generalized hierarchical tree D22 generated by the generation unit 21, and the number of users (owners) whose character string combinations for each attribute are the same for the table data D21. The anonymized table data D23 is generated by performing k-anonymization to anonymize the character string of each attribute so that becomes equal to or greater than k. Specifically, the anonymization processing unit 22 has, in order from the attribute of the higher group in the generalized hierarchical tree D22, the number of owners with the same word series of each attribute associated with the owner of the table data D21 is k or more. Anonymize the character string of each attribute so that

  The log data conversion unit 23 converts each row of the generated anonymized table data D23 into log data. Specifically, the log data conversion unit 23 first extracts all the values remaining in the anonymized table data D23. Next, the log data conversion unit 23 performs a character string replacement process using the extracted value for the original log data D10 of the corresponding owner. More specifically, for each row of the original log data D10, a value with the largest disclosure amount is selected from the values extracted from the anonymized table data D23. The value that increases the disclosed amount is a value that has the maximum character string length or word length. Next, the character string of the target line corresponding to [GAP] of the selected value is replaced. The replacement method is “sanitization” to replace all with the same character string, “tokenize” to replace the same replacement part with the same character string, and “encryption” to replace with a character string that only a user with a decryption key can view. ”. In this replacement method, it is assumed that a method considering safety and utilization is selected and set by the user. In the present embodiment, replacement is performed using “tokenization”.

  The output unit 30 outputs log data D30 that has been anonymized by the control unit 20. Specifically, the output unit 30 outputs the log data D30 by displaying on a display (not shown) or transmitting to another device connected via a communication device (not shown) in addition to a file or the like. To do.

  Here, the detail of operation | movement of the information anonymization apparatus 1 is demonstrated. FIG. 2 is a flowchart illustrating the operation of the information anonymization device 1 according to the embodiment.

  As shown in FIG. 2, when the process is started, the input unit 10 receives input of log data D10 and a threshold value k. Next, the table data conversion unit 211 performs word division of the received log data D10 using existing techniques such as division by a delimiter, character type division, and morpheme analysis (S1).

  Next, the table data conversion unit 211 lists all word series from the log data D10 divided into words (S2). FIG. 3 is an explanatory diagram illustrating enumeration of word series. As shown in FIG. 3, “name = db.” In the log data D10 is {name, =, db,. }, {Name, [GAP]},...

  Next, the table data conversion unit 211 extracts a word series that appears above the k owner on the basis of all the listed word series and the input threshold value k (S3), and the extracted word series is represented in the table data D21. Is set to the attribute (column) of the table in (S4).

  FIG. 4 is an explanatory diagram for explaining the conversion into the table data D21. As shown in FIG. 4, it is assumed that log data D10 of owner A to owner D and k = 2 are input. In this case, “User = Sato”, “A is started”,... Are extracted as word sequences appearing more than k = 2 owners, and set as attributes (columns) of the table data D21.

  Next, the table data conversion unit 211 performs a first loop process (S5 to S10) on the log data (Di (i = 0 to u)) of each owner. In the first loop processing, the table data conversion unit 211 adds a row (Ri) for Di to the table of the table data D21, and performs the second loop processing (all for each log data row (Li = 0 to m)) ( S7 to S9) are performed.

  In the second loop processing, the table data conversion unit 211 sets the log data row (Li) as a value to the attribute to which the Di row (Ri) is applied (S8).

  FIG. 5 is an explanatory diagram for explaining setting of values in the table data. More specifically, FIG. 5 is a diagram explaining setting of values in the log data D10 and the table data D21 illustrated in FIG.

  As illustrated in FIG. 5, the table data conversion unit 211 sequentially sets the log data of the owner A to the owner D in the table data D21 by performing the first loop process on the log data of the owner A to the owner D. For example, for the owner A, there are a line (L1) with “User = Abe” and a line (L2) with “A is Started” as the log data D10. The rows (L1) and (L2) are set as values in applicable attributes such as “User = [GAP]” and “[GAP] is Started” by performing the second loop processing.

  The table data conversion unit 211 excludes attributes for which values have already been set, and sets them as the highest attribute in the comprehensive relationship among the applicable attributes.

  6A and 6B are explanatory diagrams for explaining the setting of values to the table data. More specifically, FIG. 6A illustrates a case where an attribute for which a value has already been set is excluded, and FIG. 6B illustrates a case where the highest attribute is set in a comprehensive relationship.

  As shown in FIG. 6A, when “K is started” in the log data D10 of the owner A is set, since the top-level attribute to be applied is “[GAP] is started”, a value is set for the attribute. . Next, when “A is started” is set, the highest-level attribute to be applied is “[GAP] is started”, but a value has already been set for this attribute. Therefore, the value of “A is started” is set to the next attribute “A is started” in the comprehensive relationship.

  As shown in FIG. 6B, when setting “A is started” in the log data D10 of the owner A, three attributes “A is started”, “A is [GAP]”, and “[GAP] is started” are set. Is true. Here, comparing the comprehensive relationship of the three attributes, “A is [GAP]” is higher than “A is started”, and “[GAP] is started” is higher than “A is started”. Note that there is no comprehensive relationship between “A is [GAP]” and “[GAP] is started”. Here, the table data conversion unit 211 selects the attribute having the highest comprehensive relationship based on criteria such as “character string length / number of words” and “number of appearance owners”. In the illustrated example, “[GAP] is started” is ranked higher depending on the number of words.

  Returning to FIG. 2, following the first loop processing (S5 to S10), the generalized hierarchical tree generating unit 212 performs third loop processing (S11 to S11) for each attribute (Aj (j = 0 to r)) of the table data D21. S13) is performed.

  In the third loop process, the generalized hierarchical tree generation unit 212 generalizes the tree structure with the attribute (Aj) of the table data D21 as a root node and the attribute having a comprehensive relationship of word sequences from the root node as a node. A hierarchical tree D22 is created (S12).

  7A and 7B are explanatory diagrams illustrating the creation of the generalized hierarchical tree D22. More specifically, FIG. 7A illustrates the creation of a generalized hierarchical tree D22 having a one-level inclusive relationship, and FIG. 7B illustrates the generation of a generalized hierarchical tree D22 having a multilevel (two-level) inclusive relationship. .

  As shown in FIG. 7A, when “User = [GAP]” is set as a root node, “User = Abe”, “User = Sato”, and “User = Oda”, which have lower comprehensive relationships than the root node, are set. A generalized hierarchical tree D22 is created as a lower node.

  Also, as shown in FIG. 7B, when “[GAP] is [GAP]” is the root node, “[GAP] is started” and “[GAP]” whose inclusive relationship is one level lower than the root node. A generalized hierarchical tree D22 having “is stopped” as a node one step lower is created. In addition, for “[GAP] is started”, “A is started”, which is one level lower in the comprehensive relationship, is a node one level lower. In addition, regarding “[GAP] is stopped”, “C is stopped” and “B is stopped” whose inclusion relationship is one level lower are nodes that are one level lower.

  Returning to FIG. 2, following the third loop processing (S11 to S13), the anonymization processing unit 22 uses the table data D21 and the generalized hierarchical tree D22 to characterize each attribute with respect to the table data D21. K-anonymization is performed to anonymize the character string of each attribute so that the number of users having the same combination of columns is equal to or greater than k (S14). And the anonymization process part 22 produces | generates and outputs the anonymized table data D23 after performing k-anonymization with respect to the table data D21.

  FIG. 8 is an explanatory diagram for explaining the generation of the anonymized table data D23. As shown in FIG. 8, in the attributes such as “User = [GAP]” and “[GAP] = is started”, anonymization is performed with reference to the generalized hierarchical tree D22 so that the number of users becomes k or more. For example, “User = [GAP]” is anonymized to “User = [GAP]” because “User = Abe” and “User = Oda” do not satisfy k-anonymity with k = 2. The

  Returning to FIG. 2, following S14, the log data conversion unit 23 performs a fourth loop process (S15 to S17) for each row (Rj (j = 0 to u)) of the anonymized table data D23.

  In the fourth loop process, the log data conversion unit 23 converts the row (Rj) of the anonymized table data D23 into log data (S16). Specifically, the log data conversion unit 23 performs a character string replacement process on the original log data D10 of the owner corresponding to the row (Rj) of the anonymized table data D23 using the value of Rj. Following the fourth loop process (S15 to S17), the output unit 30 outputs the anonymized log data D30 (S18).

  FIG. 9 is an explanatory diagram illustrating conversion into log data. As shown in FIG. 9, the original log data D10 is “B is started”, and the value of Rj of the anonymized table data D23 is “[GAP] is started”. In this case, the log data conversion unit 23 converts “B is started” to “talk01 is started” using “[GAP] is started”. As a result, the log data D10 is converted into log data D30 in which the character string “B” is anonymized to “talk01”.

  FIG. 10 is an explanatory diagram for explaining the conversion to log data. More specifically, FIG. 10 is a diagram for explaining the conversion when there are a plurality of “values” that match a certain line. As illustrated in FIG. 10, the value that “K is started” matches is “[GAP] is started”. Therefore, “K is started” is converted to “talk01 is started” by applying a matching value. Values that “A is started” matches are “[GAP] is started” and “A is started”. In this case, “A is started” with a large amount of disclosure is applied, and “A is started” remains.

  In addition, each component of each part illustrated does not necessarily need to be physically configured as illustrated. In other words, the specific form of distribution / integration of each unit is not limited to that shown in the figure, and all or a part thereof may be functionally or physically distributed / integrated in arbitrary units according to various loads or usage conditions. Can be configured. For example, each of the generation unit 21, the anonymization processing unit 22, the log data conversion unit 23, and the like of the above embodiment may be integrated.

  Furthermore, various processing functions performed by each device may be executed entirely or arbitrarily on a CPU (or a microcomputer such as an MPU or MCU (Micro Controller Unit)). In addition, various processing functions may be executed in whole or in any part on a program that is analyzed and executed by a CPU (or a microcomputer such as an MPU or MCU) or on hardware based on wired logic. Needless to say, it is good.

  By the way, the various processes described in the above embodiments can be realized by executing a program prepared in advance by a computer. Therefore, in the following, an example of a computer that executes a program having the same function as in the above embodiment will be described. FIG. 11 is an explanatory diagram illustrating an example of a computer 300 that executes an information anonymization program.

  As illustrated in FIG. 11, the computer 300 includes a CPU 301 that executes various arithmetic processes, an input device 302 that receives data input, and a monitor 303. The computer 300 also includes a medium reading device 304 that reads a program and the like from a storage medium, an interface device 305 for connecting to various devices, and a communication device 306 for connecting to other devices by wire or wirelessly. The computer 300 also includes a RAM 307 that temporarily stores various types of information and a hard disk device 308. Each device 301 to 308 is connected to a bus 309.

  The hard disk device 308 stores an information anonymization program having the same function as each processing unit described in the above embodiment. The hard disk device 308 stores various data for realizing the information anonymization program. The input device 302 receives input from a user, for example. The monitor 303 displays an operation screen when receiving input from the user and displays various information. The interface device 305 is connected to, for example, a printing device. The communication device 306 is connected to a network, for example.

  The CPU 301 reads out each program stored in the hard disk device 308, develops it in the RAM 307, and executes it to perform various processes. Further, these programs can cause the computer 300 to function in the same manner as each processing unit described in the above embodiment.

  Note that the above-described information anonymization program is not necessarily stored in the hard disk device 308. For example, the computer 300 may read and execute a program stored in a storage medium readable by the computer 300. The storage medium readable by the computer 300 corresponds to, for example, a portable recording medium such as a CD-ROM, a DVD disk, a USB (Universal Serial Bus) memory, a semiconductor memory such as a flash memory, a hard disk drive, and the like. Alternatively, the information anonymization program may be stored in a device connected to a public line, the Internet, a LAN, or the like, and the computer 300 may read out and execute the information anonymization program therefrom.

  As described above, the information anonymization apparatus 1 extracts a character string common to k or more users from log data regarding each of a plurality of users. Moreover, the information anonymization apparatus 1 groups the extracted character strings based on the comprehensive relationship, and assigns an attribute to each group. Moreover, the information anonymization apparatus 1 matches the character string in the said attribute with the user of the log data containing the said character string for every attribute. Moreover, the information anonymization apparatus 1 anonymizes the character string of each attribute so that the number of users with the same combination of character strings of each attribute becomes k or more. Therefore, in the information anonymization apparatus 1, since the degree of replacement can be adjusted for each attribute, it is possible to suppress a reduction in the disclosed amount.

  FIG. 12 is an explanatory diagram for explaining a difference in disclosure amount depending on a threshold value (v) in anonymization. Here, the threshold value (v) is a value set as v ≧ k, and is a threshold value for generating intermediate data (table) by narrowing down in stages when k-anonymization is performed. In FIG. 12, the case where the computer 300 which satisfy | fills k-anonymity of k = 2 from the input log data D100 is illustrated.

  As shown in FIG. 12, when v = 2 (= k) is generated and intermediate data (table) is generated and converted to satisfy k-anonymity based on the table, v = 3, 4 ( The amount of disclosure increases when intermediate data is generated after conversion as> k). Specifically, the amount of disclosure is increased by “*** is started” with respect to “***”. As described above, when the anonymization is performed after the intermediate data is generated with the threshold value (v) of v ≧ k, the disclosed amount after the anonymization is changed according to the threshold value (v), so the disclosed amount is increased. Therefore, it is necessary to set an appropriate threshold value (v).

  On the other hand, in the present embodiment, as shown in FIG. 8, the degree of replacement can be adjusted for each attribute by using the generalized hierarchical tree D22. Therefore, the disclosed amount can be set without setting the threshold value (v). Can be anonymized. Specifically, by using the anonymization processing unit 22, “User = [GAP]” is anonymized as a word sequence of v = 2, and [[GAP] is started] is a word sequence of v = 4. Anonymized.

DESCRIPTION OF SYMBOLS 1 ... Information anonymization apparatus 10 ... Input part 20 ... Control part 30 ... Output part 21 ... Generation part 22 ... Anonymization processing part 23 ... Log data conversion part 300 ... Computer D10, D30, D100, D300 ... Log data D21 ... Table Data D22 ... Generalized hierarchical tree D23 ... Anonymized table data k ... Threshold

Claims (6)

Computer
Extract character strings common to k or more users from log data for each of multiple users,
Group the extracted character strings based on a comprehensive relationship, assign attributes to each group,
For each attribute, a character string in the attribute is associated with a user of the log data including the character string,
An information anonymization method characterized by executing a process of anonymizing a character string of each attribute so that the number of users having the same combination of character strings of each attribute becomes k or more. In the assigning process, in the attribute character string, a comprehensive character string attribute is a higher group attribute than a general character string attribute, and the higher group attribute is a root node, and a lower group attribute is The information anonymization method according to claim 1, further comprising: generating a hierarchical tree that includes 3. The information anonymization according to claim 2, wherein the associating process associates a character string in the attribute with a user of the log data including the character string in order from an attribute of an upper group in the hierarchical tree. Method. The anonymization process is performed so that, in order from the attribute of the upper group in the hierarchical tree, the number of users having the same combination of character strings of the attributes associated with the users of the log data is equal to or greater than k. The information anonymization method according to claim 3, wherein the character string is anonymized. On the computer,
Extract character strings common to k or more users from log data for each of multiple users,
Group the extracted character strings based on a comprehensive relationship, assign attributes to each group,
For each attribute, a character string in the attribute is associated with a user of the log data including the character string,
An information anonymization program for executing a process of anonymizing a character string of each attribute so that the number of users having the same combination of character strings of each attribute becomes k or more. A character string common to k or more users is extracted from log data relating to each of a plurality of users, the extracted character strings are grouped based on a comprehensive relationship, an attribute is assigned to each group, A processing unit for associating a character string in the attribute with a user of the log data including the character string;
An anonymization device comprising: an anonymization unit that anonymizes a character string of each attribute so that the number of users having the same combination of character strings of each attribute is equal to or greater than k.

Images