JP5962472B2 - Anonymized data generation method, apparatus and program - Google Patents

Description

  The present technology relates to information anonymization technology.

  There is a case where it is desired to disclose or provide a group of records including numerical data to others with confidential information (for example, an identifier (also referred to as ID)) of each record kept secret. At this time, even if the ID is deleted and disclosed or provided, another person may be able to estimate the ID for a record having a strong numerical value.

  For example, consider a case where the vehicle location data collector A provides location data to the traffic condition investigation organization B etc. in a form in which the ID associated with the vehicle driver, owner, etc. is concealed.

  For example, it is assumed that the position data of the vehicle collected by the collector A is data as shown in FIG. Thus, there are five records in total for the position data of three types of vehicles having IDs c1, c2, and c3. X represents latitude and Y represents longitude. The ID may be a vehicle ID or a user (user company) ID. It is assumed that a record as shown in FIG. 1 is plotted on a map as shown in FIG.

  The traffic condition investigation organization B can utilize data as shown in FIGS. 1 and 2 for a road improvement plan and a maintenance plan. For example, it can be seen that there are many overspeed vehicles on the east-west road in FIG. 2, and there are cases where a plan is made to reduce the overspeed on the road or to increase the frequency of inspection.

  Further, even when the collector A provides the traffic situation survey organization B with data as shown in FIG. 1, the traffic situation survey organization B keeps the ID secret. For example, it is conceivable that the collector A has a contract with the location data provider so as not to provide it to others unless it is anonymized. The location data provider may have used the vehicle illegally or dangerously, such as entering a prohibited area or exceeding speed, for reasons such as not wanting to be known to anyone other than the collector A. It may be possible to request anonymization.

  On the other hand, there may be a case where the traffic condition investigation organization B does not need an ID. This is because the traffic condition survey as described above can be performed without knowing the driver or operator of the vehicle. Therefore, the collector A performs the conversion that makes it difficult to estimate the ID, which is so-called anonymization, on the data as shown in FIG. 1, and discloses or provides the converted data.

  As a simple anonymization method by the collector A, there is a method of deleting an ID. Even if the traffic condition investigation organization B looks at the data obtained by deleting the ID from the data shown in FIG. 1, it is not possible to know which record is who. However, there is a problem that there is a record that can estimate the ID from the position value.

  When data obtained by deleting the ID from the data shown in FIG. 1 is plotted on the map as shown in FIG. 2, it is understood that the third record (X, Y) = (8, 7) is in “c1 parking lot”. . That is, even when only the data from which the ID is deleted can be seen, it is highly likely that the ID of the third record is c1, and it is difficult to say that the ID is sufficiently anonymized.

  Similarly, the second record (X, Y) = (14, 12) is also a record for c1, as it is unlikely that a vehicle other than the vehicle going to "c1 parking lot" will go through on the public road. Can be estimated. If the speed of this record is “40” and the legal maximum speed at this point is “30”, it is known that c1 was illegal.

  As described above, there is a record that cannot be sufficiently anonymized simply by deleting the ID.

  In addition, there is a technique that anonymizes by not only simply deleting the ID but also probabilistically disturbing the data, but there are records that greatly change the location data, which hinders the investigation by the traffic condition investigation organization B There is a problem that it may come. Further, if the probability of change is reduced, the adverse effect on the investigation by the traffic condition investigation organization B is reduced. However, for example, the probability that the second record and the third record in the data shown in FIG. Will become insufficient.

  Furthermore, there is a technique for anonymizing a plurality of records by using a k-anonymization technique. However, even if these are simply applied to the data shown in FIG. 1, sufficient anonymization is always performed. Do not mean.

JP 2011-100116 A JP 2011-128862 A JP 2012-022315 A

L. Sweeney. Achieving k-Anonymity Privacy Protection using Generalization and Suppression.International Journal on Uncertainty, Fuzziness and Knowledge-based Systems, Vol. 10, No. 5, pp. 571-588, 2002. K. LeFevre, D. J. DeWitt, R. Ramakrishnan. Incognito: Efficient Full-Domain k-Anonymity. In Proceedings of the 2005 ACM SIGMOD International Conference on Management of Data, pp. 49-60, 2005. K. LeFevre, D. J. DeWitt, R. Ramakrishnan. Mondrian Multidimensional k-Anonymity. In Proceedings of the 22nd International Conference on Data Engineering, pp. 25-, 2006. A. Machanavajjhala, J. Gehrke, D. Kifer, M. Venkitasubramaniam. L-Diversity: Privacy Beyond k-Anonymity. ACM Transactions on Knowledge Discovery from Data, Vol. 1, Issue 1, Article No. 3, 2007.

  Therefore, the objective of this technique is to provide the technique for anonymizing the data containing a numerical attribute value according to one side surface.

  An anonymized data generation method according to the present technology includes (A) a data block for each of a plurality of data blocks stored in a data storage unit that stores a plurality of data blocks each including a confidential attribute value and a numerical attribute value. A set of data blocks in which the distance defined according to the numerical attribute is within a threshold value is generated based on the numerical attribute value included in the (B), and for each of the plurality of data blocks, the data block and the data block It is determined whether the frequency distribution of confidential attribute values with the data blocks included in the collected set satisfies a predetermined condition. (C) For a data block whose frequency distribution satisfies the predetermined condition, A second numerical attribute value is generated from the numerical attribute values of the data blocks included in the generated set, and (D) the frequency distribution is The numeric attribute values in the data blocks that meet the requirements, including the processing of replacing the second numerical attribute values generated for the data block.

  Data including numeric attribute values can be anonymized.

FIG. 1 is a diagram illustrating an example of data to be anonymized. FIG. 2 is a diagram illustrating an example in which data is plotted on a map. FIG. 3 is a functional block diagram of the information processing apparatus according to the embodiment. FIG. 4 is a diagram illustrating a main processing flow according to the embodiment. FIG. 5 is a diagram illustrating a process flow of the grouping process. FIG. 6 is a diagram for explaining the outline of the present embodiment. FIG. 7 is a diagram for explaining the outline of the present embodiment. FIG. 8 is a diagram illustrating an example of data stored in the group data storage unit. FIG. 9 is a diagram illustrating a processing flow of the matching determination process for the frequency distribution pattern. FIG. 10 is a diagram illustrating an example of auxiliary data stored in the second data storage unit. FIG. 11 is a diagram illustrating a processing flow of the matching determination process for the frequency distribution pattern. FIG. 12 is a diagram illustrating an example of data stored in the second data storage unit. FIG. 13 is a diagram illustrating an example of data stored in the second data storage unit. FIG. 14 is a diagram illustrating a processing flow of post-conversion data generation processing. FIG. 15 is a diagram illustrating an example of data stored in the second data storage unit. FIG. 16 is a diagram for explaining the post-conversion data generation process. FIG. 17 is a diagram for explaining the post-conversion data generation process. FIG. 18 is a diagram for explaining the post-conversion data generation process. FIG. 19 is a diagram illustrating a processing flow of data conversion processing. FIG. 20 is a diagram illustrating an example of data stored in the anonymized data storage unit. FIG. 21 is a diagram illustrating an output example. FIG. 22 is a functional block diagram of a computer.

  FIG. 3 illustrates a configuration example of the information processing apparatus 100 according to the embodiment of the present technology. The information processing apparatus 100 includes a first data storage unit 11, a grouping unit 12, a setting data storage unit 13, a group data storage unit 14, a determination unit 15, a generation unit 16, and a second data storage unit. 17, a conversion processing unit 18, an anonymized data storage unit 19, and an output unit 20.

  The first data storage unit 11 stores, for example, data to be anonymized as shown in FIG. The setting data storage unit 13 is designated with data specifying which column is confidential information (here, ID), threshold data regarding distance and time, and a frequency distribution pattern as a condition for anonymization. Stores conversion method data.

  The grouping unit 12 executes a process for grouping records stored in the first data storage unit 11 according to the data stored in the setting data storage unit 13. The grouping is executed in order to speed up the processing by limiting the records for which the distance is calculated. The group data storage unit 14 stores the processing result of the grouping unit 12.

  The determination unit 15 uses the group data storage unit 14 among the records stored in the first data storage unit 11 to identify records that satisfy the conditions stored in the setting data storage unit 13, and generates the unit 16. For this, the position data and time data after the conversion of the position data and time data (that is, numerical attribute values) of the record are generated. The generation unit 16 generates the converted position data and time data in accordance with the conversion method data stored in the setting data storage unit 13 in accordance with an instruction from the determination unit 15. The second data storage unit 17 stores the processing results of the determination unit 15 and the generation unit 16.

  The conversion processing unit 18 processes the records stored in the first data storage unit 11 using the data stored in the second data storage unit 17 and the data stored in the setting data storage unit 13. And the processing result is stored in the anonymized data storage unit 19. The output unit 20 outputs the data stored in the anonymized data storage unit 19 according to a request, for example.

  Next, processing contents of the information processing apparatus 100 illustrated in FIG. 3 will be described with reference to FIGS. First, the grouping unit 12 performs a grouping process on the records stored in the first data storage unit 11 according to the data stored in the setting data storage unit 13, and the processing result is transmitted to the group data storage unit. 14 (FIG. 4: Step S1). The grouping process will be described with reference to FIGS.

  The grouping unit 12 generates a group ID generation function based on the data stored in the setting data storage unit 13 (FIG. 5: Step S11).

  In the present embodiment, as shown in FIG. 6, a plurality of records included in a predetermined range A specified from position data and time data of a certain record and a distance threshold match a predetermined frequency distribution pattern. Judge whether or not. However, if it is determined whether all other records are within the predetermined range A for one record, the processing time becomes longer. Therefore, the space-time is divided into regions with the widths of the distance thresholds (th1, th2) defined for the position data and the distance (ie, time difference) threshold (th3) defined for the time data (for example, FIG. 7). Specifies which region the record is contained in. This area is called a group. In this case, a record included in a region other than the immediately adjacent region (including a diagonally adjacent region) does not enter the predetermined range A for the record related to the process. If the area to which each record belongs is specified in this way, the number of records for which it is specifically determined whether or not it is within a predetermined range A can be limited.

Therefore, in this embodiment, the following group ID generation function is generated. It is assumed that the distance threshold defined for the time data is 0:01 and the distance threshold defined for the position data is 12.
f (R) = (floor (time / 0: 01), floor (X / 12), floor (Y / 12))
Here, floor (Q / S) is a function for rounding down Q to a value close to a multiple of S. F (R) is a function for calculating the group ID of the record R including the time, the latitude X, and the longitude Y.

  Then, the grouping unit 12 generates an empty group table (step S13). Thereafter, the grouping unit 12 identifies one unprocessed record in the first data storage unit 11 (step S15). Further, the grouping unit 12 generates a group ID of the identified record by using a group ID generation function (step S17).

  For example, f (fourth line record) = (floor (0: 03/0: 01), floor (23/12), floor (7/12)) = (3, 1, 0) is obtained.

  Then, the grouping unit 12 registers the record number in the group table in association with the group ID (step S19). If the group ID is not registered, the record number is also registered after the group ID is registered in the group table.

  If such processing is executed for data as shown in FIG. 1, a group table as shown in FIG. 8 is generated and stored in the group data storage unit 14. In the example of FIG. 8, record numbers belonging to the group are registered for each group ID. However, the example of FIG. 8 shows an example in which all records belong to different groups.

  Thereafter, the grouping unit 12 determines whether there is an unprocessed record in the first data storage unit 11 (step S21). If there is an unprocessed record, the process returns to step S15. On the other hand, if there is no unprocessed record, the process returns to the caller process.

  In this way, the grouping is performed in consideration of the threshold values defined for the position data and the time data, and the following process can be made more efficient.

  Returning to the description of the processing in FIG. 4, the determination unit 15 or the like executes a determination processing for matching the frequency distribution pattern (step S <b> 3). The matching determination process for the frequency distribution pattern will be described with reference to FIGS.

  The determination unit 15 identifies one unprocessed record among the records stored in the first data storage unit 11 (FIG. 9: Step S31). Further, the determination unit 15 acquires the group ID of the identified record R from the group data storage unit 14 (step S33). For example, when the fourth record of data in FIG. 1 is processed, (3, 1, 0) is obtained as can be seen from FIG.

Thereafter, the determination unit 15 generates a union of record number sets for all neighboring group IDs of the acquired group ID (step S35). The neighborhood group ID is a group ID obtained by adding any of -1, 0, and +1 to each element of the group ID. If (3, 1, 0), the following 27 group IDs are specified.
(2, 0, -1), (2, 0, 0), (2, 0, 1), (3, 0, -1), (3, 0, 0), (3, 0, 1), (4, 0, -1), (4, 0, 0), (4, 0, 1), (2, 1, -1), (2, 1, 0), (2, 1, 1), (3, 1, -1), (3, 1, 0), (3, 1, 1), (4, 1, -1), (4, 1, 0), (4, 1, 1), (2, 2, -1), (2, 2, 0), (2, 2, 1), (3, 2, -1), (3, 2, 0), (3, 2, 1), (4, 2, -1), (4, 2, 0), (4, 2, 1)

  Among these, the record number “2” is obtained for (2, 1, 1), the record number “4” is obtained for (3, 1, 0), and the record number is obtained for (4, 0, 0). The number “3” is obtained, and the record number “5” is obtained for (4, 1, 0).

  Then, the determination unit 15 specifies one unprocessed record from the generated union (step S37). For example, it is assumed that the record with the record number “2” is specified.

  Thereafter, the determination unit 15 calculates the distance between the record R (the record with the record number “4”) and the identified record (step S39).

In the present embodiment, the Euclidean distance is used as the distance for the space. Accordingly, the distance in space is {(14-23) ² + (12-7) ² } ^1/2 = (106) ^1/2 . However, the Manhattan distance may be used. Further, the distance with respect to time (here, the time difference) is | 0: 02-0: 03 | = 0.01. The space-time distance may be calculated according to a predetermined distance calculation formula.

  For example, data as shown in FIG. 10 is stored in the second data storage unit 17. In the example of FIG. 10, the spatial distance and the time distance are registered for each combination of records. This is for reuse in later processing. If only the spatial distance is reused later, only the spatial distance may be stored.

  The process proceeds to the process of FIG. 11 via the terminal A, and the determination unit 15 determines whether the distance calculated in step S39 is within a threshold (step S41). For example, when the threshold for the spatial distance is 12 and the threshold for the time distance is 0:01, the record with the record number “2” is determined to be within the threshold based on the calculation described above. .

On the other hand, for example, the time distance between the third record and the fourth record of the data in FIG. 1 is | 0: 04-0: 03 | = 0: 01, but the spatial distance is {(8-23) ² + (7 -7) Since ² } ^1/2 = 15, the distance is not within the threshold.

  When it is determined that the distance is within the threshold, the determination unit 15 registers the record number of the identified record in association with the record R (step S43). For example, data as shown in FIG. 12 is stored in the second data storage unit 17. In the example of FIG. 12, the copy of the data shown in FIG. 1 and the record number “2” are registered as elements of the record number set in association with the fourth record. Then, the process proceeds to step S45. On the other hand, if it is determined in step S41 that the distance is not within the threshold value, the process proceeds to step S45.

  Then, the determination unit 15 determines whether there is an unprocessed record in the union (step S45). If there is an unprocessed record in the union, the process returns to step S37 in FIG. On the other hand, if there is no unprocessed record in the union, the process proceeds to step S47.

  When the process is executed so far, the determination process for the distance for the fourth record is completed, and it is determined that the distances of the second record, the fourth record, and the fifth record are within the threshold, and the record number The set is {2, 4, 5}. When other records are processed, a record number set in which the distance is determined to be within the threshold is obtained as shown in FIG.

  Thereafter, the determination unit 15 determines whether or not the ID frequency distribution for the record number set associated with the record R matches the frequency distribution pattern stored in the setting data storage unit 13 (step S47). ). In the present embodiment, 1 diversity, that is, a frequency distribution pattern in which one or more types of IDs are included, or the highest 1 type of IDs in descending order of frequency, b (b is 1 or less) It is determined whether or not the frequency distribution pattern specified by any one of the frequency distribution patterns having a frequency greater than (real number) times matches.

  For example, assume that l = 3 and b = 0.5. In this case, for the fourth record, three record numbers are registered in the record number set, the ID of the second record is c1, the ID of the fourth record is c2, and the ID of the fifth record is c3. Therefore, since the frequency distribution is {c1: 1, c2: 1, c3: 1}, it can be seen that there are frequencies that are 0.5 times or more of the upper frequency for three IDs. Therefore, it can be seen that it matches the specified frequency distribution pattern.

  On the other hand, a record that does not include a record number of 3 or more in the record number set does not match the specified frequency distribution pattern. In the case of FIG. 13, for example, the first record and the third record do not match the specified frequency distribution pattern. In the case of the second record, since the frequency distribution is {c1: 2, c3: 1}, the condition of l = 3 is not satisfied, and thus the specified frequency distribution pattern is not met.

  Thereafter, when it is determined that the frequency distribution matches the specified frequency distribution pattern (step S49: Yes route), the determination unit 15 generates the record number of the record R to be processed and the record data included in the record number set. 16 to cause the generation unit 16 to execute a post-conversion data generation process (step S51). The post-conversion data generation process will be described with reference to FIGS. The generation unit 16 performs the following processing according to the data of the conversion method stored in the setting data storage unit 13. That is, when another conversion method is designated, different processing is performed.

  The generation unit 16 deletes the record number of the record having the same ID as the record R from the record number set (step S61). In the case of the record number set {2, 4, 5}, the record number of the record having the same ID as the ID “c2” of the record number “4” is deleted, and the record number set {2, 5} is obtained.

  Further, the generation unit 16 identifies the record NP having the closest spatial distance to the record R among the records included in the record number set processed in step S61 (step S63). For example, if data as shown in FIG. 10 is held, the record NP having the closest spatial distance is specified. If there are a plurality of records having the same spatial distance, NP may be selected based on the time distance.

  Further, the generation unit 16 calculates an average value AP of the position and time for the records included in the record number set (step S65). In the example described above, (time, X, Y) = (0:03, 16.5, 7.5) is obtained.

  And the production | generation part 16 produces | generates the data CR after conversion by selecting the point on the line segment which connects NP and AP at random, and it matches with the record R and stores it in the 2nd data storage part 17 (step). S67). At this time, the threshold of the spatial distance and the like are also registered. For example, data as shown in FIG. 15 is stored in the second data storage unit 17. In the example of FIG. 15, ID, time, latitude / longitude X and Y, speed, converted data CR, and spatial distance threshold are registered. As described above, only the fourth record and the fifth record match the frequency distribution pattern, and both show an example in which CR = AP in step S67.

  Taking an average value of records with different IDs has an effect of converting a numerical value with strong characteristics into a numerical value with weaker characteristics. However, the average value is highly reversible, and there is a problem that the original data can be restored if no record is deleted. The effect of alleviating this problem can be obtained by inserting a random number component, that is, by randomly selecting one point on the line segment connecting NP and AP.

  Note that NP (a spatially close point) is used as one of the end points in order to prevent as much as possible the estimation of a point having strong characteristics. Specifically, a point with strong characteristics tends to be spatially isolated, and the NP is unlikely to be a point with strong characteristics, so it is difficult to be converted near a point with strong characteristics.

  For example, in a record distribution situation as shown in FIG. 16, it is assumed that records R1 and R2 are converted within a distance range indicated by a circle. Each x represents the spatial position of one record, and “c1” to “c3” indicate the ID of each record.

  When the process described above is performed on the record R1, the record with the ID c1 is excluded, so that the NP is specified from the records with the IDs c2 and c3 as shown in FIG. 17, and the AP is calculated. . The record R1 tends to be spatially isolated, but if CR is selected between NP and AP, it can be seen that the tendency is alleviated by conversion. That is, it is converted into a record on the road where many records exist.

  On the other hand, when the NP is specified for the record R2 and the AP is calculated, it is as shown in FIG. The record R2 is the record closest to R1 among the records having different IDs from the record R1 (that is, the NP of the record R1). However, the record R2 is not too close to the record R1 even after conversion, and may remain on the road where many records exist. Recognize.

  In this way, it is difficult to estimate points with strong characteristics by attracting records that tend to be isolated to the records of other IDs. On the other hand, since records that do not tend to be isolated are not attracted to the isolated records side, it is not easy to estimate records that tend to be isolated.

  Returning to the description of the processing in FIG. 11, after step S <b> 51 or when the specified frequency distribution pattern does not match after step S <b> 49, the determination unit 15 determines whether there is an unprocessed record in the first data storage unit 11. (Step S53). If there is no unprocessed record, the process returns to the caller process. On the other hand, if there is an unprocessed record, the process returns to step S31 in FIG.

  As shown in FIG. 15, CR and a spatial distance threshold are registered for a record in which a frequency distribution that matches the specified frequency distribution pattern is obtained.

  Returning to the description of the processing in FIG. 4, the conversion processing unit 18 uses the data stored in the second data storage unit 17 to convert the data stored in the first data storage unit 11. Processing is executed (step S5). This data conversion process will be described with reference to FIGS.

  The conversion processing unit 18 specifies one unprocessed record in the first data storage unit 11 (step S71). Then, the conversion processing unit 18 determines whether or not the converted data CR is set in the second data storage unit 17 for the specified record (step S73). If the post-conversion data CR is not set for the identified record, the conversion processing unit 18 deletes the identified record (step S75). Then, the process proceeds to step S79.

  On the other hand, when the converted data CR is set for the specified record, the conversion processing unit 18 replaces the position and time of the specified record with the position and time of the converted data CR. Then, it is stored in the anonymized data storage unit 19 (step S77). At this time, the value of the spatial distance threshold is also added.

  Then, the conversion processing unit 18 determines whether there is an unprocessed record in the first data storage unit 11 (step S79). If there is an unprocessed record, the process returns to step S71.

  When such processing is executed, for example, data as shown in FIG. 20 is stored in the anonymized data storage unit 19. In the example of FIG. 20, the ID, the time after conversion, the latitude and longitude X and Y after conversion, the speed, and the spatial distance threshold are included. In the above example, only the fourth and fifth records are stored.

  Further, the conversion processing unit 18 deletes the ID that is the confidential attribute value specified in the setting data storage unit 13 from the data stored in the anonymized data storage unit 19 (step S81). As a result, anonymization is achieved. Then, the process returns to the caller process.

  Returning to the description of the processing in FIG. 4, the output unit 20 outputs the data stored in the anonymized data storage unit 19 to an output device such as a display device, or another computer upon request. (Step S7).

  For example, a display as shown in FIG. 21 is made. FIG. 21 shows an example in which the records stored in the anonymized data storage unit 19 are indicated by x marks on the map data. In this example, the ID is shown for convenience, but the ID is not output because it has been deleted. Also, it is shown that there is no record on the c1 parking lot and the road that leads to the parking lot. As a result, the risk of estimating the ID is reduced. In FIG. 21, the circle indicates the spatial distance threshold set in the record c3. As a result, a range in which a true value exists can be presented. For example, when c3 is selected by the user, the screen is displayed as shown in FIG. 21, and when c2 is selected by the user, the circle of the spatial distance threshold centered on c2 is presented, so that c2 is true. You may make it show the range where the value of exists.

  By executing the processing as described above, it becomes possible to anonymize data including numerical attribute values while preventing confidential information such as IDs from being estimated.

  Although the embodiment of the present technology has been described above, the present technology is not limited to this. For example, the functional block diagram is an example, and may not match the program module configuration. As for the processing flow, as long as the processing result does not change, the order of processing steps may be changed or parallel processing may be performed.

  In addition, although the case where the spatial distance and the time distance are handled separately is shown, an integrated distance may be handled.

  The information processing apparatus 100 described above is, for example, a computer apparatus, and as shown in FIG. 22, a display control unit 2507 connected to a memory 2501, a CPU 2503, a hard disk drive (HDD) 2505, and a display apparatus 2509. A drive device 2513 for the removable disk 2511, an input device 2515, and a communication control unit 2517 for connecting to a network are connected by a bus 2519. An operating system (OS) and an application program for executing the processing in this embodiment are stored in the HDD 2505, and are read from the HDD 2505 to the memory 2501 when executed by the CPU 2503. The CPU 2503 controls the display control unit 2507, the communication control unit 2517, and the drive device 2513 according to the processing content of the application program, and performs a predetermined operation. Further, data in the middle of processing is mainly stored in the memory 2501, but may be stored in the HDD 2505. In an embodiment of the present technology, an application program for performing the above-described processing is stored in a computer-readable removable disk 2511 and distributed, and installed from the drive device 2513 to the HDD 2505. In some cases, the HDD 2505 may be installed via a network such as the Internet and the communication control unit 2517. Such a computer apparatus realizes various functions as described above by organically cooperating hardware such as the CPU 2503 and the memory 2501 described above and programs such as the OS and application programs. .

  The above-described embodiment can be summarized as follows.

  The anonymized data generation method according to the present embodiment includes (A) each of a plurality of data blocks stored in a data storage unit that stores a plurality of data blocks each including a confidential attribute value and a numerical attribute value. A set of data blocks in which the distance defined according to the numerical attribute is within a threshold is generated based on the numerical attribute value included in the data block, and (B) the data block and the data block for each of the plurality of data blocks It is determined whether the frequency distribution of the confidential attribute value with the data block included in the set generated for the above satisfies a predetermined condition. (C) For a data block whose frequency distribution satisfies the predetermined condition, the data A second numerical attribute value is generated from the numerical attribute values of the data blocks included in the set generated for the block, and (D) frequency There includes a process for replacing with a second numeric attribute values numeric attribute values were generated for the data block in the data block that satisfies a predetermined condition.

  In this way, it is difficult to estimate the confidential attribute value from the numerical attribute value, so that appropriate data anonymization is performed. The anonymized data generation method may further include (E) a process of deleting a data block whose frequency distribution does not satisfy a predetermined condition.

  The process for generating the set described above includes (a1) for each of a plurality of data blocks, identifying an identifier of a region in which a numerical attribute value of the data block is entered among a plurality of regions determined based on a threshold value, a2) For each of the plurality of data blocks, a candidate data block whose distance is to be calculated is extracted based on the identifier specified for the data block. (a3) For each of the plurality of data blocks, the data block is extracted. A process for determining whether the distance to each candidate data block is within a threshold value may be included.

  If such processing is performed, the processing speed can be increased.

  The anonymized data generation method may further include a process of deleting the confidential attribute value from the data block in which the numerical attribute value is replaced with the second numerical attribute value. Complete anonymization is done.

  Further, the numerical attribute value described above may include position data. In this case, the distance defined according to the numerical attribute may be a distance in space, a Euclidean distance, or a Manhattan distance. The position data can be appropriately processed.

  In addition, the numerical attribute value described above may include time data. In this case, the distance defined according to the numerical attribute may include a time interval. Thus, the distance may be calculated by dividing the spatial distance and the time distance.

  Further, the predetermined condition described above is a condition that the confidential attribute value is a predetermined type or more, or there is a frequency that is a predetermined multiple of the upper frequency for each of the upper predetermined number of confidential attribute values in the descending order of frequency. May be included. This makes it difficult to estimate the confidential attribute value.

  Further, the process for generating the second numerical attribute value described above is the data having the shortest distance among the data block group excluding the data block having the same confidential attribute value as the data block related to the process in the set. You may make it include the process which produces | generates a 2nd numerical value attribute value from the numerical value of a numerical value value of a block and the numerical value attribute value of a data block group. As a result, the influence of data blocks having strong characteristics can be suppressed.

  Note that the statistic described above may be an average value. In this case, as the second numerical attribute value, a numerical attribute value between the numerical attribute value of the data block having the shortest distance and the average value of the numerical attribute values of the data block group may be specified by a random number. As a result, anonymization is sufficiently achieved.

  The anonymized data generation method may further include a process of adding data representing a range in which the data block can exist to the data block in which the numerical attribute value is replaced with the second numerical attribute value. good. This makes it possible to grasp the range in which the data block may exist.

  It is possible to create a program for causing a computer to carry out the processing described above, such as a flexible disk, an optical disk such as a CD-ROM, a magneto-optical disk, and a semiconductor memory (for example, ROM). Or a computer-readable storage medium such as a hard disk or a storage device. Note that data being processed is temporarily stored in a storage device such as a RAM.

  The following supplementary notes are further disclosed with respect to the embodiments including the above examples.

(Appendix 1)
For each of the plurality of data blocks stored in the data storage unit that stores a plurality of data blocks each including a confidential attribute value and a numerical attribute value, according to the numerical attribute based on the numerical attribute value included in the data block Generate a set of data blocks whose defined distance is within the threshold,
For each of the plurality of data blocks, determine whether the frequency distribution of confidential attribute values of the data block and the data blocks included in the set generated for the data block satisfies a predetermined condition,
For the data block whose frequency distribution satisfies the predetermined condition, a second numerical attribute value is generated from the numerical attribute value of the data block included in the set generated for the data block,
Anonymized data generation method executed by a computer, including a process of replacing a numerical attribute value in a data block whose frequency distribution satisfies the predetermined condition with the second numerical attribute value generated for the data block .

(Appendix 2)
The anonymized data generation method according to supplementary note 1, further including a process of deleting a data block whose frequency distribution does not satisfy the predetermined condition.

(Appendix 3)
The process of generating the set is as follows:
For each of the plurality of data blocks, identify an identifier of a region in which a numerical attribute value of the data block is included among a plurality of regions determined based on the threshold value
For each of the plurality of data blocks, based on the identifier specified for the data block, extract a candidate data block whose distance is to be calculated,
The anonymized data generation method according to appendix 1 or 2, including a process for determining whether the distance between each of the plurality of data blocks and each of the candidate data blocks extracted for the data block is within the threshold.

(Appendix 4)
The anonymized data generation method according to any one of appendices 1 to 3, further including a process of deleting the confidential attribute value from the data block in which the numeric attribute value is replaced with the second numeric attribute value.

(Appendix 5)
The numeric attribute value includes position data;
The anonymized data generation method according to any one of appendices 1 to 4, wherein the distance defined according to the numerical attribute is a space distance, a Euclidean distance, or a Manhattan distance.

(Appendix 6)
The numerical attribute value includes time data;
The anonymized data generation method according to claim 5, wherein the distance defined according to the numerical attribute includes a time interval.

(Appendix 7)
The predetermined condition includes a condition that the confidential attribute value is greater than or equal to a predetermined type, or a condition that there is a frequency equal to or more than a predetermined multiple of the upper frequency for each of the upper predetermined number of confidential attribute values in descending order of frequency. The anonymized data generation method according to any one of appendices 1 to 6.

(Appendix 8)
The process of generating the second numerical attribute value includes
The numerical attribute value of the data block having the shortest distance among the data block group excluding the data block having the same confidential attribute value as the data block to be processed in the set, and the statistical value of the numerical attribute value of the data block group, The anonymized data generation method according to any one of appendices 1 to 7, including a process of generating a second numerical attribute value from

(Appendix 9)
The statistic is an average value,
The anonymization according to claim 8, wherein the second numerical attribute value is specified by a random number as a numerical attribute value between the numerical attribute value of the data block having the shortest distance and an average value of the numerical attribute values of the data block group. Data generation method.

(Appendix 10)
Any one of appendixes 1 to 9, further comprising a process of adding data representing a range in which the data block can exist to the data block in which the numeric attribute value is replaced with the second numeric attribute value. Anonymized data generation method.

(Appendix 11)
For each of the plurality of data blocks stored in the data storage unit that stores a plurality of data blocks each including a confidential attribute value and a numerical attribute value, according to the numerical attribute based on the numerical attribute value included in the data block Generate a set of data blocks whose defined distance is within the threshold,
For each of the plurality of data blocks, determine whether the frequency distribution of confidential attribute values of the data block and the data blocks included in the set generated for the data block satisfies a predetermined condition,
For the data block whose frequency distribution satisfies the predetermined condition, a second numerical attribute value is generated from the numerical attribute value of the data block included in the set generated for the data block,
Anonymized data generation program for causing a computer to execute a process of replacing a numerical attribute value in a data block whose frequency distribution satisfies the predetermined condition with the second numerical attribute value generated for the data block .

(Appendix 12)
For each of the plurality of data blocks stored in the data storage unit that stores a plurality of data blocks each including a confidential attribute value and a numerical attribute value, according to the numerical attribute based on the numerical attribute value included in the data block Means for generating a set of data blocks whose defined distance is within a threshold;
Means for determining, for each of the plurality of data blocks, whether a frequency distribution of confidential attribute values of the data block and a data block included in the set generated for the data block satisfies a predetermined condition;
For a data block whose frequency distribution satisfies the predetermined condition, means for generating a second numerical attribute value from the numerical attribute value of the data block included in the set generated for the data block;
Means for replacing a numerical attribute value in a data block whose frequency distribution satisfies the predetermined condition with the second numerical attribute value generated for the data block;
An information processing apparatus.

11 First Data Storage Unit 12 Grouping Unit 13 Setting Data Storage Unit 14 Group Data Storage Unit 15 Determination Unit 16 Generation Unit 17 Second Data Storage Unit 18 Conversion Processing Unit 19 Anonymized Data Storage Unit 20 Output Unit

Claims (12)

For each of the plurality of data blocks stored in the data storage unit that stores a plurality of data blocks each including a confidential attribute value and a numerical attribute value, according to the numerical attribute based on the numerical attribute value included in the data block Generate a set of data blocks whose defined distance is within the threshold,
For each of the plurality of data blocks, determine whether the frequency distribution of confidential attribute values of the data block and the data blocks included in the set generated for the data block satisfies a predetermined condition,
For the data block whose frequency distribution satisfies the predetermined condition, a second numerical attribute value is generated from the numerical attribute value of the data block included in the set generated for the data block,
Anonymized data generation method executed by a computer, including a process of replacing a numerical attribute value in a data block whose frequency distribution satisfies the predetermined condition with the second numerical attribute value generated for the data block . The anonymized data generation method according to claim 1, further comprising: deleting a data block whose frequency distribution does not satisfy the predetermined condition. The process of generating the set is as follows:
For each of the plurality of data blocks, identify an identifier of a region in which a numerical attribute value of the data block is included among a plurality of regions determined based on the threshold value
For each of the plurality of data blocks, based on the identifier specified for the data block, extract a candidate data block whose distance is to be calculated,
The anonymized data generation method according to claim 1, further comprising: determining whether the distance between each of the plurality of data blocks and each of the candidate data blocks extracted for the data block is within the threshold. . 4. The anonymized data generation method according to claim 1, further comprising: deleting the confidential attribute value from a data block in which the numeric attribute value is replaced with the second numeric attribute value. 5. The numeric attribute value includes position data;
The anonymized data generation method according to any one of claims 1 to 4, wherein the distance defined according to the numerical attribute is a distance in space, an Euclidean distance, or a Manhattan distance. The numerical attribute value includes time data;
The anonymized data generation method according to claim 5, wherein the distance defined according to the numerical attribute includes a time interval. The predetermined condition includes a condition that the confidential attribute value is greater than or equal to a predetermined type, or a condition that there is a frequency equal to or more than a predetermined multiple of the upper frequency for each of the upper predetermined number of confidential attribute values in descending order of frequency. The anonymized data generation method according to any one of claims 1 to 6. The process of generating the second numerical attribute value includes
The numerical attribute value of the data block having the shortest distance among the data block group excluding the data block having the same confidential attribute value as the data block to be processed in the set, and the statistical value of the numerical attribute value of the data block group, The anonymized data generation method according to claim 1, further comprising: generating a second numerical attribute value from the process. The statistic is an average value,
The anonymity according to claim 8, wherein the second numerical attribute value is specified by a random number between the numerical attribute value of the data block having the shortest distance and the average value of the numerical attribute values of the data block group. Data generation method. 10. The method according to claim 1, further comprising: adding data representing a range in which the data block can exist to the data block in which the numeric attribute value is replaced with the second numeric attribute value. The anonymized data generation method of description. For each of the plurality of data blocks stored in the data storage unit that stores a plurality of data blocks each including a confidential attribute value and a numerical attribute value, according to the numerical attribute based on the numerical attribute value included in the data block Generate a set of data blocks whose defined distance is within the threshold,
For each of the plurality of data blocks, determine whether the frequency distribution of confidential attribute values of the data block and the data blocks included in the set generated for the data block satisfies a predetermined condition,
For the data block whose frequency distribution satisfies the predetermined condition, a second numerical attribute value is generated from the numerical attribute value of the data block included in the set generated for the data block,
Anonymized data generation program for causing a computer to execute a process of replacing a numerical attribute value in a data block whose frequency distribution satisfies the predetermined condition with the second numerical attribute value generated for the data block . For each of the plurality of data blocks stored in the data storage unit that stores a plurality of data blocks each including a confidential attribute value and a numerical attribute value, according to the numerical attribute based on the numerical attribute value included in the data block Means for generating a set of data blocks whose defined distance is within a threshold;
Means for determining, for each of the plurality of data blocks, whether a frequency distribution of confidential attribute values of the data block and a data block included in the set generated for the data block satisfies a predetermined condition;
For a data block whose frequency distribution satisfies the predetermined condition, means for generating a second numerical attribute value from the numerical attribute value of the data block included in the set generated for the data block;
Means for replacing a numerical attribute value in a data block whose frequency distribution satisfies the predetermined condition with the second numerical attribute value generated for the data block;
An information processing apparatus.

Images