JP6681799B2 - Generating apparatus, method and program for generalized hierarchical tree - Google Patents

Description

  The present invention relates to an apparatus, method and program for generating a generalized hierarchical tree in a data set anonymization method.

Conventionally, in a data set including an attribute that can identify an individual, from the viewpoint of privacy protection, an anonymization method has been proposed in which a part of the attribute value is generalized and the individual is not specified even if the data is combined. .
For example, in the method called k-anonymization, it is necessary to construct a generalization hierarchy for generalizing attribute values (see, for example, Non-Patent Documents 1 to 3).

Kunihiko Harada, Yoshinori Sato, “k-anonymization method with automatic generation of generalized hierarchical tree and skewness evaluation by information entropy,” Research Report Computer Security (CSEC), 2010-CSEC-50 (47), 1-7 , 2010-06-24 Iwuchukwu, T .; and Naughton, J .; F. (2007), "K-Anonymization as Spatial Indexing: Toward Scarable and Incremental Anonymization," In Proceeding of the Beer-the-Behavior-Behavior-Behavior-Beer-Venue-Learning-Venue-Legence-Venue-Duration-On-Vehicles-Beer-Vehicles-,- Byun, J .; -W. , Kamra, A .; Bertino, E .; , And Li, N .; (2007), "Efficient k-Anonymity Using Clustering Technology," In Proc. of the International Conference on Database Systems Systems for Advanced Applications, pages 188-200.

  However, in the anonymization using the generalized hierarchy constructed by the existing method, the data may be generalized more than necessary and the loss of information amount may be large.

  It is an object of the present invention to provide a generalized hierarchical tree generation device, method and program capable of reducing the loss of information amount.

  A generalized hierarchical tree generation device according to the present invention includes a selection unit that selects a second attribute having the largest correlation with respect to a first attribute included in a data set including a plurality of attributes, and the second attribute. A first generation unit that generates a node in the lowest hierarchy in which the number of records included in each range obtained by dividing the value of the first attribute among records whose attributes are in a specific range is a predetermined range; A second generation unit that integrates the nodes in the lower layer and generates nodes in the upper layer that are less than the number of nodes in the lower layer.

  The second generation unit selects an unselected attribute, and in the records in which the selected attribute is in a specific range, the number is smaller than the number of nodes in the lower hierarchy that divides the value of the first attribute. The generation device generates nodes of the upper layer in which the number of records included in the range is substantially equal, and the generation device is based on an inclusion relation of the range of the first attribute in the node of the lower layer and the node of the upper layer. Then, an adjusting unit for adjusting the number of nodes in the upper layer may be provided.

  When the total number of nodes in the lower layer and nodes in the upper layer that have an inclusion relationship exceeds a threshold value, the adjustment unit divides the entire range of the nodes that have the inclusion relationship into two to make an adjusted node. If the total number is less than or equal to the threshold value, the entire range of the nodes having the inclusion relation may be one adjusted node.

  The generation device may include an output unit that outputs a specific value range of the selected attribute as a generalization condition with respect to the value range of the node of each hierarchy.

  A generalized hierarchical tree generation method according to the present invention includes a selection step of selecting a second attribute having the highest correlation with respect to a first attribute included in a data set including a plurality of attributes, A first generation step of generating a node of the lowest hierarchy in which the number of records included in each range obtained by dividing the value of the first attribute among records whose attributes are in a specific range is a predetermined range; The computer executes a second generation step of integrating the nodes in the lower layer and generating nodes in the upper layer less than the number of nodes in the lower layer.

  A generalized hierarchical tree generation program according to the present invention includes a selection step of selecting a second attribute having the largest correlation with respect to a first attribute included in a data set including a plurality of attributes; A first generation step of generating a node of the lowest hierarchy in which the number of records included in each range obtained by dividing the value of the first attribute among records whose attributes are in a specific range is a predetermined range; A second generation step of integrating the nodes in the lower layer and generating nodes in the upper layer less than the number of nodes in the lower layer.

  According to the present invention, the loss of information amount in the data set anonymization method is reduced.

It is a block diagram which shows the functional structure of the production | generation apparatus which concerns on embodiment. It is a figure which shows an example of the method of expressing the distribution of the correlation and attribute value which concerns on embodiment. It is a figure which illustrates the adjustment method of the upper hierarchy concerning an embodiment. 6 is a flowchart showing a method for generating a generalized hierarchical tree according to the embodiment.

Hereinafter, an example of the embodiment of the present invention will be described.
In the data set including a plurality of attributes, the generation device 1 according to the present embodiment is generally used when anonymization is performed by generalizing attribute values for a combination of attributes (quasi-identifier) that can identify an individual. Generate a generalized hierarchical tree that defines attribute values for each level.

  The generation device 1 is an information processing device (computer) such as a server device or a PC including a control unit (for example, CPU) and a storage unit (for example, HDD), and stores software (generation program) stored in the storage unit. The various functions according to the present embodiment are realized by the reading and execution by the control unit.

FIG. 1 is a block diagram showing a functional configuration of a generation device 1 according to this embodiment.
The generation device 1 includes a selection unit 11, a first generation unit 12, a second generation unit 13, an adjustment unit 14, and an output unit 15.

The input of the selection unit 11 is a data set D to be evaluated, a quasi-identifier ATTR included in the data set D, and an attribute attr _f εATTR to be a target for generating a generalized hierarchical tree.
The selection unit 11 selects the second attribute attr _g having the largest correlation with the given first attribute.

More specifically, the selection unit 11, an attribute value _r p of all the records _{r p} attributes attr _f in the data set D [attr _f], ∀attr∈ATTR\ attribute value _r p [attr of {attr _f} ], And select the attribute with the maximum correlation.
The correlation between attributes is obtained from a correlation coefficient by generating a scatter plot of records, or from the degree of association based on statistical information. For example, for the value of the attribute value r _p [attr] or the record for each range, the attribute that has the largest average value or median value of the attribute value r _p [attr _f ] of the attribute attr _f may be selected.

The first generation unit 12 determines a predetermined number of records included in each range in which the value of the first attribute is divided among records in which the second attribute has a specific range (single value or range of values). The node of the lowest hierarchy is generated so that the range becomes. Specifically, the algorithm in the packing problem is used, and as a result, each lowest node in the generalized hierarchical tree contains a certain number or more of records.
It should be noted that various parameters in this processing may appropriately receive input from the user.

Here, the node generation method by the selection unit 11 and the first generation unit 12 provides an interface for selecting the second attribute based on the input from the user and generating the lowest node of the generalized hierarchical tree. You may.
For example, the generation device 1 performs an output that visually expresses the correlation and the distribution of attribute values, and accepts selection input or parameter input from the user.

FIG. 2 is a diagram showing an example of a method for expressing the correlation and the distribution of attribute values according to this embodiment.
In this example, the heat map is created and displayed with the height as the attribute attr _f of interest as one axis and the sex as the attribute attr _q for checking the correlation as the other axis.
As a result, the user visually determines that there is little overlap in the distribution of attr _f (height) for each attribute value of attr _q (sex), and that the median or the average value deviates, that is, the correlation is large. In addition, it is possible to appropriately adjust the boundaries of the nodes while visually recognizing the distribution of the attribute values and the boundaries.

The second generation unit 13 integrates the nodes in the lower layer and generates nodes in the upper layer that are smaller than the number of nodes in the lower layer.
For example, the second generation unit 13 may configure the generalized hierarchical tree according to a rule such as integrating two nodes in the lower layer into one node in the upper layer, but in the present embodiment, as an example, Adopt the procedure.

The second generation unit 13 sequentially selects the unselected attributes, and selects the values of the first attribute among the records in which the selected attribute is in the specific range (single value or range of values). The nodes are generated so that the number of records included in the area is approximately equal, and the adjustment unit 14 adjusts the nodes as the upper layer nodes.
Here, the number of nodes generated by the second generation unit 13 is smaller than the number of generated lower-layer nodes.

The adjustment unit 14 adjusts the number of nodes in the upper layer based on the inclusion relation of the range of the first attribute in the generated lower layer node and the node generated by the second generation unit 13.
For example, when the total number of lower-layer nodes and upper-layer nodes that have an inclusive relationship exceeds a threshold value (for example, 4), the adjusting unit 14 divides the entire range of the inclusive nodes into two. And adjust it to be the node of the upper layer. On the other hand, when the total number is less than or equal to the threshold value, the entire range of the nodes having the inclusion relation is set as one adjusted node.
It should be noted that various parameters in this processing may appropriately receive input from the user.

FIG. 3 is a diagram illustrating an upper layer adjustment method by the second generation unit 13 and the adjustment unit 14 according to the present embodiment.
In this adjusting method, the node of the upper layer is adjusted based on the first attribute (attr _f ) and another attribute (attr _q εATTR \ {attr _f , attr _g }).

For example, attr _f : height, attr _g : gender, attr _q : history, and the first generation unit 12 sets “−162 (cm)” and “163-164” when “attr _g (sex) = male”. , "165-166", "167", "168", ..., "175", "176-178", "179-" are divided into nodes (A).
Further, the second generation unit 13 determines from “attr _f and attr _q that“ -157 ”,“ 158-162 ”,“ 163-165 ”, and“ 166-170 ”when“ attr _q (history) = present ”. , "171-174", and "175-" are divided into nodes (B).

Here, if there is a total of 5 or more overlapping ranges in the (A) division and the (B) division, the division is divided into two (X), and in the case of less than 5 divisions, the larger division Combined into one (Y), as a result, the division (C) of the nodes in the upper hierarchy is generated.
Thereby, for example, the attribute value r _p [attr _f ] = 172 of the record of “attr _g (sex) = male” and “attr _q (history) = present” is generalized to “171-172”. .

The output unit 15 sequentially selects all the attributes and outputs the generalized hierarchical tree after adjustment.
At this time, a specific value range of the selected attribute is output as a generalization condition for the value range (generalized attribute value) of the node of each hierarchy.
For example, the attribute value r _p [attr _f ] = 172 of the record of “attr _g (sex) = male” and “attr _q (history) = present” is classified into “171-172” as a hierarchy. It is output as a condition for tree-based generalization.

  FIG. 4 is a flowchart showing a method for generating a generalized hierarchical tree by the generating device 1 according to this embodiment.

In step S1, the selection unit 11 calculates the correlation between the attribute attr _f that is the target for generating the generalized hierarchical tree and each of the other attributes.
In step S2, the selection unit 11 selects the attribute attr _g having the maximum correlation calculated in step S1.

In step S3, the first generator 12, the range of the attribute attr _g (e.g., male or female sex) for each, to produce a lowermost node of the generalized hierarchical tree.

In step S4, the second generation unit 13 selects an attribute attr _q other than the attributes attr _f and attr _g .
In step S5, the second generation unit 13 generates a node in an upper layer of the generated node in the generalized hierarchical tree for each value range of the attribute attr _q (for example, presence or absence of a history).

  In step S6, the adjusting unit 14 adjusts the number of nodes in the upper layer and the range based on the inclusion relationship between the layers of the generated node and the node generated in step S5.

  In step S7, the second generation unit 13 determines whether or not all attributes have been selected in step S4. If this determination is YES, the process proceeds to step S8, and if the determination is NO, the process returns to step S4.

In step S8, the output unit 15 outputs the generalized hierarchical tree of the attribute attr _{f and} the generalized condition when using this hierarchical tree.

  According to the present embodiment, the generation device 1 can maximize the number of nodes in the lowest hierarchy by selecting the attribute with the highest correlation, so that the amount of information that accompanies generalization in the anonymization method of the data set Loss is reduced.

  In addition, in the process of generating the upper hierarchy of the generalized hierarchy tree, the generation device 1 performs node division according to the value of each attribute, and then adjusts the number of nodes based on the inclusion relationship with the generated nodes. To do. Therefore, the generation device 1 can appropriately generate the upper hierarchy of the generalized hierarchy tree based on the association with each attribute, and can reduce the loss of information amount when the generalization level in the anonymization method is increased.

  Further, in the process of adjusting the number of nodes, the generation device 1 determines the adjusted number of nodes by comparing the total number of nodes having an inclusive relationship with a threshold value. Therefore, the generation device 1 can suppress the loss of the amount of information due to the excessive decrease in the number of nodes due to generalization.

  Moreover, the generation device 1 can improve the efficiency of the anonymization process by outputting together with the generalized hierarchical tree the generalized conditions when using this hierarchical tree.

  Although the embodiments of the present invention have been described above, the present invention is not limited to the above-described embodiments. In addition, the effects described in the present embodiment are merely enumeration of the most suitable effects resulting from the present invention, and the effects according to the present invention are not limited to those described in the present embodiment.

  Each functional unit included in the generation device 1 of the present embodiment may be distributed to a plurality of information processing devices (computers). Further, the functions of this embodiment may be provided by a cloud system in which loads are distributed by a plurality of servers.

  The generation method by the generation device 1 is realized by software. When implemented by software, a program forming the software is installed in an information processing device (computer). Further, these programs may be recorded on a removable medium such as a CD-ROM and distributed to users, or may be distributed by being downloaded to a user's computer via a network. Further, these programs may be provided to the user's computer as a Web service via the network without being downloaded.

DESCRIPTION OF SYMBOLS 1 generation device 11 selection unit 12 first generation unit 13 second generation unit 14 adjustment unit 15 output unit

Claims (6)

A selection unit for selecting the second attribute having the highest correlation with respect to the first attribute included in the data set including a plurality of attributes;
Wherein the second attribute of the record of the data set is a specific range, so the number of records contained in the first respective range within that partition the value of the attribute is a predetermined range, each was the divided A first generation unit that generates a node of the lowest hierarchy indicating a range ,
A second generation unit that integrates a plurality of nodes in the generated lower layer in order from the lowest layer to the upper layer and generates a node in the upper layer that is smaller than the number of nodes in the lower layer. Generalized hierarchical tree generator. The second generation unit selects an unselected attribute, and the number of nodes in the lower layer that divides the value of the first attribute among the records of the data set in which the selected attribute is in a specific range. Generate a node in the upper hierarchy in which the number of records contained in each range less than is approximately equal,
The generalized hierarchical tree according to claim 1, further comprising an adjusting unit that adjusts the number of nodes of the upper layer based on an inclusion relation of the range of the first attribute in the node of the lower layer and the node of the upper layer. Generator.   When the total number of nodes in the lower layer and nodes in the upper layer that have an inclusion relationship exceeds a threshold value, the adjustment unit divides the entire range of the nodes that have the inclusion relationship into two to make an adjusted node. The generalized hierarchical tree generation device according to claim 2, wherein when the total number is less than or equal to the threshold value, the entire range of the nodes having the inclusion relation is one adjusted node.   The generalized hierarchical tree generation device according to claim 1, further comprising: an output unit that outputs a specific range of the selected attribute as a generalization condition with respect to a range of nodes of each hierarchy. . A selection step of selecting part for the first attribute in the dataset including a plurality of attributes, selects the larger second attribute of highest correlation,
Of the first generating unit and the second attribute of the data set is a specific range records, as the number of records included in the first in each value range is divided the value of the attribute is a predetermined range , A first generation step of generating a node of the lowest hierarchy indicating each of the divided bins ,
A second generation in which the second generation unit integrates a plurality of nodes in the generated lower hierarchy in order from the lowest hierarchy to an upper level, and generates an upper-layer node smaller in number than the number of the lower-layer nodes. A method for generating a generalized hierarchical tree by a computer, the method including : A generalized hierarchical tree generation program for causing a computer to function as the generalized hierarchical tree generation device according to any one of claims 1 to 4 .

Images