CN113536095A

CN113536095A - Data recommendation method and device and storage medium

Info

Publication number: CN113536095A
Application number: CN202010279667.5A
Authority: CN
Inventors: 冉鹏; 粟栗; 耿慧拯
Original assignee: China Mobile Communications Group Co Ltd; China Mobile Communications Ltd Research Institute
Current assignee: China Mobile Communications Group Co Ltd; China Mobile Communications Ltd Research Institute
Priority date: 2020-04-10
Filing date: 2020-04-10
Publication date: 2021-10-22

Abstract

The invention discloses a data recommendation method, a data recommendation device and a storage medium, wherein the method comprises the following steps: determining first data to be transmitted; the first data is behavior data collected locally by the terminal; sending the second data to a server; wherein, when it is determined that the first data does not satisfy the conversion condition, the second data is the first data; when the first data are determined to meet the conversion condition, the second data are disturbance data obtained based on the first data; and receiving the recommendation data determined and sent by the server according to the second data.

Description

Data recommendation method and device and storage medium

Technical Field

The present invention relates to data privacy technologies, and in particular, to a data recommendation method, apparatus, and storage medium.

Background

The recommendation system generally recommends information and goods of interest to the user according to the characteristics of interest and purchasing behavior of the user. The recommendation system is divided into a server-side recommendation system, a client-side recommendation system, a proxy server-side recommendation system and the like according to different positions of recommendation algorithms. The existing privacy protection scheme for the recommendation system generally disturbs uploaded or collected data at a client or a server through various technologies, or rewrites a recommendation algorithm to achieve the purpose of privacy protection, for example, a centralized differential privacy technology is adopted to achieve privacy protection.

However, the centralized differential privacy technology requires that a data collector is an honest party and does not generate malicious behaviors on real data uploaded by a user, and in a real scene, a completely trusted data collector does not exist, so that the user does not want a manufacturer to obtain private data, but applications such as accurate marketing, advertisement delivery, personalized recommendation and the like need to perform data mining on a large amount of user data to obtain a more accurate user figure, so that user experience is improved; how to realize accurate recommendation on the basis of ensuring the privacy of the user is a problem to be solved at present.

Disclosure of Invention

In view of the above, the present invention is directed to a data recommendation method, apparatus and storage medium.

In order to achieve the purpose, the technical scheme of the invention is realized as follows:

the embodiment of the invention provides a data recommendation method, which is applied to a terminal and comprises the following steps:

determining first data to be transmitted; the first data is behavior data collected locally by the terminal;

sending the second data to a server; wherein, when it is determined that the first data does not satisfy the conversion condition, the second data is the first data; when the first data are determined to meet the conversion condition, the second data are disturbance data obtained based on the first data;

and receiving the recommendation data determined and sent by the server according to the second data.

In the above scheme, the method further comprises: judging whether the first data meet a conversion condition;

the judging whether the first data meet the conversion condition comprises the following steps:

determining a preset privacy parameter; the privacy parameter is associated with a preset privacy protection degree;

determining a disturbance probability value according to the preset privacy parameter;

according to the disturbance probability value, performing binary random response on the first data to obtain a response result; the response result represents whether the first data is converted or not;

in response to the response characterizing no transformation of the first data, the first data does not satisfy a transformation condition;

and in the case that the first data are converted corresponding to the response result characterization, the first data meet the conversion condition.

In the foregoing solution, the first data includes: at least one parameter and a value corresponding to each parameter in the at least one parameter;

transforming the first data, comprising:

performing multi-value random response on the numerical value corresponding to each parameter in the at least one parameter to obtain a random response result corresponding to each parameter in the at least one parameter;

and obtaining the second data according to the random response result corresponding to each parameter in the at least one parameter.

In the foregoing solution, the performing a multi-value random response on the value corresponding to each parameter in the at least one parameter to obtain a random response result corresponding to each parameter in the at least one parameter includes:

according to preset privacy parameters, carrying out multi-value random response on numerical values corresponding to all parameters in the at least one parameter to obtain random response results corresponding to all parameters in the at least one parameter; the privacy parameter is associated with a preset degree of privacy protection.

In the above scheme, the method further comprises: determining a similarity between the first data and the second data;

before sending the second data to the server, the method further includes:

adding a tag to the second data according to the similarity; the tag characterizing whether recommended data determined based on the second data is employed;

after receiving the recommendation data determined and sent by the server according to the second data, the method further includes:

determining a label of second data corresponding to the recommended data;

determining a recommendation result according to the label of the second data corresponding to the recommendation data; and the recommendation result represents whether recommendation is performed according to the recommendation data.

The embodiment of the invention provides a data recommendation device, which comprises: the device comprises a first processing module, a second processing module and a third processing module; wherein,

the first processing module is used for determining first data to be sent; the first data is behavior data collected locally by the terminal;

the second processing module is used for sending second data to the server; wherein, when it is determined that the first data does not satisfy the conversion condition, the second data is the first data; when the first data are determined to meet the conversion condition, the second data are disturbance data obtained based on the first data;

and the third processing module is used for receiving the recommendation data determined and sent by the server according to the second data.

In the above scheme, the second processing module is configured to determine a preset privacy parameter; the privacy parameter is associated with a preset privacy protection degree;

the second processing module is configured to perform multi-value random response on the value corresponding to each parameter in the at least one parameter, so as to obtain a random response result corresponding to each parameter in the at least one parameter;

In the foregoing scheme, the second processing module is configured to perform a multi-value random response on a value corresponding to each parameter in the at least one parameter according to a preset privacy parameter, so as to obtain a random response result corresponding to each parameter in the at least one parameter; the privacy parameter is associated with a preset degree of privacy protection.

In the foregoing solution, the second processing module is further configured to determine a similarity between the first data and the second data;

the second processing module is further used for adding a label to the second data according to the similarity before sending the second data to the server; the tag characterizing whether recommended data determined based on the second data is employed;

the third processing module is further configured to determine a tag of second data corresponding to the recommended data after receiving the recommended data determined and sent by the server according to the second data;

The embodiment of the invention provides a data recommendation device, which comprises a memory, a processor and a computer program which is stored on the memory and can be run on the processor, wherein the processor executes the program to realize the steps of the data recommendation method.

The embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored, where the computer program, when executed by a processor, implements the steps of the data recommendation method.

The data recommendation method, the data recommendation device and the storage medium provided by the embodiment of the invention determine first data to be sent; the first data is behavior data collected locally by the terminal; sending the second data to a server; wherein, when it is determined that the first data does not satisfy the conversion condition, the second data is the first data; when the first data are determined to meet the conversion condition, the second data are disturbance data obtained based on the first data; receiving recommendation data determined and sent by the server according to the second data; in this way, by performing Localized Differential Privacy (LDP) processing on the uploaded data, it is possible to prevent an untrusted data collector from revealing user private data.

Drawings

Fig. 1 is a schematic flowchart of a data recommendation method according to an embodiment of the present invention;

FIG. 2 is a flowchart illustrating another data recommendation method according to an embodiment of the present invention;

fig. 3 is a schematic flowchart of another data recommendation method according to an embodiment of the present invention;

fig. 4 is a schematic structural diagram of a data recommendation device according to an embodiment of the present invention;

fig. 5 is a schematic structural diagram of a data recommendation system according to an embodiment of the present invention;

fig. 6 is a schematic structural diagram of another data recommendation device according to an embodiment of the present invention.

Detailed Description

Before further detailed description of the present invention with reference to the embodiments, a description will be given of related techniques for privacy protection and recommendation based on data after privacy protection.

The rapid development of the internet industry brings convenience and rapidness of data sharing for people, but the privacy disclosure risk level caused by the rapid development is increasingly improved, and the continuous upgrading of the network attack means also puts higher requirements on the development of the theory and technology of privacy protection. With the advent of the big data age, manufacturers are increasingly focusing on user data. The existing research shows that an attacker can discover user privacy information from mass data instead of directly acquiring the user privacy information through accessing the data, so that the traditional encryption and access control technology cannot resist the attack. There are three main ways of privacy protection: data distortion, data encryption, access control. The current privacy protection technology combines the various schemes, for example, the technologies such as K-anonymity, l-diversity and T-confidentiality play a certain role in resisting consistency attack, background knowledge attack and similarity attack, all of the technologies depend on the background knowledge of an attacker, but no reasonable assumption is made on an attack model; for example, a differential privacy model proposed by c.dwork et al provides a higher-level security guarantee for personal information, does not depend on the amount of background knowledge possessed by an attacker, and achieves the purpose of protecting privacy in data analysis by introducing a data randomization processing method such as noise.

The recommendation system generally recommends information and goods of interest to the user according to the characteristics of interest and purchasing behavior of the user. The recommendation system is divided into a server-side recommendation system, a client-side recommendation system, a proxy server-side recommendation system and the like according to different positions of recommendation algorithms. The existing privacy protection scheme for the recommendation system generally disturbs uploaded or collected data at a client or a server through various technologies, or rewrites a recommendation algorithm to achieve the purpose of privacy protection. The prior art provides a recommendation system based on differential privacy protection, for example, a differential privacy method is introduced into a recommendation algorithm based on K neighbor, and privacy neighbor selection is performed in a differential privacy frame and recommendation is performed according to the privacy neighbor selection, so that the method can effectively resist attacks based on similar users; arnaud et al propose a matrix decomposition method for differential privacy protection, under an algorithm for recommending by using the matrix decomposition method, the method introduces noise disturbance meeting differential privacy conditions in user scoring data and a random gradient descent process respectively, and the scheme can resist attacks aiming at a server side to a certain extent; shen et al propose a recommendation system that applies differential privacy to clients, and use public data to calculate the magnitude of disturbance to user data, thereby ensuring the usability of the disturbed user data.

However, there is a key assumption that the centralized differential privacy model is adopted in the above method, that is, the data collector is honest and cannot generate malicious behavior on the real data uploaded by the user. In a real scene, a completely trusted data collector does not exist, and many times, a user does not want a manufacturer to obtain private data of the user. And applications such as accurate marketing, advertisement putting, personalized recommendation and the like need to carry out data mining on a large amount of user data so as to obtain a more accurate user figure, and user experience is improved.

For the recommender system, an important issue for the architecture of the recommender system is where the user information collection and user profiles are located, on the server or the client, or on a proxy server between the two. When the recommendation algorithm is implemented on a server or a proxy server, the security of the private data of the user cannot be guaranteed. The user data stored on the server can be conveniently acquired by both the manager of the recommendation system and the personnel who invade the recommendation system. Since the personal data of the user is highly valuable, a part of people who are exposed to the user data may sell the user data or use the user data for illegal use. The client-based recommendation system is difficult to acquire data of other users, user description files are difficult to obtain, collaborative recommendation strategies are difficult to implement, and a more complex recommendation algorithm is often required to be designed.

In view of the above problem, in the scheme provided in the embodiment of the present invention, first data to be sent is determined; the first data is behavior data collected locally by the terminal; sending the second data to a server; wherein, when it is determined that the first data does not satisfy the conversion condition, the second data is the first data; when the first data are determined to meet the conversion condition, the second data are disturbance data obtained based on the first data; and receiving the recommendation data determined and sent by the server according to the second data.

The present invention will be described in further detail with reference to examples.

Fig. 1 is a schematic flowchart of a data recommendation method according to an embodiment of the present invention; as shown in fig. 1, the data recommendation method is applied to a terminal (e.g., a mobile phone, a tablet computer, a personal computer, a notebook computer, etc.); the method comprises the following steps:

step 101, determining first data to be sent; the first data is behavior data collected locally by the terminal;

step 102, sending the second data to a server; wherein, when it is determined that the first data does not satisfy the conversion condition, the second data is the first data; when the first data are determined to meet the conversion condition, the second data are disturbance data obtained based on the first data;

and 103, receiving the recommendation data determined and sent by the server according to the second data.

In an embodiment, the method further comprises: judging whether the first data meet a conversion condition;

in response to the response characterizing no transformation of the first data, the first data does not satisfy a transformation condition; accordingly, the first data may be regarded as the second data;

in the case that the response result represents the conversion of the first data, the second data meets the conversion condition; accordingly, disturbance data obtained based on the first data may be used as the second data.

Specifically, the determination of whether the first data satisfies the conversion condition may be performed by performing a binary random response on the first data according to the disturbance probability value, and determining according to a response result. That is, when the response result indicates that the first data is not transformed, it may be determined that the first data does not satisfy the transformation condition, and when the response result indicates that the first data is transformed, it may be determined that the second data satisfies the transformation condition.

Here, the disturbance probability value is a probability value representing whether privacy protection is performed on the first data to be uploaded.

The binary random response is explained in detail below.

In the binary random response, real data of a user, namely the real first data, is uploaded with a probability of p, and disturbance data (namely distortion data) in the same form as the real data is uploaded with a probability of 1-p (namely the disturbance probability value). Here, the binary random response satisfies the following formula (1):

that is, in the case where the response result characterization does not convert the first data, i.e., at the probability of p, the first data is taken as the second data;

and taking the disturbance data obtained by converting the first data as second data under the condition that the response result represents the first data, namely under the probability of 1-p.

Here, by adopting a random Response (random Response) technique, it is difficult for the server to distinguish whether the user uploads real data (i.e., first data) or disturbance data, and the terminal side can deny the real data uploaded by itself with a probability of 1-p.

It should be noted that, in the binary random response technique, the relationship between the probability p of answering a real answer (here, uploading real first data) and the preset privacy parameter epsilon of the localized differential privacy satisfies the following formula (2):

when the user selects a higher privacy protection degree, the smaller the value of the privacy budget parameter epsilon of the localized differential privacy is, and correspondingly, the lower the probability p that the terminal uploads real data to the server side is.

That is to say, the determining a disturbance probability value according to the preset privacy parameter may include:

and inquiring the corresponding relation between the privacy parameters and the disturbance probability value according to the preset privacy parameters, and determining the disturbance probability value corresponding to the preset privacy parameters.

The corresponding relationship between the privacy parameter and the disturbance probability value may be preset by a developer and stored in a server, and the terminal automatically acquires the privacy parameter from the server when determining the disturbance probability value, or may be stored in a client loaded by the terminal, which is not limited herein.

Here, setting the correspondence between the privacy parameter and the disturbance probability value may be determined according to the above expression (2).

Specifically, the privacy parameter is associated with a preset privacy protection degree, and the preset privacy protection degree can be specifically set by a user through a human-computer interaction interface of the terminal; different protection degrees correspond to different privacy parameters; for example: providing a selection key by a terminal (specifically, a client loaded on the terminal) and respectively corresponding to a primary protection degree, a secondary protection degree and a tertiary protection degree; the primary protection degree is greater than the secondary protection degree, and the secondary protection degree is greater than the tertiary protection degree; correspondingly, the privacy parameter corresponding to the primary protection degree is smaller than the privacy parameter corresponding to the secondary protection degree, and the privacy parameter corresponding to the secondary protection degree is smaller than the privacy parameter corresponding to the tertiary protection degree. The user selects different privacy protection degrees according to the requirement of the user, and then the terminal can determine different privacy protection degrees and corresponding privacy parameters.

Here, before the data recommendation method is enabled, the user may also select whether to adopt privacy protection according to the user's own needs. For example, the terminal provides a close key, when the user selects the privacy protection degree of the historical data, the terminal may also provide a close key in addition to the primary protection degree, the secondary protection degree, and the tertiary protection degree, and if the close key is selected, the representation does not adopt privacy protection.

In one embodiment, the first data comprises: at least one parameter and a value corresponding to each parameter in the at least one parameter;

transforming the first data, comprising:

By converting the first data in the above manner, the disturbance data can be obtained based on the first data, and the obtained disturbance data is used as the second data.

Specifically, the performing a multi-valued random response on the value corresponding to each parameter in the at least one parameter to obtain a random response result corresponding to each parameter in the at least one parameter includes:

Specifically, the multi-value response refers to performing a random response according to a preset privacy parameter and a value corresponding to each parameter.

For example, the first data comprises: at least one commodity (i.e. the at least one parameter) and a score (i.e. a numerical value for each parameter) corresponding to each commodity; the first data may be recorded in a vector form, denoted as X ═ X (X)₁,x₂,…x_i,…x_n) Wherein x is_iThe evaluation of the ith product by the user is shown, and generally, a score of 0 indicates that the user has not used the product or has not evaluated the product.

And carrying out multi-value random response aiming at the corresponding score of each commodity, wherein the multi-value random response comprises the following steps:

when the random response technology judges that the real data are not uploaded to the server at the time, the terminal will carry out comparison on each bit X of the vector X_iCarrying out one-time multivalued random response; specifically, assuming that the score can be 1,2, …, k, with k levels, the terminal will apply equation (3) below to each bit X in the vector X_iCarrying out multivalued random response:

wherein e represents a natural constant, epsilon represents a preset privacy parameter, and k represents an original x_iThe value of (a), i.e. the raw score;

specifically, for a bit X in the vector X_iIs provided with

Is set to the original value, has

Is set to 1,2, …, k is not equal to x_iAny value of (a), the algorithm output is noted as y_iFinally, obtaining a disturbed data Y after each bit is disturbed (Y)₁,y₂,…y_i,…y_n)。

In practical application, considering that the difference between the disturbance data and the original data (i.e., the original first data) is large, the recommended data determined according to the disturbance data does not conform to the result required by the user, and if the recommended data is still recommended to the user according to the recommended data, the experience of the user is reduced, so that whether the recommended data determined according to the disturbance data is recommended to the user is judged.

Based on this, in an embodiment, the method further comprises: determining a similarity between the first data and the second data;

before sending the second data to the server, the method further includes:

determining a label of second data corresponding to the recommended data;

Here, after obtaining the perturbation data (denoted as Y) through the random response, a euclidean distance between the original data (i.e., the first data X) and the perturbation data Y (i.e., the second data) is calculated to represent a similarity between the original data X and the perturbation data Y, where the euclidean distance is calculated as follows:

here, the similarity is used to determine whether a recommendation condition is met, and if the recommendation condition is met, the recommendation result is used, and if the recommendation condition is not met, the recommendation result is not used. The condition of meeting the recommendation condition means that the similarity exceeds a preset similarity threshold; on the contrary, the condition that the similarity does not meet the recommendation condition means that the similarity does not exceed a preset similarity threshold; the similarity threshold is preset by a developer and is stored in the server.

The tag may be marked in a digital form, such as with the numeral 1 indicating that recommended data determined based on the second data may be employed, and the numeral 0 indicating that recommended data determined based on the second data is not employed; the label may be marked with other characters such as numbers or letters, which is not limited herein.

The second data carries a label, and after the server receives the second data carrying the label, the server determines recommended data according to the second data; and adding the same label to the recommended data based on the carried label, namely, the recommended data sent to the terminal also carries the label, so that the terminal can determine the label of the second data corresponding to the recommended data based on the received recommended data, and determine the recommendation result according to the label of the second data corresponding to the recommended data.

Correspondingly, the embodiment of the invention also provides a data recommendation method, the data recommendation method is applied to the server, and the server adopts the data recommendation method for recommendation. Fig. 2 is a schematic flow chart of another data recommendation method according to an embodiment of the present invention, and as shown in fig. 2, the method includes:

step 201, receiving second data sent by a terminal; the second data is the first data or disturbance data obtained based on the conversion of the first data; the first data is original data collected from the terminal;

step 202, determining recommendation data based on the received second data; the recommended data carries a label, and the label represents whether the recommended data determined based on the second data is adopted;

step 203, sending the recommended data to the terminal.

After receiving the second data sent by the terminal, the server may determine recommended data according to the second data, and specifically, a method for determining recommended data based on the received second data by the server may adopt any data recommendation method, which is not limited herein.

The following provides a method of determining recommendation data, in particular based on the received second data, comprising:

determining the characteristics of each parameter in the second data and the numerical value corresponding to each parameter, and determining a first vector according to the characteristics of each parameter in the second data and the numerical value corresponding to each parameter;

obtaining at least one second vector; the second vector is obtained based on second data obtained from other terminals;

determining a similarity of the first vector and each of the at least one second vector;

determining a target second vector with the similarity exceeding a preset threshold value with the first vector from at least one second vector according to the similarity; the preset threshold is preset by a developer and is stored in the server;

and determining a terminal corresponding to the target second vector, and determining recommended data based on the data sent by the terminal corresponding to the target second vector.

Specifically, the determining recommended data based on the data sent by the terminal corresponding to the target second vector includes:

determining at least one first parameter included in data sent by a terminal corresponding to the target second vector;

determining at least one second parameter included in data sent by a terminal corresponding to the first vector;

and screening the at least one second parameter from the at least one first parameter, and taking the rest second parameters as recommendation data.

The above is only to provide a reference method for determining recommended data, and other methods may also be adopted in practical applications.

The determining recommendation data based on the received second data comprises:

determining a label carried by the second data;

determining recommendation data based on the second data, and adding the tag to the recommendation data;

correspondingly, the sending the recommendation data to the terminal includes: and sending the recommendation data carrying the label to the terminal.

Fig. 3 is a schematic flowchart of another data recommendation method according to an embodiment of the present invention; as shown in fig. 3, the data recommendation method includes:

301, randomizing historical data to be uploaded by a client by using a local differential privacy technology;

here, the client may be loaded on a device, and the device may be a terminal to which the method shown in fig. 1 is applied.

Specifically, the step 301 includes:

step 3011, perform a binary random response to whether to upload real historical data to the server, and obtain a random response result; and the random response result represents whether real historical data is uploaded or not. In the binary random response, uploading real historical data according to the probability of p, and uploading disturbance data in the same form as the real historical data according to the probability of 1-p; the binary random response satisfies the following formula (4):

here, with the random response technique, it is difficult for the server to distinguish the data uploaded by the client as real history data or disturbance data, and the user can deny that the real history data is uploaded by itself with a probability of 1-p.

In the recommendation algorithm, the history data uploaded by the client may be generally expressed as a "commodity-score" vector X ═ X (X)₁,x₂,…x_i,…x_n) Wherein x is_iThe evaluation of the ith product by the user is shown, and generally, a score of 0 indicates that the user has not used the product or has not evaluated the product.

For example, the historical data may be data related to a movie watched by a user, data related to a book read by the user, and data related to a certain type of article purchased by the user;

taking the commodity as a movie as an example, and the score is a score of the user for the movie; i.e. the historical data, including: at least one movie and a score corresponding to each movie;

such as: the historical data comprises: movie one-3 points, movie two-5 points, movie three-9 points, … … points, and movie N-6 points.

Step 3012, when the random response technique determines not to upload the real history data to the server, the client will apply to each bit X of the vector X_iCarrying out one-time multivalued random response; specifically, assuming a score of 1,2, …, k levels, the client will pair each bit X in the vector X as in equation (5)_iCarrying out multivalued random response:

wherein e represents a natural constant, epsilon represents a preset privacy parameter, and k represents an original x_iThe numerical values of (1);

specifically, for a bit X in the vector X_iIs provided with

Is set to the original value, has

Is set to 1,2, …, k is not equal to x_iAny value of (a), the algorithm output is noted as y_iFinally, obtaining a disturbed data vector Y (Y) after each bit is disturbed₁,y₂,…y_i,…y_n)。

Specifically, before the step 301, the method further includes:

before the recommendation service is started, the user can select the privacy protection degree of the historical data at the client, and whether the localized differential privacy is adopted to protect the historical data or not and the protection degree of the localized differential privacy are correspondingly adopted.

Step 302, the client determines target data and sends the target data to the server.

Here, the target data is the uploaded data obtained after the processing in step 301, and may specifically be real historical data or disturbance data obtained after the processing of the historical data.

Specifically, the step 302 further includes:

after obtaining the disturbance data Y through random response, calculating the Euclidean distance between the original historical data X and the disturbance data Y as the similarity between the original data X and the disturbance data Y; here, the euclidean distance is calculated as the following formula (6):

determining a label corresponding to the target data according to the calculated similarity, wherein the label represents whether recommended data determined based on the target data is adopted or not;

correspondingly, the sending the target data to the server includes:

and sending the target data carrying the label to a server.

Specifically, history data, that is, a vector X is subjected to localized differential privacy processing and then recorded as X '(X' ═ X, X '═ Y), and a client marks X' before uploading X ', for example, a tag used for characterizing whether recommended data determined based on X' is adopted is added; after receiving the recommended data, the client may determine whether to use the corresponding recommended data according to the tag carried by the recommended data (see the method shown in fig. 1 specifically, which is not described here again).

Or marking X ' before the client uploads X ', and locally recording the relation between the uploaded X ' and X; for example, add unique tag a to X; when uploaded X '═ X, a label (i.e., a) is added to X', or when uploaded X '═ Y and the similarity between X and Y is higher than a set similarity threshold, a label (e.g., a') is added to Y, where the similarity between Y and X is not higher than the set similarity threshold, then no label or other characters may be marked to indicate that no recommendation data based on Y is to be employed; here, a' corresponds to a; after the client receives the recommendation data, comparing the tag of the recommendation data (i.e. the tag a or a 'corresponding to X') with the locally marked tag (including the tag a of the real historical data X and the tag a 'of the disturbance data Y with higher similarity to the real historical data), if the tag carried by the returned recommendation data is a' or a, determining that the tag is matched with the locally marked tag, using the current recommendation data, otherwise, not using the current recommendation data.

Step 303, the server receives target data sent by the client, and determines recommended data by using a preset recommendation method according to the received target data;

it should be noted that, because the form of the disturbance data is the same as that of the real upload data, the data subjected to the localized differential privacy processing can still be recommended by the existing recommendation algorithm. And after the server runs the recommendation algorithm, the recommendation data carrying the label is returned to the client.

Here, the preset recommendation method specifically refers to the method shown in fig. 2, and details are not described here.

Step 304, the server sends the recommended data and the label corresponding to the recommended data to the client;

and 305, the client determines a recommendation result according to the recommendation data and the label corresponding to the recommendation data.

The following further describes the localized differential privacy technique and the random response technique involved in the above scheme.

The differential privacy technique is an important privacy protection method, and has been widely used in many fields in recent years. Differential privacy does not require that the overall privacy of the data set be guaranteed, but rather that protection be provided for individual privacy in the data set. The original statistical data is subjected to distortion processing by adding random noise and the like, so that the influence of the change of any record in the data set on the query output result is limited, an attacker cannot know the privacy information of the relevant individuals by observing the query result, and the safety is ensured on the premise of sacrificing certain accuracy.

The localized differential privacy technology is based on a data collection framework proposed by a centralized differential privacy protection technology, and is different from the assumption of the centralized differential privacy on a trusted third party, which is aimed at an untrusted third party data collector.

The protection model under the localized differential privacy fully considers the possibility that a data collector steals or reveals the privacy of a user in the data acquisition process. In the model, each user firstly carries out privacy processing on data, then the processed data are sent to a data collector, and the data collector carries out statistics on the collected data to obtain an effective analysis result. Namely, the privacy information of the individual is ensured not to be revealed when the data is subjected to statistical analysis. Formalization of localized differential privacy is defined as follows.

Giving n users, wherein each user corresponds to a privacy algorithm M, a definition domain Dom (M) and a value domain ran (M), and if the algorithm M records t and t' (t) in any two records_,the same output result is obtained on t' epsilon Dom (M))

Satisfying the following inequality, then M satisfies epsilon-localized differential privacy:

epsilon is a privacy protection budget and is used for representing the privacy protection level, and the smaller the value of epsilon, the more similar the probability distribution of the query result of the algorithm on the adjacent data sets, and the higher the privacy protection level. When ε is 0, the data collector will simply not be able to distinguish t from t' from the results received, when the degree of protection is highest. But an increase in the level of privacy protection often results in a decrease in data availability.

As can be seen by definition, the localized differential privacy technique ensures that the algorithm M satisfies epsilon-localized differential privacy by controlling the similarity of the output results of any two records. In short, it is almost impossible to deduce which record its input data is based on a certain output result of the privacy algorithm M.

The random response technology is a mainstream perturbation mechanism of the localized differential privacy technology, and the main idea of the random response technology is to perform privacy protection on original data by using uncertainty of response to sensitive problems. The random response technique mainly comprises two steps: disturbance statistics and correction.

To specifically introduce the random response technique, a specific problem scenario is introduced below. Suppose there are n users, of which the true proportion of aids patients is pi, but we do not know. To which we wish to scale

And (6) carrying out statistics. Then a sensitive question is initiated, is "is you an aids patient? ", each user responds thereto, answer X for the ith user_iYes or no, but for privacy reasons the user does not respond directly to the true answer. It is assumed that it gives an answer by means of a non-uniform coin with a probability p of the front side facing upwards and a probability 1-p of the back side facing upwards. And throwing the coin, and if the front side is upward, answering a real answer, and if the back side is upward, answering an opposite answer.

The method comprises the following steps of firstly, carrying out disturbance statistics, and carrying out statistics on answers of n users by using the disturbance method to obtain a statistic value of the number of AIDS patients. Assume that in the statistical result, the number of people answering "yes" is n₁The number of people who answer "No" is n-n₁Obviously, according to the above statistics, the proportion of users answering "yes" and "no" is as follows:

Pr(X_iis ═ p + (1-pi) (1-p)

Pr(X_iNot (1-pi) p + pi (1-p)

According to the statistical result, the maximum likelihood estimation value of the true proportion pi of the AIDS patient can be obtained

And calculate

As can be seen from the expectations that,

unbiased estimation of π:

the total number of people who can thus be suffering from HIV is:

considering the random response technique from the point of differential privacy, assume that a patient is aids and when he answers "do you are aids? "this sensitive question, he has a probability of p to answer" yes "and a probability of 1-p to answer" no ", whereas for a patient who is not ill, he has a probability of p to answer" no "and a probability of 1-p to answer" yes ". Therefore, we can obtain the differential privacy definition correspondingly satisfied by the random response technology:

substituting the probability p of the real situation into a formula to obtain the relation between the privacy budget parameter epsilon and p:

the greater the probability p of answering a real situation, the greater the privacy budget parameter epsilon, i.e. the lower the degree of protection of localized differential privacy.

Fig. 4 is a schematic structural diagram of a data recommendation device according to an embodiment of the present invention, where the data recommendation device is applied to a terminal, and as shown in fig. 4, the data recommendation device includes: the device comprises a first processing module, a second processing module and a third processing module; wherein,

Specifically, the second processing module is configured to determine a preset privacy parameter; the privacy parameter is associated with a preset privacy protection degree;

Specifically, the first data includes: at least one parameter and a value corresponding to each parameter in the at least one parameter;

Specifically, the second processing module is configured to perform a multi-value random response on a numerical value corresponding to each parameter in the at least one parameter according to a preset privacy parameter, so as to obtain a random response result corresponding to each parameter in the at least one parameter; the privacy parameter is associated with a preset degree of privacy protection.

Specifically, the second processing module is further configured to determine a similarity between the first data and the second data;

It should be noted that: in the data recommendation apparatus provided in the foregoing embodiment, when implementing the corresponding data recommendation method, only the division of each program module is illustrated, and in practical applications, the processing distribution may be completed by different program modules according to needs, that is, the internal structure of the server is divided into different program modules to complete all or part of the processing described above. In addition, the apparatus provided by the above embodiment and the embodiment of the corresponding method belong to the same concept, and the specific implementation process thereof is described in the method embodiment, which is not described herein again.

Fig. 5 is a schematic structural diagram of a data recommendation system according to an embodiment of the present invention, where the data recommendation system includes: the system comprises a terminal and a server, wherein the terminal is loaded with a client capable of implementing the data recommendation method shown in fig. 1, as shown in fig. 5, the client sends data to the server, and the sent data is original data or disturbance data; and the server determines recommended data based on the data after receiving the data and sends the recommended data to the client.

When the client side implements the corresponding data recommendation method, the method shown in fig. 1 may be specifically referred to; and will not be described in detail herein.

When the server implements the corresponding data recommendation method, reference may be specifically made to the method shown in fig. 2; and will not be described in detail herein.

Fig. 6 is a schematic structural diagram of a data recommendation device according to an embodiment of the present invention; as shown in fig. 6, the apparatus 60 includes: a processor 601 and a memory 602 for storing computer programs executable on said processor; wherein, the processor 601 is configured to execute, when running the computer program, the following steps: determining first data to be transmitted; the first data is behavior data collected locally by the terminal; sending the second data to a server; wherein, when it is determined that the first data does not satisfy the conversion condition, the second data is the first data; when the first data are determined to meet the conversion condition, the second data are disturbance data obtained based on the first data; and receiving the recommendation data determined and sent by the server according to the second data.

In an embodiment, the processor 601 is configured to execute, when running the computer program, the following steps: determining a preset privacy parameter; the privacy parameter is associated with a preset privacy protection degree; determining a disturbance probability value according to the preset privacy parameter; according to the disturbance probability value, performing binary random response on the first data to obtain a response result; the response result represents whether the first data is converted or not;

In an embodiment, the processor 601 is configured to execute, when running the computer program, the following steps: performing multi-value random response on the numerical value corresponding to each parameter in the at least one parameter to obtain a random response result corresponding to each parameter in the at least one parameter;

In an embodiment, the processor 601 is configured to execute, when running the computer program, the following steps: according to preset privacy parameters, carrying out multi-value random response on numerical values corresponding to all parameters in the at least one parameter to obtain random response results corresponding to all parameters in the at least one parameter; the privacy parameter is associated with a preset degree of privacy protection.

In an embodiment, the processor 601 is configured to execute, when running the computer program, the following steps: determining a similarity between the first data and the second data;

before sending the second data to the server, executing: adding a tag to the second data according to the similarity; the tag characterizing whether recommended data determined based on the second data is employed;

after receiving the recommendation data determined and sent by the server according to the second data, the method further executes: determining a label of second data corresponding to the recommended data; determining a recommendation result according to the label of the second data corresponding to the recommendation data; and the recommendation result represents whether recommendation is performed according to the recommendation data.

Specifically, the data recommendation apparatus specifically executes the method shown in fig. 1, and belongs to the same concept as the recommendation method embodiment shown in fig. 1, and the specific implementation process thereof is detailed in the method embodiment and is not described herein again.

In practical applications, the apparatus 60 may further include: at least one network interface 603. The various components in the recommendation device 60 are coupled together by a bus system 604. It is understood that the bus system 604 is used to enable communications among the components. The bus system 604 includes a power bus, a control bus, and a status signal bus in addition to a data bus. For clarity of illustration, however, the various buses are labeled as bus system 604 in fig. 6. The number of the processors 601 may be at least one. The network interface 603 is used for wired or wireless communication between the data recommendation device 60 and other devices.

The memory 602 in the present embodiment is used to store various types of data to support the operation of the data recommendation device 60.

The method disclosed by the above-mentioned embodiment of the present invention can be applied to the processor 601, or implemented by the processor 601. The processor 601 may be an integrated circuit chip having signal processing capabilities. In implementation, the steps of the above method may be performed by integrated logic circuits of hardware or instructions in the form of software in the processor 601. The Processor 601 may be a general purpose Processor, a DiGital Signal Processor (DSP), or other programmable logic device, discrete gate or transistor logic device, discrete hardware components, or the like. Processor 601 may implement or perform the methods, steps, and logic blocks disclosed in embodiments of the present invention. A general purpose processor may be a microprocessor or any conventional processor or the like. The steps of the method disclosed by the embodiment of the invention can be directly implemented by a hardware decoding processor, or can be implemented by combining hardware and software modules in the decoding processor. The software modules may be located in a storage medium located in the memory 602, and the processor 601 reads the information in the memory 602 and performs the steps of the aforementioned methods in conjunction with its hardware.

In an exemplary embodiment, the data recommender 60 may be implemented by one or more Application Specific Integrated Circuits (ASICs), DSPs, Programmable Logic Devices (PLDs), Complex Programmable Logic Devices (CPLDs), Field Programmable Gate Arrays (FPGAs), general purpose processors, controllers, Micro Controllers (MCUs), microprocessors (microprocessors), or other electronic components for performing the foregoing methods.

An embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored, where the computer program, when executed by a processor, performs: determining first data to be transmitted; the first data is behavior data collected locally by the terminal; sending the second data to a server; wherein, when it is determined that the first data does not satisfy the conversion condition, the second data is the first data; when the first data are determined to meet the conversion condition, the second data are disturbance data obtained based on the first data; and receiving the recommendation data determined and sent by the server according to the second data.

In one embodiment, the computer program, when executed by the processor, performs: determining a preset privacy parameter; the privacy parameter is associated with a preset privacy protection degree; determining a disturbance probability value according to the preset privacy parameter; according to the disturbance probability value, performing binary random response on the first data to obtain a response result; the response result represents whether the first data is converted or not;

In one embodiment, the computer program, when executed by the processor, performs: performing multi-value random response on the numerical value corresponding to each parameter in the at least one parameter to obtain a random response result corresponding to each parameter in the at least one parameter;

In one embodiment, the computer program, when executed by the processor, performs: according to preset privacy parameters, carrying out multi-value random response on numerical values corresponding to all parameters in the at least one parameter to obtain random response results corresponding to all parameters in the at least one parameter; the privacy parameter is associated with a preset degree of privacy protection.

In one embodiment, the computer program, when executed by the processor, performs: determining a similarity between the first data and the second data;

In the several embodiments provided in the present application, it should be understood that the disclosed apparatus and method may be implemented in other ways. The above-described device embodiments are merely illustrative, for example, the division of the unit is only a logical functional division, and there may be other division ways in actual implementation, such as: multiple units or components may be combined, or may be integrated into another system, or some features may be omitted, or not implemented. In addition, the coupling, direct coupling or communication connection between the components shown or discussed may be through some interfaces, and the indirect coupling or communication connection between the devices or units may be electrical, mechanical or other forms.

The units described as separate parts may or may not be physically separate, and parts displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed on a plurality of network units; some or all of the units can be selected according to actual needs to achieve the purpose of the solution of the embodiment.

In addition, all the functional units in the embodiments of the present invention may be integrated into one processing unit, or each unit may be separately regarded as one unit, or two or more units may be integrated into one unit; the integrated unit can be realized in a form of hardware, or in a form of hardware plus a software functional unit.

Those of ordinary skill in the art will understand that: all or part of the steps for implementing the method embodiments may be implemented by hardware related to program instructions, and the program may be stored in a computer readable storage medium, and when executed, the program performs the steps including the method embodiments; and the aforementioned storage medium includes: a mobile storage device, a Read-Only Memory (ROM), a Random Access Memory (RAM), a magnetic disk or an optical disk, and other various media capable of storing program codes.

Alternatively, the integrated unit of the present invention may be stored in a computer-readable storage medium if it is implemented in the form of a software functional module and sold or used as a separate product. Based on such understanding, the technical solutions of the embodiments of the present invention may be essentially implemented or a part contributing to the prior art may be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for causing a computer device (which may be a personal computer, a server, or a network device) to execute all or part of the methods described in the embodiments of the present invention. And the aforementioned storage medium includes: a removable storage device, a ROM, a RAM, a magnetic or optical disk, or various other media that can store program code.

The above description is only for the specific embodiments of the present invention, but the scope of the present invention is not limited thereto, and any person skilled in the art can easily conceive of the changes or substitutions within the technical scope of the present invention, and all the changes or substitutions should be covered within the scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the appended claims.

Claims

1. A data recommendation method is applied to a terminal and comprises the following steps:

2. The method of claim 1, further comprising: judging whether the first data meet a conversion condition;

3. The method of claim 2, wherein the first data comprises: at least one parameter and a value corresponding to each parameter in the at least one parameter;

transforming the first data, comprising:

4. The method according to claim 3, wherein said performing a multi-valued random response on the value corresponding to each parameter of the at least one parameter to obtain a random response result corresponding to each parameter of the at least one parameter comprises:

5. The method of claim 1, further comprising: determining a similarity between the first data and the second data;

before sending the second data to the server, the method further includes:

determining a label of second data corresponding to the recommended data;

6. A data recommendation apparatus, characterized in that the apparatus comprises: the device comprises a first processing module, a second processing module and a third processing module; wherein,

7. The apparatus according to claim 6, wherein the second processing module is configured to determine a preset privacy parameter; the privacy parameter is associated with a preset privacy protection degree;

8. The apparatus of claim 7, wherein the first data comprises: at least one parameter and a value corresponding to each parameter in the at least one parameter;

9. The apparatus according to claim 8, wherein the second processing module is configured to perform a multi-value random response on a numerical value corresponding to each parameter in the at least one parameter according to a preset privacy parameter, so as to obtain a random response result corresponding to each parameter in the at least one parameter; the privacy parameter is associated with a preset degree of privacy protection.

10. The apparatus of claim 6, wherein the second processing module is further configured to determine a similarity between the first data and the second data;

11. A data recommendation device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, characterized in that the steps of the method according to any of claims 1 to 5 are implemented when the processor executes the program.

12. A computer-readable storage medium, on which a computer program is stored, which, when being executed by a processor, carries out the steps of the method of any one of claims 1 to 5.