JP2015176496A - Risk analysis device, method and program in anonymous data - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a risk analysis device for quantitatively analyzing such a risk level that an individual contained in anonymous data is uniquely specified, and optimizing parameters for use in anonymity by using the quantified risk level as a measuring rod, and to provide its method and program.SOLUTION: A risk analysis device 10 quantitatively analyzes a risk every record constituting anonymous data, quantifies and calculates a risk level of the anonymous data according to a specific scale (e.g., a prior knowledge of an attacker, and a content rate (reproduction rate and F-scale of a conformable rate)) based on the risk analyzed for every record, and outputs the calculated risk level (corresponding to the parameters for use in anonymity).

Description

  The present invention relates to a risk analysis apparatus, method, and program for anonymized data.

  Conventionally, effective use of data has been attempted by statistically processing the data. For example, a large amount of data including information such as age, sex, region, and race that are likely to cause a specific disease is widely released, statistically processed, and used for trend analysis and preventive measures.

  When such data is disclosed, it is necessary to carefully protect the privacy, and therefore it is necessary to perform data transformation processing so that the owner of the data is not specified. Therefore, many techniques related to data transformation processing for protecting privacy have been disclosed so far. For example, a technique (for example, k-anonymization processing) is disclosed in which a part of data is generalized or ambiguous so that an individual is not specified even if data is combined (for example, non-patent literature) 1).

  Further, Non-Patent Document 2 discloses a technique that can reduce the probability of individual identification in the entire data set. In Non-Patent Document 2, with respect to movement data that is a type of history data, the reciprocal of the number of cases is set as an individual specific probability for points included in the history, and the number of cases of history data whose value is close to 1 / k is reduced. Disclosure of risk analysis methods.

Latina Sweney, k-anonymity: a model for protecting privacy, International Journal of Uncertainty, Fuzines and Knows 70, Vs. Anna Monreale, Gennady L. Andrienko, Natalia V. Andrienko, Fosca Giannotti, Dino Pedreschi, Salvatore Rinzivillo, Stefan Wrobel: “Movement Data Anonymity through Throughgeneralization.

Examples of conventional risk analysis include, for example, k-anonymization. This is a risk analysis considering the worst case, and is not always a suitable method from the viewpoint of optimization.
In the conventional method, since the prior knowledge of the attacker who tries to identify the individual is not taken into consideration in the model, the probability of identifying the individual may be unreasonably higher than the value at the time of actual use.
In addition, the evaluation scale used by the conventional method cannot correctly evaluate the method of adding data (noise) that does not exist in the original data. Specifically, since the amount of noise is not reflected, the result of the evaluation method cannot distinguish between cases where the amount of noise is large and small even if the same method is used (if the specific risk is the same, the noise is less. The dataset is good).

  The problem in the present invention is that when anonymized data is disclosed, a method for quantitatively analyzing the risk of uniquely identifying an individual included in the data in a more realistic model and the quantified risk The idea is to devise a method for optimizing the parameters used for anonymization on the basis of.

  The present invention quantitatively analyzes a risk level in which an individual included in the data is uniquely identified in anonymized data, and optimizes parameters used for anonymization using the quantified risk level as a measure An object of the present invention is to provide a risk analysis apparatus, method and program.

  In the anonymized data, it is assumed that individuals constituting the data are each assigned to one record. This method quantitatively evaluates the risk level at which individuals are uniquely identified from anonymized data. First, the individual specific risk of each record was quantitatively evaluated and quantified. This is a technique that arranges records from the lowest risk according to the risk and quantifies the risk level according to a certain scale.

  In addition, the risk level quantification method as described above, and when assessing the risk of each record, the risk is calculated according to the amount of prior knowledge of the attacker who tries to identify the individual, and the worst case This is a method with an upper limit of risk.

  In addition, the risk level quantification method as described above is based on the fact that the attacker knows part or all of the movement trajectory data, and reserves the number of nodes in the known trajectory. It is a technique for quantifying the amount of knowledge.

  Or, it is a risk level quantification method as described above, and for the point anonymization process, the content rate of the number of points included in the original data is calculated, and the data that does not exist in the original data in the anonymization process This is a risk level quantification method for calculating a numerical value representing the content rate.

  Further, in the risk level quantification method as described above, according to the number of output results calculated based on the parameters used in the anonymization process, the parameters are compared with the reproducibility (recall) and content rate. This is an anonymization parameter determination method for automatic determination.

  Furthermore, a risk model is constructed using the above risk level quantification technique, and an optimal parameter is obtained by selecting a parameter for anonymization that maximizes the gain in the model.

Specifically, the following solutions are provided.
(1) A risk analysis device that analyzes a risk level in which the individual is uniquely identified from anonymized data including information related to the individual, and quantitatively analyzes the risk for each record constituting the anonymized data Risk analysis means, risk level calculation means for quantifying and calculating the risk level of the anonymized data according to a specific scale based on the risk for each record analyzed by the risk analysis means, and the risk level calculation And a risk level output means for outputting the risk level calculated by the means.

  According to the configuration of (1), the risk analysis apparatus quantitatively analyzes the risk for each record constituting the anonymized data, and based on the risk for each analyzed record (for example, an attacker) Quantified and calculated risk level of anonymized data according to prior knowledge and content rate (F-scale of recall and relevance rate)), and outputs the calculated risk level (corresponding to parameters used for anonymization) .

  Therefore, the risk analysis apparatus according to (1) quantitatively analyzes the anonymized data for the risk level at which an individual included in the data is uniquely identified, and anonymized using the quantified risk level as a scale. The parameters used for the optimization can be optimized.

  (2) The risk according to (1), wherein the risk analysis means calculates the risk according to an amount of prior knowledge of an attacker who attempts to identify an individual when evaluating the risk of each record. Level analyzer.

  Therefore, the risk analysis apparatus according to (2) can quantitatively analyze the anonymized data, including the attacker's prior knowledge, the risk level that uniquely identifies the individual included in the data. .

  (3) The risk analysis means quantifies the number of nodes of the known trajectory as the amount of prior knowledge, with knowledge of a part or all of the movement trajectory data as the prior knowledge of the attacker. The risk level analysis device according to (2).

  Therefore, the risk analysis apparatus according to (3) quantitatively analyzes the risk level in which the individual included in the data is uniquely specified in the anonymized data according to the amount of the attacker's prior knowledge. be able to.

  (4) The risk level calculation means compares the risk quantified by the risk analysis means with a threshold value, and the number of the records whose risk is equal to or less than the threshold value is the number of the records of the anonymized data. The risk analyzer according to (1), wherein a ratio of the total number is calculated as a risk level.

  Therefore, the risk analysis apparatus according to (4) can quantitatively analyze the risk level in which the individual included in the data is uniquely specified in the anonymized data.

  (5) The risk level calculation means is an attribute included in the original data before being anonymized, and the number of attributes included in the anonymized data corresponds to a total number of the attributes included in the original data. Recall rate calculating means for calculating a recall rate that is a ratio, and the number of the attributes that are included in the original data and also included in the anonymized data are the total number of the attributes included in the anonymized data A specific scale is calculated based on the relevance ratio calculating means for calculating the relevance ratio, which is a ratio to the ratio, the recall ratio calculated by the recall ratio calculation means, and the relevance ratio calculated by the precision ratio calculation means And a risk level calculating means for calculating a parameter for anonymization based on the specific scale calculated by the scale calculating means. Risk analysis apparatus according to (4).

  Therefore, the risk analysis apparatus according to (5) quantitatively analyzes the anonymized data in which noise is added to the risk level in which the individual included in the data is uniquely specified in the anonymized data. Can do.

  (6) A method executed by the risk analysis apparatus according to (1), in which the risk analysis unit quantitatively analyzes a risk for each record constituting the anonymized data; A risk level calculating step for quantifying and calculating a risk level of the anonymized data according to a specific scale based on the risk for each of the records analyzed by the risk analysis step; and the risk level A method comprising: a risk level output step in which the output means outputs the risk level calculated by the risk level calculation step.

  Therefore, in the method according to (6), in the anonymized data, the risk level in which the individual included in the data is uniquely identified is quantitatively analyzed, and the anonymization is performed using the quantified risk level as a scale. The parameters used can be optimized.

  (7) A program for causing a computer to execute each step of the method according to (6).

  Therefore, the program according to (7) causes the computer to quantitatively analyze the risk level in which the individual included in the data is uniquely identified in the anonymized data, and the quantified risk level as a scale. Parameters used for anonymization can be optimized.

According to the present invention, in the anonymized data, it is possible to quantitatively analyze a risk level at which an individual included in the data is uniquely specified.
Furthermore, according to the present invention, it becomes possible to evaluate an anonymization method for adding noise, and it is possible to quantify the risk of identifying an individual from information on a point representing stay, and to automatically determine an anonymization parameter of the point. .

It is a figure which shows the structure of the risk analyzer which concerns on Embodiment 1 of this invention. In the risk analysis apparatus which concerns on Embodiment 1 of this invention, it is a figure which shows the example at the time of putting together for every point where a risk has the same value. In the risk analysis apparatus according to Embodiment 1 of the present invention, it is a diagram illustrating an example of a ratio of the total number of records having a risk value equal to or less than a threshold to the total number of records. It is a flowchart which shows the process of the risk analyzer which concerns on Embodiment 1 of this invention. It is a figure which shows the structure of the risk analyzer which concerns on Embodiment 2 of this invention. In the risk analysis apparatus which concerns on Embodiment 2 of this invention, it is a figure which shows the example of the relationship between the reproduction rate in the parameter k, and the risk that an individual is specified. In the risk analysis apparatus which concerns on Embodiment 2 of this invention, it is a figure which shows the example of the relationship between the relevance rate in the parameter k, and the risk that an individual is specified. In the risk analysis apparatus which concerns on Embodiment 2 of this invention, it is a figure which shows the example of the relationship between the threshold value of a risk, and F-scale. It is a flowchart which shows the process of the risk analyzer which concerns on Embodiment 2 of this invention.

In the present embodiment, data including information about an individual (referred to as original data) is anonymized by an anonymized data creation device (not shown) so that the individual is not uniquely identified.
The risk analysis apparatus 10 analyzes a risk level at which an individual is uniquely specified for anonymized data (referred to as anonymized data).
Based on the risk level analyzed by the risk analysis device 10, anonymized data that is less likely to identify an individual can be created by the anonymized data creation device.
Hereinafter, embodiments of the present invention will be described with reference to the drawings.

[Embodiment 1]
The risk analysis apparatus 10 according to the first embodiment calculates a risk according to the amount of prior knowledge of an attacker who attempts to identify an individual, and sets the worst case as the upper limit of the risk.

  Specifically, it is assumed that the attacker knows part or all of the movement trajectory data, and the number of nodes of the known trajectory (for example, the ratio of the number of points indicating the trajectory). Is quantified as the amount of prior knowledge.

The risk analysis apparatus 10 performs risk analysis on the anonymized data according to the procedures (1) to (3).
(1) First, the risk that an individual is specified is quantitatively evaluated for each record constituting anonymized data.
(2) Based on the quantified risk for each record, the records are arranged from the lowest risk.
(3) When the attacker's prior knowledge is determined, the risk level for the anonymized data is quantitatively calculated.

  Specifically, the risk analysis apparatus 10 includes a risk analysis unit 11, a risk level calculation unit 12, and a risk level output unit 13.

  The risk analysis means 11 quantitatively analyzes the risk for each record constituting the anonymized data. When the risk analysis means 11 evaluates the risk of each record, the risk analysis means 11 calculates the risk in accordance with the amount of prior knowledge of the attacker who intends to identify an individual. The risk analysis means 11 uses the knowledge of a part or all of the movement trajectory data as prior knowledge of the attacker, and uses the number of nodes of the known trajectory (for example, position information indicating the moved trajectory). Number) as the amount of prior knowledge.

  The risk level calculation means 12 quantifies and calculates the risk level of the anonymized data according to a specific scale (for example, preliminary knowledge of the attacker) based on the risk for each record analyzed by the risk analysis means 11. Specifically, the risk level calculation means 12 compares the risk quantified by the risk analysis means 11 with a threshold value, and the ratio of the number of records whose risk is equal to or less than the threshold value to the total number of anonymized data records Is calculated as a risk level.

  The risk level output unit 13 outputs the risk level calculated by the risk level calculation unit 12. Specifically, the risk level output means 13 accepts the amount of preliminary knowledge of the attacker and the amount of preliminary knowledge designated by the user, and calculates the value of the parameter k corresponding to the amount of preliminary knowledge received. The value of the calculated parameter k is output as the risk level.

The above-described contents are shown below by taking the trajectory data of each individual as an example. For example, a case where the trajectory of each individual is expressed as in Equation 1 will be described.
Here, A to S indicate positions, and indicate a trajectory in which an individual has moved by A → B.

For the original data represented by Equation 1, the anonymized data is data represented by Equation 2.

  As represented by Equation 2, the anonymized data is processed with attributes (for example, points indicating a trajectory) such as t1 to t6, t8, and t9 so that an individual is not specified. Further, t7 is processed by the immediately preceding data t6 and t10 is processed by the immediately preceding data t9 so as to satisfy the condition of the anonymization parameter k.

  At this time, each risk is evaluated as shown in Equation 3.

That is, the reciprocal of the frequency of the position representing the trajectory is used as a quantitative evaluation. For example, since the position “A” appears in seven records, the risk of the record including A is 1/7.
Next, the risk is summarized for each point having the same value, and the ratio of the collected points to the anonymized data is obtained.

  FIG. 2 is a diagram illustrating an example when the risks are grouped for each point having the same value. In the example of FIG. 2, as a result of analysis by the risk analysis device 10, among the anonymized data, 50% of the records have a risk of 0, 20% have a risk of 1/7, and 1/6 have the risk This is an example showing that 10% records and 15% risk records are 15%.

When such risk values are integrated, for example, the ratio of points where the risk value is equal to or less than the threshold value is obtained, and a graph as shown in FIG. 3 is obtained.
FIG. 3 is a diagram illustrating an example of a ratio of the total number of records having a risk value equal to or less than the threshold to the total number of records. In FIG. 3, the horizontal axis indicates the risk threshold, and the vertical axis indicates the attacker's prior knowledge level.
From the risk analysis results shown in FIG. 2, the risk threshold is 0.01% or less at 50%, 0.15 or less at 70% (50% + 20%), and 0.17 or less at 80% (50% + 20% + 10%). ), 0.35 or less becomes 95% (50% + 20% + 10% + 15%), and the ratio of records corresponds to the attacker's prior knowledge and is expressed in the graph as shown in FIG. Can do.
FIG. 3 shows an example of a graph with three attributes (for example, the number of points) (h = 3) and a graph with five attributes (for example, the number of points) (h = 5). Yes.

Therefore, if the attacker's knowledge level is fixed, the value of the parameter k to be selected can be obtained.
For example, assuming that the attacker's knowledge level is 95% and there are three attributes (h = 3), the value of the parameter k to be selected is 10,000, for example.

  FIG. 4 is a flowchart showing processing of the risk analysis apparatus 10 according to the first embodiment of the present invention. The risk analysis apparatus 10 includes hardware included in a computer and its peripheral devices, and software that controls the hardware. The following processing is executed by a control unit (for example, the CPU of the risk analysis apparatus 10) according to predetermined software. It is processing to do.

  In step S101, the CPU (risk analysis means 11) acquires anonymized data. More specifically, the CPU acquires anonymization data of the anonymization parameter k.

  In step S102, the CPU (risk analysis means 11) calculates the risk for each record. More specifically, the CPU calculates the frequency at which an attribute that specifies an individual appears in a record constituting anonymized data, and obtains the reciprocal of the calculated frequency.

  In step S103, the CPU (risk level calculation means 12) calculates the risk level of the anonymized data according to the prior knowledge of the attacker based on the calculated risk. More specifically, the CPU compares the risk calculated in step S102 with a threshold value, and calculates, as a risk level, the ratio of the number of records whose risk is equal to or less than the threshold value to the total number of anonymized data records. .

  In step S104, the CPU (risk level output means 13) outputs the calculated risk level.

[Embodiment 2]
In the second embodiment, when evaluating the risk of each record, the content rate, which is the rate at which the attribute included in the original data (for example, data representing the place where the user stayed) is included in the anonymized data, is calculated and calculated. The risk is calculated according to the content rate.
As a premise, there is a device that creates anonymized data with an anonymization parameter k, and a set of anonymized points (for example, anonymized moving data) can be obtained by inputting movement data including the points And

  The risk analysis apparatus 10 includes a risk analysis unit 11, a risk level calculation unit 12, and a risk level output unit 13. The risk level calculation unit 12 includes a recall rate calculation unit 121, a conformance rate calculation unit 122, Scale calculating means 123. The risk analysis means 11 and the risk level output means 13 are the same as in the first embodiment.

The recall ratio calculating unit 121 calculates a recall ratio in which the number of attributes included in the original data before being anonymized and included in the anonymized data is a ratio to the total number of attributes included in the original data. To do.
The relevance ratio calculating unit 122 calculates a relevance ratio in which the number of attributes included in the original data and included in the anonymized data is a ratio to the total number of attributes included in the anonymized data.
The scale calculation unit 123 calculates a specific scale (for example, F-scale) based on the reproduction rate calculated by the reproduction rate calculation unit 121 and the matching rate calculated by the matching rate calculation unit 122.

  The above-described content will be described by taking movement data including information on a place where an individual stays as information related to an individual as an example.

The risk level calculation means 12 calculates the following three evaluation values (recall rate, relevance rate, F-scale). The three evaluation values are defined as follows.
Recall rate (Recall): (NoP (B) ∧NoP (A)) / NoP (B)
Precision (Precision): (NoP (B) ∧NoP (A)) / NoP (A)
F-Measure: Harmonic average of precision and recall

Here, NoP (A), NoP (B), NoP (B) ∧NoP (A) are defined as follows.
NoP (A): Set of attributes (eg, points) included in anonymized data after anonymization processing NoP (B): Attributes (eg, points) included in original data before anonymization processing Set NoP (B) ∧ NoP (A): Set of attributes (for example, points) included in both original data and anonymized data

The risk analysis apparatus 10 performs the following processes (1) to (4) while increasing the anonymization parameter k to 2, 3,.
(1) Count the points included in the records that make up the anonymized data for each same point, calculate the frequency of the points, find the reciprocal of the calculated frequency (n), and calculate the risk (1 / n) at that point To do.
(2) Summarize each spot with the same risk.
For example, points where the risk is 0.33, points where the risk is 0.02, and points where the risk is 0.01 are collected.
(3) In order from the set of points with the smallest risk value, the recall rate in the set of points is obtained based on the points included in the set.
(4) At this time, when the recall is obtained from the nth smallest area set, the recall is obtained from the result of accumulating the 1,2,... Nth smaller area sets.
For example, the recall is calculated for a set of points with a risk of 0.01. Next, when calculating the recall for a set of points with a risk of 0.02, the recall is calculated from the result of accumulating the set of points with a risk of 0.01. Similarly, when calculating the recall rate for a set of points with a risk of 0.33, the recall rate is calculated from the result of accumulating a set of points with a risk of 0.01 to 0.33.
When the calculation is made in this way and the result is represented in a graph, it is represented in a graph as shown in FIG.
FIG. 6 is a diagram illustrating an example of the relationship between the recall rate in parameter k and the risk of identifying an individual. In FIG. 6, the vertical axis represents the recall rate, and the horizontal axis represents the risk (probability) of identifying an individual.

Similar to the recall, the precision is calculated in the same way.
That is, in accordance with the points included in the set in order from the set of points with the smallest risk value, the relevance ratio in the set of those points is obtained.
At this time, when obtaining the relevance ratio from the nth smallest area set, the relevance ratio is obtained from the result of accumulating the 1,2,... Nth small area sets.
When the calculation is performed as described above and the result is represented in a graph, the graph is represented as shown in FIG.
FIG. 7 is a diagram illustrating an example of the relationship between the relevance ratio in the parameter k and the risk of identifying an individual. In FIG. 7, the vertical axis represents the recall rate, and the horizontal axis represents the risk (probability) for identifying an individual.

Finally, for each item on the horizontal axis, the F-scale that is the harmonic average of the precision and recall is obtained, and the point that maximizes is selected.
That is, the threshold value t for the risk value is set (0 <t <1 / k).
For each item on the horizontal axis, an F-scale that is a harmonic average of the precision and recall is obtained. The F-Measure is generally determined by the following formula:
F-Measure = (2 * Recall * Precision) / (Recall + Precision)

FIG. 8 is a diagram illustrating an example of the relationship between the risk threshold and the F-scale. The example of FIG. 8 (1) is an example when the anonymization parameter k is 3, and the example of FIG. 8 (2) is an example when the anonymization parameter k is 4, as shown in FIG. 8 (3). An example is an example when the anonymization parameter k is 5.
In this example, since the F-scale when k = 3 and t = 0.15 is maximized, these parameters are determined, and only points where the risk falls below 0.15 are included when k = 3. Use the data as the output result.

Note that, depending on the use of the anonymized data, there is a possibility that either the precision or the recall is more important, and in that case, an E-measure may be used instead.
E-Measure = (1- (1 + b ² )) / ((b ² / Recall) + (1 / Precision))
Here, b is a weighting coefficient and takes a value between 0 and 1. The value of b may be adjusted according to the output result.

  FIG. 9 is a flowchart showing processing of the risk analysis apparatus 10 according to the second embodiment of the present invention.

  In step S201, the CPU (risk analysis means 11) acquires anonymized data. More specifically, the CPU acquires anonymization data of anonymization parameter k (initial value is 2).

  In step S202, the CPU (risk analysis means 11) calculates the risk for each record. More specifically, the CPU calculates the frequency at which an attribute that specifies an individual appears in a record constituting anonymized data, and obtains the reciprocal of the calculated frequency.

  In step S203, the CPU (risk level calculation means 12) collects the calculated risk values. More specifically, the CPU collects each attribute (for example, point) that is the same risk value.

  In step S <b> 204, the CPU (risk level calculation means 12, reproduction rate calculation means 121, relevance rate calculation means 122) obtains the reproducibility and relevance rate for each collected risk value while accumulating each risk value. More specifically, the CPU sequentially sets the attributes (for example, points) of the attributes (for example, points) based on the attributes (for example, points) included in the set in order from the set of attributes (for example, points) having a small risk value. Find the recall and precision of the set. At this time, when the CPU obtains the recall rate and the matching rate from the nth smallest area set, the CPU calculates the recall rate and the matching rate from the result of accumulating the first, 2,. Ask.

  In step S205, the CPU (scale calculation means 123) calculates an F-scale of the recall rate and the matching rate.

  In step S206, the CPU (risk level calculation means 12) determines whether or not the process is finished. Specifically, the CPU determines whether or not the anonymization parameter k is equal to or greater than a predetermined value (for example, a value specified by the user). If this determination is YES, the CPU moves the process to step S207, and if this determination is NO, the CPU moves the process to step S208.

  In step S207, the CPU (risk level calculation means 12, risk level output means) obtains and outputs a risk value threshold for the maximum F-scale. Thereafter, the CPU ends the process.

  In step S208, the CPU (risk level calculation means 12) increases (+1) the anonymization parameter k. Thereafter, the CPU moves the process to step S201.

According to the first embodiment, the risk analysis apparatus 10 quantitatively analyzes the risk for each record constituting the anonymized data, and anonymizes according to the attacker's prior knowledge based on the risk for each analyzed record. The risk level of the data is quantified and calculated, and the calculated risk level (corresponding to the parameter used for anonymization) is output.
According to the second embodiment, the risk analysis apparatus 10 quantitatively analyzes the risk for each record constituting the anonymized data, and based on the risk for each analyzed record, for example, the content rate (for example, content rate) The risk level of the anonymized data is quantified and calculated according to (Reproducibility and F-scale of precision), and the calculated risk level (corresponding to the parameter used for anonymization) is output.
Therefore, the risk analysis device 10 can quantitatively analyze the risk level in which the individual included in the data is uniquely specified in the anonymized data. Furthermore, according to the present invention, it becomes possible to evaluate an anonymization method for adding noise, and it is possible to quantify the risk of identifying an individual from information on a point representing stay, and to automatically determine an anonymization parameter of the point. .

  As mentioned above, although embodiment of this invention was described, this invention is not restricted to embodiment mentioned above. The effects described in the embodiments of the present invention are only the most preferable effects resulting from the present invention, and the effects of the present invention are limited to those described in the embodiments of the present invention. is not.

DESCRIPTION OF SYMBOLS 10 Risk analyzer 11 Risk analysis means 12 Risk level calculation means 121 Recall rate calculation means 122 Relevance rate calculation means 123 Scale calculation means 13 Risk level output means

Claims (7)

A risk analysis device that analyzes a risk level for uniquely identifying the individual from anonymized data including information about the individual,
Risk analysis means for quantitatively analyzing risk for each record constituting the anonymized data;
Risk level calculation means for quantifying and calculating the risk level of the anonymized data according to a specific scale based on the risk for each record analyzed by the risk analysis means;
A risk level output means for outputting the risk level calculated by the risk level calculation means;
A risk analysis apparatus comprising:   The risk analysis apparatus according to claim 1, wherein the risk analysis unit calculates the risk according to an amount of prior knowledge of an attacker who attempts to identify an individual when evaluating the risk of each record.   The risk analysis means quantifies the number of nodes of the known trajectory as the amount of prior knowledge, with knowledge of part or all of the movement trajectory data as the prior knowledge of the attacker. The risk analysis apparatus according to claim 2.   The risk level calculation means compares the risk quantified by the risk analysis means with a threshold, and the number of the records whose risk is equal to or less than the threshold occupies the total number of the records of the anonymized data The risk analysis device according to claim 1, wherein the ratio is calculated as a risk level. The risk level calculation means includes
A recall that calculates the recall that is the ratio of the number of attributes included in the original data before being anonymized and included in the anonymized data to the total number of the attributes included in the original data A calculation means;
Relevance ratio calculating means for calculating a relevance ratio, wherein the number of the attributes included in the original data and included in the anonymized data is a ratio to the total number of the attributes included in the anonymized data; ,
Scale calculating means for calculating a specific scale based on the recall calculated by the recall calculating means and the precision calculated by the precision calculating means;
Further comprising
The risk analysis apparatus according to claim 4, wherein the risk level calculation unit calculates a parameter for anonymization based on the specific scale calculated by the scale calculation unit. A method executed by the risk analysis apparatus according to claim 1,
A risk analysis step in which the risk analysis means quantitatively analyzes the risk for each record constituting the anonymized data;
A risk level calculating step in which the risk level calculating means quantifies and calculates the risk level of the anonymized data according to a specific measure based on the risk for each of the records analyzed by the risk analyzing step;
A risk level output step in which the risk level output means outputs the risk level calculated by the risk level calculation step;
A method comprising:   The program for making a computer perform each step of the method of Claim 6.

Images