JP6214150B2 - Information processing apparatus, information processing method, and information processing program - Google Patents

Description

  The present invention relates to a technique for anonymizing or diversifying personal information.

  With the development of information processing technology, information is collected in many everyday situations, and processing using the collected information is performed. For example, when a consumer purchases a product as a member of a store, the consumer's name, age, gender, address, e-mail address, etc. are often registered at the time of membership registration. When a consumer purchases a product, the store-side system records the consumer and the purchased product information in association with each other. By accumulating and analyzing information on purchased products in this way, it is possible to estimate the consumer's preferences and perform a service such as sending a direct mail when a new product preferred by the consumer is released. it can. Furthermore, by analyzing information of many consumers, information such as products preferred by women in their 20s and products preferred in the Kanto area can be derived and used for marketing and the like.

  In addition, the information can be used not only for the store but also for the manufacturer of the product and other companies for the development of new products and the improvement of safety, and may have value.

  However, the consumer's personal information in the store cannot be provided to others without obtaining the consent of each consumer. For this reason, when providing information related to the consumer to others, it is necessary to anonymize so that individuals cannot be identified.

  For example, if there is only one person 25 years old in the member list in which the age is described, the person can be identified when he / she knows that the 25-year-old acquaintance is the member. That is, if there is only one person with the attribute of a 25-year-old member, there is a high possibility that an individual can be specified by comparing with other information.

  Therefore, if the age description in the member list is abstracted into 10-year breaks, and there are multiple people with the same attribute, such as three in their 20s, who of the three is identified become unable. A state in which there are k or more people having the same attribute in this way is referred to as “k-anonymity” and processing such data is referred to as “k-anonymization”.

JP 2012-133451 A JP 2011-108195 A JP 2011-128862 A JP 2012-78932 A

In conventional anonymization devices, when abstracting the value of each item to satisfy k-anonymity, data is simply separated so that the same attribute value becomes multiple, so even if anonymity is satisfied Sometimes it becomes worthless data. For example, when data is used to know a fashion trend, the age item is important. If the age item is excessively abstracted for anonymization, the utility value is lost. In this case, the priority of the items to be abstracted by the operator is specified, and anonymity is satisfied by abstracting items other than the age. For anonymization, if the age item is divided into 17 years old or older and less than 22 years old, adults and minors may be mixed in the same group, and high school students and working adults may be mixed. Will disappear. In this case, the operator specifies the age item separator and abstracts the other items so as to satisfy anonymity.

As described above, the conventional anonymization apparatus is not practical because there are many opportunities to require the operator's judgment. In particular, it has been difficult to anonymize so-called big data such as membership information of a store on the Internet (net shop) and SNS (social networking service) with a conventional device.
Therefore, the present invention provides a technique for processing target data based on the value after abstraction and making it anonymous.

In order to solve the above problems, an information processing apparatus of the present invention provides:
A data receiving unit that receives target data including a plurality of items associated with an individual;
An abstraction unit that generates abstraction candidate data by replacing a word that is a value of an item in the target data with an abstracted word;
A value determination unit that receives the value of the word included in the abstraction candidate data and obtains the value of the abstraction candidate data based on the value of the word included in the abstraction candidate data;
A test unit that tests on condition that a combination of values of items corresponding to one individual of the abstraction candidate data is not single in the abstraction candidate data;
A selection unit that selects the abstraction candidate data based on the value of the abstraction candidate data that satisfies the test condition.

  The test unit may test anonymity on condition that a combination of values of different items associated with one individual of the abstraction candidate data is not single in the abstraction candidate data.

The test unit may test diversity on condition that a combination of values of the same item associated with one individual of the abstraction candidate data is not single in the abstraction candidate data.
The value of the word may be a value based on statistical information of the word used on the website.
In order to solve the above problems, an information processing apparatus of the present invention provides:
Receiving target data including a plurality of items associated with an individual;
Generating abstract candidate data by replacing words that are values of items in the target data with abstract words;
Receiving the value of the word included in the abstraction candidate data, and determining the value of the abstraction candidate data based on the value of the word included in the abstraction candidate data;
Testing a condition that a combination of values of items corresponding to one individual of the abstraction candidate data is not single in the abstraction candidate data;
The computer executes a step of selecting the abstraction candidate data based on the value of the abstraction candidate data satisfying the test condition.

  The present invention may be a program for causing a computer to execute the above method. Furthermore, the program may be recorded on a computer-readable recording medium.

Here, the computer-readable recording medium refers to a recording medium that accumulates information such as data and programs by electrical, magnetic, optical, mechanical, or chemical action and can be read from the computer. . Examples of such a recording medium that can be removed from the computer include a flexible disk, a magneto-optical disk, a CD-ROM, a CD-R / W, a DVD, a DAT, an 8 mm tape, and a memory card.
Further, there are a hard disk, a ROM (read only memory), and the like as a recording medium fixed to the computer.

  The present invention can provide a technique for processing and anonymizing target data based on the value after abstraction.

FIG. 1 is a functional block diagram of the information processing apparatus. FIG. 2 is an explanatory diagram of the anonymization process. FIG. 3 is an explanatory diagram of the diversification process. FIG. 4 is a diagram illustrating a hardware configuration of the information processing apparatus. FIG. 5 is an explanatory diagram of anonymization processing using the value of data after abstraction. FIG. 6 is an explanatory diagram of candidate patterns. FIG. 7 is a diagram illustrating an example of a part of the age item in the target data. FIG. 8 is a diagram illustrating an example of value data acquired for age. FIG. 9 is a diagram illustrating the value of the age item. FIG. 10 is a table showing the value of the item of age. FIG. 11 is a diagram illustrating an example of a part of the age item in the abstraction candidate data. FIG. 12 shows the value data of each word acquired for the age. FIG. 13 is a diagram illustrating the value of the item of the age. FIG. 14 is a diagram illustrating the value of the age item. FIG. 15 is an explanatory diagram of anonymization processing showing a modification of the first embodiment. FIG. 16 is an explanatory diagram of the anonymization process according to the second embodiment. FIG. 17 is an explanatory diagram of processing for acquiring a category from an unknown word. FIG. 18 is an explanatory diagram of anonymization processing showing a modification of the second embodiment.

Hereinafter, embodiments for carrying out the present invention will be described with reference to the drawings. The configuration of the following embodiment is an exemplification, and the present invention is not limited to the configuration of the embodiment.
<Embodiment 1>
FIG. 1 is a functional block diagram of the information processing apparatus, FIG. 2 is an explanatory diagram of anonymization processing, and FIG. 3 is an explanatory diagram of diversification processing. The information processing apparatus 10 according to the first embodiment performs anonymization so that an individual cannot be specified from personal information to be processed.

  FIG. 2A shows an example in which the last name item is deleted from the member information including the last name, age, and gender items. As shown in Fig. 2 (A), if there is only one 16-year-old woman in the member information in which the age is described, the person is identified when it turns out that the 16-year-old woman is this member. it can. That is, if there is only one person with the attribute of 16 years old and female, there is a possibility that an individual can be identified by comparing with other information.

  In FIG. 2 (B), the description of the age in the member list is abstracted and classified by age, such as 0's (under 10 years), 10's, and 20's. However, even in this case, there is only one female teenager, and an individual can be specified as in FIG. 2A, which is insufficient for anonymization.

Therefore, in FIG. 2 (C), it is further abstracted, and the age divisions are changed as in the teens and under (19 years old and under) and the 20s. In the case of FIG. 2 (C), there are two women in their teens and under, and the attributes of “under 10s” and [female] are not single. For this reason, even if it turns out that a 16-year-old woman is this member as mentioned above, it cannot be specified which is the data of the 16-year-old woman. A state in which there are k or more people having the same attribute in this way is referred to as “k-anonymity” and processing such data is referred to as “k-anonymization”.

  FIG. 3 shows an example in which the data of the use station for each user is abstracted and used as the data of the ward to which the use station for each user belongs. In the pre-abstraction data, since the station is specified, there is a possibility that the user can be specified by comparing the data such as the residence near Shinjuku Station and the work place near Tokyo Station. For this reason, by abstracting the use station and making it a ward to which the use station belongs, there are a plurality of users who use stations in Shinjuku ward and stations in Chiyoda ward, and the user is not specified. The abstraction that attribute values have l types of possibilities, such as “use stations in Shinjuku ward and stations in Chiyoda ward” is called l-diversification.

  As shown in FIG. 1, the information processing apparatus 10 includes an abstraction unit 11, a value determination unit 12, a test unit 13 selection unit 14, a data update unit 15, a data reception unit 16, a value data acquisition unit 17, and a word category analysis unit. 18, a word value calculator 19 and a data output unit 40 are provided.

  The data receiving unit 16 receives target data including a plurality of items associated with an individual, and stores the data in a test DB (database) 41.

When the target data is anonymized or diversified, the abstraction unit 11 generates abstract candidate data by replacing words (words) that are values of items in the target data with abstracted words. In this embodiment, a word (word) is a group of words such as a word or a phrase, a numerical value such as location information or a telephone number, identification information such as an e-mail address or an IP address, a symbol having the same meaning as the word, or the like. May be included.
The value determination unit 12 obtains the value of the abstraction candidate data based on the value of the word included in the abstraction candidate data.

  The test unit 13 performs test on the condition that the combination of the values of items corresponding to one individual of the abstraction candidate data is not single in the abstraction candidate data. For example, the test unit 13 tests whether the abstraction candidate data satisfies k-anonymity or l-diversity.

  The selection unit 14 selects the abstraction candidate data based on the value of the abstraction candidate data that satisfies the test condition. For example, the selection unit 14 selects a predetermined number of abstraction candidate data satisfying k-anonymity and l-diversity in descending order of value. The selection unit 14 may select abstraction candidate data having the highest value among the abstraction candidate data satisfying k-anonymity and l-diversity.

  Based on the abstraction candidate data selected by the selection unit 14, the data update unit 15 updates the value of the item that identifies the individual in the personal information in the test DB 41 to an abstracted value to obtain anonymized information. .

The value data acquisition unit 17 acquires (receives) word value data included in the abstraction candidate data from the search information storage DB. Further, the value data acquisition unit 17 makes a request to another device when the value data of the word is not registered in the search information storage DB, and registers the acquired value data in the search information storage DB (data request ) And periodically visit other devices to acquire the latest value data and update the value data registered in the search information storage DB (data crawler). In this embodiment, the statistical information of each word is received from the search engine 20 as this value data. Here, the statistical information of each word includes, for example, an SEM advertising unit price (unit price per click), a click rate, an average ranking, the number of display times per day, the number of clicks per day, and the like. Note that the value acquisition destination is not limited to a search engine, and may be a web page, an SNS, or the like. In this case, for example, the use frequency of each word in a web page or SNS may be used as the value.

  The word category analysis unit 18 analyzes data on a website or the like to obtain a new word or a word (category) obtained by abstracting the word and registers it in the search information storage DB.

  Based on the value of the word acquired by the value data acquisition unit 17, the value calculation unit 19 obtains statistical information on the value of the word such as an annual average, a monthly average, and a weekly average of the word value.

  The data output unit 40 reads out anonymization information from the test DB 41 and outputs it. Here, the output of anonymization information includes display output by a display device, print output by a printer, transmission to another computer, writing to a storage medium, and the like. For example, the data update unit 15 distributes the anonymized information to the user terminal in response to the request, distributes the anonymized information to a predetermined distribution destination, and the like. Note that the data output unit 40 may copy the anonymization information to the anonymization completion DB (not shown) when the anonymization process is completed, and read and output the anonymization completion DB from the anonymization completion DB.

  The verification DB 41 receives personal information (target data), provides the personal information for verification, and retains anonymized information that is anonymized by rewriting data that identifies the individual by the data update unit 15.

  The search information storage DB 42 stores the value of the word acquired by the value data acquisition unit 17, information of the word and category obtained by the word category analysis unit 18, statistical information of the value obtained by the value calculation unit 19, and the like.

  In FIG. 1, a search engine 20 is a site (computer) that provides a search function for information existing on a network such as the Internet. That is, when the search engine 20 receives a keyword to be searched from the user terminal, the search engine 20 provides a list such as a URL of a web page including the keyword as a search result, and displays it on the user terminal.

  In addition, the search engine 20 uses this search function to display an advertisement linked to a keyword in a search result, or to display a link to a sponsor site that has paid an advertisement fee according to the keyword. For this reason, the search engine 20 uses the number of searches per day (display count), the number of clicks on the search result advertisement (clicks), the advertising fee per click (cost per click), etc. Are stored as word statistics.

  Based on this information, the search engine 20 determines the click rate obtained by dividing the number of display times by the number of clicks, the value obtained by multiplying the number of clicks per day by the cost per click (cost per day), the time of application for an advertisement (advertisement) Also ask for the ranking of the advertisement according to the cost presented at the time of the auction.

  The search engine 20 stores information related to the word, such as the number of clicks, the number of times of display, the ranking, the cost of the day, the click rate, the unit price of clicks, etc. A search word storage DB 22 that stores information on advertisements distributed together with search results.

  FIG. 4 is a diagram illustrating a hardware configuration of the information processing apparatus. The information processing apparatus 10 is a so-called computer having a CPU 1, a memory 2, a communication control unit 3, a storage device 4, and an input / output interface 5.

  The CPU 1 executes the program expanded in an executable manner in the memory 2, and the above-described abstraction unit 11, value determination unit 12, test unit 13, selection unit 14, data update unit 15, data reception unit 16, value data acquisition The function of the part 17, the word category analysis part 18, the word value calculation part 19, and the data output part 40 is provided.

  The memory 2 can also be called a main storage device. The memory 2 stores, for example, a program executed by the CPU 1, data received via the communication control unit 3, data read from the storage device 4, other data, and the like.

The communication control unit 3 is connected to another device via a network and controls communication with the device. The input / output interface 5 is appropriately connected to output means such as a display device and a printer, input means such as a keyboard and pointing device, and input / output means such as a drive device. The drive device is a removable storage medium read / write device, such as an input / output device for a flash memory card, a USB adapter for connecting a USB memory, or the like. Further, the removable storage medium may be a disk medium such as a CD (Compact Disc), a DVD (Digital Versatile Disk), or a Blu-ray Disc (registered trademark) . The drive device reads the program from the removable storage medium and stores it in the storage device 4.

The storage device 4 can also be called an external storage device. The storage device 4 may be an SSD (Solid State Drive), an HDD, or the like. The storage device 4 exchanges data with the drive device. For example, the storage device 4 stores an information processing program installed from the drive device. The storage device 4 reads out the program and delivers it to the memory 2. In the present embodiment, the storage device 4 stores the test DB 41 and the search information accumulation DB 42 described above.

  FIG. 5 is an explanatory diagram of anonymization processing using the value of data after abstraction. The information processing apparatus 10 first acquires (receives) target data from another computer or storage device (step S10), normalizes the target data to be in a predetermined format, and registers it in the verification DB 41 (step S20).

  The information processing apparatus 10 reads the target data from the verification DB 41 (step S30), and determines whether or not value data exists in the search information storage DB 42 for each word in the target data (step S40). The information processing apparatus 10 proceeds to step S60 when all word value data exists in the search information storage DB 42 (step S40, Yes), and when there is insufficient value data (step S40, No), Word value data is obtained from an external device, in this example, the search engine 20 (step S50). Note that the value information of the words existing in the search information storage DB 42 other than the value data acquired from the search engine is acquired from the search information storage DB 42 (step S60).

  Further, the information processing apparatus 10 creates abstraction candidate data by replacing each item of the target data with an abstracted word (category) in order to satisfy anonymity (step S70). When there are a plurality of items that can be abstracted, all patterns are created when each item is abstracted and when it is not abstracted. For example, if the target data includes three items A, B, and C and all items can be abstracted, and the abstracted items are A ′, B ′, and C ′, as shown in FIG. Six candidate patterns can be created, such as A ′, B, C when only A is abstracted, and A ′, B ′, C when items A and B are abstracted.

Next, the information processing apparatus 10 calculates the value of the abstraction candidate data of each pattern based on the value data of each word included in the abstraction candidate data (step S80), and based on the value of this abstraction candidate data. The order of testing is determined (step S90). For example, the test order is determined in descending order of the value. Although it is desirable to test all candidate patterns, abstract candidate data that is too low in value may be removed from the order based on the value of the abstract candidate data. For example, abstract candidate data less than a predetermined ratio, such as after a predetermined value or less than half, may be removed in order of value. Further, the abstraction candidate data whose value is less than a predetermined ratio with respect to the value of the target data may be excluded. This reduces the number of tests and shortens the processing time.

  In accordance with the order of this test, the information processing apparatus 10 tests the anonymity of the abstraction candidate data (step S100). For example, in order to test k-anonymity, the number (existence number) of combinations of values of different items associated with one individual is present in the abstraction candidate data. Alternatively, in order to test 1 diversity, the number (existence number) in which the combination of values of the same item associated with one individual exists in the abstraction candidate data is obtained. Then, the smallest of the existence numbers is obtained as the minimum number of appearances (k value / l value) (step S110), and it is determined whether or not the minimum number of appearances exceeds 1 (step S120). That is, if the k value exceeds 1, k-anonymity is satisfied, and if it is 1, k-anonymity is not satisfied. Similarly, if the l value exceeds 1, l-diversity is satisfied, and if l value is 1, l-diversity is not satisfied.

  When the minimum number of appearances (k value / l value) does not exceed 1 (step S120, No), the information processing apparatus 10 further abstracts the value of at least one item of the abstraction candidate data. Replacing with the abstracted word (step S130), the process returns to step S100.

  On the other hand, when the minimum number of appearances (k value / l value) exceeds 1 (step S120, Yes), the information processing apparatus 10 calculates the difference between the value of the abstraction candidate data and the value of the original target data. Obtain (Step S140), and determine the difference, a value based on the difference, for example, the ratio of the difference to the value of the target data, and the ratio of the value of the abstract candidate data to the value of the target data as the value of the abstract candidate data. (Step S150).

  Further, the information processing apparatus 10 determines whether there is a candidate pattern that has not been verified (step S160). If there is a candidate pattern that has not been verified (step S160, Yes), the information processing apparatus 10 follows the order determined in step S90. Then, the next abstraction candidate data is specified (step S170), and the process returns to step S100 to test the next abstraction candidate data.

  Thus, when the test is repeated for the abstraction candidate data of each pattern and the next candidate pattern disappears (step S160, No), the information processing apparatus 10 determines based on the value of each abstraction candidate data obtained in step S150. Then, the abstraction candidate data to be adopted is selected (step S180), the target data in the test DB 41 is updated based on the selected abstraction candidate data (step S190), and the process ends.

  In the selection of the abstraction candidate data, for example, the abstraction candidate data having the highest value among all candidate patterns is selected. The information processing apparatus 10 outputs a plurality of abstraction candidate data in descending order of value from all candidate patterns, and the abstraction candidate data that the operator thinks is appropriate from the output abstraction candidate data May be selected, and the specified abstraction candidate data may be selected. The test DB 41 may be updated by overwriting the target data with the selected abstraction candidate data to be anonymized data, or a word in the target data may be abstracted in the same way as the selected abstraction candidate data. It is good also as anonymized data by doing.

Next, the value of data in the present embodiment will be described with reference to FIGS. FIG. 7 is a diagram illustrating an example of a part of the age item in the target data. As shown in FIG. 7, the target data has the number of people ci for each age si. For example, the number of people (c1) who are 18 years old (s1) is 30
There are 10 people (c2) who are 19 years old (s2).

FIG. 8 shows an example of value data acquired for the age si. The value data in FIG. 8 has a SEM unit price ei for each age si.
The value of this age si is a value obtained by multiplying the SEM unit price ei by the number of people ci, and is represented by Equation 1.
si = ci × ei (Formula 1)
As shown in FIG. 9, the value of the age item S (e) is the total of each age si, and is expressed by Equation 2. In FIG. 9, n is 5. Therefore, the value of the age item S (e) is 2446 yen as shown in FIG. The value of the target data is the sum of the values of all items in the target data.

  On the other hand, FIG. 11 is a diagram showing an example of a part of the age item in the abstraction candidate data. As shown in FIG. 11, the abstraction candidate data has the number of people ci for each age ki. For example, the number of teenagers (k1) (c1) is 40, and the number of people in their 20s (k2) (c2) is 22.

FIG. 12 shows an example of value data of each word acquired for the age ki. The value data in FIG. 12 has a SEM unit price ei for each age ki.
The value of this age ki is a value obtained by multiplying the SEM unit price ei by the number of people ci, and is expressed by Equation 3.
ki = ci × ei (Formula 3)
Then, as shown in FIG. 13, the value of the item S (k) of the age is the total of each age ki, and is expressed by Equation 4. In FIG. 13, n is 2. Therefore, the value of the age item S (k) is 2134 yen as shown in FIG. In other words, the value was lost by 312 yen by abstracting the age item into the age. Further, the sum of the values of all items in the abstraction candidate data is the value of the abstraction candidate data.

Then, as the value of the abstraction candidate data obtained in step S150, for example, as shown in Equation 5, an impairment rate M (k that is obtained by dividing the value of the abstraction candidate data by the sum of the value of the abstraction candidate data and the value of the target data. )
M (k) = S (k) / (S (k) + S (e)) (Formula 5)
As described above, the information processing apparatus 10 according to the present embodiment can evaluate the value of each abstraction candidate data with high accuracy by evaluating the value of each abstraction candidate data based on the value of the abstracted word. Since abstract candidate data having high value can be selected later, appropriate anonymization processing can be performed.
<Modification>
In the first embodiment, the process of updating the target data registered in the verification DB is shown. However, the present invention is not limited to this, and the received target data may be sequentially processed and distributed. FIG. 15 is an explanatory diagram of anonymization processing showing this modification. In addition, this modification differs in the flow of the anonymization process shown in FIG. 15 compared with the above-mentioned Embodiment 1, and the other structure is the same. For example, the hardware configuration of the information processing apparatus 10 is the same, and the description thereof is omitted.

  The information processing apparatus 10 first acquires (receives) target data from the user terminal or another computer (step S10), normalizes the target data into a predetermined format, and stores it in the memory 2 (step S25).

The information processing apparatus 10 reads the target data from the memory 2 (step S30), and determines whether value data exists in the search information storage DB 42 for each word in the target data (step S40). The information processing apparatus 10 proceeds to step S60 when all word value data exists in the search information storage DB 42 (step S40, Yes), and when there is insufficient value data (step S40, No), Word value data is obtained from an external device, in this example, the search engine 20 (step S50). Note that the value information of the words existing in the search information storage DB 42 other than the value data acquired from the search engine is acquired from the search information storage DB 42 (step S60).

  Further, the information processing apparatus 10 creates abstraction candidate data by replacing each item of the target data with an abstracted word (category) in order to satisfy anonymity (step S70). When there are a plurality of items that can be abstracted, all patterns are created when each item is abstracted and when it is not abstracted.

  Next, the information processing apparatus 10 calculates the value of the abstraction candidate data of each pattern based on the value data of each word included in the abstraction candidate data (step S80), and based on the value of this abstraction candidate data. Abstraction candidate data to be tested is determined (step S95). The abstraction candidate data is determined, for example, as abstraction candidate data having the highest value among all candidate patterns. The information processing apparatus 10 outputs a plurality of abstraction candidate data in descending order of value from all candidate patterns, and the abstraction candidate data that the operator thinks is appropriate from the output abstraction candidate data May be specified, and the specified abstraction candidate data may be determined.

  In accordance with the order of this test, the information processing apparatus 10 tests the anonymity of the abstraction candidate data (step S100). For example, in order to test k-anonymity, the number (existence number) of combinations of values of different items associated with one individual is present in the abstraction candidate data. Alternatively, in order to test 1 diversity, the number (existence number) in which the combination of values of the same item associated with one individual exists in the abstraction candidate data is obtained. Then, the smallest of the existence numbers is obtained as the minimum number of appearances (k value / l value) (step S110), and it is determined whether or not the minimum number of appearances exceeds 1 (step S120).

  When the minimum number of appearances (k value / l value) does not exceed 1 (step S120, No), the information processing apparatus 10 further abstracts the value of at least one item of the abstraction candidate data. Replacing with the abstracted word (step S130), the process returns to step S100.

On the other hand, when the minimum appearance number (k value / l value) exceeds 1 (step S120, Yes), the information processing apparatus 10 distributes the abstraction candidate data as anonymized data (step S145).
As described above, according to the present modification, anonymized data having an appropriate value can be immediately distributed.

<Embodiment 2>
In the first embodiment, the abstraction process using the words registered in the search information storage DB has been described. However, the present invention is not limited to this, and an external device can be used when a word not registered in the search information storage DB is received. It is good also as a structure which acquires from and abstracts. FIG. 16 is an explanatory diagram of the anonymization process showing the second embodiment. In addition, this Embodiment 2 differs in the flow of the anonymization process shown in FIG. 16 compared with above-mentioned Embodiment 1, and the other structure is the same. For example, the hardware configuration of the information processing apparatus 10 is the same, and the description thereof is omitted.

  The information processing apparatus 10 first acquires (receives) target data from another computer or storage device (step S210), normalizes the target data to be in a predetermined format, and registers it in the verification DB 41 (step S220).

The information processing apparatus 10 reads the target data from the verification DB 41 (step S230), and determines whether each word in the target data exists in the search information storage DB 42 (step S240). When all the words exist in the search information storage DB 42, the information processing apparatus 10 proceeds to step S260 (step S240, Yes), and when there is a missing word (step S240, No), abstracts the word. The acquired word (category) data is acquired from an external device, in this example, the search engine 20 (step S250). FIG. 17 is an explanatory diagram of processing for acquiring a category from an unknown word. As shown in FIG. 17, for example, when an unknown name “Nippon Taro” is included in the target data, this unknown word is searched by the search engine 20, and a word with a large number of co-occurrence in the search result web page Extract words that are close to each other. For example, when words such as “drama”, “departure”, “team 48”, “actor”, “idol”, and “entertainer” are extracted, the relationship between these words is obtained by collation with a known thesaurus or natural language analysis. A category that abstracts an unknown word is determined, and a category that abstracts this category is determined. For example, “Taro Nihon” → “Team 48” → “Actor”
→ Define the level of abstraction like “celebrity”.

  Note that categories other than the categories acquired from the search engine 20, that is, categories that existed in the search information storage DB 42, are acquired from the search information storage DB 42, and each item of the target data is replaced with an abstract word (category) to satisfy anonymity. Abstraction candidate data is created (step S260). When there are a plurality of items that can be abstracted, all patterns are created when each item is abstracted and when it is not abstracted.

  Next, the information processing apparatus 10 calculates the value of the abstraction candidate data of each pattern based on the value data of each word included in the abstraction candidate data, and determines the order of the tests based on the value of the abstraction candidate data. Determine (step S270). For example, the test order is determined in descending order of the value.

  In accordance with the order of the verification, the information processing apparatus 10 verifies the anonymity of the abstraction candidate data (step S280). For example, in order to test k-anonymity, the number (existence number) of combinations of values of different items associated with one individual is present in the abstraction candidate data. Alternatively, in order to test 1 diversity, the number (existence number) in which the combination of values of the same item associated with one individual exists in the abstraction candidate data is obtained. Then, the smallest of the existence numbers is obtained as the minimum number of appearances (k value / l value) (step S290), and it is determined whether or not the minimum number of appearances exceeds 1 (step S300).

  When the minimum number of appearances (k value / l value) does not exceed 1 (step S300, No), the information processing apparatus 10 further abstracts the value of at least one item of the abstraction candidate data, that is, Replacement with the abstracted word (step S310), the process returns to step S280.

  On the other hand, when the minimum number of appearances (k value / l value) exceeds 1 (step S300, Yes), the information processing apparatus 10 determines the difference between the value of the abstract candidate data and the value of the original target data, Then, a value based on the difference, for example, a ratio of the difference to the value of the target data and a ratio of the value of the abstraction candidate data to the value of the target data are determined as the value of the abstraction candidate data (step S320).

  Further, the information processing apparatus 10 determines whether there is a candidate pattern that has not been verified (step S330). If there is a candidate pattern that has not been verified (step S330, Yes), the information processing apparatus 10 follows the order determined in step S270. Next, the abstraction candidate data in the next order is specified (step S340), and the process returns to step S280 to test the next abstraction candidate data.

In this way, when the test is repeated for the abstraction candidate data of each pattern and there is no next candidate pattern (No in step S330), the information processing apparatus 10 is based on the value of each abstraction candidate data obtained in step S320. Then, the abstraction candidate data to be adopted is selected (step S340), the target data of the test DB 41 is updated based on the selected abstraction candidate data (step S350), and the process is terminated.

  As described above, according to the present embodiment, it is possible to abstract the unknown item by acquiring the category from another device.

<Modification>
In the second embodiment, the process of updating the target data registered in the verification DB is shown. However, the present invention is not limited to this, and the received target data may be sequentially processed and distributed. FIG. 18 is an explanatory diagram of anonymization processing showing this modification. In addition, this modification differs in the flow of the anonymization process shown in FIG. 18 compared with the above-mentioned Embodiment 2, and the other structure is the same. For example, the hardware configuration of the information processing apparatus 10 is the same, and the description thereof is omitted.

  The information processing apparatus 10 first acquires (receives) target data from another computer or storage device (step S210), normalizes the target data to be in a predetermined format, and registers it in the memory 2 (step S225).

  The information processing apparatus 10 reads the target data from the verification DB 41 (step S230), and determines whether each word in the target data exists in the search information storage DB 42 (step S240). When all the words exist in the search information storage DB 42, the information processing apparatus 10 proceeds to step S260 (step S240, Yes), and when there is a missing word (step S240, No), abstracts the word. The acquired word (category) data is acquired from an external device, in this example, the search engine 20 (step S250).

  Note that categories other than the categories acquired from the search engine 20, that is, categories that existed in the search information storage DB 42, are acquired from the search information storage DB 42, and each item of the target data is replaced with an abstract word (category) to satisfy anonymity. Abstraction candidate data is created (step S260). When there are a plurality of items that can be abstracted, all patterns are created when each item is abstracted and when it is not abstracted.

  Next, the information processing apparatus 10 calculates the value of the abstraction candidate data of each pattern based on the value data of each word included in the abstraction candidate data, and performs the test based on the value of the abstraction candidate data. Candidate data is determined (step S275). The abstraction candidate data is determined, for example, as abstraction candidate data having the highest value among all candidate patterns. The information processing apparatus 10 outputs a plurality of abstraction candidate data in descending order of value from all candidate patterns, and the abstraction candidate data that the operator thinks is appropriate from the output abstraction candidate data May be specified, and the specified abstraction candidate data may be determined.

  In accordance with the order of the verification, the information processing apparatus 10 verifies the anonymity of the abstraction candidate data (step S280). For example, in order to test k-anonymity, the number (existence number) of combinations of values of different items associated with one individual is present in the abstraction candidate data. Alternatively, in order to test 1 diversity, the number (existence number) in which the combination of values of the same item associated with one individual exists in the abstraction candidate data is obtained. Then, the smallest of the existence numbers is obtained as the minimum number of appearances (k value / l value) (step S290), and it is determined whether or not the minimum number of appearances exceeds 1 (step S300).

  When the minimum number of appearances (k value / l value) does not exceed 1 (step S300, No), the information processing apparatus 10 further abstracts the value of at least one item of the abstraction candidate data, that is, Replacement with the abstracted word (step S310), the process returns to step S280.

On the other hand, when the minimum number of appearances (k value / l value) exceeds 1 (step S300, Yes)
The information processing apparatus 10 distributes the abstraction candidate data as anonymized data (step S325).
As described above, according to the present modification, anonymized data having an appropriate value can be immediately distributed by acquiring a category from another device for abstracting an unknown item.

<Others>
The present invention is not limited to the illustrated examples described above, and various modifications can be made without departing from the scope of the present invention.

DESCRIPTION OF SYMBOLS 1 Information processing apparatus 2 Memory 3 Communication control part 4 Storage apparatus 5 Input / output interface 10 Information processing apparatus 11 Abstraction part 12 Value determination part 13 Test part 14 Selection part 15 Data update part 16 Data reception part 17 Value data acquisition part 18 Word Category analysis department
1 9 Value Calculation Department
2 0 Search engine 21 Data output part
4 0 Data output section

Claims (9)

A data receiving unit that receives target data including a plurality of items associated with an individual;
An abstraction unit that generates abstraction candidate data by replacing a word that is a value of an item in the target data with an abstracted word;
A value determination unit that receives a value of a word included in the abstraction candidate data and obtains a first value of the abstraction candidate data based on a value of the word included in the abstraction candidate data;
Among the abstraction candidate data, a predetermined percentage of the abstraction candidate data having the first high value or a part of the abstraction candidate data in order of the first value, the value of the item corresponding to one individual A test unit that tests on condition that the combination is not single in the abstraction candidate data; and
A selection unit that selects the abstraction candidate data based on a second value obtained by multiplying the value of the word included in the abstraction candidate data satisfying the test condition by the number of persons having the word as an attribute value. Information processing device. A data receiving unit that receives target data including a plurality of items associated with an individual;
Wherein when the word is the value of the item in the target data does not exist in the abstract word is de database is a word in the target data words and the abstract does not exist and unknown words, external the unknown word A search engine that is a device searches for a web page as a search result, and a word that co-occurs on the web page is analyzed in natural language to obtain a word that abstracts the unknown word, and the abstract word and abstraction unit but which generates an abstracted candidate data instead of abstracting word a word in the target data to obtain the abstracted words from the database, if present in the database,
A value determination unit that receives the value of the word included in the abstraction candidate data and obtains the value of the abstraction candidate data based on the value of the word included in the abstraction candidate data;
A test unit that tests on condition that a combination of values of items corresponding to one individual of the abstraction candidate data is not single in the abstraction candidate data;
An information processing apparatus comprising: a selection unit that selects abstraction candidate data based on the value of the abstraction candidate data that satisfies the test condition.   The said test | inspection part tests anonymity on condition that the combination of the value of the different item matched with one individual of the said abstraction candidate data is not single in the said abstraction candidate data. Information processing device.   The test unit according to any one of claims 1 to 3, wherein the test unit tests diversity on condition that a combination of values of the same item associated with one individual of the abstraction candidate data is not single in the abstraction candidate data. The information processing apparatus according to claim 1.   The information processing apparatus according to any one of claims 1 to 4, wherein the value of the word is a value based on statistical information of a word used on a website. Receiving target data including a plurality of items associated with an individual;
Generating abstract candidate data by replacing words that are values of items in the target data with abstract words;
Receiving a value of a word included in the abstraction candidate data, and determining a first value of the abstraction candidate data based on a value of the word included in the abstraction candidate data;
Among the abstraction candidate data, a predetermined percentage of the abstraction candidate data having the first high value or a part of the abstraction candidate data in order of the first value, the value of the item corresponding to one individual Testing the condition that the combination is not single in the abstraction candidate data; and
A computer selecting abstraction candidate data based on a second value obtained by multiplying the value of a word included in the abstraction candidate data satisfying the test condition by the number of persons having the word as an attribute value; Information processing method to be executed. Receiving target data including a plurality of items associated with an individual;
Wherein when the word is the value of the item in the target data does not exist in the abstract word is de database is a word in the target data words and the abstract does not exist and unknown words, external the unknown word A search engine that is a device searches for a web page as a search result, and a word that co-occurs on the web page is analyzed in natural language to obtain a word that abstracts the unknown word, and the abstract word a step but generating the abstracted candidate data instead of abstracting word a word in the target data to obtain the abstracted words from the database, if present in the database,
Receiving the value of the word included in the abstraction candidate data, and determining the value of the abstraction candidate data based on the value of the word included in the abstraction candidate data;
Testing a condition that a combination of values of items corresponding to one individual of the abstraction candidate data is not single in the abstraction candidate data;
An information processing method in which a computer executes a step of selecting abstraction candidate data based on a value of abstraction candidate data satisfying the test condition. Receiving target data including a plurality of items associated with an individual;
Generating abstract candidate data by replacing words that are values of items in the target data with abstract words;
Receiving a value of a word included in the abstraction candidate data, and determining a first value of the abstraction candidate data based on a value of the word included in the abstraction candidate data;
Among the abstraction candidate data, a predetermined percentage of the abstraction candidate data having the first high value or a part of the abstraction candidate data in order of the first value, the value of the item corresponding to one individual Testing the condition that the combination is not single in the abstraction candidate data; and
Selecting abstraction candidate data based on a second value obtained by multiplying the value of a word included in the abstraction candidate data satisfying the test condition by the number of persons having the word as an attribute value, An information processing program for execution. Receiving target data including a plurality of items associated with an individual;
Wherein when the word is the value of the item in the target data does not exist in the abstract word is de database is a word in the target data words and the abstract does not exist and unknown words, external the unknown word A search engine that is a device searches for a web page as a search result, and a word that co-occurs on the web page is analyzed in natural language to obtain a word that abstracts the unknown word, and the abstract word a step but generating the abstracted candidate data instead of abstracting word a word in the target data to obtain the abstracted words from the database, if present in the database,
Receiving the value of the word included in the abstraction candidate data, and determining the value of the abstraction candidate data based on the value of the word included in the abstraction candidate data;
Testing a condition that a combination of values of items corresponding to one individual of the abstraction candidate data is not single in the abstraction candidate data;
An information processing program for causing a computer to execute a step of selecting abstraction candidate data based on a value of abstraction candidate data satisfying the test condition.

Images