JP6256035B2 - Data editing program, data editing method, and data editing apparatus - Google Patents

Description

  The present invention relates to a data editing program, a data editing method, and a data editing apparatus.

  Individual vote data is a relational model represented by a two-dimensional table, in which sample information is stored in each row. The sample may be a person, another animal, or a device, but in the following, it is assumed that the sample is a person. The information includes, for example, “identifier” (may be “name” if the sample is a person), “date of birth”, “postal code”, “hobby”, etc. . In some cases, it is desired to generalize (convert) the data so that a large amount of information remains in consideration of the privacy of each sample.

  As a case where the individual vote data is to be generalized, secondary utilization of the data can be considered. For example, company A collects individual vote data as shown in FIG. 1 from a customer, sells the data to company B, and company B uses the knowledge of analyzing the individual vote data for market analysis and the like. At this time, Company A considers the customer and does not want to provide other companies such as Company B with data that may infringe on the customer's privacy. On the other hand, Company B is not interested in the information of each individual of Company A, but wants to obtain overall information as accurately as possible.

  As one of the generalization methods, statisticalization for each attribute is known. For example, when the name, date of birth, postal code, and hobby are described in the individual vote data, the “hobby” is converted into frequency distribution information. For example, if there are two people who have a hobby of golf, two people who have a hobby of swimming, two people who have a hobby of reading, and two people who have a hobby of cooking, hobby = {golf : 2, swimming: 2, reading: 2, cooking: 2}. Looking at this information does not tell who is a hobby, but it is possible to know the trend of the overall hobby.

  Thus, it can be said that the statistics for each attribute is one of the methods to meet the demand. However, this method has a drawback that the relationship between attributes is not known. For example, in the case of the above example, if company B wants to analyze the correlation between "birth year" and "hobby", even if it obtains statistical data for "birth year" and "hobby" separately, Cannot be realized.

  Anonymization is known as one of the generalization methods that can analyze the relationship between attributes. That is, the relation model after deleting the “identifier” of each line of the individual vote data or an attribute close to it (if the sample is a person, it may be “name”). Company B who saw this can analyze the relationship between the attributes (other than “identifier”).

  As one of the generalization methods that can analyze the relationship between attributes, l-diversification is known (for example, Non-Patent Document 1). l-Diversification receives Quasi-Identifier (QI) and Sensitive-Attribute (SA) as inputs and groups rows with close QI values so that the SA values of each group have diversity. . SA is a column of information that the data provider of each sample, that is, each row of the individual vote data, does not want to be known to the public, and QI is a set of information that can be easily known by others. The QI can correspond to data described in one or more columns in the individual vote data. Here, diversity is a property that can be determined for the frequency distribution of SA values, and is usually a property that determines that the bias of the frequency distribution is small.

  In addition, in relation to buying and selling goods and services via a computer, a functional classification including at least one entity and at least one characteristic associated with each entity as a method of expressing knowledge about the goods and services. The method of performing is known (for example, patent document 1). For example, methods that rely on object-centric constraint methods that incorporate object-oriented principles with constraint satisfaction techniques are known. Object-oriented principles include identification, classification, polymorphism, and inheritance, and constraint satisfaction methods are methods that represent inter-concept or intra-concept relationships between attributes. By adopting such a method, multiple sellers can describe each product in a uniform way that can be customized, integrated, interchanged and reused in various environments.

JP-A-10-149288

Ashwin Macavanavajjhala, Daniel Kifer, Johannes Gehrke, and Muthuramakrishnan Venquitabramaniam, L-diversity: Privacy beyondmitymany, Knowl. Discov. Data, Vol. 1. March 2007

  However, in practice, it may be different depending on the attribute that a person does not want to be known, and information (for example, l-diversification) that the data provider of each sample, that is, each row of individual data, is not surely known. SA) and information that can be easily known by others (for example, when using generalization by l-diversification, QI) is difficult to set appropriately, and privacy is considered. There is a problem that it cannot be generalized.

  Therefore, as one aspect, an object of the present invention is to provide a data editing program, a data editing method, and a data editing apparatus that can analyze a relationship between attributes in consideration of sample privacy.

A relation model including a plurality of attribute values for each of a plurality of samples, and generalized information in which a hierarchy and a generalized value corresponding to each of the hierarchies are defined for each attribute, A combination of the generalized values of the plurality of samples corresponding to one, and corresponding to all other attributes of the plurality of attributes with respect to the generalized value corresponding to one attribute of the plurality of attributes There is provided a data editing program that causes a computer to execute a process of extracting a combination of the generalized values in which the generalized values have diversity.

  The relationship between attributes can be analyzed in consideration of sample privacy.

It is a figure which shows the example of individual vote data. It is a figure which shows the example of the relationship model after anonymization. It is a figure which shows the example of the relationship model after l-diversification. It is a figure which shows the example of the functional block of a data editing apparatus. It is a figure which shows the example of the generalized tree of "the year of birth." It is a figure which shows the example of the generalization tree of "zip code". It is a figure which shows the example of the generalization tree of "hobby". It is a figure which shows the example of the diversity definition of each hierarchy of each generalization tree. It is a figure which shows the example which applied generalization information to FIG. It is a figure which shows the example of the set of generalization information. It is a figure which shows the example of the generalized result. It is a figure which shows the example of the generalized result. It is a figure which shows the example of the generalized result. It is a figure which shows the example of a structure of a data editing apparatus. It is a figure which shows the example of the flow of a process. It is a figure which shows the example of the flow of a process which makes the set O with respect to P. FIG. It is a figure which shows the example of the flow of a process which makes the set I with respect to P. FIG.

  Hereinafter, a data editing program, a data editing method, and a data editing apparatus according to embodiments will be described with reference to the drawings. The data editing program, the data editing method, and the data editing apparatus according to the embodiment include individual information, that is, a relational model (two-dimensional table) in which each person's information is stored in each row. Generalize (convert) the data so that

FIG. 1 is a diagram illustrating an example of individual vote data.
As a case where the individual vote data is to be generalized, secondary utilization of the data can be considered. For example, company A collects individual vote data as shown in FIG. 1 from a customer, sells the data to company B, and company B uses the knowledge of analyzing the individual vote data for market analysis and the like. At this time, Company A considers the customer, and does not want to provide other companies such as Company B with data that may infringe on the privacy of the customer. On the other hand, Company B is not interested in the information of each individual of Company A, but wants to obtain overall information as accurately as possible.

  As a generalization method, there is statistics for each attribute. For example, in the case of FIG. 1, “hobby” is a method of converting into frequency distribution information such as hobby = {golf: 2, swimming: 2, reading: 2, cooking: 2}. Company B does not know who has a hobby even after looking at this information, but can understand the overall trend of hobbies.

  Thus, it can be said that the statistics for each attribute is one of the methods to meet the demand. However, this method has a drawback that the relationship between attributes is not known. For example, in the case of Fig. 1, when company B wants to analyze the correlation between "birth year" and "hobby", even if it obtains statistical data for "birth year" and "hobby" separately, it achieves that. Can not. In the following, we will focus on generalization that can analyze the relationship between attributes.

Anonymization is a generalization method that can analyze the relationship between attributes.
FIG. 2 is a diagram illustrating an example of a relation model after anonymization. FIG. 2 shows a relation model after anonymizing FIG. 1, that is, deleting a row identifier or an attribute close thereto, for example, “name” of FIG.

Company B who saw this can analyze the relationship between the attributes (other than “name”). However, privacy protection may not be sufficient just by anonymization. For example, consider the following situation.
(1) “Hachijo Hachiro” doesn't want B to know that his hobby is dancing.
(2) Company B knows that “the year of birth” of “Hachijo Hachiro” is 1989 and “zip code” is 122.
(3) Company B knows that there is a line “Hachijo Hachiro” in the individual data shown in FIG.

  When all of these situations are established, privacy protection is not sufficient in FIG. This is because Company B can know from the year of birth and the postal code that the line “Hachijo Hachiro” is the eighth line in FIG. 2, ie, (Birth year, postal code) = (1989, 122). Therefore, it can be understood that the “hobby” of “Hachijo Hachiro” is “dance”. However, this is because "Hachijo Hachiro" does not want.

  In the data editing apparatus, the data editing method, and the data editing program of the embodiment, a person who sees a relation model after generalization is targeted for a case where detailed information about a certain person included therein is included. In that case, as in the above example, privacy protection is insufficient only by anonymization.

  FIG. 3 is a diagram illustrating an example of a relationship model after l-diversification. l-Diversification is one of the generalization methods that can analyze the relationship between attributes.

  l-Diversification is an example of l-diversification, which accepts Quasi-Identifier (QI) and Sensitive-Attribute (SA) as inputs, and groups rows with similar QI values (QI values) (for example, to the same value). In general, the SA values (SA values) of each group have diversity. SA is a column of information that each person (row data provider) does not want to be made aware of, and QI is a column set (one or more columns) of information that other people can easily know.

  Diversity in l-diversification is a property that can be determined for the frequency distribution of SA values, and is usually a property that determines that the bias of the frequency distribution is small.

  As an example of l-diversification, for example, QI = {year of birth, postal code}, SA = hobby, and diversity can be considered as “having two or more hobby values”. For example, suppose that there is k who was born in 1970 and lives in a place where the postal code is 121 and has a hobby of swimming, and m who was born in 1972 and lives in a place where the postal code is 122 and has a hobby of reading. Here, suppose that born in "197?" And the postal code is "12?" As QI, SA = {swimming, reading} and there are two types of SA values, so there are two or more hobby values. The condition of diversity is satisfied. Thus, l-diversification is known as a generalization method that can analyze the relationship between attributes and also considers privacy.

  In the example shown in FIG. 3, QI = {birth year, postal code}, SA = {hobby}, and the diversity is “two or more hobby values”, compared to the example shown in FIG. 2. Is an example of diversification. In FIG. 3, “?” Represents an arbitrary number and is used to generalize the QI values of groups to the same value. The {1, 3} line, {2, 4} line, {5, 6} line, {7, 8} line, whose QI values are close to each other, are grouped. In addition, the ninth line where no line has a close QI value is painted in black. The SA value of each group satisfies diversity. That is, the frequency distribution of SA values of any group has two or more types of SA values.

  In the example shown in FIG. 3, the relationship between attributes can be analyzed and privacy is also taken into consideration. For example, considering the above example, Company B cannot narrow the line of “Hachijo Hachiro” to any of {7, 8} lines, and therefore its “hobby” is also narrowed to one of {reading, dancing}. I can't put it. It should be noted that “Hachijo Hachiro” is not the ninth line in FIG. 3 if one knows the l-diversification algorithm. The 9th line was painted because there was no line with a close QI value, and it should not have been painted if it was close to the 7th or 8th line QI value, so the QI value of the {7, 8} line It can be seen that “Hachijo Hachiro” corresponding to is not on the 9th line.

  As described above, l-diversification can analyze the relationship between attributes and can also consider privacy.

  However, l-diversification has a problem that the user (for example, Company A) must appropriately determine QI and SA.

  For example, unlike the previous case, “Hachijo Hachiro” does not want his company's year of birth and postal code to be known to Company B, and Company B knows that the “hobby” of “Hachijo Hachiro” is dance. Think. However, it is assumed that Company A does not know that and has set QI and SA as before. In this situation, when company B looks at the relationship model in Figure 3, the line “Hachijo Hachiro” is line 8, and the “year of birth” and “zip code” may be “1989” and “12?”, Respectively. It turns out that is high. In other words, privacy protection is insufficient for “Hachijo Hachiro”. There is a possibility that the line “Hachijo Hachiro” is the 9th line. For example, when “Hobby” is rare for dancers or when the frequency distribution of each person ’s hobby is known, The possibility of “Hachiro Hachiro” in the eighth line may increase.

  Also, in actuality, there are cases where different attributes do not want to be known depending on the person, and in that case, it may not be possible to set the QI and SA appropriately.

  In the data editing apparatus, the data editing method, and the data editing program of the embodiment described below, when there are n columns of relational models to be generalized, for any n−1 columns, the remaining values for the rows where the values are the same. Generalize to give diversity to column values. By receiving the definition of diversity for each column as input and generalizing it while judging the diversity of each column, each column is converted into a relational model that achieves diversity. In other words, the data editing apparatus, data editing method, and data editing program of the embodiment described below do not require setting of QI and SA, and generalize the relationship between attributes in consideration of privacy. The relation model after generalization can analyze the relation between attributes considering the privacy of the sample. For example, about one person included in the individual vote data, even if a person who knows the information up to n-1 column out of n columns, the remaining one column information is diversified, so it is high Privacy protection can be realized.

<Data editing device>
FIG. 4 is a diagram illustrating an example of functional blocks of the data editing apparatus 100.

  The data editing apparatus 100 includes an input unit 102, a generalization unit 104, and an output unit 106. The generalization unit 104 may also be referred to as an anonymization unit 104.

The input unit 102 of the data editing apparatus 100 receives the following as input.
(I1) Relational model R to be generalized
(I2) Generalized tree T for each column of relational model R
(I3) Diversity definition D of each hierarchy of each generalized tree
(I4) Maximum number of black lines s
The relation model R is a two-dimensional table in which information about samples is stored in each column, and is shown in FIG. 2, for example. Of course, in the relational model R, as shown in FIG. 2, the sample does not need to be a person, and may be another animal or a device, and is generally arbitrary.

  The generalized tree T in each column of the relationship model R is tree structure data indicating the classification relationship of each value. In the generalized tree T, hierarchies and values in each hierarchy (also referred to as generalized values) are defined. Hierarchy 0 is an arbitrary value “*”, and the degree of generalization decreases as the number of hierarchies increases. In other words, as the number of hierarchies increases, the transition from abstract to concrete. The generalized tree is sometimes called generalized information.

  FIG. 5 is an example of a generalized tree of “birth year”. In FIG. 5, only the portion related to the values appearing in FIG. 2 is expressed, but there may be portions related to other values. FIG. 5 has three levels up to a depth of three. As you follow the edge in the direction of the root of the tree, the numbers are generalized. Generalizing to the root corresponds to sanitization, but for convenience, this is called layer 0. For example, the value 1989 is 1989 in layer 3, is “198?” When generalized to layer 2, and is “19?” When generalized to layer 1. Furthermore, it is “*” when generalized to the hierarchy 0. Here, “?” Is an arbitrary single-digit number, and “*” is an arbitrary number of arbitrary digits.

  FIG. 6 is a diagram illustrating an example of a generalized tree of “zip code”, and FIG. 7 is a diagram illustrating an example of a generalized tree of “hobby”.

  Assume that the relationship model R is shown in FIG. At this time, as the generalized tree T, from “birth year” in FIG. 2 to what is shown in FIG. 5, from “zip code” in FIG. 2 to what is shown in FIG. 6, “hobby” in FIG. A map having the relationship from to FIG. 7 will be used in the following description.

The diversity definition D of each hierarchy of each generalized tree is assumed to be a mapping D: (a, l) → d from the combination of the column name a and the hierarchy 1 to the diversity definition. The diversity definition d is a mapping d: F → 1/0 from the frequency distribution to a logical value indicating whether or not the property is satisfied. Further, the map d is a map having the following properties.
(D1) Monotonicity: (d (F1) = 1) ∧ (d (F2) = 1) => d (F1 + F2) = 1. However, F1 + F2 is the sum of frequency distributions.
(D2) Hierarchical monotonicity: d (F) = 1⇒d ′ (F ′) = 1. However, d ′ is a diversity definition in a hierarchy that is one smaller than d, and F ′ is a frequency distribution in the d ′ hierarchy, that is, F is generalized to the d ′ hierarchy.

  FIG. 8 is a diagram illustrating an example of diversity definition of each hierarchy of each generalized tree. FIG. 8 is an example of the mapping D corresponding to the generalized tree T described above.

  For example, let d be the diversity definition of birth year: 3. At this time, d becomes true (“1”) only when F has different values at the 10's place. For example, F = {“1970”: 1, “1989”: 2} → d (F) = 1, F = {“1970”: 2, “1978”: 2} => d (F) = 0. Moreover, each diversity of FIG. 8 including the diversity definition d satisfies monotonicity and hierarchical monotonicity. For example, F = {“1970”: 1, “1989”: 2} → d (F1) = 1, F2 = {“1970”: 2, “1989”: 1} → d (F2) = 1, Since d (F1 + F2) = d ({“1970”: 3, “1989”: 3}) = 1, it is certainly consistent with monotonicity. Further, F1 = {“1970”: 1, “1989”: 2} → d (F1) = 1, and d ′ (F1 ′) = d ′ (“197?”: 1, “198?”: 2 ) = 1, so it is certainly consistent with hierarchical monotonicity. Note that the diversity definition of layer 0 of each column is a mapping that always returns true (“1”). Such a map D is used in the following description.

  The maximum sanitized line number s is a non-negative integer less than the number of lines in the relational model R. In the following description, s = 2.

  As a result of the generalization unit 104, the output unit 106 of the data editing apparatus 100 outputs a generalized information set and a relation model after generalization with the generalized information G that is one of its elements.

  The generalized information G is a set of a set of {column name: hierarchy} and a set of row numbers to be sanitized. It is assumed that {column name: hierarchy} has at most one in each column. There is no need for column name data of hierarchy = 0. In the following, it is assumed that line numbers are indexed by 0, 1,... In order from the first line. The generalized information G can be, for example, G = ({birth year: 2, postal code: 1, hobby: 1}, {8}). This means that “birth year” is generalized to level 2, “zip code” is generalized to level 1, “hobby” is generalized to level 1, and the ninth line is sanitized.

  FIG. 9 is a diagram showing an example in which the generalized information is applied to FIG. More specifically, FIG. 9 shows the relation model shown in FIG. 2 after generalization according to the generalized information G = ({birth year: 2, postal code: 1, hobby: 1}, {8}). It is a relationship model. If Company B, who knows some information about “Hachijo Hachiro”, sees FIG. 9, even if he / she knows “birth year” and “postal code”, he / she does not know “hobby”, but “postal code” and “ Even if you know "hobby", you will not know "birth year" in detail, and even if you know "birth year" and "hobby", you will not know "zip code" in detail. Note that a line may be deleted instead of sanitizing.

  The output unit 106 of the data editing apparatus 100 may output a set of generalized information in a table format as shown in FIG. The first line in FIG. The set output from the output unit 106 of the data editing apparatus 100 may be referred to as a generalized relational model.

  Due to the monotonicity and hierarchical monotonicity of the diversity definition D, when a generalized information G achieves the diversity definition D, all generalized information G having a {column name: hierarchy} set below the generalized information G is all Achieve diversity definition D. Thereby, there is an advantage that the generalized information G can be easily obtained. Note that the size of the column name: hierarchy set is determined by the size of the hierarchy of each column. For example, if P1 = {birth year: 2, zip code: 1}, P2 = {birth year: 1, zip code: 1}, P3 = {birth year: 1, zip code: 2}, P1> P2, P3> P2 Therefore, the size of P1 and P3 cannot be determined.

  In the generalization unit 104 of the data editing apparatus 100, when the relation model R received by the input unit 102 has n columns, for any n−1 columns, the values are diversified into the values of the remaining columns for the same row. Generalize as there is. The generalization unit 10 may attempt to generalize so as to achieve diversity in order from a small set to a bundle structure based on a set of rows of columns. This generalization is similar to l-diversification, but differs from l-diversification in that the diversity determination is different for each column.

  Further, the generalization unit 104 of the data editing apparatus 100 has a function of repeatedly verifying whether or not the relationship model (two-dimensional table) after conversion is achieved if the maximum number of sanitized lines s or less is deleted. The output unit 106 may not output the result when the number of lines greater than or equal to the maximum sanitized line number s is deleted.

  In the input unit 102 of the data editing apparatus 100, the relation model R shown in FIG. 2, the generalized tree T shown in FIGS. 5 to 7, and the diversity definition D shown in FIG. The function of the generalization unit 104 of the data editing apparatus 100 when the maximum sanitized line number s = 2 is accepted as an input will be described.

  The input unit 102 of the data editing apparatus 100 has a function of preparing a set C having {column name: maximum hierarchy} of each column name of the relational model R as an element. The column name of the relation model R is {birth year, zip code, hobby}, and the maximum hierarchy of each is {general year: 3, zip code: 2, hobby: 2} from generalized tree T, so C = {{birth year: 3}, {zip code: 2}, {hobby: 2}}.

  The generalization unit 104 of the data editing apparatus 100 has a function of preparing a set O having the maximum hierarchy satisfying the diversity definition D as an element for each element P of the set C. For example, when the element P = {birth year: 3}, the maximum hierarchy that satisfies the diversity is {birth year: 3} and no sanitization is required. In addition, when the element P = {zip code: 2}, the maximum hierarchy that satisfies the diversity is {zip code: 2}, and no sanitization is required. Further, when the element P = {hobby: 2}, the maximum hierarchy that satisfies the diversity is {hobby: 2}, and no sanitization is required. Therefore, the set O = {({birth year: 3}, {}), ({zip code: 2}, {}), ({hobby: 2}, {})}.

  Here, the terms “satisfy diversity” and “achieve diversity” may be used synonymously with “satisfies diversity definition D”.

  The generalization unit 104 of the data editing apparatus 100 merges hierarchies of duplicate column names as two minimum values for combinations of {column name: hierarchy} of all two pieces of generalized information GεO having different column name sets. {Column name: Hierarchy} is obtained, set as set C, and elements having a non-maximal hierarchy are deleted from set C.

  The generalization unit 104 of the data editing apparatus 100 has a function of emptying the set O and adding all maximum hierarchies satisfying the diversity definition D to the set O for each element P of the set C.

  Further, the generalization unit 104 of the data editing apparatus 100 has a function of deleting one or less column names having a positive hierarchy from among the elements of the set O. Although generalized information with one or less column names having a positive hierarchy cannot be calculated, the overall processing amount can be reduced. Even if this function is excluded, generalized information can be calculated, but at that time, generalization by generalized information with one or less column names having a positive hierarchy can be substituted by statisticalization.

  Further, the generalization unit 104 of the data editing apparatus 100 has a function of repeating the above process only (number of columns of the relational model R−1) times.

In the example of FIG. 2, there are the following three combinations of {column name: hierarchy} of two G∈Os having different column name sets.
(1) {Birth year: 3}, {Postal code: 2}
(2) {Birth year: 3}, {Hobby: 2}
(3) {Zip code: 2}, {Hobby: 2}
Since there is no duplicate column name, they are merged as they are, and the set C = {{birth year: 3, zip code: 2}, {birth year: 3, hobby: 2}, {zip code: 2, hobby: 2}}. . All elements of set C are maximal.

  For example, if each element P of the set C = {birth year: 3, zip code: 2}, the maximum hierarchy satisfying the diversity is {birth year: 3, zip code: 0} and no sanitization is required, {birth year: 2, with a postal code: 2} and inked {8}. Similarly, in the case of P = {birth year: 3, hobby: 2}, ({birth year: 2, hobby: 1}, {8}) and ({birth year: 1, hobby: 2}, {8}) , P = {zip code: 2, hobby: 2} are ({zip code: 2, hobby: 1}, {8}) and ({zip code: 0, hobby: 2}, {}) . Therefore, O = {({birth year: 3, zip code: 0}, {}), ({birth year: 2, zip code: 2}, {8}), ({birth year: 2, hobby: 1}, { 8}), ({birth year: 1, hobby: 2}, {8}), ({zip code: 2, hobby: 1}, {8}), ({zip code: 0, hobby: 2}, { })}.

  In the example of FIG. 2, among the elements of the set O, ({birth year: 3, postal code: 0}, {}) and ({postal code: 0, hobby: 2}, {})} are both hierarchical. Since there is only one column name that is a positive value, these are deleted, and O = {({birth year: 2, postal code: 2}, {8}), ({birth year: 2, hobby: 1}, { 8}), ({birth year: 1, hobby: 2}, {8}), ({zip code: 2, hobby: 1}, {8})}.

In the second iteration, there are the following five combinations of {column name: hierarchy} of two GεOs with different column name sets.
(1 ') {Birth year: 2, Zip code: 2}, {Birth year: 2, Hobby: 1}
(2 ') {Birth year: 2, Zip code: 2}, {Birth year: 1, Hobby: 2}
(3 ') {Birth year: 2, Zip code: 2}, {Birth year: 2, Hobby: 1}
(4 ') {Birth year: 2, Hobby: 1}, {Zip code: 2, Hobby: 1}
(5 ') {Birth year: 1, Hobby: 2}, {Zip code: 2, Hobby: 1}
Here, the generalization unit 104 of the data editing apparatus 100 has a function of merging the hierarchy of duplicate column names as the minimum value of each other. When this function is used, the above (1 ′) to (5 ′) are as follows.
(1) {Birth year: 2, Zip code: 2, Hobby: 1}
(2) {Birth year: 1, Zip code: 2, Hobby: 2}
(3) {Birth year: 2, Zip code: 2, Hobby: 1}
(4) {Birth year: 2, Zip code: 2, Hobby: 1}
(5) {Birth year: 1, Zip code: 2, Hobby: 1}
Among these items, item (3) <item (1), item (4) <item (1), item 5 <item (2), so items (1) and (2) are excluded except for these non-maximum items. And set C = {{year of birth: 2, postal code: 2, hobby: 1}, {birth year: 1, postal code: 2, hobby: 2}}.

  Next, the generalization unit 104 of the data editing apparatus 100 again empties the set O and adds all maximum hierarchies satisfying the diversity definition D to the set O for each element P of the set C. When each element P of the set C = {birth year: 2, zip code: 2, hobby: 1}, the maximum hierarchy satisfying the diversity is ({birth year: 2, zip code: 1, hobby: 1}, {8} ) And ({birth year: 1, zip code: 2, hobby: 1}, {8}), and P = {birth year: 1, zip code: 2, hobby: 2} Are ({birth year: 1, zip code: 2, hobby: 1}, {8}) and ({birth year: 1, zip code: 0, hobby: 2}, {8}). Therefore, O = {({Birth year: 2, Zip code: 1, Hobby: 1}, {8}, ({Birth year: 1, Zip code: 2, Hobby: 1}, {8}), ({Birth year: 1, postal code: 0, hobby: 2}, {8})} In this case, the generalization unit 104 of the data editing apparatus 100 has no element to be deleted in the set O, and does nothing.

  FIG. 10 is a diagram illustrating an example of a set of generalized information. However, in FIG. 10, information regarding the column whose hierarchy value is 0 is omitted.

  When FIG. 10 is obtained, one generalized information is appropriately selected therefrom, and the relational model R is generalized. The selection method is, for example, the one with the highest sum of hierarchies, if there are multiple hierarchies with a higher number of columns with a positive value, and if there are multiple hierarchies, the first one when sorting with a string representation , Etc. In general, an evaluation function having generalized information as an input and an evaluation value as an output is prepared in advance, and a function having a minimum or maximum value is selected.

  For generalization, for each column a of the relational model, the generalized tree t is acquired from T, the hierarchy is acquired from the generalized information, the value of each row is replaced with the value of that hierarchy of t, and the generalized information This is done by sanitizing all the lines corresponding to the set of line numbers to be sanitized. FIG. 9 is a result generalized with the first element of FIG.

  The output unit 106 of the data editing apparatus 100 may output only the generalized information or the changed relation model.

  The function of preparing the set O having the maximum hierarchy satisfying the diversity definition D as an element for each element P of the set C of the generalization unit 104 of the data editing apparatus 100 will be described in more detail.

  The generalization unit 104 of the data editing apparatus 100 generalizes the copy of the relationship model R by P in this column range because the column set of each element P of the set C is {birth year, postal code}.

  FIG. 11 is a diagram illustrating a result generalized by P ′ = {year of birth: 3, postal code: 2}. In order to achieve the diversity definition D, the row set to be sanitized is I = {0, 1,..., 8}. In other words, all lines need to be painted. The condition does not hold because the number of I elements | I | = 9 and the maximum number of sanitized lines s = 2. Here, the set C = {P} = {{year of birth: 3, postal code: 2}}.

  The generalization unit 104 of the data editing apparatus 100 deletes one element from the set C and sets it as P. For example, P ← {year of birth: 3, postal code: 2}, C ← {}.

  The generalization unit 104 of the data editing apparatus 100 first copies the element P of the set C to the element P ′ for each column name a of P and the column name a in which the hierarchy of a is greater than 0. Decrease P's a hierarchy by 1. For example, P ′ ← {year of birth: 2, postal code: 2}.

  First, the generalization unit 104 of the data editing apparatus 100 sets the column name a ← the year of birth, and the black line necessary for the relation model R to achieve diversity by the generalization by P ′ in the column range of the element P ′. Set I is calculated. For example, since the hierarchy of P's birth year is 3, the element P of the total C is copied to the element P 'and copied, and the hierarchy of a of the element P' is reduced by 1. Then, P ′ ← {year of birth: 2, postal code: 2}. Since the column set of element P 'is {birth year, zip code}, the copy of relational model R is generalized by P' in this column range.

  FIG. 12 is a diagram illustrating an example of a result generalized by P ′ = {year of birth: 2, postal code: 2}. In order to achieve diversity definition D, the set of rows to be sanitized is I = {8}. In the example shown in FIG. 12, the condition is satisfied because the number of elements | I | = 1 of the line set I to be sanitized and the maximum number of sanitized lines s = 2.

  Then, the generalization unit 104 of the data editing apparatus 100 adds (P ′, I) to the set O. As a result, O = {({year of birth: 2, postal code: 2}, {8})}.

  Next, the generalization unit 104 of the data editing apparatus 100 sets a ← zip code. Since the postal code hierarchy of P is 2, P is copied to P ′, and the hierarchy of a of P ′ is reduced by 1. Then, P '← {year of birth: 3, postal code: 1}.

  Next, the generalization unit 104 of the data editing apparatus 100 generalizes the copy of R by P ′ within this column range since the column set of P ′ is {birth year, postal code}.

  FIG. 13 is a diagram illustrating an example of a result generalized by P ′ = {year of birth: 3, zip code: 1}. In order to achieve the diversity definition D, the row set to be sanitized is I = {0, 1,..., 8}. In other words, all lines need to be painted. Since the number of elements of the line set I to be sanitized | I | = 9 and the maximum number of sanitized lines s = 2, the condition is not satisfied. Therefore, P ′ is added to C, and the set C = {P} = {{birth year: 3, postal code: 1}}. Since C is not empty, the generalization unit 104 of the data editing apparatus 100 deletes one element from the set C and sets it to P. The generalizing unit 104 of the data editing apparatus 100 has a function of repeating the description of the case where “a” is the birth year above until the set C becomes empty. As a result, when C becomes empty, O = {({birth year: 2, zip code: 2}, {8}), ({birth year: 2, zip code: 1}, {8}), ({ Year of birth: 3, postal code: 0}, {})}.

  The generalization unit 104 of the data editing apparatus 100 is not maximal (the other elements ({birth year: 2, zip code :)) among the three elements of the set O ({birth year: 2, zip code: 1}, {8}). 2}, {8}) is smaller than P ′), and is deleted. As a result, the set O = {({birth year: 2, zip code: 2}, {8}), ({birth year: 3, zip code: 0}, {})}.

  In the above example, the generalization unit 104 of the data editing apparatus 100 performs the calculation even for the result that does not become the maximum, but may not perform the calculation for the result that does not become the maximum as much as possible. For this purpose, for example, {column name: hierarchy} that does not require calculation may be stored. For example, when the generalization unit 104 of the data editing apparatus 100 adds an element to the set O, all {column names: hierarchies} below P ′ are added to the calculation unnecessary set, and P ′ is included in the calculation unnecessary set. It may have a function to check whether or not

  The function of creating the set I for P of the generalization unit 104 of the data editing apparatus 100 will be described in more detail.

  The generalization unit 104 of the data editing apparatus 100 has a function of performing the following processing on the element p of P.

  The generalization unit 104 of the data editing apparatus 100 extracts the diversity definition d for the element p of P from the diversity definition D. For example, the diversity definition d is a diversity definition of {birth year: 3}, and as shown in FIG. 8, a map that returns 1 if there are two or more values of the tenth place, and returns 0 otherwise. It may be.

  The generalization unit 104 of the data editing apparatus 100 calculates a set U of J by setting a set of row numbers having the same value other than the column name of p as a group J from rows other than I of the relation model R ′. In FIG. 11, the rows other than I in R ′ are all the rows in FIG. 11, and the columns other than the column name of p are {zip code}, so a group having the same value of “zip code” in FIG. , U = {{0, 2, 6, 7}, {1, 3, 4, 5}, {8}}. For example, J = {8} is a group of (zip code) = (13?). If the column other than the column name of p is {}, all the rows other than I in R ′ are set as one group, and U = {J}.

  The generalization unit 104 of the data editing apparatus 100 calculates a frequency distribution of p columns and J values from R ′. Since the row of p is the year of birth and J = {0, 2, 6, 7}, F = {“1970”: 1, “1972”: 1, “1989”: 2} from FIG.

  The generalization unit 104 of the data editing apparatus 100 has a function of determining whether d (F) = 1. In the above example, since F has two kinds of values of the 10th place, 7 and 8, d (F) = 1.

  The generalization unit 104 of the data editing apparatus 100 has a function of repeatedly applying the above function to all J elements.

  Assume that the last repetition J ← {8}. Since the column of p is “the year of birth” and J = {8}, F = {“2000”: 1} from FIG. Since there is only one type of F in which the value of the 10's place is 0, d (F) = 0, and all elements of J are added to I. In the above example, I = {8} and c = 1.

  Next, the generalization unit 104 of the data editing apparatus 100 has a function of setting p ← zip code: 2 and extracting the diversity definition d for p from D. The rows other than I in R ′ are the rows {0, 1,..., 7} of FIG. 11 and the columns other than the column name of p are {the year of birth}, so the rows {0, 1,. .., 7} “Birth Year” values are made into a group, and U = {{0, 1}, {2}, {3}, {4}, {5}, {6, 7}}. J ← {0, 1} and F = {“12?”: 1, “14?”: 1}. Since there are two types of F, 2 and 4, in F, d (F) = 1.

  At the end of repetition for all U elements, I = {2, 3, 4, 5, 6, 7, 8}.

  The generalization unit 104 of the data editing apparatus 100 has a function of repeatedly applying the above function to all p elements.

  The generalization unit 104 of the data editing apparatus 100 has a function of determining whether c = 0, and passing c to the output unit 106 when c = 0.

  The generalization unit 104 of the data editing apparatus 100 has a function of checking again whether the diversity definition D has been achieved when I is changed by using the above c.

  With the above function, the data editing apparatus 100 can obtain a set of generalized information for generalizing the relational model R with the generalized tree T so as to satisfy the diversity definition by sanitizing the relationship model R in the s rows or less.

  Therefore, the data editing apparatus 100 can be easily used by information that the data provider of each sample, that is, each line of the individual vote data does not want to be known (for example, SA in the case of using generalization by l-diversification) and others. It is not necessary to set information that can be known (for example, QI in the case of using generalization by l-diversification), and generalization that can analyze the relationship between attributes in consideration of privacy can be performed.

FIG. 14 is a diagram illustrating an example of the configuration of the data editing apparatus 100 according to the embodiment.
The computer 200 includes a central processing unit (CPU) 202, a read only memory (ROM) 204, and a random access memory (RAM) 206. The computer 500 further includes a hard disk device 208, an input device 210, a display device 212, an interface device 214, and a recording medium driving device 216. These components are connected via a bus line 220, and various data can be exchanged under the control of the CPU 202.

  A central processing unit (CPU) 202 is an arithmetic processing unit that controls the operation of the entire computer 200, and functions as a control processing unit of the computer 200.

  A Read Only Memory (ROM) 204 is a read-only semiconductor memory in which a predetermined basic control program is recorded in advance. The CPU 202 can control the operation of each component of the computer 200 by reading and executing the basic control program when the computer 100 is started.

  A random access memory (RAM) 206 is a semiconductor memory that can be written and read at any time and used as a working storage area as necessary when the CPU 202 executes various control programs.

  The hard disk device 208 is a storage device that stores various control programs executed by the CPU 202 and various data. The CPU 202 can perform various control processes described later by reading and executing a predetermined control program stored in the hard disk device 208.

  The input device 210 is, for example, a mouse device or a keyboard device. When operated by a user of the information processing device, the input device 210 acquires input of various information associated with the operation content and sends the acquired input information to the CPU 202. To do.

  The display device 212 is a liquid crystal display, for example, and displays various texts and images according to display data sent from the CPU 202.

  The interface device 214 manages the exchange of various information with various devices connected to the computer 200.

  The recording medium driving device 216 is a device that reads various control programs and data recorded on the portable recording medium 218. The CPU 202 can read out and execute a predetermined control program recorded on the portable recording medium 218 via the recording medium driving device 216 to perform various control processes described later. As the portable recording medium 218, for example, a flash memory equipped with a USB (Universal Serial Bus) standard connector, a CD-ROM (Compact Disc Read Only Memory), a DVD-ROM (Digital Versatile Disc Only Only). and so on.

  In order to configure the data editing apparatus 100 using such a computer 200, for example, a control program for causing the CPU 202 to perform the processing in each processing unit described above is created. The created control program is stored in advance in the hard disk device 208 or the portable recording medium 218. Then, a predetermined instruction is given to the CPU 202 to read and execute the control program. By doing so, the CPU 202 provides the functions of the information processing apparatus.

<Data editing process>
The data editing process will be described with reference to FIGS.

  When the data editing apparatus 100 is a general-purpose computer 200 as shown in FIG. 14, the following description defines a control program for performing such processing. That is, hereinafter, it is also a description of a control program that causes a general-purpose computer to perform the processing described below.

  That is, in the following, using a relational model R including a plurality of attribute values for each of a plurality of samples, and generalized information T in which generalized values corresponding to the hierarchies and the respective hierarchies are defined for each attribute. A combination of generalized values of a plurality of samples corresponding to one of the hierarchies, and a generalization corresponding to other attributes of the plurality of attributes with respect to a generalized value corresponding to one attribute of the plurality of attributes There is provided a data editing program characterized by causing the computer 200 to execute a process of extracting a combination of generalized values having various values.

  Further, in the combination of generalized values of a plurality of samples corresponding to one of the hierarchies, the generalized value for all of the plurality of attributes is different from that of the plurality of attributes for one value of the plurality of attributes. In order to satisfy the diversity definition D defined by the hierarchy corresponding to the attribute and the other attribute, among the values of the attributes included in the relationship model, the values of the attributes related to a predetermined number of samples You may make the computer 200 perform the process to delete.

A mapping d obtained by mapping D: (a, l) → d from a set of a and a hierarchy of one of a plurality of attributes to a diversity definition is logical with F as the frequency distribution for one of the plurality of attributes. Mapping to values d: F → 1/0, F1 + F2 is the sum of the frequency distributions F1 and F2, and ∧ as a logical product operation,
(D1) Monotonicity: (d (F1) = 1) ∧ (d (F2) = 1) => d (F1 + F2) = 1
(D2) hierarchical monotonicity: d (F) = 1⇒d ′ (F ′) = 1,
Meet.

  A combination of generalized values of multiple samples corresponding to one of the hierarchies, and corresponding to all other attributes of the multiple attributes with respect to the generalized value corresponding to one of the multiple attributes You may extract the combination of the generalized value in which the normalized value has diversity.

  Further, when the generalized information T is represented by a generalized tree, the generalization may be performed so as to include at most one attribute including a hierarchy corresponding to the root of the generalized tree.

FIG. 15 is a diagram illustrating an example of the flow of processing.
When the processing is started, in S100, the input unit 102 of the data editing apparatus 100 causes the relation model R, the generalized tree T of each column of the relational model, the diversity definition D of each hierarchy of each generalized tree, and the maximum ink. The number of fill lines s is accepted as input.

  In the next S102, the generalization unit 104 of the data editing apparatus 100 prepares a column name of each column name of the relation model R; a set C having the maximum hierarchy as an element. The column name of the relation model R is {birth year, zip code, hobby}, and the maximum hierarchy of each is {general year: 3, zip code: 2, hobby: 2} from generalized tree T, so C = {{birth year: 3}, {zip code: 2}, {hobby: 2}}. When the process in this step ends, the process proceeds to S104.

  In S104, the generalization unit 104 of the data editing apparatus 100 prepares a set O having elements of the maximum hierarchy that achieves diversity (satisfies diversity definition D) for each element P of the set C. For example, when the element P = {birth year: 3}, the maximum hierarchy that satisfies the diversity is {birth year: 3} and no sanitization is required. In addition, when the element P = {zip code: 2}, the maximum hierarchy that satisfies the diversity is {zip code: 2}, and no sanitization is required. Further, when the element P = {hobby: 2}, the maximum hierarchy that satisfies the diversity is {hobby: 2}, and no sanitization is required. Therefore, the set O = {({birth year: 3}, {}), ({zip code: 2}, {}), ({hobby: 2}, {})}.

The process of S104 will be described with reference to FIG.
When the processing is started, the generalization unit 104 of the data editing apparatus 100 in S200, the relation model R, the generalization tree T of each column of the relational model, the diversity definition D of each hierarchy of each generalization tree, the maximum ink The number of fill lines s and the set P of {column name: hierarchy} are accepted as input.

  In step S202, the generalization unit 104 of the data editing apparatus 100 prepares an empty set O. When the process of this step ends, the process proceeds to S204.

  In S204, the generalization unit 104 of the data editing apparatus 100 performs the sanitization line set I necessary for the relational model R to achieve diversity (satisfaction with the diversity definition D) by P generalization in the column range of P. Is calculated. For example, since the column set of each element P of the set C is {birth year, zip code}, the copy of the relational model R is generalized by P in this column range. FIG. 11 is a diagram illustrating a result generalized by P ′ = {year of birth: 3, postal code: 2}. In order to achieve the diversity definition D, the row set to be sanitized is I = {0, 1,..., 8}. In other words, all lines need to be painted.

The process of S204 will be described with reference to FIG.
When the process is started, the generalization unit 104 of the data editing apparatus 100 in S300, the relation model R, the generalization tree T of each column of the relation model, the diversity definition D of each hierarchy of each generalization tree, the maximum ink The number of fill lines s and the set P of {column name: hierarchy} are accepted as input.

  In the next step S302, the generalization unit 104 of the data editing apparatus 100 copies the relation model R to the relation model R ′, and generalizes the relation model R ′ according to the generalized tree T by the element P of the set C. When the process of this step ends, the process proceeds to S304.

  In S304, the generalization unit 104 of the data editing apparatus 100 prepares an empty set I. When the process in this step ends, the process proceeds to S306.

  In S306, the generalization unit 104 of the data editing apparatus 100 prepares a logical value c, and substitutes an initial value 0 for the logical value c. That is, c = 0. When the process of this step ends, the process proceeds to S308.

  In S308, the generalization unit 104 of the data editing apparatus 100 resets the variable l that specifies the element p of the element P of the set C. For example, l = 0 may be set. When the process in this step ends, the process proceeds to S310.

  In S310, the generalization unit 104 of the data editing apparatus 100 updates l and obtains the element p from the element P of the set C using l. For example, the value of l may be increased by 1, and the corresponding element p may be obtained. First, p ← {year of birth: 3}. When the process of this step ends, the process proceeds to S312.

  In S312, the generalization unit 104 of the data editing apparatus 100 extracts the diversity definition d corresponding to the element pεP from the diversity definition D. For example, the diversity definition of {birth year: 3} is a map that “returns 1 when there are two or more 10-digit values, otherwise returns 0”. When the process of this step ends, the process proceeds to S314.

  In S314, the generalization unit 104 of the data editing apparatus 100 sets a group of row numbers having the same value other than the column name of the element p from a row other than the sanitized row set I of the relation model R ′ as a group J, and sets J U is calculated. In FIG. 11, the rows other than I in R ′ are all the rows in FIG. 11, and the columns other than the column name of p are {zip code}, so a group having the same value of “zip code” in FIG. , U = {{0, 2, 6, 7}, {1, 3, 4, 5}, {8}}. For example, J = {8} is a group of (zip code) = (13?). If the column other than the column name of p is {}, all the rows other than I in R ′ are set as one group, and U = {J}. When the process of this step ends, the process proceeds to S316.

  In S316, the generalization unit 104 of the data editing apparatus 100 resets the variable m that identifies the elements of the set U. For example, m = 0 may be set. When the process of this step ends, the process proceeds to S318. Hereinafter, S322 to S328 are repeated for each element of U.

  In step S318, the generalization unit 104 of the data editing apparatus 100 updates m. For example, the value of m may be increased by 1. When the process of this step ends, the process proceeds to S320.

  In S320, the generalization unit 104 of the data editing apparatus 100 acquires the element J of the set U corresponding to the current m. For example, J ← {0, 2, 6, 7}. When the process of this step ends, the process proceeds to S322.

  In S322, the generalization unit 104 of the data editing apparatus 100 calculates the frequency distribution F of the column of elements p and the value of J from the relationship model R ′. For example, since the row of p is the year of birth and J = {0, 2, 6, 7}, F = {“1970”: 1, “1972”: 1, “1989”: 2} from FIG. When the process of this step ends, the process proceeds to S324.

  In S324, the generalization unit 104 of the data editing apparatus 100 determines whether d (F) = 0. If the result of this determination is “YES”, that is, d (F) = 0, the process proceeds to S326. If the result of this determination is “NO”, that is, d (F) ≠ 0, the process proceeds to S328. For example, in the case of F = {“1970”: 1, “1972”: 1, “1989”: 2}, there are two kinds of values of the tenth place of 7 and 8 in F, so d (F) = 1. Become. In this case, the process proceeds to S326.

  In S326, the generalization unit 104 of the data editing apparatus 100 adds all elements of the element J of the set U corresponding to m to the sanitized line set I, and substitutes 1 for the logical value c (c ← 1). When the process of this step ends, the process proceeds to S328.

  In S328, the generalization unit 104 of the data editing apparatus 100 determines whether all elements of the set U have been processed. If the result of this determination is “YES”, that is, if all elements of the set U have been processed, the process proceeds to S330. If the result of this determination is “NO”, that is, if all elements of the set U have not been processed, the process returns to S318.

  Assume that J ← {8} in the last iteration. In S322, since the column of p is “birth year” and J = {8}, F = {“2000”: 1} from FIG. Then, since there is only one type of F in S324 having a value of 10's place, d (F) = 0, and in S326, all elements of J are added to I. For example, I = {8}, c = 1.

  In S330, the generalization unit 104 of the data editing apparatus 100 determines whether all the elements of the elements P in the set C have been processed. If the result of this determination is “YES”, that is, if all elements of the set U have been processed, the process proceeds to S332. If the result of this determination is “NO”, that is, if all elements of the set U have not been processed, the process returns to S310.

In the second S310, p ← zip code: 2 may be set.
In the second S312, the diversity definition of {zip code: 2} is a map "returns 1 when there are two or more values of the number of 10 and 0 otherwise" from FIG.

  In S314 of the second time, the rows other than I of R ′ are the rows {0, 1,..., 7} of FIG. 11 and the columns other than the column name of p are {the year of birth}. 0, 1,..., 7} having the same “birth year” value, and U = {{0, 1}, {2}, {3}, {4}, {5}, {6, 7}}.

  In the second S320, J ← {0, 1}, and in the next S322, F = {“12?”: 1, “14?”: 1}.

  In S324 of the 2nd time, since F has two kinds of values of the tenth place, 2 and 4, d (F) = 1.

  The processes of S318 to S328 are repeated, and when all U elements are repeated, I = {2, 3, 4, 5, 6, 7, 8}.

  In S332, the generalization unit 104 of the data editing apparatus 100 determines whether the logical value c is 0. If the result of this determination is “YES”, ie, c = 0, the process proceeds to S334. If the result of this determination is “NO”, ie, c ≠ 0, the process returns to S306.

  If the same processing is performed, I = {0, 1, 2, 3, 4, 5, 6, 7, 8} and c = 1 when the processing moves to S322 next time, so that the processing returns to S306 again. . Next, when the process moves to S322, I = {0, 1, 2, 3, 4, 5, 6, 7, 8} and c = 0.

  In step S334, the output unit 106 of the data editing apparatus 100 outputs the sanitized line set I. When the process in this step is completed, the process proceeds to S206 in FIG.

  By S330 of FIG. 17, when the sanitization line set I is changed, a process of checking again whether diversity has been achieved (diversity definition D is satisfied) is realized. As in the above example, when control is first transferred to S330, the row {0, 1} is treated as having achieved diversity, but as the sanitized row set I increases, the row { 0, 1} has also been calculated that diversity has not been achieved. This is a characteristic process required to request that a diversity definition be simultaneously achieved in multiple columns.

  In S206, the generalization unit 104 of the data editing apparatus 100 determines whether the number of elements | I | of the sanitized line set I is equal to or less than the maximum number of sanitized lines s, that is, whether | I | ≦ s. . If the result of this determination is “YES”, that is, if the number of elements | I | of the sanitized line set I is equal to or less than the maximum sanitized line number s (| I | ≦ s), the process proceeds to S208. If the result of this determination is “NO”, that is, if the number of elements | I | in the sanitized line set I is greater than the maximum sanitized line number s (| I |> s), the process proceeds to S210. For example, the condition is not satisfied when the number of elements I | I | = 9 and the maximum number of sanitized lines s = 2. Therefore, the process proceeds to S210. If the condition is satisfied, the process proceeds to S208.

  In S208, the generalization unit 104 of the data editing apparatus 100 adds the set of the element P of the set C and the sanitized line set I as an element to the set O. For example, O = {(P, I)}. When the process of this step ends, the process proceeds to S242.

  In S210, the generalization unit 104 of the data editing apparatus 100 prepares an empty set C and adds an element P of the set C to an element of the set C. For example, the set C = {P} = {{year of birth: 3, zip code: 2}}. When the process of this step ends, the process proceeds to S212.

  In S212, the generalization unit 104 of the data editing apparatus 100 starts to repeat S212 to S232 until the element C becomes empty. When the process of this step ends, the process proceeds to S214.

  In S214, the generalization unit 104 of the data editing apparatus 100 deletes one element from the set C and sets it to P. For example, P ← {year of birth: 3, postal code: 2}, C ← {}. When the process of this step ends, the process proceeds to S216.

  In S216, the generalization unit 104 of the data editing apparatus 100 starts repeating S216 to S230 for each of the P column names a. When the process of this step ends, the process proceeds to S218.

  In S218, the generalization unit 104 of the data editing apparatus 100 acquires one column name a of the element P of the set C. For example, a ← birth year. When the process of this step ends, the process proceeds to S224.

  In S218, the generalization unit 104 of the data editing apparatus 100 determines whether the hierarchy of the column name a of the element P of the set C is greater than zero. If the result of this determination is “YES”, that is, if the hierarchy of the column name a of the element P of the set C is greater than 0, the process proceeds to S220. If the result of this determination is “NO”, that is, if the hierarchy of the column name a of the element P of the set C is not greater than 0, the process proceeds to S230. For example, since the hierarchy of P's birth year is 3, the process proceeds to S220.

  In S220, the generalizing unit 104 of the data editing apparatus 100 copies the element P to the element P ', and reduces the hierarchy of a of the element P' by 1. For example, P ′ ← {year of birth: 2, postal code: 2}. When the process of this step ends, the process proceeds to S222.

  In S222, the generalization unit 104 of the data editing apparatus 100 performs the sanitization necessary for the relation model R to achieve diversity (satisfaction with the diversity definition D) in the column range of P ′ by the generalization by P ′. Set I is calculated. For example, since the column set of element P ′ is {birth year, postal code}, the copy of relational model R is generalized by P ′ in this column range. FIG. 12 is a diagram illustrating an example of a result generalized by P ′ = {year of birth: 2, postal code: 2}. In order to achieve diversity definition D, the set of rows to be sanitized is I = {8}. In the example shown in FIG. 12, the condition is satisfied because the number of elements | I | = 1 of the line set I to be sanitized and the maximum number of sanitized lines s = 2.

  The process of S222 is the same as the process of S204, and is shown in FIG. When the process of this step ends, the process proceeds to S224.

  In S224, the generalization unit 104 of the data editing apparatus 100 determines whether the number of elements | I | of the sanitized line set I is equal to or less than the maximum number of sanitized lines s, that is, whether | I | ≦ s. . If the result of this determination is “YES”, that is, if the number of elements | I | of the sanitized line set I is equal to or less than the maximum number of sanitized lines s (| I | ≦ s), the process proceeds to S226. If the result of this determination is “NO”, that is, if the number of elements | I | in the sanitized line set I is greater than the maximum sanitized line number s (| I |> s), the process proceeds to S234. When | I | = 1 and s = 2, the condition is satisfied, and the process proceeds to S228.

  In S226, the generalizing unit 104 of the data editing apparatus 100 adds the set of the element P ′ of the set C and the sanitizing line set I as an element to the set O. For example, (P ′, I) is added to the set O. As a result, O = {({year of birth: 2, postal code: 2}, {8})}. When the process of this step ends, the process proceeds to S230.

  In S228, the generalization unit 104 of the data editing apparatus 100 adds the element P ′ to the set C. When the process of this step ends, the process proceeds to S230.

  In S230, the generalization unit 104 of the data editing apparatus 100 determines whether or not the processing of S216 to S228 has been performed for all the columns of the element P. If the result of this determination is “YES”, that is, if the processes of S216 to S228 have been performed for all the columns of the element P, the process proceeds to S232. If the result of this determination is “NO”, that is, if the processing of S216 to S228 has not been performed for all the columns of the element P, the processing returns to S216. For example, a ← zip code is set, and the process returns to S224.

In the second S218, since the postal code hierarchy of P is 2, the process proceeds to S220.
In the second S220, P is copied to P ′, and the level of P ′ a is reduced by 1. Then, P ′ ← {year of birth: 3, postal code: 1}.

  In the second S222, since the column set of P 'is {birth year, postal code}, the copy of R is generalized by P' in this column range. FIG. 13 is a diagram illustrating an example of a result generalized by P ′ = {year of birth: 3, zip code: 1}. In order to achieve the diversity definition D, the row set to be sanitized is I = {0, 1,..., 8}. In other words, all lines need to be painted.

  In the second S224, the condition is not satisfied because the number of elements | I | = 9 of the line set I to be sanitized and the maximum number of sanitized lines s = 2. Therefore, the process proceeds to S228.

  In S228, the generalization unit 104 of the data editing apparatus 100 adds P ′ to C, and the set C = {P} = {{year of birth: 3, zip code: 1}}.

  In S232, the generalization unit 104 of the data editing apparatus 100 determines whether or not the processing of S212 to S230 has been performed for all elements P of the set C. If the result of this determination is “YES”, that is, if the processes of S212 to S230 have been performed for all elements P of the set C, the process proceeds to S234. If the result of this determination is “NO”, that is, if the processes of S212 to S230 have not been performed for all the elements P of the set C, the process returns to S212.

  For example, when C is not empty, the generalization unit 104 of the data editing apparatus 100 deletes one element from the set C and sets it as P. That is, the generalization unit 104 of the data editing apparatus 100 repeats the processes of S214 to S232 until the set C becomes empty. As a result, when C becomes empty, O = {({birth year: 2, zip code: 2}, {8}), ({birth year: 2, zip code: 1}, {8}), ({ Year of birth: 3, postal code: 0}, {})}.

  In S234, the generalization unit 104 of the data editing apparatus 100 deletes the element having the non-maximum element P ′ from the set O. Therefore, among the three elements of set O, ({birth year: 2, zip code: 1}, {8}) is not maximal (other elements ({birth year: 2, zip code: 2}, {8}) This is deleted because the part P ′ is smaller). As a result, the set O = {({birth year: 2, zip code: 2}, {8}), ({birth year: 3, zip code: 0}, {})}. When the process of this step ends, the process proceeds to S236.

  In S236, the output unit 106 of the data editing apparatus 100 outputs the set O. When the process in this step is completed, the process proceeds to S106 in FIG.

  In FIG. 16, when | I |> s, the sanitized line set I is not used. Therefore, when | I |> s after S326 in FIG. 17 or the like, the output unit 106 of the data editing apparatus 100 May immediately output the sanitized line set I and end the processing shown in FIG. By doing so, there is an effect of reducing the processing amount.

  In S106, the generalization unit 104 of the data editing apparatus 100 sets a variable i for designating a relation model column to 0.

  In the next S108, the generalization unit 104 of the data editing apparatus 100 increases the value of i by 1. When the process in this step is finished, the process proceeds to S110.

  In S110, the generalization unit 104 of the data editing apparatus 100 merges the hierarchies of duplicate column names as two minimum values for all the combinations of {column names: hierarchies} of two GεOs having different column name sets { Column name: Hierarchy} is obtained, and these are set as set C, and elements whose hierarchies are not maximum are deleted from set C. In the example of FIG. 2, the combinations of {column name: hierarchy} of two GεOs having different column name sets are (1) {birth year: 3}, {zip code: 2}, (2) {birth year: 3 }, {Hobby: 2}, (3) {zip code: 2}, {hobby: 2}. Since there is no duplicate column name, they are merged as they are, and the set C = {{birth year: 3, zip code: 2}, {birth year: 3, hobby: 2}, {zip code: 2, hobby: 2}}. . All elements of set C are maximal. If there is a duplicate column name or there is a non-maximum element, it will be processed at the second iteration. When the process of this step ends, the process proceeds to S112.

  In S112, the generalization unit 104 of the data editing apparatus 100 empties the set O, and adds, for each element PεC, all maximal hierarchies that satisfy diversity (satisfy diversity definition D) to the set O. The processing in this step is the same as the processing shown in FIG. Therefore, repeated description is omitted. For example, if each element P of the set C = {birth year: 3, zip code: 2}, the maximum hierarchy satisfying the diversity is {birth year: 3, zip code: 0} and no sanitization is required, {birth year: 2, with a postal code: 2} and inked {8}. Similarly, in the case of P = {birth year: 3, hobby: 2}, ({birth year: 2, hobby: 1}, {8}) and ({birth year: 1, hobby: 2}, {8}) , P = {zip code: 2, hobby: 2} are ({zip code: 2, hobby: 1}, {8}) and ({zip code: 0, hobby: 2}, {}) . Therefore, O = {({birth year: 3, zip code: 0}, {}), ({birth year: 2, zip code: 2}, {8}), ({birth year: 2, hobby: 1}, { 8}), ({birth year: 1, hobby: 2}, {8}), ({zip code: 2, hobby: 1}, {8}), ({zip code: 0, hobby: 2}, { })}. In the example of FIG. 2, among the elements of the set O, ({birth year: 3, postal code: 0}, {}) and ({postal code: 0, hobby: 2}, {})} are both hierarchical. Since there is only one column name that is a positive value, these are deleted, and O = {({birth year: 2, postal code: 2}, {8}), ({birth year: 2, hobby: 1}, { 8}), ({birth year: 1, hobby: 2}, {8}), ({zip code: 2, hobby: 1}, {8})}. When the process of this step ends, the process proceeds to S114.

  In S114, the generalization unit 104 of the data editing apparatus 100 deletes the elements of the set O that have one or less column names having a positive hierarchy. When the process of this step ends, the process proceeds to S116.

  In S116, the generalization unit 104 of the data editing apparatus 100 determines whether the value of i is equal to or greater than (the number of columns of the relational model R−1). If the result of this determination is “YES”, that is, if the value of i is equal to or greater than (number of columns of relational model R−1), the process proceeds to S118. If the result of this determination is “NO”, that is, if the value of i is not equal to or greater than (number of columns of relational model R−1), the process returns to S108.

  In the second processing of S110, combinations of {column name: hierarchy} of two GεOs with different column name sets are (1 ′) {birth year: 2, postal code: 2}, {birth year: 2, hobby. : 1}, (2 ') {Birth year: 2, Zip code: 2}, {Birth year: 1, Hobby: 2}, (3') {Birth year: 2, Zip code: 2}, {Birth year: 2, Hobby] : 1}, (4 ') {Birth year: 2, Hobby: 1}, {Zip code: 2, Hobby: 1}, (5') {Birth year: 1, Hobby: 2}, {Zip code: 2, Hobby : 1}.

  Here, the generalization unit 104 of the data editing apparatus 100 merges the hierarchy of duplicate column names as the minimum value of each other. Then, the above (1 ′) to (5 ′) are respectively (1) {birth year: 2, postal code: 2, hobby: 1}, (2) {birth year: 1, postal code: 2, hobby: 2} , (3) {birth year: 2, postal code: 2, hobby: 1}, (4) {birth year: 2, postal code: 2, hobby: 1}, (5) {birth year: 1, postal code: 2, Hobby: 1}. Among these items, item (3) <item (1), item (4) <item (1), item 5 <item (2), so items (1) and (2) are excluded except for these non-maximum items. And set C = {{year of birth: 2, postal code: 2, hobby: 1}, {birth year: 1, postal code: 2, hobby: 2}}.

  In the second processing of S112, if each element P of the set C = {birth year: 2, zip code: 2, hobby: 1}, the maximum hierarchy that satisfies the diversity is ({birth year: 2, zip code: 1, Hobbies: 1}, {8}) and ({birth year: 1, zip code: 2, hobbies: 1}, {8}), P = {birth year: 1, zip code: 2, hobbies: 2} The maximum hierarchies that satisfy diversity are ({birth year: 1, zip code: 2, hobby: 1}, {8}) and ({birth year: 1, zip code: 0, hobby: 2}, {8}) It is. Therefore, O = {({Birth year: 2, Zip code: 1, Hobby: 1}, {8}, ({Birth year: 1, Zip code: 2, Hobby: 1}, {8}), ({Birth year: 1, postal code: 0, hobby: 2}, {8})}.

  In the second S114, the generalization unit 104 of the data editing apparatus 100 has no elements to be deleted in the set O and does nothing.

  In S118, the output unit 106 of the data editing apparatus 100 outputs the set O. The set O output from the output unit 106 of the data editing apparatus 100 in S118 may be referred to as a generalized relational model. An example output is shown in FIG.

  The process of S110 of FIG. 15 calculates the maximum {column name: hierarchy} that may be included in the set O in S112 as C for a column set that is one column larger than the number of columns of the C elements so far. Is the purpose. Although it is simply calculated in S110, {column name: hierarchy} that may not be included in the set O may be calculated in more detail in S112.

  The process in S114 of FIG. 15 has the effect of reducing the overall processing amount, although it becomes impossible to calculate generalized information with one or less column names having a positive hierarchy. Even if this process is skipped, generalized information can be calculated, but generalization by generalized information with one or less column names having a positive hierarchy can be substituted by statistics.

  With the above processing example, the relation model R is sanitized with the maximum number of sanitized lines s or less, and a set of generalized information for generalizing with the generalized tree T so as to satisfy the diversity definition D is obtained. Moreover, the result of generalizing the relation model R with any generalized information can be obtained. Thus, the individual vote data can be converted into a relational model with a high degree of privacy protection for secondary use.

Regarding the above embodiment, the following additional notes are disclosed.
(Appendix 1)
One of the hierarchies using a relational model including values of a plurality of attributes for each of a plurality of samples and generalized information in which a hierarchy and a generalized value corresponding to each of the hierarchies are defined for each attribute. A combination of the generalized values of the plurality of samples corresponding to the generalized value corresponding to another attribute of the plurality of attributes with respect to the generalized value corresponding to one attribute of the plurality of attributes A data editing program for causing a computer to execute a process of extracting a combination of generalized values having a variety of normalized values.
(Appendix 2)
Furthermore, in the combination of the generalized values of the plurality of samples corresponding to one of the hierarchies, the generalized value for all of the plurality of attributes is set to one value of the plurality of attributes, In order to satisfy the diversity definition D defined by the other attributes of the plurality of attributes and the hierarchy corresponding to the other attributes, a predetermined number of samples among the values of the plurality of attributes included in the relation model The data editing program according to appendix 1, wherein the computer executes a process of deleting a plurality of attribute values.
(Appendix 3)
The mapping d obtained by mapping D: (a, l) → d from the set of one of the plurality of attributes a and the hierarchy to the diversity definition is a frequency for one of the plurality of attributes a Mapping of distribution to F as logical value d: F → 1/0, F1 + F2 is the sum of frequency distributions F1 and F2, and ∧ is a logical product operation.
(D1) Monotonicity: (d (F1) = 1) ∧ (d (F2) = 1) => d (F1 + F2) = 1
(D2) hierarchical monotonicity: d (F) = 1⇒d ′ (F ′) = 1,
The data editing program according to Appendix 2, satisfying
(Appendix 4)
A combination of the generalized values of the plurality of samples corresponding to one of the hierarchies, wherein all other of the plurality of attributes with respect to the generalized value corresponding to one attribute of the plurality of attributes The editing program according to any one of appendices 1 to 3, wherein the computer executes a process of extracting a combination of the generalized values in which the generalized values corresponding to the attributes of the variable have diversity.
(Appendix 5)
Further, when represented by the generalized information generalized tree, the computer causes the computer to execute a process of performing the generalization so as to include at most one of the attributes including the hierarchy corresponding to the root of the generalized tree. The data editing program according to any one of appendices 1 to 4.
(Appendix 6)
A data editing method executed by a computer, wherein a relational model including values of a plurality of attributes for each of a plurality of samples, and a hierarchy and a generalized value corresponding to each of the hierarchies are defined for each of the attributes The generalized information is a combination of the generalized values of the plurality of samples corresponding to one of the hierarchies, and the generalized value corresponding to one attribute of the plurality of attributes Extracting a combination of the generalized values in which the generalized values corresponding to other attributes of a plurality of attributes have diversity;
Data editing method including.
(Appendix 7)
Furthermore, in the combination of the generalized values of the plurality of samples corresponding to one of the hierarchies, the generalized value for all of the plurality of attributes is set to one value of the plurality of attributes, In order to satisfy the diversity definition D defined by the other attributes of the plurality of attributes and the hierarchy corresponding to the other attributes, a predetermined number of samples among the values of the plurality of attributes included in the relation model The data editing method according to appendix 6, including deleting a plurality of attribute values.
(Appendix 8)
In the diversity definition, a mapping d obtained by mapping D: (a, l) → d from a set of one of the plurality of attributes a and the hierarchy l to the diversity definition is the plurality of attributes. F is a frequency distribution for one of a and F is a mapping to a logical value d: F → 1/0, and F1 + F2 is the sum of the frequency distributions F1 and F2, and ∧ is a logical product operation.
(D1) Monotonicity: (d (F1) = 1) ∧ (d (F2) = 1) => d (F1 + F2) = 1
(D2) hierarchical monotonicity: d (F) = 1⇒d ′ (F ′) = 1,
The data editing method according to appendix 7, wherein:
(Appendix 9)
A combination of the generalized values of the plurality of samples corresponding to one of the hierarchies, wherein all other of the plurality of attributes with respect to the generalized value corresponding to one attribute of the plurality of attributes The data editing method according to any one of appendices 6 to 8, further comprising: extracting a combination of the generalized values in which the generalized values corresponding to the attributes of the variable have diversity.
(Appendix 10)
Further, when represented by the generalized information generalized tree, the generalization is performed so as to include at most one attribute including the hierarchy corresponding to a root of the generalized tree. The data editing method according to one item.
(Appendix 11)
One of the hierarchies using a relational model including values of a plurality of attributes for each of a plurality of samples and generalized information in which a hierarchy and a generalized value corresponding to each of the hierarchies are defined for each attribute. A combination of the generalized values of the plurality of samples corresponding to the generalized value corresponding to another attribute of the plurality of attributes with respect to the generalized value corresponding to one attribute of the plurality of attributes A generalization unit for extracting a combination of the generalized values having diversified values.
A data editing apparatus comprising:
(Appendix 12)
The generalization unit further includes, for one value of the plurality of attributes, for all other values of the plurality of attributes in the combination of the generalized values of the plurality of samples corresponding to one of the hierarchies. In order for the generalized value to satisfy the diversity definition D defined by the other attribute of the plurality of attributes and the hierarchy corresponding to the other attribute, among the values of the plurality of attributes included in the relationship model, The data editing apparatus according to attachment 11, wherein values of a plurality of attributes relating to a predetermined number of samples are deleted.
(Appendix 13)
In the diversity definition, a mapping d obtained by mapping D: (a, l) → d from a set of one of the plurality of attributes a and the hierarchy l to the diversity definition is the plurality of attributes. F is a frequency distribution for one of a and F is a mapping to a logical value d: F → 1/0, and F1 + F2 is the sum of the frequency distributions F1 and F2, and ∧ is a logical product operation.
(D1) Monotonicity: (d (F1) = 1) ∧ (d (F2) = 1) => d (F1 + F2) = 1
(D2) hierarchical monotonicity: d (F) = 1⇒d ′ (F ′) = 1,
The data editing apparatus according to Supplementary Note 11, wherein
(Appendix 14)
The generalization unit is a combination of the generalized values of the plurality of samples corresponding to one of the hierarchies, and the plurality of the generalized values corresponding to one attribute among the plurality of attributes. 14. The data editing apparatus according to any one of appendices 11 to 13, wherein the generalized values corresponding to all the other attributes are extracted from a combination of the generalized values.
(Appendix 15)
The generalization unit, when represented by the generalized information generalized tree, performs the generalization so as to include at most one attribute including the hierarchy corresponding to the root of the generalized tree. The data editing device according to any one of the above.

DESCRIPTION OF SYMBOLS 100 Data editing apparatus 102 Input part 104 Generalization part 106 Output part

Claims (6)

One of the hierarchies using a relational model including values of a plurality of attributes for each of a plurality of samples, and generalized information in which a hierarchy and a generalized value corresponding to each of the hierarchies are defined for each attribute. A combination of the generalized values of the plurality of samples corresponding to, corresponding to all other attributes of the plurality of attributes with respect to the generalized value corresponding to one attribute of the plurality of attributes A data editing program that causes a computer to execute a process of extracting a combination of the generalized values in which the generalized values have diversity. One of the hierarchies using a relational model including values of a plurality of attributes for each of a plurality of samples and generalized information in which a hierarchy and a generalized value corresponding to each of the hierarchies are defined for each attribute. A combination of the generalized values of the plurality of samples corresponding to the generalized value corresponding to another attribute of the plurality of attributes with respect to the generalized value corresponding to one attribute of the plurality of attributes A combination of the generalized values having a variety of normalized values,
In the combination of the generalized values of the plurality of samples corresponding to one of the hierarchies, the generalized value for all of the other attributes of the plurality of attributes is the plurality of the plurality of attributes. In order to satisfy the diversity definition defined by the other attribute of the attribute and the hierarchy corresponding to the other attribute, a plurality of attributes related to a predetermined number of samples among the values of the plurality of attributes included in the relation model A data editing program for causing a computer to execute a process of deleting the value of. In the diversity definition, a mapping d obtained by mapping D: (a, l) → d from a set of one of the plurality of attributes a and the hierarchy l to the diversity definition is the plurality of attributes. F is a frequency distribution for one of a and F is a mapping to a logical value d: F → 1/0, and F1 + F2 is the sum of the frequency distributions F1 and F2, and ∧ is a logical product operation.
(D1) Monotonicity: (d (F1) = 1) ∧ (d (F2) = 1) => d (F1 + F2) = 1
(D2) hierarchical monotonicity: d (F) = 1⇒d ′ (F ′) = 1,
The data editing program according to claim 2, wherein: Further, when the generalized information is represented by a generalized tree, the computer is caused to execute a process of performing generalization so as to include at most one of the attributes including the hierarchy corresponding to a root of the generalized tree. The data editing program according to any one of claims 1 to 3 . A data editing method executed by a computer, wherein a relational model including values of a plurality of attributes for each of a plurality of samples, and a hierarchy and a generalized value corresponding to each of the hierarchies are defined for each of the attributes The generalized information is a combination of the generalized values of the plurality of samples corresponding to one of the hierarchies, and the generalized value corresponding to one attribute of the plurality of attributes Extracting a combination of the generalized values in which the generalized values corresponding to all other attributes of a plurality of attributes have diversity;
Data editing method including. One of the hierarchies using a relational model including values of a plurality of attributes for each of a plurality of samples and generalized information in which a hierarchy and a generalized value corresponding to each of the hierarchies are defined for each attribute. A combination of the generalized values of the plurality of samples corresponding to, corresponding to all other attributes of the plurality of attributes with respect to the generalized value corresponding to one attribute of the plurality of attributes A generalization unit for extracting a combination of the generalized values in which the generalized values have diversity;
A data editing apparatus comprising: