JP6588880B2 - Anonymization device, anonymization method, and program - Google Patents

Description

  The present invention relates to a technique for anonymizing personal data, and particularly to a technique for k-anonymizing trajectory information, which is time-series data of position information.

  Non-Patent Document 1 describes a method called k-anonymization as a method for anonymizing personal data. k-anonymization is an anonymization technique in which there is always k or more data having the same attribute in a set of personal data, and the probability that an individual is specified is suppressed to 1 / k or less. Non-Patent Documents 2 to 5 describe a method of applying k-anonymization to trajectory information that is time-series data of position information. For example, in Non-Patent Document 5, first, latitude / longitude is generalized by mapping position information represented by latitude / longitude / time to a mesh on a map. Next, the user who has the same latitude and longitude at all times (that is, has the same trajectory information) and has no more than k users is deleted. As a result, there are always k or more users for certain trajectory information, and the trajectory information is k-anonymized.

L. Sweeney, "k-Anonymity: A Model for Protecting Privacy", International Journal of Uncertainty, Fuzziness and Knowledge-Based Systems, vol. 10 (5), pp. 557-570, October 2002. O. Abul, F. Bonchi, and M. Nanni, "Never Walk Alone: Uncertainty for Anonymity in Moving Objects Databases", ICDE '08 Proceedings of the 2008 IEEE 24th International Conference on Data Engineering, Pages 376-385, 2008. M. E. Nergiz et al., "Towards Trajectory Anonymization: a Generalization-Based Approach", Transactions on Data Privacy, vol. 2 (1), pp. 47-75, 2009. C.-Y. Chow and M. F. Mokbel, "Trajectory Privacy in Location-based Services and Data Publication", ACM SIGKDD Explorations Newsletter, vol. 13 (1), pp. 19-29, June 2011. R. Shigetomi-Yamaguchi et al., "Applicability of Existing Anonymization Methods to Large Location History Data in Urban Travel", IEEE International Conference on Systems, Man, and Cybernetics, 2012.

  Since the trajectory information that has been k-anonymized by the prior art is composed of only users who have passed through areas with relatively high traffic, the number of users is always deleted. Tend to decrease significantly. This is because even if the latitude and longitude are generalized, a user having the same combination of latitude and longitude at a plurality of times is difficult to find in an area where the traffic is relatively low.

  In view of the above points, an object of the present invention is to provide an anonymization technique capable of k-anonymization so that more users are included in trajectory information after anonymization.

  In order to solve the above-described problem, the anonymization device according to the present invention receives, as input, trajectory information including an identifier for identifying a user, a plurality of pieces of position information including information indicating time and information indicating position. A non-dimensionalization unit that generates non-dimensional position information obtained by making the non-dimensional information based on the difference between the maximum value and the minimum value, and the non-dimensional position information into a plurality of clusters. The generalization and non-dimensionalization is performed by replacing the clustering unit that performs clustering into the non-dimensionalized position information and the information indicating the time and the information indicating the position with the central value of the cluster to which the non-dimensionalized position information belongs. Generalization position that generates position information, and generalized position that returns the information indicating the time of generalized non-dimensionalized position information and the information indicating position to the original dimension based on the difference between the maximum value and the minimum value Generates anonymized trajectory information by deleting generalized position information related to users whose number of users specified by information indicating time and position is less than a predetermined number from the trajectory information and an inverse dimensionless unit that generates information And a deletion unit.

  According to the present invention, the trajectory information can be anonymized by generalizing the information indicating the position and the information indicating the time. This makes it easier to maintain user data that has been easily removed by the conventional k-anonymization method and passes through a low-traffic area, resulting in an increase in the number of users included in the k-anonymized trajectory information. To do.

FIG. 1 is a diagram illustrating a functional configuration of the anonymization device. FIG. 2 is a diagram illustrating a processing procedure of the anonymization method.

  Hereinafter, embodiments of the present invention will be described in detail. In addition, the same number is attached | subjected to the component which has the same function in drawing, and duplication description is abbreviate | omitted.

  In order to solve the above-mentioned problem, one measure is to generalize not only latitude and longitude but also time. The embodiment of the present invention is an anonymization device that outputs anonymized trajectory information by k-anonymizing input trajectory information. The anonymization device of the embodiment groups position information that is close in a three-dimensional space of time, latitude, and longitude, unifies the time, latitude, and longitude of position information that belongs to a certain group, and performs generalization. For example, if the location information is “I was at the south exit of A station at 14:59” or “I was at the north exit of A station at 15:01”, both of them were “I was at A station at 15:00” To be processed. For this purpose, a method is used in which position information is clustered in a three-dimensional space of time, latitude, and longitude, and each attribute of the position information is replaced with the central value of the cluster to which it belongs.

  As illustrated in FIG. 1, the anonymization device according to the embodiment includes an input unit 1, a dimensionless unit 2, a clustering unit 3, a generalization unit 4, an inverse dimensionless unit 5, a deletion unit 6, and an output unit 7. including. This anonymization apparatus performs the process of each step illustrated in FIG. 2, thereby realizing the anonymization method of the embodiment.

  An anonymization device is, for example, a special program configured by reading a special program into a known or dedicated computer having a central processing unit (CPU), a main storage device (RAM: Random Access Memory), and the like. Device. For example, the anonymization device executes each process under the control of the central processing unit. The data input to the anonymization device and the data obtained in each process are stored in the main storage device, for example, and the data stored in the main storage device is read out to the central processing unit as necessary. It is used for processing. At least a part of each processing unit of the anonymization device may be configured by hardware such as an integrated circuit.

  With reference to FIG. 2, the process procedure of the anonymization method of embodiment is demonstrated.

  In step S1, trajectory information to be anonymized is input to the input unit 1. The trajectory information is sent to the dimensionless unit 2. The trajectory information is time-series data of user position information, and includes, for example, an identifier that identifies the user, information indicating time, and information indicating position. In this embodiment, it is assumed that the information indicating the position is expressed by latitude and longitude, and the trajectory information is configured by four attributes of user ID, time, latitude, and longitude, as shown in the following table, for example. For example, in the first and second lines excluding the header in the following table, the user with the user ID “3” was at the position of latitude “35.68367342” and longitude “139.47106963” at time “08:00:18”. , 5 minutes later, at time “08:05:18”, it has been moved to the position of latitude “35.68302667” and longitude “139.47132593”.

  In step S2, the dimensionless unit 2 receives the trajectory information from the input unit 1, and performs dimensionless processing based on the difference between the maximum value and the minimum value for each of the time, latitude, and longitude included in the trajectory information. The dimensionless unit 2 outputs dimensionless position information (hereinafter referred to as dimensionless position information) to the clustering unit 3.

  Non-dimensionalization is performed because time, latitude, and longitude have different dimensions (units), and thus a three-dimensional space cannot be simply defined. Specifically, t is the time before dimensionless, t 'is the time after dimensionless, lat is the latitude before dimensionless, lat' is the dimension after dimensionless, lon is before dimensionless The longitude and lon ′ are made dimensionless by dividing them by (maximum value−minimum value), respectively, as shown in the following formula, with the longitude after dimensionlessness. For the time t, for example, the following equation is calculated by converting the elapsed time from the reference time such as 0 hours 0 minutes 0 seconds into seconds.

Where t _max is the maximum value at time t, t _min is the minimum value at time t, lat _max is the maximum value at latitude lat, lat _min is the minimum value at latitude lat, lon _max is the maximum value at longitude lon, and lon _min is The minimum values of longitude lon, α _t , α _lat , α _lon are predetermined real numbers given in advance. α _t , α _lat , and α _lon may be set so as to satisfy the required levels of anonymity and usefulness. For example, α _t = α _lat = α _lon = 1.

In step S3, the clustering unit 3 receives the non-dimensionalized position information output from the non-dimensionalized unit 2, and clusters the non-dimensionalized positional information into N _cls (> 1) clusters. The number of clusters N _cls is set to satisfy the required level of anonymity and usefulness. The clustering unit 3 outputs the dimensionless position information after clustering to the generalization unit 4. As the clustering method, any existing method may be used. For example, the k-average method described in Reference Document 1 below may be used.
[Reference 1] JA Hartigan and MA Wong, "Algorithm AS 136: A K-Means Clustering Algorithm", Journal of the Royal Statistical Society. Series C (Applied Statistics), Vol. 28, No. 1 (1979), pp 100-108.

  In step S4, the generalization unit 4 receives the non-dimensionalized position information after clustering output from the clustering unit 3, and the time / latitude / longitude included in the non-dimensionalized position information belongs to the non-dimensionalized position information. Replace with the central value of the cluster to be unified and generalize. The generalization unit 4 outputs the generalized non-dimensional position information (hereinafter referred to as generalized non-dimensional position information) to the inverse non-dimensionalization unit 5.

  In step S5, the inverse dimensionless unit 5 receives the generalized dimensionless position information output from the generalization unit 4, and sets the time, latitude, and longitude of the generalized dimensionless position information as the maximum value and the minimum value, respectively. Revert to the original dimension based on the difference. The inverse dimensionless unit 5 outputs generalized dimensionless position information (hereinafter referred to as generalized position information) whose dimensions have been restored to the deletion unit 6. Specifically, t 'is the time before reverse dimensionless, t is the time after reverse dimensionless, lat' is the latitude before reverse dimensionless, lat is the latitude after reverse dimensionless, lon ' The dimension is restored to the original by multiplying (maximum value−minimum value), respectively, by using the dimensionless longitude and lon as the inverse dimensionless longitude.

  In step S6, the deletion unit 6 receives the generalized position information output by the inverse dimensionless unit 5, and the generalized position information is determined so that the number of users specified by time, latitude, and longitude is equal to or greater than a predetermined number k (> 1). Delete the location information. The predetermined number k is set to satisfy the required level of anonymity and usefulness. Specifically, first, as a preprocessing, when a plurality of times, latitudes, and longitudes are continuously the same for each user, only one is deleted and deleted. This is because, by generalizing the time, a state in which the same user has position information existing at a plurality of the same positions at the same time may occur, but in this case, anonymization cannot be performed correctly. Next, the number of users whose time, latitude, and longitude all match is totaled, and generalized position information related to users whose number of users is less than a predetermined number k is deleted. As a result, there are always k or more users having certain trajectory information, and trajectory information including generalized position information after deletion satisfies k-anonymity. The deletion unit 6 outputs trajectory information including the generalized position information after deletion (hereinafter referred to as anonymized trajectory information) to the output unit 7.

  In step S7, the output unit 7 receives the anonymized trajectory information output by the deleting unit 6 and outputs the anonymized trajectory information.

  The first point of the present invention is that the number of users included in the k-anonymized trajectory information is increased by unifying and generalizing not only latitude and longitude but also time. This is realized by generalization of time, latitude, and longitude by replacing with the central value of the cluster to which it belongs. The second point of this invention is that it is necessary to define a three-dimensional space of time, latitude, and longitude in order to perform clustering of position information. By doing so, we defined a three-dimensional space.

  As described above, the embodiments of the present invention have been described, but the specific configuration is not limited to these embodiments, and even if there is a design change or the like as appropriate without departing from the spirit of the present invention, Needless to say, it is included in this invention. The various processes described in the embodiments are not only executed in time series according to the description order, but may also be executed in parallel or individually as required by the processing capability of the apparatus that executes the processes.

[Program, recording medium]
When various processing functions in each device described in the above embodiment are realized by a computer, the processing contents of the functions that each device should have are described by a program. Then, by executing this program on a computer, various processing functions in each of the above devices are realized on the computer.

  The program describing the processing contents can be recorded on a computer-readable recording medium. As the computer-readable recording medium, for example, any recording medium such as a magnetic recording device, an optical disk, a magneto-optical recording medium, and a semiconductor memory may be used.

  This program is distributed by selling, transferring, or lending a portable recording medium such as a DVD or CD-ROM in which the program is recorded. Furthermore, the program may be distributed by storing the program in a storage device of the server computer and transferring the program from the server computer to another computer via a network.

  A computer that executes such a program first stores, for example, a program recorded on a portable recording medium or a program transferred from a server computer in its own storage device. When executing the process, the computer reads a program stored in its own recording medium and executes a process according to the read program. As another execution form of the program, the computer may directly read the program from a portable recording medium and execute processing according to the program, and the program is transferred from the server computer to the computer. Each time, the processing according to the received program may be executed sequentially. A configuration in which the above-described processing is executed by a so-called ASP (Application Service Provider) type service that realizes a processing function only by an execution instruction and result acquisition without transferring a program from the server computer to the computer. It is good. Note that the program in this embodiment includes information that is used for processing by an electronic computer and that conforms to the program (data that is not a direct command to the computer but has a property that defines the processing of the computer).

  In this embodiment, the present apparatus is configured by executing a predetermined program on a computer. However, at least a part of these processing contents may be realized by hardware.

DESCRIPTION OF SYMBOLS 1 Input part 2 Nondimensionalization part 3 Clustering part 4 Generalization part 5 Reverse dimensionless part 6 Deletion part 7 Output part

Claims (5)

The trajectory information including an identifier for identifying the user, a plurality of position information composed of information indicating the time and information indicating the position is input, and the information indicating the time and the information indicating the position of the trajectory information are respectively the maximum value and the minimum value. A dimensionless unit that generates dimensionless position information that is dimensionless based on the difference between
A clustering unit that clusters the non-dimensional position information into a plurality of clusters;
Generate generalized non-dimensionalized position information by replacing information indicating time and information included in the non-dimensionalized position information with the center value of the cluster to which the non-dimensionalized position information belongs. A generalization section;
An inverse dimensionless unit that generates generalized position information in which the information indicating the time of the generalized non-dimensionalized position information and the information indicating the position are returned to the original dimensions based on the difference between the maximum value and the minimum value,
A deletion unit that generates anonymized trajectory information obtained by deleting generalized position information related to a user whose number of users specified by information indicating time and information indicating position is less than a predetermined number from the trajectory information;
Anonymization device including The anonymization device according to claim 1,
The information indicating the above position consists of latitude and longitude, t is the time before non-dimensionalization, t 'is the time after non-dimensionalization, lat is the latitude before non-dimensionalization, and lat' is non-dimensional Lon is the longitude before dimensionless, lon 'is the longitude after dimensionlessness, t _max is the maximum value at time t, t _min is the minimum value at time t, and lat _max is the latitude lat Lat _min is the minimum value of latitude lat, lon _max is the maximum value of longitude lon, lon _min is the minimum value of longitude lon, and α _t , α _lat , α _lon are predetermined real numbers,
The dimensionless unit is configured to dimensionless the position information by the following equation:

The inverse dimensionless unit returns the generalized dimensionless position information to the original dimension according to the following equation:

Anonymization device. The anonymization device according to claim 1 or 2,
When the same location information continues for a plurality of users, the deletion unit deletes all but one, and the number of users whose time information and location information all match is less than the predetermined number. The generalized position information is deleted.
Anonymization device. An anonymization method executed by an anonymization device including a non-dimensionalization unit, a clustering unit, a generalization unit, an inverse non-dimensionalization unit, and a deletion unit,
The dimensionless unit receives, as input, trajectory information including an identifier for identifying a user, a plurality of position information including information indicating time and information indicating position, and information indicating the time and information of the trajectory information A dimensionless step for generating dimensionless position information that is dimensionless based on the difference between the maximum value and the minimum value,
The clustering section, and clustering step of clustering the dimensionless position information into a plurality of clusters,
The generalization unit, the information indicating information and position indicating the time included in the dimensionless position information, generalization dimensionless was generalized by replacing the center value of the cluster to which the dimensionless position information belongs A generalization step for generating generalized position information;
The inverse dimensionless unit generates generalized position information in which the information indicating the time of the generalized dimensionless position information and the information indicating the position are returned to the original dimensions based on the difference between the maximum value and the minimum value. An inverse dimensionless step to
A deletion step of the deleting unit generates the anonymous locus information user deletes the generalization positional information about the user to be less than the predetermined number specified by information indicating information and position representing the time from the trajectory information,
Anonymization methods including:   The program for functioning a computer as an anonymization apparatus in any one of Claim 1 to 3.

Images