JP6627328B2 - Anonymous processing device and anonymous processing method - Google Patents

Description

  The present invention relates to an anonymous processing technique for anonymizing or diversifying personal information.

  2. Description of the Related Art With the development of information processing technology, information is collected in many everyday situations, and processing is performed using the collected information. For example, when a consumer becomes a member of a store and purchases a product, the name, age, gender, address, mail address, and the like of the consumer are often registered at the time of member registration. Then, when the consumer purchases the product, the store-side system records the information of the consumer and the purchased product in association with each other. By accumulating and analyzing the information of the purchased product in this way, it is possible to estimate the taste of the consumer and to provide a service such as sending out a direct mail when a new product desired by the consumer is released. Further, by analyzing information of many consumers, information such as products preferred by women in their twenties and products favored in the Kanto area can be derived and used for marketing and the like.

  In addition, such information can be used not only by the store, but also by a maker that manufactures the product and other companies to develop new products and improve safety, and may have value.

  However, since the personal information of the consumer possessed by the store cannot be provided to other persons without obtaining the permission of each consumer, conventionally, the range of the license granted by each consumer based on the contract at the time of the member registration has been conventionally used. It was used mainly at the store and managed to prevent personal information from leaking to third parties. However, in recent years, if useful information can be derived from the personal information and provided to others in a state in which the individual cannot be identified, there is a possibility of activating the industry. To be provided to the public.

  In this case, it is necessary to not only delete the identification information such as the name and the telephone number of each consumer, but also to make the original consumer unidentifiable even when combined with other information.

  For example, if there is only one 25-year-old person in the member list in which the age is described, the person can be identified when a 25-year-old acquaintance knows that he is a member. That is, if there is only one person having the attribute of a 25-year-old member, there is a high possibility that the individual can be specified by comparing it with other information.

  Therefore, if the age description in the member list is abstracted into 10-year-old sections and if there are two or more people with the same attribute, such as three in their twenties, it is possible to specify which of the three people become unable. Such a state where there are k or more people having the same attribute is referred to as satisfying "k-anonymity", and processing data in such a manner is referred to as "k-anonymization".

  In addition, various standards and methods for anonymization have been proposed, for example, l-diversity, Pk anonymization, and t-closeness (see Non-Patent Document 1).

JP 2012-133451 A JP 2011-108195 A JP 2011-128882 A JP 2012-78932 A

Author: Hiroshi Nakagawa, "Privacy Protection Data Mining", [Search on May 23, 2014], Internet <URL: http://www.r.dl.itc.u-tokyo.ac.jp/~nakagawa/labintro /2010PPDM-summary.pdf>

By making personal information k-anonymous, it is possible to reduce the risk of re-identification and abuse, and to provide information to third parties. However, a great deal of computational resources are required for anonymous processing and verification processing. There was a problem that needed. Since the anonymous state generation process and the test process are performed using a combination of attribute values of the target data, the number of attributes to be combined is increased, or attributes with many types of attribute values (the number of choices) are combined. When the number (the number of sections to be described later) increases, the amount of calculation increases exponentially. Therefore, to obtain detailed data, an enormous amount of calculation resources is required.

  Also, when trying to obtain detailed data, if many attributes are combined, the number of occurrences of the combined attribute values will decrease dramatically and it will not be possible to anonymize. However, even if the data can be anonymized, the abstraction is high, resulting in data with a small amount of information.

  For this reason, in the past, in order to obtain detailed and anonymous data with a small amount of calculation processing, processing of confirming an anonymous state from the bottom up or from the top down as in the OLA method has been proposed. Since the optimal solution (GOD: Globally Optimal Dataset) was found near the bottom, or the GOD was found near the top calculated from the bottom, the calculation amount could not be reliably reduced.

  Therefore, the present invention provides a technique for obtaining detailed and anonymous data with a small amount of arithmetic processing.

The anonymous processing device according to the present invention,
When the personal information is anonymized by a combination of a plurality of attributes, the number of combinations of attribute values that the attribute can take is defined as the number of categories, and when the personal information is anonymized by the combination of the attributes, the combination of the attribute values A storage unit that stores the correspondence between the number of divisions and the minimum number of occurrences, with the minimum number being the minimum occurrence number among the numbers in which
When the minimum number of appearances when the personal information to be processed is anonymized is equal to or more than the target value, based on the correspondence between the number of divisions and the minimum number of occurrences, the number of divisions where the minimum number of occurrences becomes the target value A prediction unit having a prediction value of
An anonymization unit that anonymizes personal information to be processed with a combination of a plurality of attributes;
A testing unit for testing whether or not the minimum number of appearances in the case of performing the anonymization is equal to or more than the target value,
The anonymization unit ranks the combinations of the attributes based on the number of classes when performing anonymization with a combination of a plurality of attributes, and anonymizes the combinations of the attributes having the ranks corresponding to the predicted values and the number of classes. When it is determined that the minimum number of occurrences is not greater than or equal to the target value, the anonymization and the test are performed in the order of the number of segments corresponding to the predicted value according to the ranking.

  The anonymous processing device, when the minimum number of appearances when performing the anonymization is equal to or more than the target value, updates the predicted value with the number of segments when performing the anonymization, the updated predicted value May be used to perform the anonymization.

  The anonymous processing device, when it is determined that the minimum number of occurrences when performing the anonymization is not more than the target value, according to the ranking, determine the combination of the attributes to be subsequently anonymized, May be set in a selectable plurality in the order of searching for a combination of attributes that satisfies.

The anonymous processing method according to the present invention,
When the personal information is anonymized by a combination of a plurality of attributes, the number of combinations of attribute values that the attribute can take is set to the number of categories, and when the personal information is anonymized by the combination of the attributes, the combination of the attribute values Is the minimum number of occurrences among the number of occurrences, the step of referring to a storage unit that stores the correspondence between the number of divisions and the minimum number of occurrences,
When the minimum number of appearances when the personal information to be processed is anonymized is equal to or more than the target value, based on the correspondence between the number of divisions and the minimum number of occurrences, the number of divisions where the minimum number of occurrences becomes the target value Taking as a predicted value;
Anonymizing personal information to be processed with a combination of a plurality of attributes;
Performing a test as to whether the minimum number of appearances in the case of performing the anonymization is equal to or more than the target value,
Is executed by the computer,
In the anonymizing step, the combinations of the attributes are ranked based on the number of segments in the case of performing the anonymization with a combination of a plurality of attributes, and the combination of the attributes of the order that is the number of segments corresponding to the predicted value Anonymize with
In the step of performing the test, when it is determined that the minimum number of occurrences is not equal to or greater than the target value, the anonymization and the test are performed according to the ranking and in ascending order of the number of segments corresponding to the predicted value.

  The anonymous processing method, when the minimum number of appearances when the anonymization is performed is equal to or more than the target value, updates the predicted value with the number of divisions when the anonymization is performed, and updates the updated predicted value May be used to perform the anonymization.

  In the anonymity processing method, when it is verified that the minimum number of appearances when performing the anonymization is not more than the target value, a combination of attributes to be subsequently anonymized is determined according to the ranking and the anonymity is determined. May be set in a selectable plurality in the order of searching for a combination of attributes that satisfy the condition.

  Further, the present invention may be a program for causing a computer to execute the above method. Further, the conversion program may be recorded on a computer-readable recording medium.

  Here, the computer-readable recording medium refers to a recording medium that stores information such as data and programs by electrical, magnetic, optical, mechanical, or chemical action and can be read from a computer. . Examples of such a recording medium that can be removed from a computer include a flexible disk, a magneto-optical disk, a CD-ROM, a CD-R / W, a DVD, a DAT, an 8 mm tape, a memory card, and the like.

  Further, as a recording medium fixed to the computer, there is a hard disk, a ROM (Read Only Memory) or the like.

  The present invention can provide a technique for obtaining detailed and anonymous data with a small amount of calculation processing.

FIG. 1 is an explanatory diagram of the anonymization process. FIG. 2 is an explanatory diagram of the diversification process. FIG. 3 is a schematic configuration diagram of the anonymization system in the embodiment. FIG. 4 is a diagram illustrating an example of personal information. FIG. 5 is a diagram showing a value generalization hierarchy (VGH) of the attribute B (dosage amount) shown in FIG. FIG. 6 is a diagram showing a value generalization hierarchy of the attribute C (period until complete recovery) shown in FIG. FIG. 7 is a diagram showing an attribute generalization hierarchy (DGH: Domain Generalization Hierachies) of the attribute B and the attribute C. FIG. 8 is a diagram showing a value generalized hierarchy and an attribute generalized hierarchy of a region (attribute D). FIG. 9 is a diagram illustrating the number of sections when attributes are combined. FIG. 10 is a diagram illustrating a hardware configuration of the anonymous processing device and the approximate function calculation device. FIG. 11 is an explanatory diagram of an approximate function calculation method. FIG. 11 is an explanatory diagram of an approximate function obtaining method. FIG. 13 illustrates an anonymization process based on a predicted GOD value. FIG. 14 illustrates an anonymization process based on a predicted GOD value. FIG. 15 is a diagram illustrating an example of the value generalization hierarchy. FIG. 16 is a diagram illustrating an example in which anonymization processing is continuously performed. FIG. 17 is a diagram illustrating a modification of the anonymization process. FIG. 18 is a diagram illustrating an example of the approximation function.

  Hereinafter, embodiments for implementing the present invention will be described with reference to the drawings. The configuration of the following embodiment is an exemplification, and the present invention is not limited to the configuration of the embodiment.

<Embodiment 1>
FIG. 1 is an explanatory diagram of the anonymization process, and FIG. 2 is an explanatory diagram of the diversification process. FIG. 1A shows an example in which the last name item is deleted from the member information including the last name, age, and gender items. As shown in FIG. 1 (A), if there is only one 16-year-old woman in the member information in which the age is described, when the 16-year-old woman is found to be this member, that person is identified. it can. That is, if there is only one person having the attribute of 16-year-old woman, there is a possibility that the individual can be identified by comparing it with other information.

  In FIG. 1B, the description of the age in the member list is abstracted and classified by age, such as 0s (under 10 years old), 10s, and 20s. However, even in this case, there is only one female teenager, and the individual can be identified similarly to FIG. 1A, which is insufficient for anonymization.

  Therefore, in FIG. 1 (C), the abstraction is further abstracted, and the division of the ages is changed as in teens and younger (19 years and younger) and in their 20s. In the case of FIG. 1C, there are two women under the age of ten, and the attributes [teens and under] and [female] are not single. For this reason, even if it turns out that a 16-year-old woman is this member as described above, it cannot be specified which is the data of the 16-year-old woman. Such a state where there are k or more people having the same attribute is referred to as “k-anonymity”, and processing data in such a manner is referred to as “k-anonymization”.

FIG. 2 shows an example in which the data of the use station for each user is abstracted and the data of the ward to which the use station belongs for each user is used. Since the station is specified in the data before the abstraction, there is a possibility that the user can be specified by comparing the data with data such as a house near Shinjuku station and a work place near Tokyo station. For this reason, by abstracting the use station to the ward to which the use station belongs, the number of users who use the station in Shinjuku ward and the station in Chiyoda ward becomes multiple, and the user is not specified. Such an abstraction that the attribute value has one type of possibility, such as “using a station in Shinjuku ward and a station in Chiyoda ward”, is called l-diversification.

  FIG. 3 is a schematic configuration diagram of the anonymization system 10 in the present embodiment. As shown in FIG. 1, the anonymization system 10 includes an anonymous processing device 1 and an approximate function calculation device 2.

  The anonymous processing device 1 includes a data receiving unit 11, a division number acquiring unit 12, a coefficient acquiring unit 13, an anonymizing unit 15, a test unit 16, a data output unit 18, a prediction unit 19, an anonymous result DB (database) 31, anonymous An information column DB 32 is provided.

  The data receiving unit 11 receives target data (personal information) including a plurality of items (attributes) associated with an individual, an anonymization condition, an anonymization command, and the like. The reception of personal information and anonymization conditions may be received via a network such as the Internet, read from a storage medium, or input from input means such as a keyboard. FIG. 4 is a diagram illustrating an example of personal information. In the example shown in FIG. 4, each row (tuple) is recorded in association with attributes of each individual, such as sex, dosage, and period until complete healing.

The number-of-sections acquiring unit 12 acquires the number of sections when anonymizing personal information to be anonymized. The number of divisions is the number of types of attribute values (words) that can be taken by the attributes included in the anonymous information, in other words, the number of divisions when the values of the attributes constituting the anonymous information are divided into the same values. In addition, the number-of-sections acquiring unit 12 may acquire the number of sections of generalized (abstracted) attribute values. FIG. 5 is a diagram showing a value generalization hierarchy (VGH) of the attribute B (dosage amount) shown in FIG. Attribute B is data indicating the dose administered in the range of 1 ml to 200 ml. When the value is divided into values of 1 ml as shown in B3 in FIG. 5, the possible attribute values are 1 ml, 2 ml, 3 ml, 4 ml,.・ There are 200 types such as 200ml. That is, when the attribute B is divided for each 1 ml, the number of divisions is 200. Also, when attribute B is generalized (abstracted) and, for example, is divided into values of 10 ml as shown in B2 of FIG. 5, possible attribute values are 1 ml to 10 ml, 11 ml to 20 ml, 21 ml to 30 ml.・ There are 20 types such as 191 ml to 200 ml. That is, when the attribute B is divided for every 10 ml, the number of divisions is 20. Further, if attribute B is further generalized and divided into values for every 50 ml as in B1, for example, there are four types of possible attribute values such as 1ml to 50ml, 51ml to 100ml, 101ml to 150ml, and 151ml to 200ml. Become. That is, when the attribute B is divided every 50 ml, the number of divisions is four. In FIG. 5, a generalized attribute value of 1 ml, 2 ml, 3 ml, 4 ml,..., 10 ml of B3 is 1 ml to 10 ml of B2. The generalized attribute values of 1 ml to 10 ml, 11 ml to 20 ml, 21 ml to 30 ml, 31 ml to 40 ml, and 41 ml to 50 ml of B2 are 1 ml to 50 ml of B3. That is, a generalized attribute value of B3 is an attribute value of B2, and a generalized attribute value of B2 is an attribute value of B1, which is generalized hierarchically. For example, a set of attribute values separated by the same reference (every 1 ml) such as B3 and having the same degree of generalization is defined as one layer, and the attribute values separated by the generalized B2 reference (every 10 ml) are defined as one layer. The set is a layer of B2, which has a higher degree of generalization than the layer of B3. Further, a set of attribute values delimited by the standard of B1 (every 50 ml) is defined as a layer B1 having a higher degree of generalization than the layer B2. By setting the attribute value generalization hierarchy in this way, 7 ml of the B3 hierarchy can be generalized to 1 ml to 10 ml of the B2 hierarchy, and 68 ml of the B3 hierarchy can be generalized to 61 ml to 70 ml of the B2 hierarchy. Also, 1 ml to 10 ml of the layer B2 can be generalized to 1 ml to 50 ml of the layer B1, and 61 ml to 70 ml of the layer B2 can be generalized to 51 ml to 100 ml of the layer B1.

FIG. 6 is a diagram showing a value generalization hierarchy of the attribute C (period until complete recovery) shown in FIG. Attribute C is data indicating the period until complete recovery in the range of 1 week to 12 weeks. If the value is divided into weekly values as shown in C2 of FIG. 6, the possible attribute values are 1 week and 2 weeks. , 3 weeks, 4 weeks... 12 weeks, that is, 12 categories. Also, when the attribute C is generalized and divided into monthly values, for example, as indicated by C1 in FIG. 6, possible attribute values are less than January, less than January to February, and less than February to March. Thus, there are three types, that is, three sections. In FIG. 6, the generalized attribute values of C2 for one week, two weeks, three weeks, and four weeks are obtained by changing the attribute values of C1 for less than one month and C2 for nine weeks, ten weeks, eleven weeks, and twelve weeks. The generalization is less than February to March of C1. That is, the generalization of the attribute value of C2 is the attribute value of C1, and is generalized in a hierarchical manner. For example, a set of attribute values separated by the same criterion (every week) having the same degree of generalization, such as C2, is defined as one layer, and this is a generalized C1 criterion (monthly). The set is a layer of C1 having a higher degree of generalization than the layer of C2. By setting the attribute value generalization hierarchy in this way, three weeks of the hierarchy of C2 are generalized to less than January of the hierarchy of C1, and ten weeks of the hierarchy of C2 are generalized to less than February to March of the hierarchy of C1. can do.

FIG. 7 is a diagram illustrating an attribute generalization hierarchy (DGH: Domain Generalization Hierachies) of the attribute B and the attribute C. As shown in FIG. 7, the hierarchical structure of the attribute B is as follows: the hierarchy of the above B3 → the hierarchy of the B2 → the hierarchy of the B1 → the root. The layer of B3 includes attribute values of {1 ml, 2 ml, 3 ml, 4 ml... 200 ml}, and the layer of B2 has attributes of {1 ml to 10 ml, 11 ml to 20 ml, 21 ml to 30 ml. Values, and the layer of B1 includes attribute values of {1 ml to 50 ml, 51 ml to 100 ml, 101 ml to 150 ml, 151 ml to 200 ml}. Further, the hierarchical structure of the attribute C is such that the above-mentioned hierarchy of C2 → the hierarchy of C1 → the root. The layer of C2 includes attribute values of {1 week, 2 weeks, 3 weeks, 4 weeks ... 12 weeks}, and the layer of C1 is {less than January, less than January to February, and 2 to 3 months. Includes attribute values for less than a month. As described above, as the attribute generalized hierarchy, the hierarchical structure of each attribute and the attribute value included in each attribute are set.

  The attribute is not limited to a numerical value. FIG. 8 is a diagram showing a value generalized hierarchy and an attribute generalized hierarchy of a region (attribute D). In FIG. 8, the hierarchy of D3 indicates 47 prefectures, the hierarchy of D2 indicates 14 regions, and the hierarchy of D1 indicates 8 regions.

  In the present embodiment, the hierarchy with the highest degree of generalization (the most abstract hierarchy) is defined as the first hierarchy, and the attributes of the first hierarchy are represented by B1, C1, The attribute of the second layer is indicated as B2, C2, D2, and the attribute of the third layer is indicated as B3, C3, D3.

  The value generalized hierarchy and the attribute generalized hierarchy of each attribute are, for example, predetermined and stored in a storage device. When the attribute is a numerical value, the anonymous processing device 1 may create a value generalized hierarchy and an attribute generalized hierarchy by dividing the input target data and the range of the attribute by predetermined values.

  Further, the attributes are not limited to those that can be generalized, and may have attributes used without generalization. For example, the attribute A (sex) is classified into two categories, male and female. It should be noted that an attribute that is not generalized in a hierarchical manner is handled as a hierarchy having the highest generalization (first hierarchy).

  FIG. 9 is a diagram showing the number of sections when these attributes are combined. As shown in FIG. 9, the number of divisions when the attributes are combined is a value obtained by multiplying the number of divisions of each attribute. The number of divisions when the attribute A and the attribute B1 are combined is eight divisions, and the attribute A and the attribute B2 are The number of sections when combined is 40, the number of sections when attribute A and attribute C1 are combined is 6, and the number of sections when attribute A and attribute C2 are combined is 24.

  Similarly, the attribute B1 and the attribute C1 have eight sections, the attribute B1 and the attribute C2 have 24 sections, the attribute B2 and the attribute C1 have 60 sections, and the attribute B2 and the attribute C2 have 240 sections.

  Further, if the attribute A, the attribute B1, and the attribute C1, 24 sections, if the attribute A, the attribute B1, and the attribute C2, 96 sections, if the attribute A, the attribute B2, and the attribute C1, 120 sections, the attribute A, the attribute B2, and the like. If it is attribute C2, it is 480 division.

  The coefficient acquisition unit 13 acquires the approximate function calculated by the approximate function calculation device 2. The approximation function is, for example, the number of decreases in the minimum number of appearances or the ratio of the number of decreases to the total number when the number of segments is increased when anonymizing the target data.

  When anonymizing or diversifying the target data, the anonymizing unit 15 replaces a word (word) that is an attribute value (attribute value) in the target data with a word generalized based on the value generalization hierarchy. In this way, anonymization is performed, and the target data is set as anonymous candidate data. In the present embodiment, a word (word) is a group of words such as a word or a phrase, and includes age, dosage, period until complete recovery, location information, numerical values such as telephone numbers, and identification information such as a mail address and an IP address. And symbols having the same meaning as words.

  The test unit 16 performs a test on the condition that a combination of attribute values corresponding to one individual of the anonymous candidate data exists in the anonymous candidate data in a number equal to or more than the reference number and is not at least one. In other words, in the anonymous candidate data, a test is performed under the condition that the number of matching combinations (the number of appearances) and the smallest one (the minimum number of occurrences) are equal to or more than the reference value among the combinations of attribute values of one tuple. I do. That is, when the k value (minimum number of occurrences) is equal to or greater than the reference value or the l value is equal to or greater than the reference value, the test unit 16 determines whether the anonymous candidate data satisfies k-anonymity. And whether or not 1-diversity is satisfied. When the combination of attribute values of one tuple is, for example, (male, 35 ml, February) in the anonymous candidate data, the test unit 16 determines the number of matches with this attribute value combination (male, 35 ml, February). (The number of appearances) is counted, and the test is performed on the condition that the smallest number of appearances (minimum number of appearances) is equal to or more than the reference value among all the combinations of the anonymous candidate data. The test unit 16 stores the anonymous candidate data satisfying the anonymity as anonymous information in the anonymous result DB 31 as a result of the test.

  The data output unit 18 reads and outputs anonymized information from the anonymous result DB 31. Here, the output of the anonymized information is, for example, display output by a display device, print output by a printer, transmission to another computer, writing to a storage medium, and the like.

  When the minimum number of occurrences when the personal information to be processed is anonymized is equal to or more than the target value, the prediction unit 19 sets the minimum number of occurrences to the target value based on the correspondence between the number of categories and the minimum number of occurrences. The above-mentioned number of sections is defined as a predicted value.

  The approximate function calculation device 2 includes an anonymous information acquisition unit 21, an appearance number acquisition unit 22, a coefficient calculation unit 23, a frequent pattern DB 33, and an approximate function DB 34.

  The anonymous information acquisition unit 21 acquires anonymous information from the anonymous result DB 31 obtained by anonymizing personal information. Further, the appearance number acquisition unit 22 obtains the number of divisions by dividing the attributes constituting the anonymous information for each word (attribute value), and obtains the minimum number of occurrences of the word in each division.

  A coefficient calculation unit, based on a combination of a plurality of the different numbers of sections and the minimum number of sections, based on the combination of the minimum number of occurrences, the number of the minimum occurrences when the number of the sections is increased, or the ratio of the reduced number to the total number of the reduced number. It is obtained as an approximate function and stored in the approximate function DB 34.

FIG. 10 is a diagram illustrating a hardware configuration of the anonymous processing device 1 and the approximate function calculation device 2.
The anonymous processing device 1 and the approximate function calculation device 2 are so-called computers having a CPU 101, a memory 102, a communication control unit 103, a storage device 104, and an input / output interface 105.

  The CPU 101 executes a program expanded in an executable manner in the memory 102. Accordingly, the CPU 101 of the anonymous processing device 1 performs the functions of the data receiving unit 11, the number-of-sections obtaining unit 12, the coefficient obtaining unit 13, the anonymizing unit 15, the test unit 16, the data output unit 18, and the prediction unit 19 described above. provide. The CPU 101 of the approximation function calculation device 2 provides the functions of the anonymous information acquisition unit 21, the appearance number acquisition unit 22, and the coefficient calculation unit 23 described above.

  The memory 102 can also be called a main storage device. The memory 102 stores, for example, programs executed by the CPU 101, data received via the communication control unit 103, data read from the storage device 104, and other data.

  The communication control unit 103 connects to another device via a network and controls communication with the device. The input / output interface 105 is appropriately connected to output means such as a display device and a printer, input means such as a keyboard and a pointing device, and input / output means such as a drive device. The drive device is a removable storage medium read / write device, such as a flash memory card input / output device, a USB adapter for connecting a USB memory, or the like. Further, the removable storage medium may be a disk medium such as a CD (Compact Disc) and a DVD (Digital Versatile Disk). The drive device reads the program from the removable storage medium and stores the program in the storage device 104.

The storage device 104 can also be referred to as an external storage device. The storage device 104 may be an SSD (Solid State Drive), HDD, or the like. The storage device 104 exchanges data with the drive device. For example, the storage device 104 stores an information processing program and the like installed from the drive device. Further, the storage device 104 reads the program and delivers the program to the memory 102. In the present embodiment, the storage device 104 of the anonymous processing device 1 stores the anonymous result DB 31 described above. Further, the storage device 104 of the approximate function calculation device 2 stores a frequent pattern DB 33 and an approximate function DB 34.

  Next, an approximate function calculation method executed by the approximate function calculation device 2 of the anonymization system 10 according to the present embodiment according to a program will be described. FIG. 11 is an explanatory diagram of an approximate function calculation method. The approximate function calculation device 2 first obtains the most abstract value generalized hierarchy and the number of processings n from another computer or storage device (step S10). Note that the processing count n is a predetermined value indicating the number of samples obtained, that is, the number of repetitions of the processing for obtaining the samples.

Next, the approximate function calculation device 2 of the present embodiment acquires the target data from the anonymization process DB (Step S20), counts the number of sections of the target data (Step S30), and stores the number in the anonymization process DB. (Step S40). Then, the approximation function calculating device 2 determines whether or not the number of processes n has reached 1 (step S50). If the number of processes n has not reached 1 (step S50, No), the number of processes n is decremented. Then (step S60), the process returns to step S10, and the processes of steps S10 to S50 are repeated. The processes of steps S10 to S50 are repeated a predetermined number of times, and when the number of processes n is determined to be 1 in step S50 (step S50)
, Yes), the number of processes n is returned to the initial value (step S70), and the routine goes to step S90.
Note that the processing of steps S90 to S150 is to investigate the number of appearances of the value generalized hierarchy.

The approximation function calculation device 2 acquires the most abstract value generalized hierarchy from among the value generalized hierarchies for which the number of appearances has not yet been obtained (step S90), and acquires personal information (target information) (step S100). . Each attribute value of personal information is generalized according to the value generalization hierarchy acquired in step S90, the number of appearances is counted for each combination of attribute values (step S110), and the minimum number of appearances (k value) is obtained. (Step S120), and stores it in the anonymization treatment DB (Step S130). Then, the approximation function calculating device 2 determines whether or not the number of processes n has reached 1 (step S140). If the number of processes n has not reached 1 (step S140, No), the number of processes n is decremented. Then (step S150), the process returns to step S90, and the processes of steps S90 to S150 are repeated. The processes in steps S90 to S150 are repeated a predetermined number of times. If it is determined in step S140 that the number of processes n is 1 (step S140, Yes), the process in FIG. 11 ends.

但し、ｙ：最少出現数（ｋ値）、ｘ：区分数

そして、式１と式２から、近似関数として式３（累乗近似式）を求め、匿名化処理ＤＢに格納する(ステップＳ２５０)。
αｘβ ・・・式３
図１８は、横軸に区分数、縦軸に最少出現数をとり、近似関数の例を示したグラフである。 Next, the approximate function calculation device 2 acquires an approximate function as shown in FIG. The approximate function calculation device 2 obtains a list of the number of partitions of the value generalized hierarchy and a list of k values (step S210), stores the k values in an array to obtain an average value (step S220), and obtains β by Expression 1. (Step S23
0), and α is obtained by Expression 2 (step S240).

Where y: minimum number of occurrences (k value), x: number of divisions

Then, Expression 3 (power approximate expression) is obtained as an approximate function from Expressions 1 and 2, and stored in the anonymization processing DB (Step S250).
αxβ ・ ・ ・ Equation 3
FIG. 18 is a graph showing an example of the approximation function with the horizontal axis representing the number of divisions and the vertical axis representing the minimum number of appearances.

次に、図１３、図１４を用いて、予測ＧＯＤ値に基づく匿名化処理について説明する。匿名処理装置１は、図１３の処理を開始すると、先ず、処理対象とする個人データを個人データ蓄積ＤＢから取得する。また、匿名処理装置１は、予測ＧＯＤの値と値一般化階層（書き換えパターン）とを匿名化処理ＤＢから取得し（ステップＳ３４０）、取得した値一般化階層に含まれる属性の組み合わせのうち、予測ＧＯＤの値以下で最も大きい区分数を持つ組み合わせを選択する(ステップＳ３５０)。 The approximation function calculating device 2 obtains the target k value, that is, the minimum number of occurrences required for anonymization (step S260), and satisfies the k value of the target by transforming Expression 3 into Expression 4. An x value (the number of sections) is obtained (step S270), and the obtained x value is stored in the anonymization processing DB as a predicted GOD value (step S280).

Next, the anonymization process based on the predicted GOD value will be described with reference to FIGS. When the processing of FIG. 13 is started, the anonymous processing device 1 first acquires personal data to be processed from the personal data storage DB. In addition, the anonymous processing device 1 acquires the value of the predicted GOD and the value generalization hierarchy (rewrite pattern) from the anonymization processing DB (step S340), and among the combinations of the attributes included in the acquired value generalization hierarchy, A combination having the largest number of sections that is equal to or smaller than the value of the predicted GOD is selected (step S350).

  FIG. 15 is a diagram illustrating an example of the value generalization hierarchy. FIG. 15 shows, for attributes A, B, and C, the number of sections when attributes of each layer are combined, arranged in ascending order. In FIG. 15, for convenience of explanation, the number of sections is shown in ascending order. However, it is not always necessary to physically arrange them in order, but it is sufficient that a combination of attributes can be selected according to the number of sections.

  Here, the anonymous processing device 1 determines whether or not there are a plurality of combinations of the attributes selected in step S350, that is, whether or not there are a plurality of combinations having the largest number of divisions equal to or less than the value of the predicted GOD (step S360). If there is a plurality (Step S360, Yes), it is determined whether or not a priority is set (Step S370). When the priorities are set in advance (step S370, Yes), the anonymous processing device 1 reads out the priorities from the storage device and selects a combination of attributes with high priorities (step S380). The priorities are set, for example, for each attribute, and the priorities of the attributes are totaled for each combination, and a combination having a higher total priority is selected, or a combination including an attribute having the highest priority is selected. .

  Note that the priority may be an arbitrarily set numerical value, or the number of hits when each attribute or attribute value is searched by a search engine of a network such as the Internet, the number of searches for each attribute value, and the number of attributes. The price when the value is used as the SEM advertisement keyword may be acquired and used as the priority. For example, the number of hits, the number of searches, and the SEM price are obtained from the search engine for words indicating attributes such as the dosage and the treatment period, and those with a high hit count, the number of searches, and those with a high SEM price are prioritized. And the combination of attributes is selected.

  On the other hand, when such a priority is not set (No at Step S370), a priority is determined according to the content of each attribute, and a combination of attributes is selected (Step S390). For example, priority is given to an attribute having a large number of combined attributes. That is, if the number of sections is the same, a combination of three attributes is given priority over a combination of two attributes. In addition, priority may be given to those having many types of attribute values and those having a small bias of attribute values.

  The process of determining the priority of the combination of attributes in steps S380 and S390 is not limited to the case where there are a plurality of combinations selected in step S350, and is the same for all the combinations of attributes created based on the value generalization hierarchy. If there are a plurality of sections, the priority may be determined in steps S380 and S390. That is, in the case where the combinations of attributes are sorted and ranked in ascending or descending order according to the number of divisions, the ranks may be determined according to the priorities in steps S380 and S390 for the combinations having the same number of divisions.

When a combination of attributes is selected in steps S380 and S390, or when it is determined that there is no plurality of combinations of attributes selected in step S350 (step S360
, No), the personal information An is anonymized by the combination of the selected attributes, and the minimum number of appearances (k value) is obtained (step S400).

  Then, in step S410 of FIG. 14, the anonymous processing device 1 determines whether or not the minimum number of appearances when anonymized by the combination of the attributes selected based on the predicted GOD is equal to or larger than the target (target value) (step S410). ), That is, when the k value is set as the target, it is determined whether or not k anonymity is satisfied.

If the minimum number of appearances is equal to or larger than the target (step S410, Y
es), the process proceeds to step S490, and if it is not equal to or more than the target (step S410, No), a combination of attributes selected based on the predicted GOD, that is, steps S380 and S390
Alternatively, the order of the combination of the attributes selected in step S350 is set in the variable J, the variable m is set to the initial value (m = 1) (step S420), and the personal information An is anonymized by the combination of the attributes in the order J + m. (Step S430). Therefore, anonymization is performed using a combination of attributes that is one rank higher than the combination of attributes selected based on the predicted GOD, that is, a combination of attributes that are detailed by one rank.

  Further, the anonymous processing device 1 determines whether or not the minimum number of appearances when anonymized in step S430 is equal to or greater than the target (step S440), and if the minimum number of occurrences is not equal to or greater than the target (step S440, No), Next, the personal information An is anonymized using a combination of attributes having the rank Jm (step S450). Therefore, anonymization is performed using a combination of attributes whose rank is one smaller than the combination of attributes selected based on the predicted GOD, that is, a combination of attributes whose rank is one abstract.

The anonymous processing device 1 determines whether or not the minimum number of appearances when anonymized in step S450 is equal to or greater than the target (step S460). If the minimum number of occurrences is not equal to or greater than the target (step S460, No), the variable m Is incremented (step S470), and step 43 is executed.
Returning to 0, the personal information An is anonymized by the combination of the attributes having the rank of J + m. For this reason, if the process in step S430 is the second time, anonymization is performed using a combination of attributes having two orders of magnitude higher than the combination of attributes selected based on the predicted GOD, and if the minimum number of occurrences is not equal to or greater than the target ( (Step S440, No), anonymization is performed using a combination of attributes having two smaller ranks than the combination of attributes selected based on the predicted GOD (Step S450). If the process in step S430 is the third time, anonymization is performed using a combination of attributes having three orders of magnitude higher than the combination of attributes selected based on the predicted GOD, and if the minimum number of occurrences is not equal to or greater than the target (step S430). (S440, No), anonymization is performed using a combination of attributes having three orders smaller than the combination of attributes selected based on the predicted GOD (step S450).

  When the anonymity is not satisfied as described above, the GOD is searched by alternately anonymizing a combination that is more detailed than a combination of attributes selected based on the predicted GOD and an abstract combination.

Then, the anonymous processing device 1 determines that the minimum number of appearances of the anonymized information anonymized in step S430 is equal to or larger than the target (step S440, Yes), or the minimum occurrence number of the anonymous information anonymized in step S450 is the target. If it is determined to be above (step S460, Ye
s) The predicted GOD value is updated with the number of sections of the anonymous information (step S480), and the result of the anonymization process is output (step S490). In this example, the predicted GOD value, the anonymized information, and the minimum number of appearances (k value) of the anonymized information are stored in the anonymization processing DB.

  As described above, according to the anonymization processing of FIGS. 13 and 14, since the search for the GOD value is started from the predicted GOD value, the processing load of the anonymization can be reliably reduced.

  When anonymizing personal information having similar attribute information, the predicted GOD value also tends to be similar. Therefore, when a large amount of personal information is continuously anonymized, the prediction is performed as shown in FIGS. After obtaining the GOD value, anonymization processing may be performed using the predicted GOD value. FIG. 16 is a diagram illustrating an example of this continuous processing. FIG. 16 shows an example in which n pieces of personal information are sequentially processed from 1 to n, and the personal information to be processed is indicated as An.

When the processing of FIG. 16 is started, the anonymous processing device 1 first sets the number of processes n to an initial value (step S510), and acquires personal data An to be processed from the personal data storage DB (step S520). The initial value of the number of processes n is usually set to 1 and the personal data A1 is acquired in step S520. However, when the process of FIG. 16 is performed following the processes of FIGS. Since the personal data A1 is processed in step 14, the initial value set in step S510 is set to 2, and in step S520 personal data after A2 is acquired. Here, the anonymous processing device 1 determines whether the personal data An has been acquired, that is, whether there is any unprocessed personal data An (step S530). (Step S530
, Yes), the value of the predicted GOD and the value generalized hierarchy (rewrite pattern) are acquired from the anonymization process DB (step S540). Then, the anonymous processing device 1 selects a combination having the largest number of divisions that is equal to or less than the value of the predicted GOD from among the combinations of attributes included in the acquired value generalized hierarchy, and anonymously transfers the personal information An by this attribute combination. Then, the minimum number of appearances (k value) is obtained (step S550).

  Then, the anonymous processing device 1 determines whether or not the minimum number of occurrences determined in step S550 is equal to or more than the target (target value) (step S560). It is determined whether or not the condition is satisfied.

If the minimum number of appearances is equal to or greater than the target (step S560, Y
es) Since the anonymity is satisfied, the result of the anonymization process is recorded in the anonymization process DB (step S660), the number of processes n is incremented (step S670), the process returns to step S520, and proceeds to the next process. Transition.

On the other hand, if the minimum number of occurrences determined in step S550 is not equal to or greater than the target (step S550).
560, No), a combination of attributes selected based on the predicted GOD, ie, step S55
The rank of the combination of the attributes selected at 0 is set to the variable J, the variable m is set to the initial value (m = 1) (step S590), and the personal information An is anonymized by the combination of the attributes of the rank J + m (step S590). Step S600). Therefore, anonymization is performed using a combination of attributes that is one rank higher than the combination of attributes selected based on the predicted GOD, that is, a combination of attributes that are detailed by one rank.

  Further, the anonymous processing device 1 determines whether or not the minimum number of appearances when anonymized in step S600 is equal to or more than the target (step S610). Next, the personal information An is anonymized using a combination of attributes having the rank Jm (step S620). Therefore, anonymization is performed using a combination of attributes whose rank is one smaller than the combination of attributes selected based on the predicted GOD, that is, a combination of attributes whose rank is one abstract.

The anonymous processing device 1 determines whether the minimum number of appearances when anonymized in step S620 is equal to or larger than the target (step S630). If the minimum number of occurrences is not equal to or larger than the target (step S630, No), the variable m Is incremented (step S640), and step 60 is performed.
Returning to 0, the personal information An is anonymized by the combination of the attributes having the rank of J + m. For this reason, if the process in step S600 is the second time, anonymization is performed using a combination of attributes that are two ranks higher than the combination of attributes selected based on the predicted GOD, and if the minimum number of occurrences is not equal to or greater than the target ( (Step S610, No), anonymization is performed using a combination of attributes having two smaller ranks than the combination of attributes selected based on the predicted GOD (Step S620).

When the anonymity is not satisfied as described above, the GOD is searched by alternately anonymizing a combination that is more detailed than a combination of attributes selected based on the predicted GOD and an abstract combination.

Then, the anonymous processing device 1 determines that the minimum number of appearances of the anonymized information anonymized in step S600 is equal to or larger than the target (step S610, Yes), or the minimum occurrence number of anonymous information anonymized in step S620 is the target. If it is determined that this is the case (step S630, Ye
s) The predicted GOD value is updated with the number of sections of the anonymous information (step S650), and the result of the anonymization process is output (step S660). In this example, the predicted GOD value, the anonymized information, and the minimum number of appearances (k value) of the anonymized information are stored in the anonymization processing DB.

  When step S660 for the anonymous information is completed, the number of processes n is incremented (step S670), the process returns to step S520, and shifts to the process of the next personal data An. Then, in step S520, if the next personal information An cannot be obtained, that is, if there is no unprocessed personal information (No in step S530), the processing in FIG. 16 ends. According to the anonymization process of FIG. 16, a large amount of personal information can be processed more efficiently by performing continuous processing using the GOD value for which anonymization has succeeded as the predicted GOD value of the next anonymization process.

  As described above, according to the present embodiment, the predicted GOD value is obtained based on the approximation function, and the search for the GOD value is started from the predicted GOD value, so that the process of obtaining the GOD value can be reliably reduced.

  Further, by processing similar personal information continuously using the predicted GOD value, a large amount of anonymous information can be efficiently created.

<Modified example>
FIG. 17 is a diagram illustrating a modification of the anonymization process. In the processes of FIGS. 14 and 16, the GOD search is performed alternately in the order of the number of sections, but the search may be performed in another order. For example, the GOD search process (steps S420 to S490) in FIG. 14 and the GOD search process (steps S590 to S660) in FIG. 16 may be changed to the process in FIG.

  In this case, the anonymous processing device 1 determines that the minimum number of occurrences is not equal to or greater than the target in step S410 of FIG. 14 (No in step S410), or determines that the minimum number of occurrences is not equal to or greater than the target in step S560 of FIG. In this case (step S560, No), an instruction for a search pattern is obtained (step S602). Here, the search pattern indicates the order of the next combination of attributes to be searched when the minimum number of appearances when the combination of attributes based on the predicted GOD is anonymized is not equal to or greater than the target. In this example, as in FIGS. 14 and 16 described above, pattern 1 is searched alternately, pattern 2 is searched in the order of increasing the number of sections m, and pattern 2 is searched in the order of decreasing the number m of sections. Pattern 3 is used. The search pattern may be configured to receive an input from an operator or to read a preset value.

Next, the anonymous processing device 1 sets the combination of the attributes selected based on the predicted GOD, that is, the rank of the combination of the attributes selected in step S350 in FIG. 13 or step S550 in FIG. m is set to an initial value (for example, r = 1, m = 1) (step S604), and it is determined whether or not the search pattern is 1 (step S606).

  If the search pattern is 1 (step S606, Yes), the anonymous processing device 1 proceeds to step S608, and anonymizes the personal information An with the combination of the attributes having the order of J + m. Therefore, if the combination of attributes is higher by m than the combination of attributes selected based on the predicted GOD, that is, if m is 1, anonymization is performed using a combination of attributes that are detailed by one rank.

  Next, the anonymous processing device 1 determines whether the minimum number of appearances when anonymized in step S608 is equal to or greater than the target (step S610), and if the minimum number of occurrences is not equal to or greater than the target (step S610, No). Then, the personal information An is anonymized using a combination of attributes having the rank of Jm (step S620). Therefore, if the combination of attributes is smaller by m than the combination of attributes selected based on the predicted GOD, that is, if m is 1, anonymization is performed using a combination of attributes whose rank is one more abstract.

The anonymous processing device 1 determines whether the minimum number of appearances when anonymized in step S620 is equal to or larger than the target (step S630). If the minimum number of occurrences is not equal to or larger than the target (step S630, No), the variable m Is incremented (step S640), and step 60 is performed.
6, when it is determined in step S608 that the minimum number of appearances of the anonymized anonymous information is equal to or larger than the target (step S610, Yes), or in step S620, it is determined that the minimum number of appearances of the anonymized anonymous information is equal to or larger than the target. In this case (step S630, Yes), the result of the anonymization process is output (step S660). In this example, the predicted GOD value, the anonymized information, and the minimum number of appearances (k value) of the anonymized information are stored in the anonymization processing DB.

If it is determined in step S606 that the search pattern is not 1 (step S60
6, No), the anonymous processing device 1 determines whether or not the search pattern is 2 (step S710),
If the search pattern is 2 (step S710, Yes), the process proceeds to step S715, and the personal information An is anonymized using a combination of the attributes having the rank of J + m (step S715). When the search is performed using the pattern 2, the value of J at the time of performing the anonymization in step S715 may be different from that of the pattern 1, for example, by subtracting a predetermined number Q to obtain (J−Q) + m. Alternatively, the offset may be set such that the search is started from a combination of attributes having a small number of sections.

  Next, the anonymous processing device 1 determines whether or not the minimum number of appearances when anonymized in step S715 is equal to or greater than the target (step S720). (Step S720, No), it is determined whether or not the variable r has reached a predetermined number R (Step S750). If the variable r has not reached the predetermined number R (Step S750, No), the variable m is incremented. Then (step S640), the process returns to step 606.

  On the other hand, in step S720, when the anonymous processing device 1 determines that the minimum number of appearances when the anonymization is performed in step S715 is equal to or larger than the target (step S720, Yes), the anonymization processing result is output (step S730). In this example, the predicted GOD value, the anonymized information, and the minimum number of appearances (k value) of the anonymized information are stored in the anonymization processing DB, and the variable (the number of successful anonymization) r is incremented (step S740). ), And proceed to step S750. That is, until the number of successes r reaches the predetermined value R, the variable m is incremented, and a search for the pattern 2 is performed using the combination of attributes with the increased number of sections (steps S710 to S750).

If it is determined in step S710 that the search pattern is not 2 (step S71)
(0, No), the anonymous processing device 1 proceeds to step S755, and anonymizes the personal information An with a combination of the attributes having the rank of Jm. When the search is performed using the pattern 3, the value of J at the time of performing the anonymization in step S755 may be different from that of the pattern 1. For example, a predetermined number P may be added and the classification may be performed as (J + P) + m. The offset may be set so that the search is started from a combination of a large number of attributes.

Next, the anonymous processing device 1 determines whether or not the minimum number of appearances when anonymized in step S755 is equal to or greater than the target (step S760), and if the minimum number of occurrences is not equal to or greater than the target (step S760, No). It is determined whether or not the variable r has reached a predetermined number R (step S75).
0), if the variable r has not reached the predetermined number R (No at Step S750), the variable m is incremented (Step S640), and the process returns to Step 606.

  On the other hand, in step S760, when the anonymous processing device 1 determines that the minimum number of appearances when the anonymization is performed in step S755 is equal to or more than the target (step S760, Yes), the anonymization processing result is output (step S770). In this example, the predicted GOD value, the anonymized information, and the minimum number of appearances (k value) of the anonymized information are stored in the anonymization processing DB, and the variable (the number of successful anonymization) r is incremented (step S780). ), And proceed to step S750. That is, until the number of successes r reaches the predetermined value R, the variable m is incremented, and a search for the pattern 3 is performed using a combination of attributes in which the number of divisions is reduced (steps S755 to S780).

Then, when step S660 is completed, or when the number of successes r reaches the predetermined number in step S750 (step S750, Yes), the anonymous processing device 1 ends if it is the search process of FIG. If it is a search process, the process moves to step S670. In step S750, in addition to the determination of the number of successes r, if the number of successes r is 1 or more, it is determined that the search for patterns 2 and 3 has been completed even if the number of failures reaches a predetermined value (step S750).
, Yes), if it is the search process of FIG. 14, the process is terminated, and if it is the search process of FIG. 16, step S6
70 may be performed.

  As described above, according to the present modification, GOD search can be performed with a desired search pattern. Therefore, it is possible to perform an appropriate anonymization process according to the purpose of the anonymization.

<Others>
The present invention is not limited to the illustrated examples described above, and it goes without saying that various changes can be made without departing from the spirit of the present invention.

DESCRIPTION OF SYMBOLS 1 Anonymous processing device 2 Approximate function calculation device 10 Anonymization system 11 Data reception unit 12 Division number acquisition unit 13 Coefficient acquisition unit 15 Anonymization unit 16 Test unit 18 Data output unit 19 Prediction unit 21 Anonymous information acquisition unit 22 Number of appearance acquisition unit 23 Coefficient calculation unit

Claims (3)

When the personal information is anonymized by a combination of a plurality of attributes, the number of combinations of attribute values that the attribute can take is set to the number of categories, and when the personal information is anonymized by the combination of the attributes, the combination of the attribute values A storage unit that stores the correspondence between the number of divisions and the minimum number of occurrences, with the minimum number being the minimum occurrence number among the numbers in which
When the minimum number of appearances when the personal information to be processed is anonymized is equal to or more than the target value, based on the correspondence between the number of divisions and the minimum number of occurrences, the number of divisions where the minimum number of occurrences is the target value A prediction unit having a prediction value of
An anonymization unit that anonymizes personal information to be processed with a combination of a plurality of attributes;
A testing unit for testing whether the minimum number of occurrences when the anonymization is performed is equal to or greater than the target value,
The anonymization unit ranks the combinations of the attributes based on the number of classes when performing anonymization with a combination of a plurality of attributes, and anonymizes the combinations of the attributes having the ranks corresponding to the predicted values and the number of classes. ,
If the anonymous minimal number of occurrences when performing was assayed with the not more than the target value,
The assay portion may, in accordance with the ranking, have row the anonymous and the test on the number of divisions and close order corresponding to the predicted value,
When it is verified that the minimum number of appearances when performing the anonymization is equal to or more than the target value,
The test unit updates the predicted value with the number of segments when the anonymization is performed,
The anonymization unit performs the anonymization using the updated predicted value,
Anonymous processing device. When it is verified that the minimum number of occurrences when performing the anonymization is not more than the target value, according to the ranking, a combination of attributes to be subsequently anonymized is determined, and a combination of attributes satisfying the anonymity is determined. anonymity processing apparatus according to claim 1 in which a plurality set the order of searching selectable. When the personal information is anonymized by a combination of a plurality of attributes, the number of combinations of attribute values that the attribute can take is set to the number of categories, and when the personal information is anonymized by the combination of the attributes, the combination of the attribute values Is the minimum number of occurrences among the number of occurrences, the step of referring to a storage unit that stores the correspondence between the number of divisions and the minimum number of occurrences,
When the minimum number of appearances when the personal information to be processed is anonymized is equal to or more than the target value, based on the correspondence between the number of divisions and the minimum number of occurrences, the number of divisions where the minimum number of occurrences becomes the target value Taking as a predicted value;
Anonymizing personal information to be processed with a combination of a plurality of attributes;
Performing a test as to whether the minimum number of appearances in the case of performing the anonymization is equal to or more than the target value,
Is executed by the computer,
In the anonymizing step, the combinations of the attributes are ranked based on the number of segments in the case of performing the anonymization with a combination of a plurality of attributes, and the combination of the attributes of the order that is the number of segments corresponding to the predicted value Anonymize with
In the step of performing the test, when it is determined that the minimum number of occurrences when the anonymization is performed is not more than the target value, the anonymity is determined according to the ranking and in the order of the number of classifications corresponding to the predicted value. line doctor the reduction and the test
When it is verified that the minimum number of appearances when performing the anonymization is equal to or more than the target value,
In the step of performing the test, the predicted value is updated with the number of segments when the anonymization is performed,
In the anonymizing step, performing the anonymization using the updated predicted value,
Anonymous processing method.

Images