JP7096222B2 - Risk assessment device, risk assessment method and risk assessment program - Google Patents

Description

The present invention relates to a method for assessing the risk of publishing document data.

Conventionally, various methods such as k-anonymization have been proposed as data set anonymization techniques. However, these methods did not target general document data. Regarding the anonymization of document data, as in Non-Patent Documents 1 and 2, a method of evaluating a risk by calculating the amount of information from the number of appearances of words in a document has been proposed.

David Snchez, and Montserrat Batet, "C-sanitized: A privacy model for document redaction and sanitization", Journal of the Engineering6, Engineering6 Venkatesan T. et al. Chakaravarty, Himanshu Gupta, Prasan Roy, and Mukesh K.K. Mohania, “Efficient Techniques for Document Sanitation”, Proceedings of the 17th ACM connerence on Information and knowledge management, 843-852.

In the conventional method, a risk assessment is carried out from the viewpoint of whether sensitive information such as an individual's disease name contained in document data or an idea about politics / religion is concealed.
However, even if the document data itself does not contain sensitive information associated with the individual, such as a school accident report, personal information and additional information related to this document data will be obtained and linked. Could be attached. Therefore, it was difficult to sufficiently evaluate the risk from only the document data.

An object of the present invention is to provide a risk assessment device, a risk assessment method, and a risk assessment program that can appropriately evaluate the risk when publishing document data.

The risk evaluation device according to the present invention performs a Web search by a combination of an information amount calculation unit that calculates the amount of information of each word included in document data and a predetermined number of words among a predetermined number of words having a high amount of information. A search unit that performs and acquires a predetermined number from the top of the search results, and a group of words that are included in the predetermined number of words and are not included in the combination with respect to the search results acquired by the search unit. It is provided with an evaluation unit that evaluates the document risk by associating with the document data based on the degree of matching.

The search unit may perform a Web search by combining up to a specified maximum number of words.

The search unit may change the pattern of the combination, perform a Web search a specified number of times, and acquire the higher rank of each search result.

The evaluation unit may evaluate based on the ratio of the search results acquired by the search unit in which the degree of matching exceeds the threshold value.

The risk assessment device includes an extraction unit that extracts a proper noun satisfying a predetermined condition from the search results acquired by the search unit, and the evaluation unit extracts the document risk when the proper noun is extracted. May be adjusted high.

The risk assessment device includes an index acquisition unit that acquires an index indicating the topicality of the document data, and the evaluation unit may adjust the evaluation of the document risk according to the index.

The index acquisition unit may classify the content of the document data into any of a predetermined category by machine learning and acquire an index associated with the category.

The information amount calculation unit calculates the amount of information of each word included in the document data of the search result in which the degree of matching exceeds the threshold, and the search unit calculates the amount of information in the document data of the search result to be more than a predetermined amount. If a word is included, the Web search may be performed again by the combination including the word.

The evaluation unit may further evaluate the document risk for each combination and evaluate the individual risk for each word by integrating the document risk.

Even if the evaluation unit re-evaluates the document risk for the document data when the individual risk is generalized according to a predetermined rule and presents the amount of change in the document risk due to the generalization. good.

The risk evaluation method according to the present invention performs a Web search by combining a predetermined number of words among a predetermined number of words having a high amount of information and an information amount calculation step for calculating the amount of information of each word included in the document data. A search step for acquiring a predetermined number from the top of the search results, and a group of words included in the predetermined number of words and not included in the combination with respect to the search results acquired in the search step. Based on the degree of matching, the computer executes an evaluation step of evaluating the document risk by associating with the document data.

The risk assessment program according to the present invention is for operating a computer as the risk assessment device.

According to the present invention, the risk of publishing document data can be appropriately evaluated.

It is a figure which illustrates the attack assumed in this embodiment. It is a figure which shows the functional structure of the risk assessment apparatus in this embodiment. It is a flowchart which shows the risk assessment method in this embodiment.

Hereinafter, an example of the embodiment of the present invention will be described.
In the risk assessment method in the present embodiment, it is assumed that the attacker possesses general search ability, and the risk of document data against an attack by Web search is evaluated.

FIG. 1 is a diagram illustrating an attack assumed in the present embodiment.
The attacker extracts keywords from the document data and performs a Web search using these keywords. After that, the attacker identifies the information about the document data from the search results, especially the individual, and the identified information (for example, "△△ -kun") and the sensitive information contained in the document data (for example, "benefit 15 million yen"). ”) And try to link it.

The device (computer) that implements the risk assessment method of the present embodiment quantitatively evaluates the risk that information related to document data will be discovered by an attacker by simulating such a Web search.

FIG. 2 is a diagram showing a functional configuration of the risk assessment device 1 in the present embodiment.
The risk assessment device 1 is an information processing device (computer) such as a server or a personal computer, and includes a control unit 10 and a storage unit 20, as well as various data input / output devices and communication devices.

The control unit 10 is a part that controls the entire risk assessment device 1, and realizes each function in the present embodiment by appropriately reading and executing various programs stored in the storage unit 20. The control unit 10 may be a CPU.

The storage unit 20 is a storage area for various programs and various data for making the hardware group function as the risk evaluation device 1, and may be a ROM, RAM, flash memory, hard disk (HDD), or the like. Specifically, the storage unit 20 includes a program (risk evaluation program) for causing the control unit 10 to execute each function of the present embodiment, parameters, a document data set including document data to be processed by this program, and the like. Remember.

The control unit 10 includes a morphological analysis unit 11, an information amount calculation unit 12, a search unit 13, an extraction unit 14, an index acquisition unit 15, and an evaluation unit 16.
The control unit 10 promotes anonymization of the document data by evaluating the risk of the related information being searched from the document data by these functional units.

The morphological analysis unit 11 performs morphological analysis on the target document data and divides it into words. Further, the morphological analysis unit 11 extracts specific parts of speech (for example, nouns, verbs, etc.) that may pose a risk from the obtained words.

The information amount calculation unit 12 calculates the information amount of each word extracted by the morphological analysis unit 11.
The information amount I (x) of the word x can be expressed by, for example, I (x) = −logP (x). Note that P (x) represents the probability of appearance of the word x, and is obtained by dividing the number of appearances of x by the total number of words. Alternatively, the information amount I (x) may be calculated by an index such as TF-IDF using the document data set D.

The search unit 13 performs a Web search by combining up to a specified maximum number (m) of words among a predetermined number (n) of words having a high amount of calculated information, and performs a Web search from the top of the search results. To get.
The number of combinations is Σ _m ( _n C _m ), and depending on the designation of n and m, the number of searches for all the combinations becomes enormous. Therefore, an upper limit may be set for the number of searches, or the number of words (keywords) used for one search may be fixed to a predetermined number instead of being varied up to a maximum of several meters.
The search unit 13 changes the pattern of word combinations, performs Web searches a specified number of times, and acquires the top ranks of each search result (for example, 10 items each).

The extraction unit 14 extracts a proper noun satisfying a predetermined condition from the search results acquired by the search unit 13.
For example, when the document data is an accident report or the like, the proper noun corresponds to the name of the victim, and the attacker associates the document data with the document data so that sensitive information about the individual is known.

The index acquisition unit 15 acquires an index indicating the topicality of the document data and provides it to the evaluation unit 16.
The topicality is, for example, the degree of injury due to an accident, and indicates the amount of related information, that is, the ease of searching. This index may be manually given to the document data in advance, or may be given according to the content of the document data by using an existing language processing method.
For example, the index acquisition unit 15 classifies the contents of the document data into one of predetermined categories (for example, serious or minor injuries, or fatal accidents or non-fatal accidents) by machine learning, and is associated with this category. Get the index.

The evaluation unit 16 includes words included in a predetermined number (n) of words extracted from the document data and not included in the combination used for the search with respect to the entire search results acquired by the search unit 13. Evaluate the risk of linking with document data based on the degree of agreement with the group.
Specifically, for example, the evaluation unit 16 includes, among the search results acquired by the search unit 13, words having a matching degree exceeding the threshold value, that is, words that are the same as or similar to words that were not used as the search keyword. Evaluation may be based on the percentage of search results (articles).

Further, the evaluation unit 16 adjusts the risk evaluation according to the index obtained from the index acquisition unit 15. That is, when the topicality of the document data is high, there is a high possibility that related information will be searched, so the risk is highly evaluated.
Further, the evaluation unit 16 adjusts the risk to a high level when the extraction unit 14 extracts a proper noun such as a victim's personal name.

The evaluation unit 16 may further evaluate the risk for each combination of words that have been searched on the Web, and evaluate the individual risk for each word by integrating these risks. For example, it is determined that there is a risk that a word included in a search keyword when a search result in which the degree of matching of words exceeds a threshold value is obtained is a predetermined value or more. Furthermore, words that are judged to be similarly high risk in different combinations are evaluated as having higher risk.
The obtained word-by-word evaluation is presented to the user to promote anonymization of words with high individual risk. Alternatively, words with a predetermined or higher individual risk may be anonymized by being automatically generalized, or generalization candidates may be presented.

Further, the evaluation unit 16 may re-evaluate the risk of the document data when a word having a high individual risk is generalized, and present to the user the amount of change (decrease) in the risk of the document data due to the generalization.
The target of generalization may be all words whose individual risk is equal to or higher than a predetermined value, but the evaluation unit 16 gives priority to the words having the higher individual risk, and sequentially gives the user the amount of change in the risk of the document data. You may present it.

FIG. 3 is a flowchart showing a risk assessment method in the present embodiment.
Here, the number of words that can be candidates for search keywords extracted from the document data n, the number of words used as search keywords m, the number of times web search is executed i, the number of search result acquisitions j, and the topicality (sensitivity) of the document data. ) Is input as a parameter. The index ε may be calculated by semantic analysis of document data as described above.

In step S1, the morphological analysis unit 11 performs morphological analysis on the target document data and extracts words having a specific part of speech such as a noun and a verb as words that are likely to be used as search keywords by an attacker. ..

In step S2, the information amount calculation unit 12 calculates the information amount of each word extracted in step S1 by an index based on the frequency of appearance.

In step S3, the search unit 13 extracts n words with a high amount of information calculated in step S2, randomly selects m words from them, and executes a Web search k times. Then, the search unit 13 obtains j search results from the top and i × j search results in total each time the Web is searched.

In step S4, the evaluation unit 16 determines the ratio of the i × j search results obtained in step S3 that include the same or similar words as the nm words that were not used as the search keyword. Select the above related documents. Then, the evaluation unit 16 calculates a risk evaluation value according to the ratio of the related documents selected to the entire search result.

In step S5, the extraction unit 14 determines whether or not there is a proper noun satisfying a specific condition such as the name of the victim in the related documents selected in step S4. If this determination is YES, the process proceeds to step S6, and if the determination is NO, the process proceeds to step S7.

In step S6, the evaluation unit 16 adjusts the evaluation value calculated in step S4 and highly evaluates the risk. In addition, the evaluation unit 16 may adjust the increase range or the increase rate of the evaluation value according to the ratio of the related documents in which the corresponding proper noun exists in step S5.

In step S7, the evaluation unit 16 adjusts the evaluation value based on the index ε indicating the topicality of the document data, and the higher the topicality of the document data, the higher the risk is evaluated.

According to the present embodiment, the risk evaluation device 1 performs a Web search using a combination of a specified predetermined number of words as a search keyword among a predetermined number of words having a high amount of information contained in the document data, and the search result is obtained. Get the specified number from the top. The risk assessment device 1 evaluates the risk associated with the document data based on the degree of matching with the word group included in a predetermined number of words and not included in the search keyword for the search result.
As a result, when the document data is released, the risk assessment device 1 simulates an actual attack to quantitatively and appropriately determine the risk that an attacker will obtain personal information and additional information related to the document data. Can be evaluated.

The risk assessment device 1 can simulate a plurality of search keyword selections by an attacker by performing a Web search by combining up to a specified maximum number of words, and can appropriately evaluate the risk of document data.

The risk assessment device 1 changes the pattern of the combination of search keywords, performs a Web search a specified number of times, and acquires the top of each search result.
As a result, the risk assessment device 1 can acquire search results from various viewpoints by simulating a plurality of search patterns, and can more appropriately evaluate the risk of obtaining related information.

The risk assessment device 1 evaluates the risk based on the percentage of the search results in which the degree of matching of words other than the search keyword exceeds the threshold.
As a result, the risk assessment device 1 can efficiently determine the related information associated with the document data and appropriately evaluate the risk.

The risk assessment device 1 adjusts the risk to a high level when a proper noun satisfying a predetermined condition is extracted from the search result.
As a result, the risk assessment device 1 can determine the possibility that the document data is associated with a proper noun such as an individual name or a school name by an attacker, and can appropriately evaluate the risk.

The risk evaluation device 1 adjusts the risk evaluation according to an index indicating the topicality of the document data.
For example, if the document data is an accident report, the number of articles varies depending on the degree of the accident, so if the topic is high in a serious accident, the article of the accident can be easily searched even from a word with a low amount of information. , The risk evaluation device 1 can appropriately evaluate the risk of associating related information in accordance with the actual situation.

Further, the risk evaluation device 1 classifies the contents of the document data into one of the predetermined categories by machine learning, and acquires the index associated with these categories to appropriately determine the index that is not determined in advance. Can be given to and the risk can be evaluated appropriately.

The risk assessment device 1 evaluates the risk for each combination of words, and evaluates the individual risk for each word by integrating the evaluation results.
As a result, the risk assessment device 1 can reduce the risk of the document data by presenting words with high individual risk contained in the document data and promoting anonymization before publication, or by automatically generalizing the words. can.

Further, the risk assessment device 1 re-evaluates the risk of the document data when the individual risk generalizes words having a predetermined value or more, and presents the amount of change in the risk of the document data due to the generalization.
Thereby, the risk assessment device 1 can show how much the risk of the document data is reduced by what kind of generalization, and can make the user perform anonymization of the document data at an appropriate level.

Although the embodiments of the present invention have been described above, the present invention is not limited to the above-described embodiments. Moreover, the effects described in the above-described embodiments are merely a list of the most suitable effects resulting from the present invention, and the effects according to the present invention are not limited to those described in the embodiments.

In the above-described embodiment, the Web search is performed by the word included in the document data to be evaluated, but in reality, it is conceivable that the search is performed again by the word included in the search result.
Therefore, the risk evaluation device 1 similarly calculates the amount of information of a word from the related documents searched for the risk evaluation, and when a word having a predetermined amount of information or more is included, the search keyword including these words is used. You may perform the Web search again.
As a result, the search behavior of the attacker can be simulated more faithfully, and a more appropriate evaluation of the risk can be expected.

The risk assessment method by the risk assessment device 1 is realized by software. When realized by software, the programs that make up this software are installed in the information processing device (computer). Further, these programs may be recorded on a removable medium such as a CD-ROM and distributed to the user, or may be distributed by being downloaded to the user's computer via a network. Further, these programs may be provided to the user's computer as a Web service via a network without being downloaded.

1 Risk assessment device 10 Control unit 11 Morphological analysis unit 12 Information amount calculation unit 13 Search unit 14 Extraction unit 15 Index acquisition unit 16 Evaluation unit 20 Storage unit

Claims (12)

An information amount calculation unit that calculates the amount of information for each word contained in the document data,
A search unit that performs a Web search by combining a plurality of words from a predetermined number of words from the top of the amount of information and acquires a predetermined number from the top of the search results.
Document risk due to association with the document data based on the degree of matching with the word group included in the predetermined number of words and not included in the combination with respect to the search result acquired by the search unit. A risk assessment device equipped with an evaluation unit that evaluates. The risk assessment device according to claim 1, wherein the search unit performs a Web search by combining up to a designated maximum number of words. The risk assessment device according to claim 1 or 2, wherein the search unit changes the pattern of the combination, performs a Web search a specified number of times, and acquires a higher rank of each search result. The risk assessment device according to any one of claims 1 to 3, wherein the evaluation unit evaluates based on the ratio of the degree of matching exceeding the threshold value among the search results acquired by the search unit. It is provided with an extraction unit that extracts a proper noun satisfying a predetermined condition from the search results acquired by the search unit.
The risk assessment device according to any one of claims 1 to 4, wherein the evaluation unit adjusts the document risk to a high level when the proper noun is extracted. It is equipped with an index acquisition unit that acquires an index indicating the topicality of the document data.
The risk assessment device according to any one of claims 1 to 5, wherein the evaluation unit adjusts the assessment of the document risk according to the index. The risk assessment device according to claim 6, wherein the index acquisition unit classifies the contents of the document data into any of a predetermined category by machine learning, and acquires an index associated with the category. The information amount calculation unit calculates the amount of information of each word included in the document data of the search result in which the degree of matching exceeds the threshold value.
The risk assessment according to any one of claims 1 to 7, wherein when the document data of the search result contains a word having a predetermined amount of information or more, the search unit performs a Web search again by a combination including the word. Device. The risk assessment device according to claim 1 to claim 8, wherein the evaluation unit further evaluates the document risk for each of the combinations and evaluates the individual risk for each word by integrating the document risks. The evaluation unit re-evaluates the document risk with respect to the document data when the individual risk is generalized according to a predetermined rule, and presents the amount of change in the document risk due to the generalization. The risk assessment device according to 9. An information amount calculation step that calculates the amount of information for each word contained in the document data,
A search step of performing a Web search by combining a plurality of words from a predetermined number of words from the top of the amount of information and acquiring a predetermined number from the top of the search results.
Document risk due to association with the document data based on the degree of matching with the word group included in the predetermined number of words and not included in the combination with respect to the search result acquired in the search step. The evaluation steps to evaluate and the risk assessment method performed by the computer. A risk assessment program for operating a computer as the risk assessment device according to any one of claims 1 to 10.

Images