KR101519449B1 - Anonymizing Device and Method using Information theory approach of Electronic Medical Records - Google Patents

Abstract

Disclosed is an apparatus, method and recording medium for anonymizing information based on information theory of electronic medical records. A storage unit for storing data of an electronic medical record (EMR), an entropy calculation unit for calculating an entropy of individual attributes of stored data, an attribute combination unit for generating attribute combinations by combining individual attributes, A joint entropy calculation unit for calculating a joint entropy for the generated property combinations, a dependency calculation unit for calculating a dependency of the calculated joint entropy, a property having a property less than a predetermined information loss among combinations of attribute of joint entropy and dependency And an k-re-identification preventing unit for anonymizing data using a k-anonymity based on the selected combination of attributes and an attribute combination selecting unit for selecting a combination.

Description

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an anonymizing apparatus and method using an information theory of electronic medical records,

The present invention relates to an apparatus and method for anonymizing, and more particularly, to an apparatus and method for anonymizing information using electronic medical record information theory.

The electronic medical record is a medical record created in the clinical field. In addition to the original purpose of supporting medical practice, recently, it has been important to develop a new medical technology by analyzing medical information, . However, since it contains personal information of patients, it is restricted to be disclosed to researchers. Therefore, there is a great demand for anonymization technology that protects personal information without damaging the medical information itself.

Conventional studies focus mainly on deletion or concealment of information items to be protected, and there is a risk that private information may be exposed to an unexpected path in the future. In order to reduce the risk of such exposure, anonymization has been continuously studied, and many studies have been conducted based on the k-anonymity condition.

Disclosure of the Invention An object of the present invention is to provide a personal identification information anonymization technique and an anti-re-identification technique in anonymization.

FIG. 1 (a) is a view for explaining a conventional personal identification information anonymization technique (De-identification). Personal identification information anonymization is a technique for performing anonymization by deleting personal identification information. At this time, information that is intuitive to identify an individual such as a name, a resident registration number, etc. corresponds to the person identification information. That is, the personal identification information anonymization technique deletes a name (Name) and an SSN (Social Security Number) included in the table 110 and anonymizes the table 130.

However, as shown in FIG. 1 (b), the personal identification information anonymization technique can remove an individual identification information and perform some degree of anonymization, but a situation in which an individual can be re-identified by a combination of remaining information Occurs. When the re-identification occurs, even if anonymization is performed as in the table 150 and the table 160, the table 180 is extracted by combining some remaining information. This will extract information about who is sick. Misuse of such information can lead to disadvantages for individuals in various fields, such as insurance companies, politics, and employment.

FIG. 2 is a diagram illustrating a technique for preventing re-identification. The re-identification prevention technique is anonymization based on information on which the personal identification information anonymization technique is performed. That is, the re-identification prevention technique reduces the probability of re-identification by generalizing information of a certain portion from the tables 220 and 230 obtained after anonymization of the personal identification information. In one embodiment, the re-identification prevention technique may perform generalization by erasing certain portions of the postal code information of table 220. [ Thus, the technique makes it impossible to re-identify the table 210 and the table 220, even when the table 250 is combined.

The most important technique for performing re-identification prevention is the k-re-identification prevention technique. The k-re-identification prevention technique includes three types of data. The three kinds of data are an explicit ID, sensitive information (sensitive information ID), and quasi-identifier (quasi-identifier).

Personal identification information is personal identification information, which is information directly used to identify an individual, such as a name, a social security number, and a telephone number.

Sensitive information is data generated by a specific agency and may be a sensitive attribute that must be protected by information that is close to the individual. In one embodiment, these may be prescription or diagnostic records provided by the hospital.

Among the items excluding the individual identifier information and the sensitive information, the semi-identifier may have a possibility to cause re-identification through connection with an item of the external table, or may be a combination of items to cause re-identification. That is, as shown in FIG. 3, the Age 310 and the ZIP 320 are entries painted in red on the table 310 and the table 320, respectively.

The k-re-identity prevention technique is a technique for generalizing data such that at least k types of records belonging to the above-mentioned quasi-identifiers are classified. The k-re-identity prevention scheme is a process of embedding data so that at least k records have the same quasi-identifier value.

Referring to FIG. 4 as an embodiment of the k-re-identification preventing method, FIG. 4 (a) is an original table and FIG. 4 (b) is a table on which a re-identification prevention technique is performed when k is 4. The quasi identifiers 410 and 430 in FIG. 4 (a) and FIG. 4 (b) are zip code, age and nationality, and the k value of the k- .

The k-re-identity prevention scheme for k = 4 normalizes the data so that at least four records, such as data 450, have the same quasi-identifier value.

In order to maximize the usefulness of the data, it is important to reduce the information loss because the information is lost in the process of generalizing the data. In order to reduce information loss, the conventional k-re-identification prevention technique has sought a method of clustering records and data as similar as in Fig. Table 530 shows a table that is a bundle of Work Class and Marital status when k = 3, and table 550 shows a table 530 that is the table . In particular, since k = 3, three records are identical.

As such, the conventional method increases the amount of computation exponentially when finding similar records for all combinations, and does not effectively reduce information loss. Information loss is a very important measure in evaluating the performance of the k-re-identification technique. In particular, the conventional method can not guarantee a certain performance, and the fact that the execution time increases exponentially must be solved.

An object of the present invention is to provide an apparatus and method for anonymizing information using an electronic medical record information theory that calculates attributes for performing generalization using combined entropy and dependency.

It is another object of the present invention to provide an apparatus and method for anonymizing information using an electronic medical record information theory that effectively prevents information loss in performing a k-re-identification prevention technique.

It is another object of the present invention to provide an apparatus and method for anonymizing information using an electronic medical record information theory that reduces the amount of output in performing the k-re-identification prevention technique.

An apparatus for anonymizing information using an electronic medical record information theory, comprising: a storage unit for storing data of an electronic medical record (EMR); an entropy calculating unit for calculating an entropy of individual attributes of the stored data; An attribute combination unit for generating attribute combinations by combining the individual attributes, a joint entropy calculation unit for calculating joint entropy for the generated attribute combinations, a dependency calculation unit for calculating the dependency of the calculated joint entropy, An attribute combination selector for selecting an attribute combination less than a predetermined amount of information loss among the attribute combinations of the binding entropy and the dependency, and an attribute combination selecting unit for selecting the attribute combination using the k-anonymity based on the selected attribute combination. And a k-re-identification preventing unit for anonymizing the data.

And an input unit for receiving new data of the electronic medical record and inputting a necessary variable k for gernerizing the data.

The attribute combination unit may sort the entropy or join entropy in descending order to remove an attribute or attribute combination including an entropy lower in priority or a lower binding entropy.

The attribute combination unit may sort the dependencies in ascending order to remove attribute combinations having a dependency higher than a predetermined priority order.

The combining entropy calculating unit may calculate the combining entropy for two different attributes according to the following equation.

[Mathematical Expression]

는 속성 조합된 상태인 ij에 대한 확률을 의미한다.Here, i and j represent states of individual attributes,

Is the probability for ij, the combined state of the attributes.

In order to calculate the dependency, the dependency calculation unit may calculate the conditional entropy of the binding entropy according to the following equation.

[Mathematical Expression]

는 개별 속성 y에 대한 개별 속성 x를 의미한다.here,

Means an individual attribute x for an individual attribute y.

The dependency calculation unit may calculate dependence of x on the individual attribute y as follows:

[Mathematical Expression]

는 개별 속성 y에 대한 엔트로피를 의미한다.here,

Is the entropy for the individual attribute y.

The attribute combination selection unit may repeat the process of performing the attribute combination unit, the combining entropy calculation unit, and the dependency calculation unit when there is no attribute combination less than the predetermined information loss amount.

An anonymizing method using an information theory of electronic medical records includes the steps of loading data of an electronic medical record (EMR), calculating an entropy for individual attributes of the retrieved data, Generating a combination entropy for the generated attribute combinations, calculating a dependence of the calculated binding entropy, combining the combination entropy and the attribute of the dependency Selecting an attribute combination less than a predetermined information loss amount and anonymizing the data using a k-anonymity based on the selected attribute combination.

Receiving new data of the electronic medical record, and inputting a necessary variable k for gerneralization of the data.

An apparatus and method for anonymizing information based on information theory of electronic medical records according to the present invention can calculate an attribute for performing generalization using combined entropy and dependency.

In addition, it is possible to effectively prevent information loss in performing the k-re-identification prevention technique.

In addition, the execution time can be shortened by reducing the amount of output in performing the k-re-identification prevention technique.

FIG. 1 (a) is a view for explaining a conventional personal identification information anonymization technique.
Fig. 1 (b) is a view for explaining re-identification as a prior art.
FIG. 2 is a view for explaining a conventional re-identification preventing technique.
FIG. 3 is a view for explaining a quasi-identifier of a prior art k -reference prevention technique.
FIG. 4 is a diagram for explaining a process of performing the k-re-identification prevention technique when k = 4 in the prior art.
FIG. 5 is a view for explaining a process of clustering members according to the prior art k-re-identification prevention technique.
6 is a block diagram illustrating the components of an anonymizing apparatus in accordance with an embodiment of the present invention.
7 is a block diagram illustrating components of a control unit according to an embodiment of the present invention.
FIG. 8 is a diagram illustrating a diagram for explaining entropy and combining entropy according to an embodiment of the present invention. Referring to FIG.
9 is a diagram for explaining a key-value pair structure based on a hash function according to an embodiment of the present invention.
10 is a diagram for explaining a data structure proposed based on a linked list according to an embodiment of the present invention.
Figure 11 is a graph illustrating a comparison of results that reduce unique patient information in accordance with an embodiment of the present invention.
FIG. 12 is a graph illustrating a comparison of time when an algorithm according to an embodiment of the present invention is performed.
13 is a flowchart illustrating an anonymization method according to an embodiment of the present invention.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings. In the drawings, the same reference numerals are used to designate the same or similar components throughout the drawings. In the following description of the present invention, a detailed description of known functions and configurations incorporated herein will be omitted when it may make the subject matter of the present invention rather obvious or understandable to those skilled in the art.

6 is a block diagram illustrating the components of an anonymizing apparatus in accordance with an embodiment of the present invention.

Referring to FIG. 6, the anonymizing device 1 can anonymize data of electronic medical records using a k-re-identification technique. An anonymizing device 1 can anonymize based on information theory to minimize information loss. The anonymizing device 1 may include an input unit 610, a control unit 630, an output unit 650, and a storage unit 670.

The input unit 610 can receive new data of the electronic medical record. The new data may be at least one of data on a new patient, data on modifications of existing patients, and data on additions of existing patients. The input unit 610 may receive a variable k necessary for anonymizing the data of the electronic medical record. The variable k is a variable required for generalization, and may be a variable necessary for generalizing the data so that at least k records have the same data value.

The control unit 630 may calculate an entropy for individual attributes of the electronic medical record stored in the storage unit 670. [ The control unit 630 may combine the individual attributes to generate attribute combinations. The control unit 630 can calculate the joint entropy for the generated attribute combinations and calculate the dependency of the calculated coupling entropy. The control unit 630 may select an attribute combination less than the predetermined information loss amount among the attribute combinations of the combining entropy and the dependency. Also, the control unit 630 can anonymize data using the k-re-identification prevention technique based on the selected attribute combination.

The output unit 650 can output the original data of the electronic medical record stored in the storage unit 670. The output unit 630 may output data obtained by anonymizing the original data. The output unit 650 may include at least one of a monitor, a liquid crystal, a projector, a TV and a hand-up display, and a printed matter.

The storage unit 670 may store data of the electronic medical record. The storage unit 670 may store an attribute combination in which individual attributes are combined. The storage unit 670 may store the value calculated by the controller 630. The calculated value may be at least one of entropy, coupling entropy, and dependency. The storage unit 670 may store an algorithm necessary for anonymizing.

FIG. 7 is a block diagram illustrating components of a control unit according to an embodiment of the present invention, and FIG. 8 is a diagram illustrating a diagram for explaining entropy and combining entropy according to an embodiment of the present invention. FIG. 10 is a view for explaining a key-value pair structure based on a hash function according to an embodiment of the present invention. FIG. 10 is a view for explaining a data structure proposed based on a linked list according to an embodiment of the present invention FIG.

Referring to FIGS. 7 to 10, the controller 630 may calculate individual attributes or combinations of attributes that can minimize information loss that may occur in the generalization process of anonymizing using the characteristics of entropy. The control unit 630 can calculate the dependency for quantitatively determining the entropy value in order to find the case where the entropy value increases due to the attribute combination. The control unit 630 includes an entropy calculation unit 710, an attribute combination unit 720, a combining entropy calculation unit 730, a dependency calculation unit 740, an attribute combination selection unit 750 and a k- ).

라 할 때, 개별 속성은 [수학식 1]과 같을 수 있다.
The entropy calculation unit 710 may calculate an entropy for individual attributes of data. The data may be at least one of personal identification information, sensitive information, and semi-identifiers. The entropy calculation unit 710 calculates the total entropy

, The individual attribute may be equal to Equation (1).

Here, j denotes the index of the attribute, r denotes the number of all attributes, and m denotes the number of values that the attribute can have.

를 인종이라고 가정한다면, 하기와 같을 수 있다.if

Is a race, it can be as follows.

In particular, entropy can mean the logarithm of the probability p _i to the state i of an individual attribute in an ensemble with a stochastic state distribution, and can be defined as: " (2) "

Accordingly, the entropy calculation unit 710 can calculate the entropy of the individual attribute using Equation (2). The entropy calculation unit 710 can define entropy 810 and 820 for two different attributes as shown in [Equation 3] and [Equation 4].

Here, i and j mean the state of the individual attribute, and p _i And p _j denote the probabilities for i and j, respectively.

Since the entropy calculating unit 710 must know the probability distribution of each attribute value, the number of occurrences of each attribute value can be calculated. Accordingly, the entropy calculation unit 710 can store the attribute values in the storage unit 670 using a hash map and a link list for efficient calculation of the probability distribution.

FIG. 9A is a block diagram of a key and a corresponding value (Mapped-value), and FIG. 9B is a table showing a result of an embodiment corresponding to FIG. 9A. The hash function performed by the entropy calculation unit 710 is an algorithm for connecting a large data set to a smaller data set using a key. Since hash maps have the advantage of being able to find data values at high speed, they are suitable for applying to electronic medical record data of large hospitals. If the value of the key 1010 is 0, the structure information of the associated value may be included. In FIG. 9B, the true structure information to be connected may include {Index, Name, Age} attributes.

FIG. 10 shows corresponding values using a linked list. The entropy calculation unit 710 may normally call the next link for each node having an address for the next node. The entropy calculator 710 may indicate the addresses 1030, 1050, and 1070 of the next set of links having the same or different values. Thus, the remaining fields may be associated values. This structure can be easily inserted or deleted without having to redistribute or reorganize the entire structure.

The entropy calculator 710 can check information on the number of corresponding values and index values of the corresponding values. The information can allow for faster access to data when calculating entropy. Also, the entropy calculator 710 may calculate the total entropy and then easily access the associated value using the index of the corresponding value associated with the key, if several associated values have a large entropy.

The attribute combination unit 720 may combine the individual attributes of the data to generate attribute combinations. The attribute combination unit 720 may sort entropy or join entropy in descending order to remove an attribute or combination of attributes that includes entropy lower in priority or lower binding entropy. The attribute combination unit 720 may sort the dependencies in ascending order so as to remove the attribute combination including the dependency higher than the predetermined priority order.

The combining entropy calculating unit 730 may calculate the combining entropy for the attribute combinations. The join entropy may be a measure of the uncertainty of the attribute combination, and the join entropy 830 for the two attributes may be defined as: " (5) "

는 속성 조합된 상태인 ij에 대한 확률을 의미한다.here,

Is the probability for ij, the combined state of the attributes.

와 같은 값이 산출될 수 있으며,

및

는 같은 값으로 인식할 수 있다. 따라서, 결합 엔트로피 산출부(730)가 고려해야 할 모든 가능한 속성 조합의 수는 [수학식 6]과 같을 수 있다.
The combining entropy calculating unit 730 may integrate the respective values into one using the delimiter to calculate the combined entropy of the different attribute values present in the data of the electronic medical record. In one embodiment, the combining entropy calculator 730 may combine age and occupancy attributes

Can be calculated,

And

Can be recognized as the same value. Therefore, the number of all possible attribute combinations that the join entropy calculation unit 730 should consider is equal to Equation (6).

Therefore, the combining entropy calculating unit 730 can define the sum of all the combining entropy as Equation (7).

The dependency calculation unit 740 can calculate the dependency of the binding entropy. The dependency calculation unit 740 may calculate the conditional entropy 850 and 860 in order to calculate the dependency. The conditional entropy 860 may be an entropy 820 of one of the entropy 810 and 820 of the individual attribute minus the other entropy 810. [ That is, the conditional entropy 860 may be the entropy of one entropy 820 minus the intersection entropy 880.

The dependency calculating unit 740 can calculate the conditional entropy using Equation (8).

는 개별 속성 y에 대한 개별 속성 x를 의미한다.here,

Means an individual attribute x for an individual attribute y.

The dependency calculation unit 740 can calculate the dependence of x on the individual attribute y using Equation (9).

The dependency calculator 740 can calculate the dependency from 0 to 1. If there is no association between the two attributes, the dependency calculator 740 can calculate a value of 0, and if the associations between the two attributes are perfect, the dependency calculator 740 can calculate a value of 1.

The attribute combination selection unit 750 can select an attribute combination less than a predetermined information loss amount among the attribute combinations of the calculated binding entropy and the calculated dependency. The attribute combination selection unit 750 can select an attribute combination having a high value of the binding entropy. However, since the entropy of individual attributes is high, the attribute combination selecting unit 750 can select an attribute combination reflecting the dependency because the entropy of the entities is high so that the combination entropy is increased by combining the attributes rather than when the entropy is high.

The attribute combination selection unit 750 may repeat the process of performing the attribute combination unit 720, the combining entropy calculation unit 730, and the dependency calculation unit 740 to calculate a better attribute combination. That is, when there is no attribute combination less than the predetermined information loss amount, the attribute combination selection unit 750 repeats the process of performing the attribute combination unit 720, the combining entropy calculation unit 730, and the dependency calculation unit 740 .

The k-re-identification preventing unit 760 can anonymize the data of the electronic medical record using the k-re-identification prevention technique based on the selected attribute combination. The k-re-identification preventing unit 760 can generalize data such that the types of the same record are at least k or more, with respect to the items classified by the identifier based on k input from the input unit 610. [ That is, the k-re-identification preventing unit 760 can generalize the data so that at least k records have the same quasi-identifier value.

FIG. 11 is a graph for explaining a comparison of results of reducing unique patient information according to an embodiment of the present invention. FIG. 12 is a graph illustrating a comparison between results obtained when an algorithm according to an embodiment of the present invention is performed FIG. 2 is a graph showing a comparison of the two cases.

Referring to FIG. 11 or 12, the anonymizing device 1 can perform a performance test using data designed to measure the health and nutritional status of US residents in the NHANES database. The NHANES database is a database that has been inspected and approved by the National Center for research. The performance experiments used NHANES 2009-2010 dataset and included various demographic information such as race, ethnicity, wage, age, nutritional status, and past history. The experiment data consisted of 43 attributes and 10,538 patient information. In the performance experiment, 41 attributes without sequence number were used.

property Entropy Explanation WTMEC2YR 12.27819 Full Sample 2 Year MEC Exam Weight WTINT2YR 11.63055 Full Sample 2 Year Interview weight RIDAGEMN 9.536705 Age in Months at Screening - Recode RIDAGEEX 9.408224 Age in Months at Exam - Recode INDFMPIR 7.163948 Ratio of family income to proverty RIDAGEYR 6.164925 Age at Screening Adjudicated - Recode DMDHRAGE 5.803402 HH Ref Person Age

Table 1 shows the result of sorting the attributes having a high entropy value in descending order by the anonymizing device (1). The result is a criterion for judging which attributes are generalized in the information loss by the anonymizing device 1. This is because the property with high entropy is more likely to cause information loss. However, even if the entropy value of a single attribute is low, there may be a case where entropy greatly increases due to the combination of attributes. In order to solve the above problem, the anonymizing device 1 calculates the entropy of all possible attribute combinations.

property Join entropy Dependency RIDAGEMN || WTMEC2YR 13.2899 0.694408 RIDAGEMN || WTINT2YR 13.25515 0.680377 RIDAGEEX || WTINT2YR 13.25303 0.669517 RIDAGEYR || WTMEC2YR 13.11552 0.433983 INDFMPIR || WTMEC2YR 13.10915 0.515882 RIDAGEEX || WTMEC2YR 13.0928 0.699998 DMDHRAGE || WTMEC2YR 13.08687 0.406862

Table 2 shows the result of calculating the combined entropy and dependence of all possible attribute combinations of the anonymizing device (1). Referring to Table 2, it can be seen that all attribute combinations have a larger binding entropy compared to the entropy of each attribute. That is, the join entropy in the data is necessarily greater than or equal to the entropy of each attribute.

property Join entropy Dependency RIDEXMON || RIDAGEMN 10.57111 0.012251 RIDAGEMN || SDMVPSU 10.56547 0.106382 RIDAGEMN || DMDHRGND 10.46379 0.072598 RIDAGEEX || SDMVPSU 10.43877 0.104853 RIDAGEYR || SDMVSTRA 9.934301 0.025412 DMDHRAGE || SDMVSTRA 9.461573 0.054165 DMDEDUC2 || INDFMPIR 9.147959 0.047965

Table 3 shows the results for attribute combinations in which the anonymizing device 1 has high binding entropy and low dependency. The anonymizing device 1 can find an attribute combination having a low dependency entropy value and a low dependency. In this way, the anonymizing device 1 can cause a relatively low information loss in the generalization process.

FIG. 11 shows the number of unique patients remaining when the combination of attributes is removed based on the algorithm proposed by the anonymizing device 1 and the random selection algorithm.

The anonymizing device 1 selected the attribute combination to be removed through three iterations. The anonymizing device 1 recommends five attributes or attribute combinations for the above three iterations, and performs additional iterative operations when the same attributes are selected.

Therefore, the result of FIG. 11 confirms that the anonymizing device 1 reduces unique patient information more quickly and efficiently than the result of the random selection algorithm.

FIG. 12 shows the execution time of the algorithm proposed by the anonymizing device 1. The performance test environment is a computer with 2.4GHz CPU and 3.5GB main memory specification.

It can be seen from the results of FIG. 12 that more time is consumed to calculate the joint entropy than to merge the data from the results. The proposed hash map based structure has a strong point to quickly find and access needed values. Thus, in each iteration, the whole process involved 5,000 searches and approaches. That is, it can be seen that the anonymizing device 1 efficiently reduces the calculation time.

13 is a flowchart illustrating an anonymization method according to an embodiment of the present invention.

Referring to FIG. 13, the anonymizing device 1 can anonymize the data of the electronic medical record using the k-re-identification prevention technique. An anonymizing device 1 can anonymize based on information theory to minimize information loss.

The anonymizing device 1 selects a high ranking entropy (S100). The anonymizing device 1 can select attributes having a high entropy by sorting the calculated entropy in descending order.

The anonymizing device 1 determines whether the result according to the attribute combination is sufficiently good (S110). The anonymizing device 1 can judge whether the result according to the attribute combination has a good performance. If there is an attribute combination having a good performance, the anonymizing apparatus 1 moves to step S170, and if there is no attribute combination having a good performance, the anonymizing apparatus 1 can move to step S120.

The anonymizing device 1 removes the attributes that are low binding entropy (S120). The anonymizing device 1 can remove the attribute having the lowest ranking entropy among the binding entropies arranged in descending order. In particular, in the first iteration, attributes with low entropy can be removed because the join entropy of the attribute combination is still calculated.

The anonymizing device 1 removes the attribute which is highly dependent (S130). The anonymizing device 1 can remove attributes having a high order of dependency among the ascending order dependencies. In particular, since the dependency is not yet calculated in the first iteration, step S130 may not be performed.

The anonymizing device 1 combines attributes (S140). The anonymizing device 1 can combine the individual attributes to generate the attribute combination according to the number of cases.

The anonymizing device 1 calculates a binding entropy (S150). The anonymizing device 1 can calculate the combining entropy for the generated attribute combinations. The join entropy may reflect properties for attribute combinations. Also, the value of the combining entropy can be highly dependent on the value of the individual entropy forming the combination.

The anonymizing device 1 calculates dependency (S160). The anonymizing device 1 can calculate the dependence of the calculated coupling entropy. The anonymizing device 1 can calculate the conditional entropy for the binding entropy before calculating the dependency.

The anonymizing device 1 selects an attribute combination (S170). The anonymizing device 1 can select an attribute combination that can exhibit optimized performance. The optimized attribute combination may be a combination of attributes or attributes having a high binding entropy and a low dependency.

The anonymizing device 1 performs a k-re-identification prevention technique (S180). The anonymizing device 1 can anonymize the selected attribute or combination of attributes using the k-re-identity prevention technique. The anonymizing device 1 can minimize information loss in anonymizing.

The present invention can also be embodied as computer-readable codes on a computer-readable recording medium. A computer-readable recording medium includes all kinds of recording apparatuses in which data that can be read by a computer apparatus is stored. Examples of the computer-readable recording medium include a ROM, a RAM, a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, and the like, and may be implemented in the form of a carrier wave (for example, transmission via the Internet) . The computer-readable recording medium may also be distributed to networked computer devices so that computer readable code can be stored and executed in a distributed manner.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is clearly understood that the same is by way of illustration and example only and is not to be taken by way of limitation in the embodiment in which said invention is directed. It will be understood by those skilled in the art that various changes in form and detail may be made therein without departing from the scope of the appended claims.

1: Anonymizing device
610: input unit 630:
650: output unit 670: storage unit
710: Entropy calculation unit 720: Attribute combination unit
730: Combined entropy calculation unit 740: Dependency calculation unit
750: Attribute combination selection unit 760: k-

Claims (9)

A storage unit for storing data of an electronic medical record (EMR);
An entropy calculation unit for calculating an entropy for individual attributes of the stored data;
An attribute combination unit for combining the individual attributes to generate attribute combinations;
A joint entropy calculation unit for calculating a joint entropy for the generated attribute combinations;
A dependence calculation unit for calculating a dependency of the calculated binding entropy;
An attribute combination selection unit for selecting an attribute combination less than a predetermined information loss amount among the attribute combinations of the binding entropy and the dependency; And
And an k-re-identification unit for anonymizing the data using a k-anonymity scheme based on the selected combination of attributes.
The method according to claim 1,
Further comprising an input unit for receiving new data of the electronic medical record and inputting a necessary variable k for gerneralization of the data.
The method according to claim 1,
Wherein the attribute combination unit comprises:
Wherein said entropy or binding entropy is sorted in descending order to remove an attribute or combination of attributes including entropy lower in priority or lower binding entropy.
The method according to claim 1,
The attribute combination unit
Wherein the dependency is sorted in ascending order so that a combination of attributes including a dependency whose priority is higher than a predetermined order is removed.
The method according to claim 1,
Wherein the combining entropy calculating unit comprises:
Wherein the combining entropy for two different attributes is computed as: < EMI ID =

[Mathematical Expression]

Here, i and j represent states of individual attributes,

Is the probability for ij, the combined state of the attributes.
The method according to claim 1,
The dependence calculation unit may calculate,
An anonymizing device using an information theory of electronic medical records that calculates conditional entropy for the binding entropy as: < EMI ID =

[Mathematical Expression]

here,

Means an individual attribute x for an individual attribute y.
7. The method according to claim 1 or 6,
The dependence calculation unit may calculate,
An anonymizing apparatus using an information theory of electronic medical records that calculates the dependence of x on the individual attribute y as: < EMI ID =

[Mathematical Expression]

here,

Is the entropy for the individual attribute y.
The method according to claim 1,
Wherein the attribute combination selecting unit comprises:
Wherein the attribute combining unit, the combining entropy calculating unit, and the dependency calculating unit are repeated if there is no attribute combination less than the preset information loss amount.
Loading data of an electronic medical record (EMR);
Computing an entropy for individual attributes of the imported data;
Combining the individual attributes to generate attribute combinations;
Computing a joint entropy for the generated attribute combinations;
Calculating a dependency of the calculated coupling entropy;
Selecting an attribute combination less than a predetermined amount of information loss among attribute combinations of the binding entropy and the dependency; And
And anonymizing the data using a k-anonymity based on the selected combination of attributes. ≪ RTI ID = 0.0 > 11. < / RTI >

Images