B07

Research Abstracts on Spatial Information ScienceCSIS DAYS 2016

Privacy-preserving Trajectory Data Publishing from Adversary Having Limited Information
Seongun Choi, Toshiro Hikita, Rie Shigetomi Yamaguchi
Graduate School of Information Science and Technology, The University of Tokyo
Email: < song@yamagula.ic.i.u-tokyo.ac.jp > Web: < http://www.yamagula.ic.i.u-tokyo.ac.jp >(1) Motivation: Location aware devices and location
based services (LBSs) are widely spread nowadays.
In LBSs, customers provide their location to a service
provider and the service provider provides adequate
service based on the location information. Those
trajectory data earned from customers are collected
to be analyzed with data mining tools, so that they
could increase their service quality and profit.
Furthermore, those mining results benefit othervarious applications such as city development, travel
recommendation, location based advertising, etc.
Data publication is necessary to fully utilize those
applications because data is collected by limited
companies and organizations. Since data involves
personal information, PPDP (privacy preserving datapublication) is considered. The most famous privacy
notion in this field is k-anonymity and it is well used
nowadays. It makes attributes which can be a hint toidentify (quasi identifier) individuals to be same withother k-1 individuals. Later, confidence bounding is
proposed to complement k-anonymity. It sanitizes
data to make sensitive attributes diversed so thatadversary cannot confidently infer sensitiveinformation. It is hard to make trajectory data tosatisfy both notions because trajectory can be a quasiidentifier and a sensitive attribute. Since both notions
are having conflicting goals of similarity anddissimilarity, it is challenging to satisfy both notions.
We are studying on this challenges by setting aweaker adversary.
(2) Approach: We suggest a new adversary model whohas side information of limited locations of transit
ridership stations and attempt to identify victim’s
origin or destination, which usually be home andoffice. We model trajectory as a sequence of location
points and classify each point to quasi-identifiers orsensitive attributes. Then, we propose an algorithm
that sanitizes the trajectory data to be safe fromprivacy threat.
(3) Originality: For the trajectory data, most researches
except Terrovitis and Mamoulis (2008) limitedly
focused on k-anonymity. Terrovitis and Mamoulis(2008) considered privacy threat of location to beinferred, however, they tried to make every location
points to be safe from attribute linkage, which led thedata to be distorted excessively. Our work differsfrom them because we set specific adversary modeland specific sensitive attributes. We also definedminimum distance r that represent the distance
between sensitive attributes, to care close values. By
setting r, we strictly care of confidence bounding.
(4) Acknowledgements: Spatial data were provided by
the Center for Spatial Information Science of The
University of Tokyo, CSIS joint research No. 558.
(5) References:Sweeney, Latanya. (2002) k-anonymity: A model forprotecting privacy. International Journal of
Uncertainty, Fuzziness and Knowledge-Based
Systems, 10(5), 557-570.
Wang, Ke, Benjamin CM Fung and S. Yu Philip.
(2007) Handicapping attacker's confidence: analternative to k-anonymization. Knowledge andInformation Systems, 11(3), 345-368.
Terrovitis, Manolis, and Nikos Mamoulis. (2008)
Privacy preservation in the publication of trajectories.
Proceeding MDM '08 Proceedings of the The Ninth
International Conference on Mobile DataManagement, 65-72.

(c) OpenStreetMap contributors

Fig 1：The distribution of destinations (red dot) got off at Ochanomizu station- 24 -