Enhanced Privacy Preserving for Social Networks Relational Data Based on Personalized Differential Privacy

Chinese Journal of ElectronicsVolume 31, Issue 4 p. 741-751 Information Security and CryptologyOpen Access Enhanced Privacy Preserving for Social Networks Relational Data Based on Personalized Differential Privacy Haiyan KANG, Corresponding Author Haiyan KANG [email protected] School of Information Management, Beijing Information Science and Technology University, Beijing, 100192 ChinaSearch for more papers by this authorYuanrui JI, Corresponding Author Yuanrui JI [email protected] School of Information Management, Beijing Information Science and Technology University, Beijing, 100192 ChinaSearch for more papers by this authorShuxuan ZHANG, Shuxuan ZHANG Computer School, Beijing Information Science and Technology University, Beijing, 100192 ChinaSearch for more papers by this author Haiyan KANG, Corresponding Author Haiyan KANG [email protected] School of Information Management, Beijing Information Science and Technology University, Beijing, 100192 ChinaSearch for more papers by this authorYuanrui JI, Corresponding Author Yuanrui JI [email protected] School of Information Management, Beijing Information Science and Technology University, Beijing, 100192 ChinaSearch for more papers by this authorShuxuan ZHANG, Shuxuan ZHANG Computer School, Beijing Information Science and Technology University, Beijing, 100192 ChinaSearch for more papers by this author First published: 01 July 2022 https://doi.org/10.1049/cje.2021.00.274 This work was partially supported by the National Social Science Fund (21BTQ079), the Ministry of Education of Humanities and Social Science Project (20YJAZH046), and the National Natural Science Foundation of China (61370139) AboutSectionsPDF ToolsRequest permissionExport citationAdd to favoritesTrack citation ShareShare Give accessShare full text accessShare full-text accessPlease review our Terms and Conditions of Use and check box below to share full-text version of article.I have read and accept the Wiley Online Library Terms and Conditions of UseShareable LinkUse the link below to share a full-text version of this article with your friends and colleagues. Learn more.Copy URL Share a linkShare onFacebookTwitterLinkedInRedditWechat Abstract With the popularization and development of social software, more and more people join the social network, which produces a lot of valuable information, but also contains plenty of sensitive privacy information. To achieve the personalized privacy protection of massive social network relational data, a privacy enhancement method for social networks relational data based on personalized differential privacy is proposed. And a dimensionality reduction segmentation sampling (DRS-S) algorithm is proposed to implement this method. First, in order to solve the problem of inefficiency caused by the excessive amount of data in social networks, dimension reduction and segmentation are carried out to divide the data into groups. According to the privacy protection requirements of different users, we adopt sampling method to protect users with different privacy requirements at different levels, so as to realize personalized different privacy. After that, the noise is added to the protected data to satisfy the privacy budget. Then publish the social network data. Finally, the proposed algorithm is compared with the traditional personalized differential privacy (PDP) algorithm and privacy preserving approach based on clustering and noise (PBCN) in real data set, the experimental results demonstrate that the quality of privacy protection and data availability of DRS-S are better than that of PDP algorithm and PBCN algorithm. I. Introduction Social network privacy information can be divided into two kinds. One is personal sensitive information, such as personal mobile phone number, family address, disease, income, etc. The other is connecting information between people in social networks[1], such as relatives, classmates or colleagues. Disclosure of any type of information in social networks can pose a threat to privacy. Therefore, it is of great significance to identify and classify privacy information. Effective protection strategy should be adopted according to specific information categories. This paper mainly studies the relational data in social networks. Differential privacy[2] is considered as a powerful privacy model. It provides a powerful and excellent privacy guarantee for aggregated data analysis. But the model is limited to providing all individuals with the same level of privacy protection. Not all users need the same level of privacy protection. We use sampling method to realize personalized differential privacy (PDP), which improve the utilization of data and strengthens the protection of privacy. The amount of social network data is exponentially increasing, and data explosion has a great impact on data processing. The first problem is that streaming or real-time systems are often limited by computing and storage capabilities. It is not always possible to put all the data into memory, and the computational power is not sufficient to meet the real-time response requirements. To overcome these limitations, parallel and distributed computing is often used. Secondly, machine learning algorithms usually train only one subset of algorithms. Data sets are called training sets, and then use the remaining data sets to evaluate the effectiveness of the algorithm, rather than training all data. Thirdly, in differential privacy settings, implementing privacy protection for all data will reduce the usefulness of data. When data set is decomposed into arbitrary disjoint subsets, queries on these disjoint partitions provide less differential privacy costs when executing query tasks[3]. In general, dealing with only a subset of sensitive data will reduce the risk of leakage of sensitive information and improve the effectiveness of releasing data. The main purpose of this paper is to realize the personalized privacy protection of social network relational data. The main contributions of this paper are as follows: 1) A privacy protection method for social network relational data is proposed. And a new dimensional reduction subsection sampling (DRS-S) algorithm is proposed to implement this method. This algorithm innovatively combines the subsection method with the sampling method. 2) Personalized privacy protection should be implemented according to user’s privacy requirements. Under the premise of protecting all users’ privacy information, the hierarchy of users’ privacy protection needs is divided in order to achieve hierarchical protection. Through theoretical derivation and experimental comparison, it is proved that this method can satisfy the personalized differential privacy. 3) Experiments show that the DRS-S algorithm proposed in this paper can guarantee the good availability of data and the quality of user privacy protection. The concepts and methods involved are described in the Section II. In Section III, the DRS-S mechanism is proposed and is proved to satisfy the PDP. Section IV details the process and algorithm of DRS-S data release. Section V conducts experimental evaluation on the proposed algorithm in social networks data set. The conclusion is in the last section. II. Preliminaries In this section, we will introduce the basics of this article. Firstly, the concept of differential privacy is briefly reviewed. Then the concept of personalized differential privacy is introduced. Finally, the related works are introduced. 1. Differential privacy Social network is defined as an unweighted graph G = ( V , E ) ∈ G , in which V represents a collection of user entities in a social network, E represents relationships between users (for example, friendship, cooperation, and connections). e v i , v j ∈ E is the edge between v i and v j . V = n 0 , V is the number of the nodes in G. G ' is the graph obtained by deleting or adding an edge from G. If the minimum change d G , G ' ≤ 1 , the two graphs G and G ' are neighbors. G → e G ' denotes G and G ' are neighbors. Definition 1 (Differential privacy[4]) The conditions of algorithm M : G → G ' satisfies differential privacy: if for any two neighboring graphs G and G ' , and for any possible output O ∈ R a n g e M , there is P r M G ∈ O ≤ e ε · P r M G ' ∈ O In this definition, ε ( ε > 0 ) is a publicly known privacy parameter. It controls the intensity of differential privacy guarantees. The larger the ε is, the weaker the privacy intensity is. And the smaller the ε is, the greater the privacy intensity is. When it is small enough, e ε ≈ 1 + ε . According to the differential privacy method, f G should be perturbed by the privacy algorithm before releasing, so that the edge information of G can be hidden in the output. Differential privacy has sequence composition property. In other words, there are k methods: M 1 , … , M k . If each method independently satisfies the differential privacy, the sequence combination of these methods M = { M 1 , … , M k } also satisfies differential privacy, in which ε ' = ∑ i = 1 k ε i . For numeric data, the most common way to achieve differential privacy is to add appropriate random noise to the output. In this paper, when studying social network relational data, we adopt an exponential mechanism, which is more suitable for non-numeric data to realize differential privacy. Definition 2 (Exponential mechanism[5]) It can be used to realize differential privacy by using exponential mechanism for non-numeric functions or for a function that has no effect on adding noise. The exponential mechanism uses the score function s G , r , which returns a real value score to indicate the quality of output r with respect to the real output f G . The higher the score means the closer r get to the real output f G . For a given score function s, the exponential mechanism is expressed as ε ε s . According to the scoring function s G , r , if the output of method ε ε s D is proportional to e x p ε s ( G , r ) / 2 Δ s , it satisfies the differential privacy. In the method, Δ s is the global sensitivity of the scoring function, Δ s = m a x G G ' , r ∈ R s G , r − s G ' , r . 2. Personalized differential privacy Definition 3 (Privacy requirements[6]) It is users’ personalized privacy preference P, and the smaller the P is, the stronger the privacy preference is. Symbol P v represents the privacy requirements of user v ∈ V . We describe all users’ privacy requirements as an orderly set of pairs. For example, P = v 1 , ε 1 , v 2 , ε 2 , … , while v i ∈ V . Each user v i ∈ V maintains corresponding personalized privacy preference or assigns default privacy level. Any edges in social network graph G should be protected, the privacy requirement of edge e v i , v j is m i n P v i , P v j . Definition 4 (Personalized differential privacy[6]) Under the privacy requirements P, a random method M satisfies P-personalized differential privacy (P-PDP): if each pair of two neighboring graphs G and G ' , while G → e i j G ' and e i j = e v i , v j , and for any possible output O ∈ R a n g e ( M ) , there is P r M G ∈ O ≤ e m i n P v i , P v j · P r M G ' ∈ O The PDP provides similar strength privacy protection as the protection provided by traditional differential privacy. But the privacy guarantee of PDP is personalized to meet the needs of each user. Definition 5 (Sequence composition[6]) Jorgensen et al. proposed that the constituent attributes of traditional differential privacy naturally extend to PDP. If M 1 and M 2 are two methods satisfying respectively P 1 -PDP and P 2 -PDP, M 3 : M 1 G , M 2 G satisfied PDP. Definition 6 (Sampling method) The general intelligent method to realize PDP is called sampling method. Sampling method realize privacy protection by introducing two different types of randomness: one is the non-uniform random sampling on the edge, the other is adding uniform random input using traditional differential privacy method. For the function f G , social network graph G, threshold t, privacy requirement P, R S G , P , t is defined as an algorithm that samples the edge e i j = e v i , v j based on probability of e i j . Probability for π e i j , t = e m i n P v i , P v j − 1 e t − 1 , if m i n P v i , P v j < t 1 , otherwise where min v P v ≤ t ≤ max v P v . The sampling method is expressed as S f G , P , t = D P f t R S G , P , t , including D P f t is the t-differential privacy method for any function f G . D P f t method can be either the Laplace method, or the exponential mechanism, or even the privacy methods that are combined by several different privacy algorithms 3. Related work With the development of social network data analysis, there are many ways to protect the privacy of social network data[7]. Existing studies are sorted out as shown in Table 1. The methods of perturbation and anonymity are deeply researched. Mittal et al.[8] proposed a perturbation-based approach by deleting all edges in the original graph and replacing each edge with a graph-based structural characteristic sampling false edge. Fard et al.[9] proposed a neighborhood randomized perturbation solution, which takes social network as a directed graph and randomly perturbs to local neighborhood to reduce the structural distortion of graph, but hides sensitive links. Based on the two isomorphic graph methods of k-anonymous formation, Cheng J et al.[10] designed a series of technology to improve efficiency and maintain the utility of anonymous data at the same time, and proposed a compound vertex recognition mechanism for data privacy protection and publication. Ahmed et al.[11] proposed a random matrix approach to OSN data publishing, which achieves storage and computational efficiency by reducing dimensions of adjacency matrices and achieves differential privacy by adding a small amount of noise. In addition, In Refs.[12] and [13], the privacy-preserving methods based on identity replacement and relationship encryption were proposed. Table 1. Classification of related work Classification Examples Existing problem Perturbation method Mittal et al.[8], Fard et al.[9] Cannot face the attacker with good knowledge background Anonymity method Cheng et al.[10], Ahmed et al.[11], Casas et al.[12], Zheleva et al.[13] Cannot face the attacker with good knowledge background Differential privacy method Gao et al.[14], Bichsel et al.[15], Rubinstein et al.[16], Leake et al.[17], Liu et al.[18], Huang et al.[19] Cannot provide personalized privacy protection in social network data protection However, these perturbations and anonymous methods are not enough to face the attacker with good knowledge background. Therefore, differential privacy techniques can provide more stringent privacy guarantees. In social networks, there are many ways to protect the privacy of edge and node, user relationship and identity. The following is a list of privacy protection methods published by maps. Gao et al.[14] proposed a comprehensive differentially private graph model which combines the dK-1, dK-2, and dK-3 series together. The dK-1 series stores the degree frequency, the dK-2 series adds the joint degree frequency, and the dK-3 series contains the linking information between edges. In this scheme, low dimensional series data makes the regeneration process more executable and effective, while high dimensional data preserves additional utility of the graph. Bichsel et al.[15] proposed the DP-Finder method, which is a novel approach and system that automatically derives lower bounds on the differential privacy enforced by algorithms. Rubinstein et al.[16] designed a sampler based on sensitivity sampling, which can automatically achieve ( ϵ , δ , γ ) random differential privacy. Leake et al.[17] proposed a straightforward sampler for estimating sensitivity of non-private mechanisms, their sensitivity estimates hold with high probability, any mechanism that would be ( ϵ , δ ) -differentially private under bounded global sensitivity automatically achieves ( ϵ , δ , γ ) -random differential privacy, Liu et al.[18] proposed a local differential privacy model for social network publishing that preserves community structure information. Huang et al.[19] proposed a privacy protection approach PBCN (privacy preserving approach based on clustering and noise). However, these differential privacy methods cannot provide personalized privacy protection in social network data publication. In order to solve the shortcomings of existing research, we proposed the dimensional reduction subsection sampling (DRS-S) algorithm based on differential privacy and implement personalized privacy protection according to users’ privacy requirements, using the advantage of differential privacy technology to resist background knowledge attack and combining with sampling method to achieve personalized privacy protection. III. DRS-S Algorithm 1. Problem description This paper aims at the release of social network graph. The social network is represented as the unweighted graph G = ( V , E ) , in which V represents the user nodes in the social network, E represents the edges. e = 1 means there is a link between nodes, while e = 0 means no links. The following points need to be considered when releasing relational data: 1) The purpose of releasing data is to further explore and utilize relational data, so it is necessary to ensure the availability of released data. 2) The background knowledge of the attacker is the subgraph information of the target attack node, so it is necessary to ensure the ability to publish data against attack. 3) Different users have different privacy requirements. According to different users’ different privacy preferences, personalized privacy protection should be realized. 4) The amount of social network data is huge, so it is necessary to reduce the time and space complexity of releasing algorithm. 2. DRS-S algorithm To solve the above problems, this paper proposes an algorithm of dimensionality reduction segmentation-sampling (DRS-S) for the release of social network relationship data, which innovatively combines segmentation method with sampling method. There are two purposes of data set segmentation. First, reduce the data dimension to facilitate further processing and analysis. The second is to analyze the subset data on a similar basis to make the data of the subset more comparable. In this paper, clustering method is used to segment the data set, and the segmentation strategy is based on the number of the same adjacent nodes. Fig. 1 shows a social network DRS-S process. Fig. 1Open in figure viewerPowerPoint Social network DRS-S process. Step 1: Dimensionality reduction segmentation; Step 2: Sampling; Step 3: Reconnection Step 1 Dimensionality reduction segmentation. The specific steps are as follows: 1) The node set V in the graph G was divided into sub-node set V 1 , V 2 , ⋯ , V k according to the number of the nodes. Elements with the same number of nodes enter the same sub-node set. According to factors such as the size of the data set, the number of groups is determined. The segmentation parameter k represents the number of groups. The number of nodes in each group is the ratio of the total number of nodes n and the segmentation parameter k, t = n / k . 2) According to the grouping of the nodes, construct the subgraph G 1 , G 2 , ⋯ , G k , V G i ≤ k , ⋃ 1 k G i ⊂ G . The internal links of the subgraph are the same, and the links between the subgraphs remain unchanged. 3) The subgraph nodes are labeled as 1 , 2 , ⋯ , k , which is convenient for further processing and analysis. Step 2 Sampling. Sampling method is a common and effective method to realize differential privacy personalization. The sample can fully represent all the data. π e i j , t is the probability of the edge being sampling, which depends on the user’s privacy requirement. Therefore, personalized privacy protection can be realized. According to the sampling method, we delete the nodes that do not meet the privacy requirements and get the subgraphs G i ' i = 1 , ⋯ , k and G i ' ⊂ G i . Since each subgraph has a different probability of sampling, sampling the subgraphs is helpful to achieve different privacy. Step 3 Reconnection. When the nodes are reconnected to the graph G ' , and the original connection relationship between nodes is basically the same. We construct a simple social network graph G. Table 2 is the information table of nodes and edges in segmented, sampled and reconnected graphs. Table 2. Units for magnetic properties Figure Node Edge Segment G1 (V1,V2,V3,V4) (V1,V2), (V1,V3), (V1,V4) G2 (V5,V6,V7,V8,V9) (V5,V6),(V6,V7),(V6,V9),(V7,V8),(V8,V9) Sample G 1 ' (V1,V2,V3) (V1,V2),(V1,V3) G 2 ' (V6,V7,V8,V9) (V6,V7)/(V6,V9)/(V7,V8)/(V8/V9) Reconnect G' (V1,V2,V3,V6,V7V8,V9) (V1,V2),(V1,V3),(V3,V6)(V6,V7),(V6,V9),(V7,V8)(V8,V9) 3. DRS-S algorithm satisfies the PDP Proof: DRS-S algorithm satisfies the personalized differential privacy. We use the notation G − x (or G + x ) to represent the dataset resulting from removing (adding to) the tuple x from G. Thus, we can represent two adjacent datasets as G and G − x . We will show that for any G and G − x while for any O ⊆ R a n g e D R S S , P r D R S S G , P , ε ∈ O ≤ e P m i n x P r D R S S G − x , P , ε ∈ O We will drop the subscript from P m i n x to simplify notation in the remainder of the proof. Observe that all of the possible outputs of R S G , P , ε can be divided into those in which x was selected, and those in which x was not selected. For the convenience of proof, RS is reduction segmentation and DRSS is DRS-S (dimensionality reduction segmentation-Sampling). Thus, we can write P r D R S S G , P , ε ∈ O as ∑ 1 ≤ i ≤ n ∑ Z ⊆ G − x i ( π x Pr [ R S ( G − x , P , ε ) = Z ] Pr [ D P ε ( Z + x ) ∈ O ] ) + ∑ 1 ≤ i ≤ n ∑ Z ⊆ G − x i ( ( 1 − π x ) Pr [ R S ( G − x , P , ε ) = Z ] Pr [ D P ε ( Z ) ∈ O ] ) = ∑ 1 ≤ i ≤ n ∑ Z ⊆ G − x i ( π x Pr [ R S ( G − x , P , ε ) = Z ] Pr [ D P ε ( Z + x ) ∈ O ] ) + ( 1 − π x ) Pr [ D R S S ( G − x , P , ε ) ∈ O ] (1) Since D P ε satisfies ε -PDP, P r D P ε Z + x ∈ O ≤ e ε P r D P ε Z ∈ O Thus, Eq. (1) can be rewritten as Pr [ DRSS ( G , P , ε ) ∈ O ] ≤ ∑ 1 ≤ i ≤ n ∑ Z ⊆ G − x i ( π x Pr [ R S ( G − x , P , ε ) = Z ] ( e ε Pr [ D P ε ( Z ) ∈ O ] ) ) + ( 1 − π x ) Pr [ DRSS ( G − x , P , ε ) ∈ O ] = π x ( e ε Pr [ DRSS ( G − x , P , ε ) ∈ O ] ) + ( 1 − π x ) Pr [ DRSS ( G − x , P , ε ) ∈ O ] = ( 1 − π x + π x e ε ) Pr [ DRSS ( G − x , P , ε ) ∈ O ] (2) In substituting for π x in Eq. (2), there are two cases for x that we must consider: the case in which P min x ≥ ε , and the case in which P min x < ε . Let us consider the former case first. By definition, when P min x ≥ ε , tuple x is selected with provability π x = 1 . Thus, we have Pr DRSS G , P , ε ∈ O ≤ ( 1 − π x + π x e ε ) Pr DRSS G − x , P , ε ∈ O = e ε Pr DRSS G − x , P , ε ∈ O ≤ e P min x Pr DRSS G − x , P , ε ∈ O When P min x < ε , expanding π x in 1 − π x + π x e ε in Eq. (2), we have 1 − π x + π x e ε = 1 + e ε − 1 π x = 1 + ( e ε − 1 ) e P min x − 1 e ε − 1 = 1 + e P min x − 1 = e P min x So, we have Pr DRSS G , P , ε ∈ O ≤ e P min x Pr DRSS G − x , P , ε ∈ O In the two cases above, the DRS-S algorithm satisfies the personalized differential privacy, which is proved to be true. IV. DRS-S Releasing Approach 1. Release process based on DRS-S The social network data releasing process based on DRS-S mainly includes following steps: segmentation and sampling, adding noise, verifying and correction, and releasing. The data releasing process is shown in Fig. 2. Firstly, in the process of segmentation and sampling, the original social network graph is divided into subgraph 1, subgraph 2,…, subgraph k. Then each subgraph is randomly sampled, and the sample results are subgraph 1 ' , subgraph 2 ' , …, subgraph k ' . According to the initial link relationship, the subgraphs are reconnected. Secondly in the process of noise addition, noise is added in the reconnected graph. For non-numerical social network data, the method of adding, deleting or modifying nodes and edges of social network is generally adopted to meet the needs of differential privacy protection. Adding virtual points and virtual edges as noise. The number is the same as the number of connections removed by the sampling process. Third, during the verification and correction process, verify the security and availability of data. There are different correction strategies for different problems. If the noise is too loud, we will modify the noise parameter. If the data loss rate is too high, we will modify social relationships or hide important information of high-risk users. Finally, in the process of releasing, release the social network graph of privacy protection. Fig. 2Open in figure viewerPowerPoint Data release using DRS-S. The social network data releasing process based on DRS-S mainly includes: segmentation sampling, adding noise, verifying and correction 2. Algorithm implementation process V. Experimental and Analysis Experimental environment: the operating system is macOS 10.13.1, the development environment is IntelliJ IDEA, the programming language is Java, and the experimental data analysis adopts MATLAB. Experimental data: ego-facebook dataset on SNAP data platform (4039 users, 88234 edges, the average clustering coefficient was 0.6055 and the average shortest path was 1.4734). A random number generator is used to generate a random decimal in [0,1] (step length is 0.1) as the user’s privacy requirement. For data sets of different sizes, the segmentation parameter is also different. After many experiments, it is concluded that when 10<k<100, the data availability of DRS-S algorithm is higher. Experimental content: Comparing the running time, the quality and availability of privacy protection, as well as the changes of sampling rate parameter T and segment parameter k. The sampling ratio parameter is respectively T=0.9, T=0.7, T=0.5 and T=0.3. The segmentation parameters are 10 , 20 , ⋯ , 100 . 1. Algorithm execution time This paper tests the execution time of DRS-S algorithm on Facebook dataset. The relationship between the execution time of the algorithm and the segmentation parameter k is studied and compared with PDP[6] algorithm and PBCN approach[19]. When k takes different values, the privacy budget ε in PDP and PBCN is equal to the average value of users’ privacy requirements P (P is taken from 0 to 1, and the step size is 0.1) after DRS-S algorithm sampling. The privacy budget ε of the PDP and PBCN in the following experiments adopts this rule. For example, there are five users after sampling. The privacy requirement is P = v 1 , ε 1 , v 2 , ε 2 , ⋯ . Then ε= (0.6+0.3+0.4+0.2+0.9)/5=0.5. The experimental results are shown in Fig. 3. Fig. 3Open in figure viewerPowerPoint Algorithm runtime. Runtime of DRS-S, PDP and PBCN algorithms on the facebook dataset, as sampling ratio parameter T and segmentation parameter k are varied. The sampling ratio parameter is taken T = 0 . 9 , T = 0 . 7 , T = 0 . 5 and T = 0 . 3 . The segmentation parameter is taken 10 , 20 , … , 100 . The privacy budget ε depends on the average value of users’ privacy requirements P Results analysis of Fig.3 shows that: 1)With the increase of partition parameter k, the execution time of the DRS-S algorithm first decreases and then increases. When k < 30 , the segmentation parameter k is small, and the scale of image data is still large. so the execution time of the segmentation method combined with sampling method is still very long, the execution time of DRS-S algorithm is longer than the PDP and PBCN. 2) When 30 < k < 80 , the execution time of DRS-S algorithm is shorter than the PDP algorithm. When 20 < k < 80 , the execution time of DRS-S algorithm is shorter than the PBCN algorithm. When k = 50 , the algorithm has the shortest execution time, so it is necessary to find the optimal segmentation parameter k in different scale data sets. 3) With the further increase of the segmentation parameter k, due to the excessive number of subgraphs after segmentation, the sum of time loss of each subgraph is too much, and the execution time of the algorithm keeps increasing. 4) With the decrease of sampling rate parameter T, the data volume decreases. Therefore, th