# Data Anonymization for Hiding Personal Tendency in Set-Valued Database Publication
## 3 Problem Formulation  
A set-valued database \(\mathcal{D}\) consists of \(n\) records \(t_{k}\) for \(k=1\) to \(n\). Each \(t_{k}\) is composed of record ID TID, user ID UID and a set IID of item ID's \(i\) obtained from \(I=\{i_{1},i_{2},i_{d},..,i_{|t|}\}\), such that each individual is directly associated with his/her items. Consequently, if such a database is published plainly, malicious data recipients can conduct some data analysis to infer sensitive information such as personal tendency of any individual in \(\mathcal{D}\). Note that only IID among the components of \(t_{k}\) may be \begin{table}
\begin{tabular}{l l l l l} \hline
**Method** & **Database Type** & **Technique** & **Record Structure** & **No. of Records** \\ \hline \((I,A)\)-privacy [11] & Relational & Access control query & Preserved & Kept \\ Amplification [10] & Set-valued & Randomization and noise addition & Changed & Increase \\ Split personality [12] & Set-valued & Splitting record & Changed & Increase \\ \(\rho\)-uncertainty [7] & Set-valued & Suppressing items & Changed & Decrease \\ Rank swapping [13] & Microdata & Random based swapping & Changed & Kept \\ Proposed method & Set-valued & Similarity based swapping & Changed & Kept \\ \hline \end{tabular}
\end{table} 
Table 2: Comparison of methods protecting personal sensitive information and personal tendency. processed during the anonymization. In such a case, we simply use \(t_{k}\) as a set of items, e.g., \(t_{3}=\{5,6,7,\) 10, 12\(\}\) in Table 1, if it does not cause confusion. In real life a person tends to have several preferences, for example, the person may like travelling, on-line shopping or culinary. In our problem formulation, a database owner who publishes his/her database specifies such preference as category. A set of all such categories is denoted by \(G\). Each item in the databases is assigned to one of these categories (see Figure 1). Then we can define personal tendency as follows. **Definition 1**. : _Personal tendency is a set of categories of items existing in the person's record. Each category has a weight that is the number of items belonging to the category in a record._  
In real situations, given a set-valued database processing items directly is more practical than handling categories in data analysis. Thus, we give another definition as follows. **Definition 2**. : _Personal tendency is a set of items belonging to a certain category that exists in a record._  
To hide personal tendency, we need a data anonymization method like swapping. The swapping refers to selecting items from a record as an itemset and swap the itemset to that of another record. In the case of random swapping, the items are selected randomly, while in our proposed scheme, we select items based on a certain procedure and consider them as an itemset for swapping. **Definition 3**. : _A swapping method imposed on the database \(\mathcal{D}\) with \(n\) number of \(t\) to generate a swapped database \(\widehat{\mathcal{D}}\) is said to hide personal tendency if items of a category in a record are swapped to other items of different category in another record in a way such that it cannot be associated to its original data subject._  
To avoid excessive distortion of record structure, swapped items should be carefully selected. We give the following definition of hiding personal tendency corresponding to the case that items from a category with the highest frequency are selected. **Definition 4**. : _A swapping method imposed to database \(\mathcal{D}\) with \(n\) number of \(t\) to generate a swapped database \(\widehat{\mathcal{D}}\) is said to hide personal tendency with a modest distortion if items of a category that has the highest frequency are swapped to another record in a way such that it cannot be associated to its original data subject._  
As an example, based on Figure 1 and Table 1, we can see that a user with UID = 003 has a more tendency toward On-line shopping since the on-line shopping category has two items with IID = {6, 7} while the other category has only one item.