# Privacy Preservation and Analytical Utility of E-Learning Data Mashups in the Web of Data
## 5 Evaluation
### Empirical Evaluation
Because \(Qppc\) is the result of a one-way hash function strengthened with a nonce, the mashup coordinator could not derive the students' identifiers in a feasible computational time and, thus, re-identify the records. After integrating the quasi-identifier attributes of each student to form the aggregate quasi-identifier \(Q_{join}=(age,submission)\), the mashup coordinator \(k\)-anonymized the aggregate quasi-identifier values of the 342 students with \(k=5\). As expected, the anonymization process resulted in a dataset consisting of \(k\)-anonymous groups (5-anonymous groups), with the number of records in each \(k\)-anonymous group always greater than or equal to 5. Each generated 5-anonymous group contains the masked aggregate quasi-identifier for that group and the connectors \(Qppc\) of the students belonging to the group. As shown in  
Figure 2: Execution result of the PPVD mashup protocol on an excerpt of 10 records. Quasi-identifier attributes are marked in bold. The asterisk identifies the masked attributes. Figure 3, the 5-anonymous groups are formed by 5 records of students, i.e., 5 \(Qppc\), and the masked aggregate quasi-identifier of the group, e.g., the last 5-anonymous group has the masked aggregate quasi-identifier (\(age^{\bullet}\), \(submission^{\bullet}\)) = (53, 60). In the confidential data collection carried out in step 9 of the protocol, the mashup coordinator obtained the confidential attributes of the 342 students along with the privacy-preserving connectors \(Cppc\) and the masked aggregate quasi-identifiers. Because the connectors in the confidential data collection, \(Cppc\), were different from those used in the quasi-identifier collection, \(Qppc\), the mashup coordinator could not link \(Cppc\) with their corresponding \(Qppc\), causing the dissociation between the confidential attributes and the original quasi-identifiers. The mashup coordinator only succeeded in making ambiguous associations. The students' confidential data were associated with the quasi-identifiers of at least five students, those belonging to their 5-anonymous groups. The effects of the 5-unlinkability can be verified on any record of those shown in Figure 4. For example, the confidential attributes \((score,disability,finalresult)~{}=~{}(25,N,fail)\) of the eighth student cannot be linked to their original quasi-identifier attributes \((age,submission)=(51,61)\) because the connector \(Cppc=deb6...e63b\) does not match \(Qppc=e353...8 ba8\). By using the student's masked aggregate quasi-identifier (53, 60), the confidential attributes \((25,N,fail)\) can be linked to at least five different original aggregate quasi-identifiers (65, 53), (38, 68), (51, 61), (64, 54),  
Figure 3: (**a**) Data partition sent by the provider \(P_{a}\) during the quasi-identifier collection (step 4 of the protocol). (**b**) Data partition sent by the provider \(P_{b}\) during the quasi-identifier collection (step 4 of the protocol). (**c**) \(k\)-anonymized and integrated quasi-identifiers with \(k=5\) (steps 5 and 6 of the protocol). Quasi-identifier attributes are marked in bold. The asterisk identifies the masked attributes. and \((46,64)\). Therefore, the probability that the mashup coordinator correctly correlates the confidential attributes of the eighth student with their identity is at most \(1/5\). We can conclude that the mashup coordinator's probability of correctly correlating the confidential attributes to the original quasi-identifiers is \(1/k\) at most, thus verifying the \(k\)-unlinkability property. Logically, the uncertainty will be higher for a higher value of \(k\). As a consequence of the \(k\)-unlinkability property, if the mashup coordinator had re-identified the students through data linkage attacks by using their original quasi-identifiers and external data sources, it would not be able to link students' identities to their confidential attributes unambiguously.