# Privacy Preservation and Analytical Utility of E-Learning Data Mashups in the Web of Data
## 5 Evaluation
### Empirical Evaluation  
This subsection empirically evaluates whether the proposed PPVD mashup protocol achieves \(k\)-unlinkability between the quasi-identifier and confidential attributes and, consequently, de-identifying sensitive data against passive adversaries. We used a simulated scenario with two data providers and one mashup coordinator to conduct the empirical evaluation. The data providers hold data partitions of OULAD [62], which contains data about courses, students, and their interactions with a VLE. Specifically, the provider \(P_{a}\) holds the _OULAD studentInfo_ as a vertical data partition with diverse demographic information about 342 students, plus their final results in the courses; the provider \(P_{b}\) holds the _OULAD studentAssessment_ as another vertical data partition, containing the results of a specific learning assessment (\(id\_assessment=1753\)). The attribute used as a connector in the execution of the protocol is the identifier attribute \(id\_student\). The attributes to be vertically joined are indicated in Table 4. We had to adjust the _age_ attribute in the data partition of \(P_{A}\) since OULAD already provides masked values for this attribute. In particular, the values of the _age_ attribute are generalized in three ranges: 0-35, 33-55, and >55. Since our protocol operates on non-anonymized data, for each \(id\_student\), a random synthetic value between the two limits was assigned. Data records with _age_ in the range 0-35 were assigned a value between 18 and 35; those between 35 and 55 were assigned a value between 36 and 55; and those greater than 55 received a value between 56 and 75. The protocol was evaluated in the worst-case scenario--when the passive adversary is the mashup coordinator. This party handles original quasi-identifiers and confidential attributes during the execution of the protocol, and, as discussed in Section 5.1, it may have more information than any other adversary. The method used to \(k\)-anonymize the set of aggregate quasi-identifiers resulting from the data mashup was the multivariate microaggregation method (using the mean as an aggregate) with a privacy parameter \(k\) equal to 5. The privacy-preserving connectors, \(Qppc\) and \(Cppc\), were built on the attribute \(id\_student\) using nonces of 128 bits and the SHA-256 as Cryptographic Hash function. \begin{table}
\begin{tabular}{l l l l} \hline \hline
**Data Partition** & **Attribute** & **Type** & **Description** \\ \hline \(AstudentInfo\) & age & quasi-identifier & age of the student \\ \(AstudentInfo\) & disability & confidential & indicates whether the student has declared a disability \\ \(AstudentInfo\) & final\_result & confidential & student’s final result \\ \(BstudentAssessment\) & date\_submitted & quasi-identifier & date of student submission, measured as the number of days since the start of the module presentation \\ \(BstudentAssessment\) & score & confidential & student’s score in this assessment \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Attributes of the data partitions held by \(P_{a}\) and \(P_{b}\). Figure 2 illustrates the result of the execution of the PPVD mashup protocol on an excerpt of 10 records. The web address with the full versions of the vertical data partitions and the output dataset is published in the Data Availability Statement section. To verify whether the proposed protocol fulfills \(k\)-unlinkability and, consequently, is capable of de-identifying sensitive data, we analyzed the information that the mashup coordinator handled during the execution of the protocol. In the quasi-identifier collection carried out in step 4 of the protocol, the mashup coordinator obtained the original quasi-identifiers of the 342 students along with the privacy-preserving connectors \(Qppc\), ordered by \(Qppc\). An extract of 10 records is shown in Figure 3. We have changed the order of the records to clarify the illustration.