# Analytics on Anonymity for Privacy Retention in Smart Health Data +
## 3 Proposed Multi-Faceted Anonymity Analytics Approach
### Balancing Generalization with Data Retention in Anonymization
#### 3.3.1 Intelligent Anonymity Balance (IAB) Algorithm  
We now briefly describe our anonymization algorithm, \(IAB\) (Intelligent Anonymity Balance) as also discussed in [15]. Given a data table \(T\) with a set of attributes \(A\) and a taxonomy tree for each shield attribute. Without loss of generality, we assume one anonymity requirements \(R\) with shield \(S\subseteq A\). The basic overview of the IAB algorithm is shown in Algorithm 1. ```
ProcedureIABAnonymization Inputs:\(T\), a table with a set of attributes \(A\), a set of anonymity requirement \(R\) with a set of anonymity shield attributes \(S\subseteq A\) and corresponding taxonomy trees of each attribute in \(S\). Output: a generalized table \(T\) of \(T\) where \(T^{\prime}\) has a maximum number of rows among all generalized tables of \(T\) satisfying \(R\). 1 For each violating row and applicable attribute \(B\) in \(S\)
2\(T^{\prime}\leftarrow\) generalized table of \(T\) on \(B\)
3 Add \(T^{\prime}\) in \(W\);
4 Endfor
5 Repeat
6 Select from \(W\), table \(T_{k}\) that has a maximum number of rows and a non-zero minimum number of rows that violate \(R\)
7 For each violating row and applicable attribute \(B\) in \(S\)
8\(T^{\prime}_{k}\leftarrow\) generalized table of \(T_{k}\) on \(B\)
9 Add \(T_{k}\) in \(W\);
10 Endfor
11 Remove \(T_{k}\) from \(W\)
12 Until\(W\) is empty or no tables in \(W\) has a number of rows > number of rows of a table that satisfies \(R\)
13 Return \(T^{*}\) that has maximum number of rows over all tables in \(W\) that satisfy \(R\)
```  
**Algorithm 1** The IAB Anonymization Algorithm  
The algorithm iteratively generalizes a table on an appropriate attribute using its corresponding taxonomy tree to increase anonymity degree. In Lines 1-4, a generalized table of \(T\) on each attribute in \(S\) is generated and maintained in set \(W\). Each generalized table keeps track of two key heuristics: the number of rows that violate \(R\) and the total number of rows on the table. The former tells how close we are to finding the table that satisfies the anonymity requirements \(R\) while the latter measures how much data is preserved. Among generalized tables in \(W\), the algorithm selects a table that has the highest number of rows with the lowest violation number of rows to be further generalized (Lines 5-10). The selected table is removed from \(W\) (as shown in Line 11). The generalization process repeats until there are no more tables left in \(W\) or no tables in \(W\) has the number of rows > the number of rows of a table that satisfies \(R\). In other words, we stop expanding the search when we find a table that satisfies \(R\) or a table that is smaller than the biggest table that satisfies \(R\) found so far (even though it violates \(R\)). By monotonicity of generalization, further generalization can never grow the table. Therefore, the algorithm only further generalizes the table that is larger than those found to satisfy \(R\) so far. However, if a table violates \(R\) but is already smaller than the biggest table found so far to satisfy \(R\), further generalizing it would not result in a larger table that satisfies \(R\). Thus, the algorithm selects the largest table among the tables in \(W\) with no anonymity requirements violation. Note that it is possible to have more than one of such table of the same size. In such a case, the algorithm selects the first one found as it represents the table that has the least number of generalized steps. In other words, it retains most specific data that are closest to the given data table. Since generalization procedure monotonically decreases the number of rows, our approach uses this property to prune the fruitless path of an exhaustive search. Thus, it finds an _optimal_ solution. The optimal solution is that maximizes the information preserved (i.e., the table size) from the original table while hiding desired privacy by satisfying anonymity requirements (i.e., zero violation rows).