# Analytics on Anonymity for Privacy Retention in Smart Health Data +
## 3 Proposed Multi-Faceted Anonymity Analytics Approach
### Assessing Vulnerability to Information Leakages  
Before we transform a given health data into a more anonymous form, one may investigate if (and what areas of) the data are susceptible to information loss if an attacker uses some of his information to make inferences. To do this, we propose an analysis on various structures of the data using the [PERSON] et al. 's entropy-based measure [14] to estimate average information loss in respective areas. The motivation of this pre-anonymization analytics is not simply to apply existing measure in a typical manner but maximizing the measure for systematic use to gain useful information for privacy protection. For example, the finding that certain attribute is vulnerable to information leakage may be linked to low anonymity that can be alleviated by modifying the original data. Next, we briefly describe the measure and its derivations from two sources. **Proposition 1**. : _[PERSON]'s information quantification._  
_Let \(X\) be a discrete random variable with outcomes \(x_{1}\), \(x_{2}\),..., \(x_{n}\), \(p(x_{i})\) be the probability of \(x_{i}\) being the outcome, and \(1(x_{j})\) be the amount (or value) of information received when learning that \(x_{i}\) is the outcome (sent). Then \(I(x_{i})\) is \(log_{2}(1/p(x_{i}))\)._  
Proof. : Since the more probable the information is, the less informative the information becomes. Thus, \(I(x_{i})\) is inversely proportional to \(p(x_{i})\). Furthermore, for information of value \(y\), the amount of information is measured by the number of bits to store \(y\), i.e., \(log_{2}(y)\) bits. Thus, [PERSON]'s quantifying information \(I(x_{i})=log_{2}(1/p(x_{i}))\). \(\square\)  
**Proposition 2**. : _[PERSON] et al. 's entropy-based measure._  
_Given a data table of \(n\) individuals, where \(p(r_{i})\) is the probability of individual \(r_{i}\) being re-identified. An attacker makes queries, each of which has \(m\) possible answers represented in a sequence <\(a_{1}\), \(a_{2}\),..., \(a_{m}\)>. All \(n\) individuals are partitioned into \(m\) partitions, where each partition \(E_{j}\) contains individuals whose attribute value matches the jth answer of the query \(a_{j}\). Subsequently, the average of information loss is \(\Delta S\big{(}\big{\{}E_{j}\big{\}}\big{)}=\sum_{j=1}^{m}p(E_{j})\big{(}S_{0} -S_{j}\big{)}\), where \(S_{0}=-\sum\limits_{i=1}^{n}p(r_{i})log_{2}p(r_{i})\) and \(S_{j}=\sum_{r_{i}\in E_{j}}p\left(r_{i}|E_{j}\right)log_{2}p\left(r_{i}|E_{j}\right)\) representing an initial average amount of information (before queries) and the average of amount of information after the query answer \(j\), respectively._  
Proof. : If the attacker knows \(p(r_{i})\) then the amount or value of the information can be quantified as \(\log_{2}(1/p(r_{i}))\) by Proposition 1. Thus, an average of these information values over all individuals gives an entropy \(S_{0}=-\sum\limits_{i=1}^{n}p(r_{i})\log_{2}p(r_{i})\). (Note, if an attacker does not have any information about individuals, then everyone in the table is equally likely to be identified with \(p(r_{i})=1/n\).). Now suppose an attacker makes queries as stated. Each individual \(r_{i}\) can belong to one partition. Thus, \(\sum_{j=1}^{m}|E_{j}|=n\). Suppose an individual \(r_{i}\) is found to be in \(E_{j}\) then \(p(r_{i})\) becomes \(p(r_{i}\,|\,E_{j})\), which is \(p(\{r_{i}\}|\,\cap E_{j})/p(E_{j})=p(r_{i})/p(E_{j})\) (since \(\{r_{i}\}|\,\cap E_{j}=\{r_{i}\}\)), where \(p(E_{j})=\sum_{k\subset r_{i}\in E_{j}}p(r_{k})\). Since \(p(r_{i})\) is reduced, the information value/amount increases (as less certain is more informative). Thus, an attacker gains more information about the individual and more vulnerable to privacy breach. Thus, the average amount of information when answer \(j\) is matched \(S_{j}=\sum_{r_{i}\in E_{j}}p\left(r_{i}|E_{j}\right)\log_{2}p\left(r_{i}|E_{j}\right)\), where \(p(r_{i})\) is changed to \(p(r_{i}\,|\,E_{j})\).