# Analytics on Anonymity for Privacy Retention in Smart Health Data +
## 3 Proposed Multi-Faceted Anonymity Analytics Approach
### Assessing Vulnerability to Information Leakages
This gives an average loss to be estimated as \(\Delta S\big{(}\big{\{}E_{j}\big{\}}\big{)}=\sum_{j=1}^{m}p(E_{j})\big{(}S_{0} -S_{j}\big{)}\). \(\square\)  
Note that \(\Delta S(\{E_{j}\})\) is maximum when \(S_{j}\) is zero and \(\Delta S(\{E_{j}\})=S_{0}\) (i.e., no information is lost to the attacker or that he has no information). Hence, the normalized average information loss is \(\Delta S(\{E_{j}\})/S_{0}\) where its value is in [0, 1]. Analytics on Information Leakages  
Instead of applying the [PERSON] et al. 's entropy-based measure to the entire table, we will analyze which attribute will be most vulnerable to information leaks (i.e., leaks most amount) on the average when an attacker obtains information on the attribute values. We will use Table 1 to illustrate and explain the concept. Suppose an attacker queries information on attribute Sex. Table 1 has a total of 60 individuals with 27 females (F) and 33 males (M). When an attacker has no information, every individual is equally likely to be identified with \(p(r_{i})=1/60\). Therefore, the initial average amount of information \(S_{0}\) is \(-\sum\limits_{i=1}^{60}(1/60)log_{2}(1/60)=5.9\). For attribute Sex, there are two possible answers: <F, M>. Thus, we partition 60 individuals into \(E_{1}\) and \(E_{2}\) for those who are F and M, respectively. Based on Proposition 2 and Table 1, \(p(r_{i}\,|\,E_{1})=p(r_{i})/p(E_{1})=(1/60)/(27/60)=1/27\), for \(r_{i}\in E_{1}=\{r_{i}\}\mid i=1,\,2,\,8\)-\(10,\,12\)-\(14,\,16,\,19,\,22\,\,\}\). This gives \(S_{1}=-27(1/27)log_{2}(1/27)=4.75\). Similarly, \(p(r_{i}\,|\,E_{2})=(1/60)/(33/60)=1/33\), for \(r_{i}\in E_{2}=\{r_{i}\}\mid i=3\)-\(7,\,11,\,15,\,17,\,18,\,20,\,21\) and \(S_{2}=-33(1/33)log_{2}(1/33)=5\). By Proposition 2, \(\Delta S(\{E_{i}\})\) is \((27/60)(5.9-4.75)+(33/60)(5.9-5)=0.99\). Normalizing by a maximum (i.e., when \(\Delta S(\{E_{i}\})=S_{0}=5.9\)), we have the resulting normalized average information loss of \(0.99/5.9=0.16\) (when the attacker queries on Sex) as shown in the first row of Table 2. Similarly, we can apply the measure to estimate the average information loss given the attacker querying on other attributes except the disclosed one (e.g., genetic risk). Table 2 shows the overall results obtained. The normalized results show us on average how much information is leaked given attacker knows the attribute value of the person they are looking for. The attribute that discloses more information has a higher value out of the maximum possible value of one. As shown in Table 2, for data Table 1, the Age attribute is the most vulnerable as it leaks the most information. Next is Zip, followed by Race. These are not surprising as they are typical key attributes that lead to identity identification. Although we have not done this, the [PERSON] et al. 's entropy-based measure can be applied to a combination of attributes at any level to give different insights. Here we apply the measure to each non-disclosed attribute for systematic preliminary findings. In general, this pre-anonymization analytics can help us decide which attributes we should pay attention to when we try to protect privacy. For example, we may pick a set of most vulnerable attributes to increase anonymity by generalization. In anonymization techniques, a set of such attributes is known as quasi-identifiers or shields that are specified by users. Next section shows more details of basic anonymization techniques.