# Analytics on Anonymity for Privacy Retention in Smart Health Data +
## 3 Proposed Multi-Faceted Anonymity Analytics Approach
### Increasing Anonymity by Generalization  
The analytics in Section 3.1 show that, once an attacker obtains the query answers, information on some attributes (or set of attributes) can lead to more average information loss than the others. To protect such loss, a common practice to increase anonymity is by generalization and compression [8; 9; 10]. This section describes these basic concepts in more details along with the concept of \(k\)-anonymity that is used in many anonymization techniques including ours (to described in Section 3.3). \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Query Attribute.** & **\# Query Partitions** & **Avg. Info. Loss** &
\begin{tabular}{c} **Norm. Avg. Info.** \\ **Loss** \\ \end{tabular} \\ \hline Sex & 2 & 0.99 & 0.16 \\ Alcohol Cons. & 4 & 1.86 & 0.31 \\ Age & 13 & **3.55** & **0.60** \\ Zip & 8 & 2.75 & 0.46 \\ Weight & 5 & 2.24 & 0.38 \\ Race & 6 & 2.52 & 0.42 \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Estimated Information Loss. _Generalization_ replaces an attribute value by a more abstract form or a more general but semantically consistent value. For example, we can replace the zip \"12345\" by \"123\(\ast\)\", or replace a \"city\" by its \"country\". The former can be viewed as a suppression of the last two digits of the zip where\"\(\ast\)\" represents any non-negative digit. The consistency on semantics of attribute values is governed by its conceptual hierarchy. By doing this, the number of records of each unique tuple will increase and that increases the tuple's degree of anonymity. Consequently, individuals are more indistinguishable, and their identities are better protected. Generalization provides many advantages to preserve data privacy including consistent interpretation, traceability, and minimal content distortion [10]. We will now explain the concepts in more details via illustrations on Table 1. Continuing our analytics from Section 3.1, where we identify that Age, Zip and Race are vulnerable. One can focus on generalizing these attributes to increase their anonymity or exploring other attributes based on domain experts. Here we consider the three attributes: Alcohol Consumption (AC), Age and Zip and their corresponding conceptual hierarchies as shown in Figure 2. For AC, there are four attribute values in the domain although only three appear in Table 1. The Age attribute values are discretized into four ranges and the Zip attribute values are string of numbers where a more general value uses \"\(\ast\)\" for any non-negative digit. The Zip hierarchy is general in that it is applicable to any string of digits other than 9's. For simplicity and without loss of generality, we will illustrate generalization on parts of Table 1, namely Rows 1, 2, 5, 6, 9 and 10 with four attributes: Sex, Alcohol Consumption (AC), Age and Zip, as shown in Table 3a to be an initial data table. In Table 3a, Row 1 and Row 5 each has one record. This makes an individual in these two rows vulnerable for re-identification. If an attacker knows that the person he is looking for is a Female (F) having Medium (Med) AC and lives in Zip 52000, he will be able to identify the person and infer his age of 35 (see Row 1). Similarly, Row 5 is the only one record of a Female, Age 75, so this person can be identified and her sensitive information of having High AC can be leaked. To increase anonymity of individuals in Rows 1 and 5, we generalize on AC cells of all rows of females (i.e., Rows 1, 2, 5, 6) in Table 3a to obtain results as shown in Table 3b where the change and important areas are colored. In this table, individual in Row 1 increases his/her anonymity since Row 1 can be merged with individuals in Row 2 creating a tuple (F, Yes, 35, 5200) with four records. However, this generalization is not enough to increase anonymity of individual in Row 5.