# Feedback-Based Integration of the Whole Process of Data Anonymization in a Graphical Interface
## 2 sdcApp
### Anonymize
#### 2.3.3 Anonymization of Categorical Data  
The second subsection of the left sidebar labeled Anonymize categorical variables allows applying anonymization methods to categorical key variables. The available methods are listed in Table 5.  
Selecting Recoding allows reducing the level of detail of categorical key variables by combining levels into a new, common category which can optionally be renamed; it is also possible to add missing values to the newly generated category. Once the re-coding is done, the page refreshes and the content in the right sidebar like the number of observations violating \(k\)-anonymity was updated. It is very common feature that a safe micro-dataset features \(k\)-anonymity [12; 13]. This feature specifies that each combination of the levels of the categorical key variables occurs at least \(k\) times in the data. Choosing k-Anonymity allows creating a \(k\)-anonym dataset for all or (independently) for given subsets of the categorical key variables. The latter approach is useful if the number of categorical key variables is large. Furthermore it is also possible to set different values of \(k\) for the subsets. The algorithm works by setting specific values in key variables to missing (NA). Users can also rank variables by importance to be selected as variable in which values should be removed. This allows to specify variables that are deemed so important that no missing values should be introduced by the algorithm. By default the key variables are ordered in a way that the variables with the most number of levels are most likely to be selected as variable in which suppressions are introduced. The implementation of the algorithm also allows to apply the method independently on groups defined by a stratification variable. If the user opts for this approach, a variable defining the grouping needs to be selected from a drop-down menu. For any way, the value of \(k\) is typically set using slider inputs. Once the user has finished setting the parameters, an action button appears at the bottom of the page. Clicking this button starts the process to establish \(k\)-anonymity which might take some time. While the algorithm runs, a progress bar is displayed. Once the calculation has finished, the page refreshes and the right sidebar was updated. Users should especially have a look at the first table in which the number of suppressions for each key variable is shown. Also, the section k-anonymity in the sidebar is updated. Post-randomization (PRAM) [16] is a statistical process that possibly changes values of a variable given a specific transition matrix. In the GUI, PRAM can be applied in two different ways by either choosing PRAM (simple) or PRAM (expert). In both cases, at least one variable needs to be selected that should be post-randomized. We note that only those variables can be selected that have been defined as being suitable for post-randomization when defining the SDC problem as discussed in Section 2.3.1. We note that it is possible to select a single stratification variable. If this is the case, the post-randomization procedure is performed independently for each unique value of the grouping variable. The definition of the transition matrix is different for the \"simple\" and the \"expert\" mode. \begin{table}
\begin{tabular}{l l} \hline \hline
**Feature** & **Description** \\ \hline Recoding & combine and optionally rename factor levels \\ k-Anonymity & each combination of categorical key variables occurs \(\geq k\)-times \\ PRAM (simple) & Post-randomization using an invariant probability transition matrix \\ PRAM (expert) & Post-randomization given an explicitly specified transition matrix \\ Suppress values with high risk & set values to NA for high-risk observations \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Anonymization methods for categorical variables. In PRAM (simple), two parameters must be specified using slider inputs. pd refers to the minimum diagonal values in the (internally) generated transition matrix.