## 4 Threading Statistical Disclosure Attack Algorithm with EM (TSDA-EM)
### Removing Unnecessary Values with Proposed Tables
#### 4.4.1 Getting \(\lambda_{s,r}\) with EM  
The Expectation Maximization (EM) algorithm has been used to estimate the means of \(k\) normal distributions for the hidden variables \(Z=\{z_{i1},\ldots,z_{ik}\}\), given its current hypothesis \(\{\mu_{i1},\ldots,\mu_{ik}\}\) and the data \(X=\{x_{i}\}\). The description of each instance can be thought of as the triplet \(\{x_{i},z_{i1},z_{i2}\}\), where \(x_{i}\) is the observed value of the \(i\)th instance and where \(z_{i1}\) and \(z_{i2}\) indicate which of the two Normal distributions was used to generate the value \(x_{i}\)[39]. The EM algorithm searches for a maximum likelihood hypothesis by repeatedly re-estimating the expected values of the hidden variables \(z_{ij}\) given its current hypothesis \(\{\mu_{i1},\ldots,\mu_{ik}\}\). As mentioned before, we use the Poisson distribution (\(\lambda\)), instead of the normal distribution (\(\mu\)), motivated by the fact that the rounds, defined by the attacker, may be constructed by batches of messages or, alternatively, by time periods; this distribution is very useful when dealing with unpredictable events. The EM algorithm consists of two steps:  
* **Step 1:** Calculate the expected value \(E[z_{ij}]\) of each hidden variable \(z_{ij}\), assuming the current hypothesis \(h=\{\lambda_{1},\lambda_{2}\}\) holds. * **Step 2:** Calculate a new maximum likelihood hypothesis \(h^{\prime}=\{\lambda_{1}^{\prime},\lambda_{2}^{\prime}\}\), assuming the value taken on by each hidden variable \(z_{ij}\) is its expected value \(E[z_{ij}]\) calculated in Step 1. Then replace the hypothesis \(h=\{\lambda_{1},\lambda_{2}\}\) by the new hypothesis \(h^{\prime}=\{\lambda_{1}^{\prime},\lambda_{2}^{\prime}\}\) and iterate. In the context of our problem, where we have rounds where each one has cells \([s,r]\) and where for each cell we have the number of messages sent (all taken by feasible tables) and its _marginals_, the EM algorithm will be implemented as:  
* Hypothesis \(h_{s,r}=\{\lambda_{1},\lambda_{2}\}\), where the initial value for \(\lambda_{1}\) is the highest marginal and \(\lambda_{2}\) is the lowest marginal of the pair of communication between sender \(s\) and recipient \(r\). In case the marginals are the same, \(\lambda_{2}\) will be \(\mathbf{0}\). * Data \(X_{s,r}=\{x_{1},\ldots,x_{i}\}\), where \(x_{i}\) will be the number of messages for the cell \([s,r]\) of every feasible table generated for the round on turn. In order to calculate the expected value \(E[z_{ij}]_{s,r}\), the first step will be:  
\[E[z_{ij}]_{s,r}=\frac{\frac{\lambda_{i}^{n}z_{i}^{-\lambda_{j}}}{x_{i}!}}{ \sum_{n=1}^{2}\frac{\lambda_{i}^{n}z_{i}^{-\lambda_{n}}}{x_{i}!}} \tag{4}\]  
Finally, to calculate a new maximum likelihood, we use:  
\[\lambda_{j}=\frac{\sum_{i=1}^{m}E[z_{ij}]_{s,r}\times x_{i}}{\sum_{i=1}^{m}E[ z_{ij}]_{s,r}} \tag{5}\]  
For a comprehensive understanding of the Expectation Maximization algorithm implementation, please refer to Algorithms 1 and 2. Additionally, in Algorithm 2, we have chosen to provide a more detailed explanation of the process, as we are simulating an iteration for Table 4 to calculate the values \((s_{1},r_{1})\). ```
1:\(\lambda_{1}\gets 5\)
2:\(\lambda_{2}\gets 0\)\(\triangleright\) since both marginals are the same
3:\(i\gets j\gets 1\)
4:\(X\leftarrow[5_{1},4_{2},4_{3},3_{4},...]\)\(\triangleright\) Set of values for cell \([s_{1},r_{1}]\) from Feasible Tables of the round
5:while\(j\leq 2\)do
6:while\(i\leq X.length\)do
7:\(x_{i}\gets X_{i}\)
8:\(expectation=Expectation(x_{i},\lambda_{j})\)
9:\(numerator\gets numerator+expectation\times x_{i}\)
10:\(denominator\gets denominator+expectation\)
11:endwhile
12:\(\lambda_{j}\leftarrow\frac{numerator}{denominator}\)
13:endwhile
```  
**Algorithm 1** Expectation(x, \(\lambda\))  
As a result of EM, we have obtained two new refined likelihood hypotheses for cell \([s,r]\) (\(l_{h,s}=\lambda_{1},\lambda_{2}\)). These refined hypotheses represent the mean number of messages for the cell.