# Efficient Multi-Source Anonymity for Aggregated Internet of Vehicles Datasets
###### Abstract  
The widespread use of data makes privacy protection an urgent problem that must be addressed. Anonymity is a traditional technique that is used to protect private information. In multi-source data scenarios, if attackers have background knowledge of the data from one source, they may obtain accurate quasi-identifier (QI) values for other data sources. By analyzing the aggregated dataset, \(k\)-anonymity generalizes all or part of the QI values. Hence, some values remain unchanged. This creates new privacy disclosures for inferring other information about an individual. However, current techniques cannot address this problem. This study explores the additional privacy disclosures of aggregated datasets. We propose a new attack called a multi-source linkability attack. Subsequently, we design multi-source (\(k\),\(d\))-anonymity and multi-source (\(k\),\(l\),\(d\))-diversity models and algorithms to protect the quasi-identifiers and sensitive attributes, respectively. We experimentally evaluate our algorithms on real datasets: that is, the Adult and Census datasets. Our work can better prevent privacy disclosures in multi-source scenarios compared to existing Incognito, Flash, Top-down, and Mondrian algorithms. The experimental results also demonstrate that our algorithms perform well regarding information loss and efficiency. multi-source (\(k\),\(d\))-anonymity; multi-source (\(k\),\(l\),\(d\))-diversity; privacy; IoV; \(k\)-anonymity; aggregated dataset +
Footnote †: journal: Applied Sciences  
The \(k\)-anonymity technique is used to address privacy threats. Privacy-preserving data publishing (PPDP), introduced by [PERSON] et al. in 2010 [3], has gained considerable attention in the research community and has emerged as a pivotal aspect of data mining and information sharing. Numerous studies have been devoted to anonymized data; they often consider a data publisher's table comprising explicit identifiers (EIs), quasi-identifiers (QIs), sensitive attributes (SAs), and non-sensitive attributes (NSAs). EIs refer to attributes that explicitly identify record owners. QIs are attributes that may be used to identify an individual. An instance is [gender, ZIP code, birth] that can be potentially linked to other tables for identifying the record owner. SNA are sensitive attribute such as illness and salary. NSAs are the remaining attributes [4]. Additionally, these four attribute sets are disjointed. EIs are directly linked to sensitive information; therefore, for privacy, they are typically removed before data release. However, even with the removal of EIs, record owners can potentially be re-identified, meaning their QIs can be linked to an external table [5]. To resist this attack, data publishers release an anonymized table that includes \(QI^{\prime}\), SAs, and NSAs, with \(QI^{\prime}\) representing the results of anonymizing QIs. The concept of \(k\)-anonymity is a famous method to ensure privacy protection [6] by severing the connection between specific records and their origin. This model guarantees that each record of an anonymized dataset remains indistinguishable from at least \(\mathrm{k}-1\) other records [7]. Anonymization algorithms, as discussed [8; 9] in various studies such as [10; 11; 12; 13], primarily focus on optimizing efficiency and utility. However, these algorithms often overlook the impact of effectiveness and efficiency. Another category is scenario-based anonymization. [PERSON] et al. [14] proposed \"quasi-sensitive attributes\" that consider that the new condition of QIs and SAs are equivalent. [PERSON] et al. [15] argued that some attributes are both quasi-identifiers (QIs) and sensitive attributes (SAs). [PERSON] et al. [16] introduced the notion of \"sensitive quasi-identifiers\" for \(l\)-diversity and t-closeness models. These scenario-based approaches involve defining new attribute types to address various privacy objectives.