# Protecting Sensitive Data in the Information Age: State of the Art and Future Prospects
## 3 State-of-the-Art Privacy Measures
### Pattern-Based Privacy  
In Section 2.5, we presented that large amounts of data can be processed effectively using CEP. Here, a sequence of isolated data items is interpreted as a stream of events. A CEP engine scans the stream for predefined patterns. As the occurrence of such patterns can be confidential information, there are also several approaches for CEP to protect privacy. For instance, the data stream can be preprocessed locally at the user's site, and the user decides for each event whether to answer truthfully or incorrectly, i.e., whether to feed an event untampered into the stream or to add noise to it. Furthermore, the fact that in the data refinement process, the data are aggregated anyway when converted to knowledge can be exploited. By means of dedicated aggregation techniques applied directly at the user's site, a _zero-knowledge privacy guarantee_ (see the work by [PERSON] et al. [151]) can be achieved [152]. In doing so, it is disregarded, however, that an isolated event typically entails only little privacy-sensitive information. The information patterns targeted by CEP engines are only revealed by the occurrence of several events in a certain sequence. An arbitrary manipulation of single events is therefore not efficient and deteriorates the quality of the base data unnecessarily. Therefore, other approaches focus in particular on sequences of events. For this purpose, patterns are defined that have to be kept secret. These patterns are then purged from the data stream [153]. Although this approach is considerably less restrictive, it still overly compromises data quality [154]. The problem with this approach is that it only takes into account what has to be concealed but not what knowledge is needed by data consumers. Therefore, two types of patterns are needed to preserve data quality: _private patterns_, which have to be concealed, and _public patterns_, which are required by data consumers. Data producers and data consumers specify which knowledge must not be disclosed or respectively which knowledge is required. This is then mapped to patterns at the data level [155]. When concealing the private patterns, it has to be ensured that no public patterns are blurred in the process or additional erroneous public patterns are created by manipulating the data stream. To this end, a quality metric is used that weights the privacy (i.e., the concealment of private patterns) against the _false negatives_ (i.e., public patterns that have been concealed) and _false positives_ (i.e., public patterns that have been artificially added). The obfuscation of the private pattern must be conducted in a manner that optimizes this quality metric [156]. To maximize the quality metric, a privacy mechanism has to make use of different obfuscating techniques. Three such techniques are shown in Figure 13. In this example, the private pattern \(B\to C\) has to be concealed, while the public pattern \(A\to B\) should be recognizable. Let \(A\to B\to C\) be the data stream. A simple technique is to drop an event from the stream or to inject a new one. In the example, the event \(C\) is removed, and the event \(D\) is artificially created. This conceals the private pattern, while the public pattern remains recognizable. Removing event \(B\) would conceal the private pattern as well, but the public pattern would also not be recognizable anymore. Another technique is to tamper with the events. For instance, the attribute values of data item \(C\) can be manipulated so that it is recognized as a different event \(C^{\prime}\). This also conceals the private pattern without affecting the public pattern. Lastly, the events in the stream can be reordered. By swapping \(B\) and \(C\), the private pattern is also concealed--albeit, in this case, the public pattern is concealed as well. Using a combination of these techniques, even more complex patterns that contain conjunctions and negations in addition to sequences can be obfuscated [157].