## 3 Security and Privacy Challenges
### AI Role in EC Security
#### 3.3.4. Data Anonymization Techniques  
Data anonymization is a privacy-preserving technique that masks or removes personally identifiable information (PII) from a dataset to protect the privacy of the users. The user identifiers or PII fall under the direct and indirect identifier types. The attributes that can directly identify a user, such as names, addresses, photos, etc., are direct identifiers, whereas indirect identifiers relate to the attributes that identify users by establishing a relation with other available datasets, like age, salary, occupation, etc. The anonymization techniques have an edge over other privacy-enhancing techniques like encryption, as they do not require key management and large computational resources. However, data anonymization techniques are an irreversible process that provides privacy, but confidentiality or integrity remains unanswered [175]. In recent times, numerous data anonymization techniques have been proposed, including privacy-preserving mechanisms implemented through data masking, pseudonymization, generalization, perturbation, synthetic, etc.  
* _Data masking:_ Data masking is a technique of concealing data by creating faux versions of sensitive user data by modifying private information. The process involves modification techniques like shuffling, modest word or character substitution, encryption, or masking data. Common types of data masking are static, dynamic, and on-the-fly data masking.
* _Pseudonymization:_ Pseudonymization removes user identifiers from the dataset and replaces them with pseudonyms which hides the data source identity. Pseudonymization is defined in the EU-General Data Protection Regulation (GDPR) as \"the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information. Such additional  
Figure 12. MEC architecture.  
information is kept separately and is subject to technical and organizational measures to ensure that the personal data are not attributed to an identified or identifiable natural person\" [176].
* _Generalization:_ It is a technique of eliminating identifiable aspects of data to fully remove or reduce its identifiability. Generalization picks up a distinguishable identifier and abstracts it into a more general, lesser distinguishable value. Multiple levels of generalization do exist based on the type of data. An example of a generalization technique is bucketing that groups records into smaller buckets and minimizes the risk of data security challenges [177].
* _Perturbation Methods:_ They involve mathematical techniques for the protection of user data privacy. A controlled noise or randomness is added to the data while still being able to perform data analysis. These data privacy techniques are used in various application domains, including ML, statistics, and cryptography. Another method called the differential privacy technique adds a random noise scaled by a privacy parameter to the original data values.  
Certain limitations and disadvantages of data anonymization techniques exist, as they reduce the granularity and accuracy of the data. This may damage the relationships between the data points, which is critical for artificial intelligence algorithms or any other data science process. Also, data anonymization techniques can be reverse-engineered by gaining access to external or pseudonym databases.