# Privacy Protection Method for Vehicle Trajectory Based on VLPR Data

Authors: Hua Chen; Chen Xiong; Jia-meng Xie; Ming Cai
Journal: Journal of Advanced Transportation
 (2020)

---

## Abstract

With the rapid development of data acquisition technology, data acquisition departments can collect increasingly more data. Various data from government agencies are gradually becoming available to the public, including license plate recognition (VLPR) data. As a result, privacy protection is becoming increasingly significant. In this paper, an adversary model based on passing time, color, type, and brand of VLPR data is proposed. Through experimental analysis, the tracking probability of a vehicle’s trajectory can be more than 94% if utilizing the original data. To decrease the tracking probability, a novel approach called the (m, n)-bucket model based on time series is proposed since previous works, such as those using generalization and bucketization models, cannot deal with data with multiple sensitive attributes (SAs) or data with time correlations. Meanwhile, a mathematical model is established to expound the privacy protection principle of the (m, n)-bucket model. By comparing the average calculated linking probability of all individuals and the actual linking probability, it is shown that the mathematical model that is proposed can well expound the privacy protection principle of the (m, n)-bucket model. Extensive experiments confirm that our technique can effectively prevent trajectory privacy disclosures.


---

## Body

## 1. Introduction

With the coming of the big data era, big data are increasingly connected with our lives. The development of location-aware technology, such as mobile communications and sensing, digitizes the geographical locations of people and objects. Generalized data have the characteristics of being large scale, fast updating, and high value, which has brought great changes to people’s lives, business operations, and scientific research. Trajectory data are the sequence of location information from a moving object that is recorded in chronological order.There are two main applications for trajectory data: one for online applications and the other for offline applications. The former generally refers to location-based services (LBSs) in which location service providers can provide customized services by obtaining the real-time location information of mobile objects. For example, when a customer searches for a destination using a map application, the service provider can provide the customer with a reasonable path based on the customer’s current trajectory. The latter refers to the location service provider’s desire to discover the intrinsic value of a user’s trajectory so that the trajectory data can be directly acquired and analyzed or made available to third parties. Traditional car insurance companies, for example, set insurance prices based on the average risk of vehicles, but as user customization needs increase, companies have begun to rely on travel time, public locations, travel processes, and other information in data organizations to provide customized services to users [1, 2]. However, while location data facilitates people, it also increases the risk of personal privacy disclosure because the data contain not only the user’s location information but also the user’s home address, lifestyle, health status, social relations, behavioral patterns, and other implicit information. For example, Gambs et al. use GPS data to successfully infer a person’s home address and company information [3]. Matsuo et al. use position sensor data to build user feature matrices, classify data using machine learning techniques, and accurately infer individuals’ work, age, and smoking habits [4]. Song et al. use personal trajectory data to explore people’s past, present, and future positions with 93% accuracy [5]. Using telephone call data from a European country and analyzing it based on random space-time points, Montjoye et al. found that 95% of users could be accurately identified by randomly selecting 4 space-time points [6]. These examples show that privacy protection is a critical issue.Trajectory privacy is defined as not being traceable as moving objects at a certain distance or time. Trajectory privacy preservation mainly focuses on LBS-based privacy protection and the privacy protection related to released data; the related work is described below. Olurin et al. believe that the privacy preference platform (P3P) and P3P-based technologies have great developmental potential; therefore, they summarize the research on P3Ps and explain that the current challenge is to design a formalized privacy policy language [7]. For smartphone query privacy, Shokri et al. propose a user collaboration privacy protection method based on LBSs, which saves user query information in a buffer and passes it to other people who search for such information. Simulation results show that this method is lightweight and has low collaboration costs [8]. Khoshgozaran et al. desired strong privacy and proposed a PIR-based framework that processes server answered client queries without inferring any information. Experiments that were conducted for real-time networks have validated the usefulness of the scheme, and the existing challenge is how to reduce the space and time costs [9]. Terrovitis and Mamoulis show that there is a high risk of privacy breaches by adversaries if the trajectories are published during processing that only hides the identities of users. They develop a data suppression technique that iteratively suppresses selected locations from the original trajectory until privacy constraints are met to prevent this type of breach [10]. Based on the k-anonymity model, Nergiz et al. propose a method based on generalization to solve the problem of individual recognition in static trajectory datasets. They redefine the notion of k-anonymity for sequences of space-time points and further enhance privacy protection by releasing only a randomly generated set of representative trajectories. Experiments on real and synthetic data show that the method is effective for publishing trajectory datasets [11]. Sun et al. deem that a privacy mechanism should be consciously and consistently integrated in system designs, and, on this basis, the virtual travel line model (VTL) is proposed. The VTL can be used to standardize data when and where mobile data are collected to meet the needs of traffic modeling and privacy protection. Traffic-knowledge-based adversary models are developed to evaluate the performance of the VTL zone method and filtering algorithms. The algorithm is evaluated in terms of its privacy protection and data demands to meet traffic applications [12, 13]. The above studies show that trajectory privacy has become a key issue in trajectory data publishing. VLPR data, as a kind of trajectory data, face the same problem.With the development of intelligent transportation, increasingly more urban service organizations hope to be able to obtain VLPR data from traffic management departments to provide better urban service solutions [14]. However, even if the vehicle license plate numbers have been replaced by qualified identifier (QI) before the data are released, the trajectories are still unique relative to their QIs. Previous works [15] have shown that adversaries can still connect trajectories to users using background knowledge. Gao et al. find that even when the temporal granularity is set to be half a day, five spatiotemporal records are sufficient to uniquely identify approximately 90% of individuals using VLPR data. Besides, in a dataset, an adversary can easily get a unique trajectory in a time interval t1,t2 when the point of interest (POI) information for the trajectory is open to the public; thus, if the adversary has the background knowledge that Mike once visited the POI in the same time interval t1,t2, then the adversary has a reason to infer that the trajectory comes from Mike. In this situation, traffic management departments decide to disclose the VLPR data without the vehicle license plate numbers in case the trajectory is linked and thus the privacy information is violated. However, in our research, it is found that the privacy adversary can still use different kinds of methods to acquire the unique vehicle trajectories from incomplete data. If the VLPR data are released without processing, more than 90% of the vehicle trajectories between the upstream and downstream VLPRs can be successfully linked. To reduce the probability of the successful linkages of vehicle trajectories, the (m, n)-bucket model based on time series is proposed, and the results can provide theoretical suggestions for relevant institutions when releasing VLPR data.The rest of this paper is organized as follows. The notations used throughout this paper are summarized in Section2. Section 3 offers a brief introduction of the VLPR system. An adversary model based on VLPR data is proposed in Section 4. A VLPR data publishing method, namely, the (m, n)-bucket model based on time series, is proposed in Section 5. The criteria that are used to evaluate the performances of the (m, n)-bucket model and address the data requirements for privacy preservation are discussed in Section 6. Some case studies are carried out to evaluate the effectiveness of the (m, n)-bucket model by making privacy attacks in Section 7. Some conclusions are summarized in Section 8.


## 2. Notations

We use the notations listed in Table1 throughout this paper.Table 1
Summary of notations.
NotationsDescriptionQIiTheith quasi-identifier of vehicleSAjThejth sensitive attribute of vehicleT1nDeparture time of vehiclenT2n,pEstimated arrival time of vehiclenExExpected travel timeSmA vehicle set of VLPR 2T2mTime for vehiclem in SmT1i, T2iTime that vehiclei is at VLPR 1 and VLPR 2, respectivelyt1i, t2iVehiclei at VLPR 1 and VLPR 2, respectivelySnSuspect listtnkVehiclek in the suspect list SnSmPredicted vehiclesMBMatching bucketTVLPR data tabletii=1,2,…eVehiclei in TBii=1,2,…bBucketi in bucketstQIiVehiclet with QIi valueBQIiBucketb with QIi valuetSAjVehiclet with SAj valueBSAjBucketb with SAj valuept,BProbability that tuplet is in bucket BSAivRepresents the value of the specified columnSAi being shuffledpt,SAivThe probability thatt contains SAivpSAiv|t,BRepresent the probability thatt contains SAiv given that t is in bucket BMBSAiv′The number of valuesv′ that are contained in the SAi in MBs_numThe number of tuples with the sameQInp_max_onembThe maximum probability of one matching bucketP_oneThe data structure that stores all thep_max_onemb of one tuplep_all_oneThe sum of all thep_all_onemb in P_onePrActual linking probabilityPcTotal calculated probability


## 3. VLPR System

The VLPR is a system that adopts advanced photoelectric technology, image processing technology, and pattern recognition technology to take an image of every vehicle passing by and automatically identify the license plate of the vehicle. Today, VLPR systems are ubiquitous in cities, and they are usually placed a few meters away from the road. When a vehicle is detected at a distance in front of the device, the system begins to capture the vehicle’s image. The vehicle’s information, such as the vehicle’s license plate number, type, and color, is identified by the image algorithm; then, the identifying data that are related to geographic information in the VLPR system are stored in the database and are finally uploaded to the transportation authority data center. The storage format for VLPR data can be described as follows.As shown in Table2, the vehicle license plate number is directly associated with user privacy, which is classified as SA information. The other information consists of additional descriptions of the vehicle passing through the device, which are called QI attributes. It is a common way to encrypt or encode SA attributes before releasing data so that adversaries do not have direct access to owner information, but in this situation, the vehicle trajectory can be easily obtained. Therefore, the data management department will choose to suppress the SA attributes; however, based on our research, there are still ways to breach trajectory privacy by using only QI attributes, which increases the likelihood for an adversary to breach a vehicle owner’s privacy. To the best of our knowledge, related work on this topic has not yet been reported.Table 2
VLPR data.
IndexPassing timeVehicle license plate numberVehicle typeVehicle colorVehicle brandVLPR longitude…12018-07-30 13:08:01adhedd324dadf5SmallRedNissan114.71…22018-07-30 13:09:01adekdd431dade6MiddleBlueToyota113.62…


## 4. Adversary Model

To link the traces from two VLPRs, an adversary model based on the passing time, color, type, and brand of vehicles is proposed. Even though this adversary model only considers three QI attributes of the vehicle other than passing time, the successful linking rate is impressive (see Section6). In this part, the adversary model is illustrated in detail. Two cases are given.


### 4.1. Trajectory Linking between Two Neighboring VLPRs without an Intersection (Case 1)

Consider two neighboring VLPRs where there is no entrance or exit between them, which is the simplest case, as shown in Figure1. Suppose that the travel time from VLPR 1 to VLPR 2 is relatively stable.Figure 1
Neighboring VLPRs without an intersection (Case 1).Define the time when vehicles are at VLPR 1 as the departure time (denoted asΩ1) and the time when vehicles are at VLPR 2 as the arrival time (denoted as Ω2). By observing the departure and arrival times from the VLPR system of Shenluo highway in Foshan, China, it is found that they almost satisfy a log-normal distribution, as shown in Figure 2. In most studies [13, 16, 17], the estimated travel time is estimated using the length of the road divided by the limited speed on the road. However, the traffic flow is different at different times, resulting in different average speeds. As a result, it is difficult to accurately calculate the estimated travel time at different moments using this method. In this paper, the estimated travel time is estimated using the log-normal distribution function. The following equation can be easily derived as follows:(1)ft=1t2πδe−lnt−μ2/2δ2.Figure 2
Travel time distribution.In the previous equation,t is the travel time from VLPR 1 to VLPR 2 for the vehicle, μ is the logarithmic mean value, and δ is the logarithmic standard deviation. Since this is not the focus of this paper, it will not be discussed in detail here. For more information about the log-normal distribution function, refer to the relevant papers [4, 18]. The fitting effect is also shown in Figure 2.In this paper, if the vehiclen∈Ω1 and the vehicle m∈Ω2 are released, T2n,p is used to represent the estimated arrival time of vehicle n. This is shown in the following equation, where Ex is the expected travel time and T1n is the departure time of vehicle n:(2)T2n,p≈T1n+Ex=T1n+expμ+δ22.However, it is impossible for each vehicle to travel exactly as predicted. Therefore, the estimated time should be predicted by using a thresholdTt. While Tt=rate∗Ex, rate is a constant. That is, when a trace n∈Ω1, the estimated arrival time can be predicted within the time period T2n,p−Tt,T2n,p+Tt. In other words, a suspect list (denoted as Sn) can be obtained for VLPR 2 in the time period. If Sn is not empty, when Sn only contains one vehicle m, it can be said that m is the same vehicle as n. However, Sn usually contains a number of vehicles, which indicates that certain rules should be employed to confirm the target. To determine which vehicle in Sn is n, the other attributes of the VLPR data are used, which have been illustrated in detail in Section 2. In this paper, in addition to time, only three QI attributes (type, color, and brand) of the VLPR data are considered to recognize which vehicle at VLPR 2 is the same vehicle as that at VLPR 1. In this adversary model, the QI attributes from the VLPR data are utilized to reduce the number of suspected vehicles. Obviously, the more the QI attributes that are utilized, the fewer the suspicious objects that will remain. In the case that the filtered suspect list still contains more than one vehicle, the closest time rule is used to find the predicted vehicle, which satisfies.(3)m=argminT2m−T2n,p,m∈Sm,where T2m is the time for vehicle m in Sm and Sm is a vehicle set of VLPR 2. The previous equation indicates that vehicles m and n are the same vehicle since the arrival time of m is the closest to n. That is, the vehicle trajectories at the two VLPRs are successfully linked, which will lead to a privacy disclosure. Algorithm 1 describes the process of trajectory linking in detail.Algorithm 1: Trajectory linking process in case 1.
Input: A set of released traces (Ω1) and traces (Ω2) that pass through VLPR 1 and VLPR 2, respectivelyOutput: Predicted vehicles (Sm)(1) fort1i∈Ω1(2) fort2j∈Ω2(3)  ifT2j∈T2i−Tt,T2i+Tt(4)Sn⟵Sn∪t2i(6)  end if(6) end for(7) fortnk∈Sn(8)  ifC1i=Cnk,Ty1i=Tynk, Br1i=Brnk and Tnk is closest to T1i(9)Sm⟵Sm∪tnk(10)  end if(11) end for(12) end forDefinition 1.
T1i and T2i represent the time that vehicle i is at VLPR 1 and VLPR 2, respectively. In addition, we also have the color (referred to as C1i and C2i), type (referred to as Ty1i and Ty2i), and brand (referred to as Br1i and Br2i) of the vehicle. t1i and t2i denote vehicle i at VLPR 1 and VLPR 2, respectively. tnk represents vehicle k in the suspect list Sn. Sm is the output of the algorithm, namely, the predicted vehicles.


### 4.2. Trajectory Linking with an Intersection Situation (Case 2)

The road topology is complicated in real situations. Vehicles that arrive at one VLPR usually come from different VLPRs (e.g., VLPR 1, VLPR 2, VLPR 3, and VLPR 4). The vehicles that arrive at VLPR 1 may come from VLPR 2, VLPR 3, and VLPR 4 with the same probability, and the adversary wants to link the vehicle traces from VLPR 2, VLPR 3, and VLPR 4 to those in VLPR 1, as shown in Figure3. That is, the adversary wants to know what upstream VLPR each vehicle in VLPR 1 comes from. The travel time for each VLPR is predicted following the same rules as in Case 1, which can be estimated using Algorithm 1.Figure 3
Intersection situation (Case 2).Different from Case 1, in the simplest case (without intersection), all the vehicles arriving at VLPR 2 come from VLPR 1. If two vehicles meet the requirements of Algorithm1, it can be said they are the same vehicle from VLPR 1 to VLPR 2. However, in the complicated case (Case 2), we want to know which upstream VLPR the vehicle comes from. Sometimes there may be many of the same vehicles in different upstream VLPRs. That is, when it is found that vehicle m is at VLPR 1, there may also be one vehicle p from VLPR 2 and one vehicle q from VLPR 3 using Algorithm 1 if the two vehicles p and q have the same attributes, as shown in Figure 4. That means that it fails to link these kinds of vehicles. Fortunately, the probability of this kind of vehicle is so small that it can be ignored. Therefore, Algorithm 1 can also be used to link the trajectories in intersection situations.Figure 4
The linking procedure for Case 2.


## 4.1. Trajectory Linking between Two Neighboring VLPRs without an Intersection (Case 1)

Consider two neighboring VLPRs where there is no entrance or exit between them, which is the simplest case, as shown in Figure1. Suppose that the travel time from VLPR 1 to VLPR 2 is relatively stable.Figure 1
Neighboring VLPRs without an intersection (Case 1).Define the time when vehicles are at VLPR 1 as the departure time (denoted asΩ1) and the time when vehicles are at VLPR 2 as the arrival time (denoted as Ω2). By observing the departure and arrival times from the VLPR system of Shenluo highway in Foshan, China, it is found that they almost satisfy a log-normal distribution, as shown in Figure 2. In most studies [13, 16, 17], the estimated travel time is estimated using the length of the road divided by the limited speed on the road. However, the traffic flow is different at different times, resulting in different average speeds. As a result, it is difficult to accurately calculate the estimated travel time at different moments using this method. In this paper, the estimated travel time is estimated using the log-normal distribution function. The following equation can be easily derived as follows:(1)ft=1t2πδe−lnt−μ2/2δ2.Figure 2
Travel time distribution.In the previous equation,t is the travel time from VLPR 1 to VLPR 2 for the vehicle, μ is the logarithmic mean value, and δ is the logarithmic standard deviation. Since this is not the focus of this paper, it will not be discussed in detail here. For more information about the log-normal distribution function, refer to the relevant papers [4, 18]. The fitting effect is also shown in Figure 2.In this paper, if the vehiclen∈Ω1 and the vehicle m∈Ω2 are released, T2n,p is used to represent the estimated arrival time of vehicle n. This is shown in the following equation, where Ex is the expected travel time and T1n is the departure time of vehicle n:(2)T2n,p≈T1n+Ex=T1n+expμ+δ22.However, it is impossible for each vehicle to travel exactly as predicted. Therefore, the estimated time should be predicted by using a thresholdTt. While Tt=rate∗Ex, rate is a constant. That is, when a trace n∈Ω1, the estimated arrival time can be predicted within the time period T2n,p−Tt,T2n,p+Tt. In other words, a suspect list (denoted as Sn) can be obtained for VLPR 2 in the time period. If Sn is not empty, when Sn only contains one vehicle m, it can be said that m is the same vehicle as n. However, Sn usually contains a number of vehicles, which indicates that certain rules should be employed to confirm the target. To determine which vehicle in Sn is n, the other attributes of the VLPR data are used, which have been illustrated in detail in Section 2. In this paper, in addition to time, only three QI attributes (type, color, and brand) of the VLPR data are considered to recognize which vehicle at VLPR 2 is the same vehicle as that at VLPR 1. In this adversary model, the QI attributes from the VLPR data are utilized to reduce the number of suspected vehicles. Obviously, the more the QI attributes that are utilized, the fewer the suspicious objects that will remain. In the case that the filtered suspect list still contains more than one vehicle, the closest time rule is used to find the predicted vehicle, which satisfies.(3)m=argminT2m−T2n,p,m∈Sm,where T2m is the time for vehicle m in Sm and Sm is a vehicle set of VLPR 2. The previous equation indicates that vehicles m and n are the same vehicle since the arrival time of m is the closest to n. That is, the vehicle trajectories at the two VLPRs are successfully linked, which will lead to a privacy disclosure. Algorithm 1 describes the process of trajectory linking in detail.Algorithm 1: Trajectory linking process in case 1.
Input: A set of released traces (Ω1) and traces (Ω2) that pass through VLPR 1 and VLPR 2, respectivelyOutput: Predicted vehicles (Sm)(1) fort1i∈Ω1(2) fort2j∈Ω2(3)  ifT2j∈T2i−Tt,T2i+Tt(4)Sn⟵Sn∪t2i(6)  end if(6) end for(7) fortnk∈Sn(8)  ifC1i=Cnk,Ty1i=Tynk, Br1i=Brnk and Tnk is closest to T1i(9)Sm⟵Sm∪tnk(10)  end if(11) end for(12) end forDefinition 1.
T1i and T2i represent the time that vehicle i is at VLPR 1 and VLPR 2, respectively. In addition, we also have the color (referred to as C1i and C2i), type (referred to as Ty1i and Ty2i), and brand (referred to as Br1i and Br2i) of the vehicle. t1i and t2i denote vehicle i at VLPR 1 and VLPR 2, respectively. tnk represents vehicle k in the suspect list Sn. Sm is the output of the algorithm, namely, the predicted vehicles.


## 4.2. Trajectory Linking with an Intersection Situation (Case 2)

The road topology is complicated in real situations. Vehicles that arrive at one VLPR usually come from different VLPRs (e.g., VLPR 1, VLPR 2, VLPR 3, and VLPR 4). The vehicles that arrive at VLPR 1 may come from VLPR 2, VLPR 3, and VLPR 4 with the same probability, and the adversary wants to link the vehicle traces from VLPR 2, VLPR 3, and VLPR 4 to those in VLPR 1, as shown in Figure3. That is, the adversary wants to know what upstream VLPR each vehicle in VLPR 1 comes from. The travel time for each VLPR is predicted following the same rules as in Case 1, which can be estimated using Algorithm 1.Figure 3
Intersection situation (Case 2).Different from Case 1, in the simplest case (without intersection), all the vehicles arriving at VLPR 2 come from VLPR 1. If two vehicles meet the requirements of Algorithm1, it can be said they are the same vehicle from VLPR 1 to VLPR 2. However, in the complicated case (Case 2), we want to know which upstream VLPR the vehicle comes from. Sometimes there may be many of the same vehicles in different upstream VLPRs. That is, when it is found that vehicle m is at VLPR 1, there may also be one vehicle p from VLPR 2 and one vehicle q from VLPR 3 using Algorithm 1 if the two vehicles p and q have the same attributes, as shown in Figure 4. That means that it fails to link these kinds of vehicles. Fortunately, the probability of this kind of vehicle is so small that it can be ignored. Therefore, Algorithm 1 can also be used to link the trajectories in intersection situations.Figure 4
The linking procedure for Case 2.


## 5. A Privacy Preservation Method for VLPR Data Publishing

Privacy preservation is a serious concern when publishing VLPR data. If the original VLPR data are released without any processing, the VLPR system can be more vulnerable to privacy breaches, as shown in Section6. To reduce the probability of trajectory linkages, the VLPR data publishing method, namely, the (m, n)-bucket model based on time series, is proposed.


### 5.1. Publishing the Original Data

Publishing the original data refers to releasing all the data that are collected in a VLPR, which provides the least privacy protection but the most usable data. If all data that are collected in VLPR systems are released, then when VLPR systems’ layouts are dense enough and the data quality is good enough, it is easy for an adversary to link the traces between the upstream and downstream VLPRs. In fact, due to the complexity of the road network, it is not a simple process for adversaries to keep track of the same vehicle between several intersections. However, with the development of smart cities, road network designs have become increasingly more standardized, VLPR systems’ layouts have become increasingly more intensive, and the data that are collected have become increasingly more accurate; therefore, it will become increasingly easier for adversaries to link traces between multiple VLPRs in the near future. If all vehicle traces are released without processing, as shown in Section6, a majority of the traces can be linked by using specific adversary models. Therefore, a certain data processing approach is needed to process the data that are collected in VLPR systems to ensure the privacy of travelers.


### 5.2. (m, n)-Bucket Model Based on Time Series

#### 5.2.1. Related Work

The application of generalization to protect privacy disclosures has been very well studied in the literature [19–21]. This approach consists of generalizing a dataset to a certain extent by transforming the QI values into more general forms and dividing tuples into equivalent groups, where the values of each QI attribute are the same. Therefore, the records in the same equivalence group are indistinguishable, which meets k-anonymity [22–24] and l-diversity [25, 26]. Although generalization is a common method for privacy preservation, it makes the data lose much information and fails with high-dimensional data, which is not conducive to the effective analysis of data. To overcome the drawbacks of generalization, a bucketization method called anatomy, which protects both the privacy and correlation in the microdata, is proposed [27]. Bucketization first divides the tuples in the table into buckets and then randomly separates the quasi-identifiers (QIs) with sensitive properties by traversing the SA values in each bucket. Although bucketization can be used to deal with high-dimensional data, it also tends to disclose more information because all the QIs are released. To overcome the limitations of generalization and bucketization to get better privacy preservation and data utility, the slicing algorithm was proposed, which can prevent attribute disclosure and membership disclosure while releasing data [28]. However, slicing has been found to risk the disclosure of some absolute facts, which would help adversaries find invalid records in released datasets, resulting in personal privacy violations [29]. To improve the confidentiality of the published data in a slice table, a method called value swapping is proposed. Its purpose is to decrease the attribute disclosure risk for absolute facts and ensure l-diverse slicing. To meet the different requirements for the protection of identities and sensitive values, an approach called cross-bucket generalization is presented [30]. This approach can meet the requirements by providing higher attribute protection than identity protection and is proven to be useful for privacy preservation. Besides, there are other methods to replace sensitive attributes with anonymous characters independently at random [31] or add randomized records to the original database [32]. These methods usually can achieve good privacy protection. However, the former causes a great deal of information loss, and the latter adds a lot of information. This is unacceptable in the field of big data. In order to achieve the effect of privacy protection and keep the original data as much as possible, we proposed the algorithm that shuffles the sensitive attribute values in the same bucket. This method neither adds data nor decreases data but just shuffles sensitive data in the same bucket.All the related works that are mentioned above are not suitable for vehicle trajectory privacy preservation because existing privacy protection methods are applicable to data without time correlation. Therefore, in order to meet thek-anonymity or l-diversity requirement, the order of the data in the table can be adjusted at will. However, the VLPR data have strong time correlations, and so the positions of the data in the table cannot be adjusted at will. In conclusion, none of the above privacy protection methods are applicable to vehicle trajectory privacy protection. Therefore, based on the above research, the (m, n)-bucket model based on time series is proposed in this paper.


#### 5.2.2. Formalization of (m, n)-Bucket Model

Define T as the VLPR data that is to be published.T contains d quasi-identifier (QI) attributes QI=QI1,QI2,…,QId and e tuples T=t1,t2,…,te. Each QIi1≤i≤d can be categorical in the VLPR dataset.Definition 1.
(Bucket). A tuple partition consists of several subsets ofT such that each tuple belongs to only one subset. These subsets are referred to as buckets, and we denote them as B1,B2,…,Bb. Then, ∪i=1bBi=T and, for any 1≤i1≠i2≤b, Bi1∩Bi2=Φ.Definition 2.
((m, n)-bucket).T is sorted according to time series and is divided into several buckets where each bucket contains m tuples. After dividing T into several buckets, the values of the specified columns are shuffled inside the bucket, and n is the number of columns being shuffled.Definition 3.
(Matching Bucket). LetQI1,QI2,…,QId be the d columns of a VLPR table. Let t be a tuple and tQIi be the QIi value of t. B is denoted as a bucket in the VLPR table, and BQIi is denoted as the multiset of QIi values in B. Let SA1,SA2,…,SAn be the sensitive columns that need to be shuffled, where n represents the number of sensitive columns. Let QIn+1,QIn+2,…,QId be the nonsensitive QIi columns that do not need to be shuffled. Identifying which column is the sensitive column is not the focus of the research of this paper. For any tuple t in the VLPR 1 table, if for 1≤j≤n we can get tSAj∈BSAj, and for n+1≤i≤d we can get tQIi∈BQIi, and the value in different nonsensitive QIi columns are bound together; then, B is denoted as a matching bucket (MB).
For example, in Table3, when t2 belongs to VLPR 1, t2=purple, large, Toyota. When the QI brand column is the only sensitive column that needs to be shuffled, the set of MB for t2 is B1,B2. If the QI brand and type are the sensitive columns, the set of MB for t2 is B1,B2,B3.Table 3
The original VLPR data with bucked id.
TupleBucket idTimeColorTypeBrand112018-07-30 13:08:01PurpleMiddleNissan212018-07-30 13:08:13PurpleLargeToyota312018-07-30 13:08:16GoldenMiniToyota422018-07-30 13:08:21PurpleLargeNissan522018-07-30 13:09:00BlackMiddleToyota622018-07-30 13:09:46BlueSmallVolkswagen732018-07-30 13:09:48PurpleSmallFord832018-07-30 13:09:54BlackLargeToyota932018-07-30 13:10:04PurpleSmallHyundai1042018-07-30 13:10:11grayLargeVolkswagen1142018-07-30 13:10:18PurpleMiddleHyundai1242018-07-30 13:10:26BlackMiniHonda


#### 5.2.3. Privacy Preservation

In this section, the protection principle of the (m, n)-bucket model for vehicle identities is analyzed in detail. Generally, a tuple t may have multiple MBs. Consider an adversary who knows all the QI values of t in VLPR 1 and attempts to infer t’s SAiv in VLPR 2 to link the trajectories according to time inference, where SAiv represents the value of the specified column SAi being shuffled. The adversary needs to determine where buckets t might reside. Tuple t may be in any one of its MBs. Let pt,B be the probability that tuple t is in bucket B. It is worth mentioning that the calculation of pt,B only takes the nonsensitive QIs into account. For instance, in Table 3, if the brand column is the only sensitive column, then B1 and B2 are the MBs of t2 and B3 is not because the nonsensitive type and color columns must be bound together.In the second step, the adversary computespt,SAiv, which is the probability that t contains SAiv. In other words, it is the probability that t is successfully identified. Specifically, let pSAivt,B represent the probability that t contains SAiv given that t is in bucket B. Then, the probability pt,SAiv can be computed as(4)pt,SAiv=∑Bpt,BpSAivt,B.In a VLPR tableT, when the (m, n)-bucket model is used for any individual t, pt,SA1v,SA2v,…,SAnv meets the following formula:(5)pt,SA1v,SA2v,…,SAnv≤∑MBpt,MBMBSA1v′·MBSA2v′···MBSAnv′mn.Here,v′ denotes the most frequent value in SAi, and MBSAiv′ is the number of values v′ that are contained in the SAi in MB. For example, in Table 3 bucket 1, v′ is Toyota and MBSAiv′ is 2. In formula (5), m is the number of t’s in every bucket, and n is the number of sensitive columns.Proof.
In formula (4), if tSAi∉BSAi1≤i≤d−n, then(6)pt,B=0.
In the previous formula,d and n represent the number of QI attributes and sensitive attributes, respectively. Therefore, formula (4) is converted into the following formula:(7)pt,SAiv=∑MBpt,MBpSAivt,MB.
For all buckets,v is always less than v′; then,(8)MBSAiv≤MBSAiv′.
Ifn = 1 and SA1 is the sensitive column, then you obtain(9)pt,SA1v=∑MBpt,MBpSAvt,MB,MBSA1v≤MBSA1v.
Hence,(10)pSA1v|t,MB=MBSA1vm≤MBSA1v′m,pt,SA1v≤∑MBpt,MBMBSA1v′m.
Therefore, whenn = 1, formula (5) is true.
If n = 2 andSA1 and SA2 are the sensitive columns, then you obtain(11)pt,SA1v,SA2v=∑MBpt,MBpSA1v|t,MBpSA2v|t,MB,SA1v,MBSA1v≤MBSA1v′,MBSA2v≤MBSA2v′.
Hence,(12)pSA1v|t,MB=MBSA1vm≤MBSA1v′m,pSA2v|t,MB,SA1v=MBSA2vm≤MBSA2v′m,pt,SA1v,SA2v=∑MBpt,MBMBSA1vmMBSA2vm≤∑MBpt,MBMBSA1v′·MBSA2v′m2.
Therefore, whenn = 2, formula (5) is true.
Suppose that whenn = k and SA1,SA2,…,SAk are the sensitive columns, the following formula (13) is true.(13)pt,SA1v,SA2v,…,SAkv=∑MBpt,MBMBSA1vmMBSA2vm⋯MBSAkvm≤∑MBpt,MBMBSA1v′·MBSA2v′···MBSAkv′mk.
Whenn = k + 1 and SA1,SA2,…,SAk,SAk+1 are the sensitive columns, you obtain(14)pt,SA1v,SA2v,…,SAkv,SAk+1v=∑MBpt,MBMBSA1vmMBSA2vm⋯MBSAk+1vm≤∑MBpt,MBMBSA1v′·MBSA2v′···MBSAkv′mk⋅MBSAk+1vm.
BecauseMBSAk+1v/m≤MBSAk+1v′/m, you obtain(15)pt,SA1v,SA2v,…,SAk+1v≤∑MBpt,MBMBSA1v′·MBSA2v′···MBSAk+1v′mk+1.
In summary, formula (5) is proven to be correct.


#### 5.2.4. Analysis

In the (m, n)-bucket model, under the condition of a constant m, let p′=MBSAiv′/m≤1. This means that the greater the value of n, the lower the probability of t being successfully identified. Under the condition of a constant n, in general, the greater the value of m, the greater the probability that p′ decreases. When m increases by 1, only if the added value is equal to SAiv′p′ increases; otherwise, it decreases. Since SAi usually contains many different values, the probability of it being not equal to SAiv′ is always greater than the probability that the added value is equal to SAiv′.


#### 5.2.5. (m, n)-Bucket Algorithm

This section presents an algorithm to implement the (m, n)-bucket model. It calculates the maximum linking probability of each individual. The procedure is presented in Algorithm 2.Algorithm 2: (m, n)-Bucket algorithm.
(1)
Divide eachm tuple into one bucket according to the time series(2)
forti in VLPR 1(3)
T_suspect = ∅, Bucket = ∅, MB = ∅, P_one = ∅, P_all = ∅(4)
fortj in VLPR 2(5)
iftjtime∈titime+Ex−Tt,titime+Ex+Tt & tjQIn==tiQIn (n∈n+1,n+2,…,d)(6)
addtj to T_suspect(7)
add all tuples with the same bucket id astj into Buckets(8)
for each bucket in Buckets(9)
if any tuples in bucket with the sameSAn (n∈1,2,…,n) as ti(10)
add bucket to MB(11)
if MB is not empty(12)
s_num = the number of tuples with the same QIn (n∈n+1,n+2,…,d) as ti(13)
for each bucket in MB(14)
calculate the number of maximum values in each of the sensitive columns,nameda1,a2,…,an(15)
calculate the number of tuples with the sameQIn (n∈n+1,n+2,…,d) as ti, named b(16)
then p_max_onemb = (b/s_num) ∗ (a1/m) ∗ (a2/m) ∗ … ∗ (an/m)(17)
addp_max_onemb to P_one(18)
p_all_one = the sum of all p_all_onemb in P_one(19)
addp_all_one to P_all(20)
returnP_allThe variabletjQIn denotes the nonsensitive columns of vehicle tj (line 5). The data structures T_suspect and Buckets store the suspect tuples and suspect buckets, respectively (lines 6 and 7). SAn denotes the sensitive columns (line 9). MB stores the matching buckets (line 10). The variable s_num is the number of tuples with the same QIn as ti (line 12). The variable p_max_onemb is the maximum probability of one matching bucket (line 16). The data structure P_one stores all the p_max_onemb of one tuple, and the variable p_all_one is the sum of all the p_all_onemb in P_one. The data structure P_all stores all p_all_one.For example, in Table3, suppose that the times of all tuples meet the requirements. That is, for tj in Table 3, tjtime∈titime+Ex−Tt,titime+Ex+Tt. The adversary gets one tuple ti=purple, large, Toyota from VLPR 1. The maximum probability of ti that the adversary can guess from Table 3 is calculated as follows. Suppose that the brand and type columns are the sensitive columns, where SAn is the brand and type column and QIn is the color column. The tuple tj denotes t2, t4, t7, t9, and t11. In other words, the tuples t2, t4, t7, t9, and t11 are stored in T_suspect. The tuples in buckets 1, 2, 3, and 4 are added into Buckets. We can get that bucket 4 is not the matching bucket because the brand column does not contain “Toyota.” Therefore, MB stores buckets 1, 2, and 3. The variable s_num is the number of “purple” responses in MB, namely, s_num = 4. In bucket 1, the most frequent value in the brand column is “Toyota,” and its number is 2. In the type column, every value has the same number, so the maximum number is 1. Therefore, in bucket 1, a1=2, a2=1, b = 2, and p_max_onemb = (2/4)∗(1/3)∗(2/3) = 1/9. In bucket 2, p_max_onemb = (1/4)∗(1/3)∗(1/3) = 1/36. In bucket 3, p_max_onemb = (2/4)∗(1/3)∗(1/3) = 1/18. Then, p_all_one = 1/9 + 1/36 + 1/18 = 7/36. Hence, the adversary can guess the same tuple of ti in Table 3 with the highest probability of 7/36.


## 5.1. Publishing the Original Data

Publishing the original data refers to releasing all the data that are collected in a VLPR, which provides the least privacy protection but the most usable data. If all data that are collected in VLPR systems are released, then when VLPR systems’ layouts are dense enough and the data quality is good enough, it is easy for an adversary to link the traces between the upstream and downstream VLPRs. In fact, due to the complexity of the road network, it is not a simple process for adversaries to keep track of the same vehicle between several intersections. However, with the development of smart cities, road network designs have become increasingly more standardized, VLPR systems’ layouts have become increasingly more intensive, and the data that are collected have become increasingly more accurate; therefore, it will become increasingly easier for adversaries to link traces between multiple VLPRs in the near future. If all vehicle traces are released without processing, as shown in Section6, a majority of the traces can be linked by using specific adversary models. Therefore, a certain data processing approach is needed to process the data that are collected in VLPR systems to ensure the privacy of travelers.


## 5.2. (m, n)-Bucket Model Based on Time Series

### 5.2.1. Related Work

The application of generalization to protect privacy disclosures has been very well studied in the literature [19–21]. This approach consists of generalizing a dataset to a certain extent by transforming the QI values into more general forms and dividing tuples into equivalent groups, where the values of each QI attribute are the same. Therefore, the records in the same equivalence group are indistinguishable, which meets k-anonymity [22–24] and l-diversity [25, 26]. Although generalization is a common method for privacy preservation, it makes the data lose much information and fails with high-dimensional data, which is not conducive to the effective analysis of data. To overcome the drawbacks of generalization, a bucketization method called anatomy, which protects both the privacy and correlation in the microdata, is proposed [27]. Bucketization first divides the tuples in the table into buckets and then randomly separates the quasi-identifiers (QIs) with sensitive properties by traversing the SA values in each bucket. Although bucketization can be used to deal with high-dimensional data, it also tends to disclose more information because all the QIs are released. To overcome the limitations of generalization and bucketization to get better privacy preservation and data utility, the slicing algorithm was proposed, which can prevent attribute disclosure and membership disclosure while releasing data [28]. However, slicing has been found to risk the disclosure of some absolute facts, which would help adversaries find invalid records in released datasets, resulting in personal privacy violations [29]. To improve the confidentiality of the published data in a slice table, a method called value swapping is proposed. Its purpose is to decrease the attribute disclosure risk for absolute facts and ensure l-diverse slicing. To meet the different requirements for the protection of identities and sensitive values, an approach called cross-bucket generalization is presented [30]. This approach can meet the requirements by providing higher attribute protection than identity protection and is proven to be useful for privacy preservation. Besides, there are other methods to replace sensitive attributes with anonymous characters independently at random [31] or add randomized records to the original database [32]. These methods usually can achieve good privacy protection. However, the former causes a great deal of information loss, and the latter adds a lot of information. This is unacceptable in the field of big data. In order to achieve the effect of privacy protection and keep the original data as much as possible, we proposed the algorithm that shuffles the sensitive attribute values in the same bucket. This method neither adds data nor decreases data but just shuffles sensitive data in the same bucket.All the related works that are mentioned above are not suitable for vehicle trajectory privacy preservation because existing privacy protection methods are applicable to data without time correlation. Therefore, in order to meet thek-anonymity or l-diversity requirement, the order of the data in the table can be adjusted at will. However, the VLPR data have strong time correlations, and so the positions of the data in the table cannot be adjusted at will. In conclusion, none of the above privacy protection methods are applicable to vehicle trajectory privacy protection. Therefore, based on the above research, the (m, n)-bucket model based on time series is proposed in this paper.


### 5.2.2. Formalization of (m, n)-Bucket Model

Define T as the VLPR data that is to be published.T contains d quasi-identifier (QI) attributes QI=QI1,QI2,…,QId and e tuples T=t1,t2,…,te. Each QIi1≤i≤d can be categorical in the VLPR dataset.Definition 1.
(Bucket). A tuple partition consists of several subsets ofT such that each tuple belongs to only one subset. These subsets are referred to as buckets, and we denote them as B1,B2,…,Bb. Then, ∪i=1bBi=T and, for any 1≤i1≠i2≤b, Bi1∩Bi2=Φ.Definition 2.
((m, n)-bucket).T is sorted according to time series and is divided into several buckets where each bucket contains m tuples. After dividing T into several buckets, the values of the specified columns are shuffled inside the bucket, and n is the number of columns being shuffled.Definition 3.
(Matching Bucket). LetQI1,QI2,…,QId be the d columns of a VLPR table. Let t be a tuple and tQIi be the QIi value of t. B is denoted as a bucket in the VLPR table, and BQIi is denoted as the multiset of QIi values in B. Let SA1,SA2,…,SAn be the sensitive columns that need to be shuffled, where n represents the number of sensitive columns. Let QIn+1,QIn+2,…,QId be the nonsensitive QIi columns that do not need to be shuffled. Identifying which column is the sensitive column is not the focus of the research of this paper. For any tuple t in the VLPR 1 table, if for 1≤j≤n we can get tSAj∈BSAj, and for n+1≤i≤d we can get tQIi∈BQIi, and the value in different nonsensitive QIi columns are bound together; then, B is denoted as a matching bucket (MB).
For example, in Table3, when t2 belongs to VLPR 1, t2=purple, large, Toyota. When the QI brand column is the only sensitive column that needs to be shuffled, the set of MB for t2 is B1,B2. If the QI brand and type are the sensitive columns, the set of MB for t2 is B1,B2,B3.Table 3
The original VLPR data with bucked id.
TupleBucket idTimeColorTypeBrand112018-07-30 13:08:01PurpleMiddleNissan212018-07-30 13:08:13PurpleLargeToyota312018-07-30 13:08:16GoldenMiniToyota422018-07-30 13:08:21PurpleLargeNissan522018-07-30 13:09:00BlackMiddleToyota622018-07-30 13:09:46BlueSmallVolkswagen732018-07-30 13:09:48PurpleSmallFord832018-07-30 13:09:54BlackLargeToyota932018-07-30 13:10:04PurpleSmallHyundai1042018-07-30 13:10:11grayLargeVolkswagen1142018-07-30 13:10:18PurpleMiddleHyundai1242018-07-30 13:10:26BlackMiniHonda


### 5.2.3. Privacy Preservation

In this section, the protection principle of the (m, n)-bucket model for vehicle identities is analyzed in detail. Generally, a tuple t may have multiple MBs. Consider an adversary who knows all the QI values of t in VLPR 1 and attempts to infer t’s SAiv in VLPR 2 to link the trajectories according to time inference, where SAiv represents the value of the specified column SAi being shuffled. The adversary needs to determine where buckets t might reside. Tuple t may be in any one of its MBs. Let pt,B be the probability that tuple t is in bucket B. It is worth mentioning that the calculation of pt,B only takes the nonsensitive QIs into account. For instance, in Table 3, if the brand column is the only sensitive column, then B1 and B2 are the MBs of t2 and B3 is not because the nonsensitive type and color columns must be bound together.In the second step, the adversary computespt,SAiv, which is the probability that t contains SAiv. In other words, it is the probability that t is successfully identified. Specifically, let pSAivt,B represent the probability that t contains SAiv given that t is in bucket B. Then, the probability pt,SAiv can be computed as(4)pt,SAiv=∑Bpt,BpSAivt,B.In a VLPR tableT, when the (m, n)-bucket model is used for any individual t, pt,SA1v,SA2v,…,SAnv meets the following formula:(5)pt,SA1v,SA2v,…,SAnv≤∑MBpt,MBMBSA1v′·MBSA2v′···MBSAnv′mn.Here,v′ denotes the most frequent value in SAi, and MBSAiv′ is the number of values v′ that are contained in the SAi in MB. For example, in Table 3 bucket 1, v′ is Toyota and MBSAiv′ is 2. In formula (5), m is the number of t’s in every bucket, and n is the number of sensitive columns.Proof.
In formula (4), if tSAi∉BSAi1≤i≤d−n, then(6)pt,B=0.
In the previous formula,d and n represent the number of QI attributes and sensitive attributes, respectively. Therefore, formula (4) is converted into the following formula:(7)pt,SAiv=∑MBpt,MBpSAivt,MB.
For all buckets,v is always less than v′; then,(8)MBSAiv≤MBSAiv′.
Ifn = 1 and SA1 is the sensitive column, then you obtain(9)pt,SA1v=∑MBpt,MBpSAvt,MB,MBSA1v≤MBSA1v.
Hence,(10)pSA1v|t,MB=MBSA1vm≤MBSA1v′m,pt,SA1v≤∑MBpt,MBMBSA1v′m.
Therefore, whenn = 1, formula (5) is true.
If n = 2 andSA1 and SA2 are the sensitive columns, then you obtain(11)pt,SA1v,SA2v=∑MBpt,MBpSA1v|t,MBpSA2v|t,MB,SA1v,MBSA1v≤MBSA1v′,MBSA2v≤MBSA2v′.
Hence,(12)pSA1v|t,MB=MBSA1vm≤MBSA1v′m,pSA2v|t,MB,SA1v=MBSA2vm≤MBSA2v′m,pt,SA1v,SA2v=∑MBpt,MBMBSA1vmMBSA2vm≤∑MBpt,MBMBSA1v′·MBSA2v′m2.
Therefore, whenn = 2, formula (5) is true.
Suppose that whenn = k and SA1,SA2,…,SAk are the sensitive columns, the following formula (13) is true.(13)pt,SA1v,SA2v,…,SAkv=∑MBpt,MBMBSA1vmMBSA2vm⋯MBSAkvm≤∑MBpt,MBMBSA1v′·MBSA2v′···MBSAkv′mk.
Whenn = k + 1 and SA1,SA2,…,SAk,SAk+1 are the sensitive columns, you obtain(14)pt,SA1v,SA2v,…,SAkv,SAk+1v=∑MBpt,MBMBSA1vmMBSA2vm⋯MBSAk+1vm≤∑MBpt,MBMBSA1v′·MBSA2v′···MBSAkv′mk⋅MBSAk+1vm.
BecauseMBSAk+1v/m≤MBSAk+1v′/m, you obtain(15)pt,SA1v,SA2v,…,SAk+1v≤∑MBpt,MBMBSA1v′·MBSA2v′···MBSAk+1v′mk+1.
In summary, formula (5) is proven to be correct.


### 5.2.4. Analysis

In the (m, n)-bucket model, under the condition of a constant m, let p′=MBSAiv′/m≤1. This means that the greater the value of n, the lower the probability of t being successfully identified. Under the condition of a constant n, in general, the greater the value of m, the greater the probability that p′ decreases. When m increases by 1, only if the added value is equal to SAiv′p′ increases; otherwise, it decreases. Since SAi usually contains many different values, the probability of it being not equal to SAiv′ is always greater than the probability that the added value is equal to SAiv′.


### 5.2.5. (m, n)-Bucket Algorithm

This section presents an algorithm to implement the (m, n)-bucket model. It calculates the maximum linking probability of each individual. The procedure is presented in Algorithm 2.Algorithm 2: (m, n)-Bucket algorithm.
(1)
Divide eachm tuple into one bucket according to the time series(2)
forti in VLPR 1(3)
T_suspect = ∅, Bucket = ∅, MB = ∅, P_one = ∅, P_all = ∅(4)
fortj in VLPR 2(5)
iftjtime∈titime+Ex−Tt,titime+Ex+Tt & tjQIn==tiQIn (n∈n+1,n+2,…,d)(6)
addtj to T_suspect(7)
add all tuples with the same bucket id astj into Buckets(8)
for each bucket in Buckets(9)
if any tuples in bucket with the sameSAn (n∈1,2,…,n) as ti(10)
add bucket to MB(11)
if MB is not empty(12)
s_num = the number of tuples with the same QIn (n∈n+1,n+2,…,d) as ti(13)
for each bucket in MB(14)
calculate the number of maximum values in each of the sensitive columns,nameda1,a2,…,an(15)
calculate the number of tuples with the sameQIn (n∈n+1,n+2,…,d) as ti, named b(16)
then p_max_onemb = (b/s_num) ∗ (a1/m) ∗ (a2/m) ∗ … ∗ (an/m)(17)
addp_max_onemb to P_one(18)
p_all_one = the sum of all p_all_onemb in P_one(19)
addp_all_one to P_all(20)
returnP_allThe variabletjQIn denotes the nonsensitive columns of vehicle tj (line 5). The data structures T_suspect and Buckets store the suspect tuples and suspect buckets, respectively (lines 6 and 7). SAn denotes the sensitive columns (line 9). MB stores the matching buckets (line 10). The variable s_num is the number of tuples with the same QIn as ti (line 12). The variable p_max_onemb is the maximum probability of one matching bucket (line 16). The data structure P_one stores all the p_max_onemb of one tuple, and the variable p_all_one is the sum of all the p_all_onemb in P_one. The data structure P_all stores all p_all_one.For example, in Table3, suppose that the times of all tuples meet the requirements. That is, for tj in Table 3, tjtime∈titime+Ex−Tt,titime+Ex+Tt. The adversary gets one tuple ti=purple, large, Toyota from VLPR 1. The maximum probability of ti that the adversary can guess from Table 3 is calculated as follows. Suppose that the brand and type columns are the sensitive columns, where SAn is the brand and type column and QIn is the color column. The tuple tj denotes t2, t4, t7, t9, and t11. In other words, the tuples t2, t4, t7, t9, and t11 are stored in T_suspect. The tuples in buckets 1, 2, 3, and 4 are added into Buckets. We can get that bucket 4 is not the matching bucket because the brand column does not contain “Toyota.” Therefore, MB stores buckets 1, 2, and 3. The variable s_num is the number of “purple” responses in MB, namely, s_num = 4. In bucket 1, the most frequent value in the brand column is “Toyota,” and its number is 2. In the type column, every value has the same number, so the maximum number is 1. Therefore, in bucket 1, a1=2, a2=1, b = 2, and p_max_onemb = (2/4)∗(1/3)∗(2/3) = 1/9. In bucket 2, p_max_onemb = (1/4)∗(1/3)∗(1/3) = 1/36. In bucket 3, p_max_onemb = (2/4)∗(1/3)∗(1/3) = 1/18. Then, p_all_one = 1/9 + 1/36 + 1/18 = 7/36. Hence, the adversary can guess the same tuple of ti in Table 3 with the highest probability of 7/36.


## 5.2.1. Related Work

The application of generalization to protect privacy disclosures has been very well studied in the literature [19–21]. This approach consists of generalizing a dataset to a certain extent by transforming the QI values into more general forms and dividing tuples into equivalent groups, where the values of each QI attribute are the same. Therefore, the records in the same equivalence group are indistinguishable, which meets k-anonymity [22–24] and l-diversity [25, 26]. Although generalization is a common method for privacy preservation, it makes the data lose much information and fails with high-dimensional data, which is not conducive to the effective analysis of data. To overcome the drawbacks of generalization, a bucketization method called anatomy, which protects both the privacy and correlation in the microdata, is proposed [27]. Bucketization first divides the tuples in the table into buckets and then randomly separates the quasi-identifiers (QIs) with sensitive properties by traversing the SA values in each bucket. Although bucketization can be used to deal with high-dimensional data, it also tends to disclose more information because all the QIs are released. To overcome the limitations of generalization and bucketization to get better privacy preservation and data utility, the slicing algorithm was proposed, which can prevent attribute disclosure and membership disclosure while releasing data [28]. However, slicing has been found to risk the disclosure of some absolute facts, which would help adversaries find invalid records in released datasets, resulting in personal privacy violations [29]. To improve the confidentiality of the published data in a slice table, a method called value swapping is proposed. Its purpose is to decrease the attribute disclosure risk for absolute facts and ensure l-diverse slicing. To meet the different requirements for the protection of identities and sensitive values, an approach called cross-bucket generalization is presented [30]. This approach can meet the requirements by providing higher attribute protection than identity protection and is proven to be useful for privacy preservation. Besides, there are other methods to replace sensitive attributes with anonymous characters independently at random [31] or add randomized records to the original database [32]. These methods usually can achieve good privacy protection. However, the former causes a great deal of information loss, and the latter adds a lot of information. This is unacceptable in the field of big data. In order to achieve the effect of privacy protection and keep the original data as much as possible, we proposed the algorithm that shuffles the sensitive attribute values in the same bucket. This method neither adds data nor decreases data but just shuffles sensitive data in the same bucket.All the related works that are mentioned above are not suitable for vehicle trajectory privacy preservation because existing privacy protection methods are applicable to data without time correlation. Therefore, in order to meet thek-anonymity or l-diversity requirement, the order of the data in the table can be adjusted at will. However, the VLPR data have strong time correlations, and so the positions of the data in the table cannot be adjusted at will. In conclusion, none of the above privacy protection methods are applicable to vehicle trajectory privacy protection. Therefore, based on the above research, the (m, n)-bucket model based on time series is proposed in this paper.


## 5.2.2. Formalization of (m, n)-Bucket Model

Define T as the VLPR data that is to be published.T contains d quasi-identifier (QI) attributes QI=QI1,QI2,…,QId and e tuples T=t1,t2,…,te. Each QIi1≤i≤d can be categorical in the VLPR dataset.Definition 1.
(Bucket). A tuple partition consists of several subsets ofT such that each tuple belongs to only one subset. These subsets are referred to as buckets, and we denote them as B1,B2,…,Bb. Then, ∪i=1bBi=T and, for any 1≤i1≠i2≤b, Bi1∩Bi2=Φ.Definition 2.
((m, n)-bucket).T is sorted according to time series and is divided into several buckets where each bucket contains m tuples. After dividing T into several buckets, the values of the specified columns are shuffled inside the bucket, and n is the number of columns being shuffled.Definition 3.
(Matching Bucket). LetQI1,QI2,…,QId be the d columns of a VLPR table. Let t be a tuple and tQIi be the QIi value of t. B is denoted as a bucket in the VLPR table, and BQIi is denoted as the multiset of QIi values in B. Let SA1,SA2,…,SAn be the sensitive columns that need to be shuffled, where n represents the number of sensitive columns. Let QIn+1,QIn+2,…,QId be the nonsensitive QIi columns that do not need to be shuffled. Identifying which column is the sensitive column is not the focus of the research of this paper. For any tuple t in the VLPR 1 table, if for 1≤j≤n we can get tSAj∈BSAj, and for n+1≤i≤d we can get tQIi∈BQIi, and the value in different nonsensitive QIi columns are bound together; then, B is denoted as a matching bucket (MB).
For example, in Table3, when t2 belongs to VLPR 1, t2=purple, large, Toyota. When the QI brand column is the only sensitive column that needs to be shuffled, the set of MB for t2 is B1,B2. If the QI brand and type are the sensitive columns, the set of MB for t2 is B1,B2,B3.Table 3
The original VLPR data with bucked id.
TupleBucket idTimeColorTypeBrand112018-07-30 13:08:01PurpleMiddleNissan212018-07-30 13:08:13PurpleLargeToyota312018-07-30 13:08:16GoldenMiniToyota422018-07-30 13:08:21PurpleLargeNissan522018-07-30 13:09:00BlackMiddleToyota622018-07-30 13:09:46BlueSmallVolkswagen732018-07-30 13:09:48PurpleSmallFord832018-07-30 13:09:54BlackLargeToyota932018-07-30 13:10:04PurpleSmallHyundai1042018-07-30 13:10:11grayLargeVolkswagen1142018-07-30 13:10:18PurpleMiddleHyundai1242018-07-30 13:10:26BlackMiniHonda


## 5.2.3. Privacy Preservation

In this section, the protection principle of the (m, n)-bucket model for vehicle identities is analyzed in detail. Generally, a tuple t may have multiple MBs. Consider an adversary who knows all the QI values of t in VLPR 1 and attempts to infer t’s SAiv in VLPR 2 to link the trajectories according to time inference, where SAiv represents the value of the specified column SAi being shuffled. The adversary needs to determine where buckets t might reside. Tuple t may be in any one of its MBs. Let pt,B be the probability that tuple t is in bucket B. It is worth mentioning that the calculation of pt,B only takes the nonsensitive QIs into account. For instance, in Table 3, if the brand column is the only sensitive column, then B1 and B2 are the MBs of t2 and B3 is not because the nonsensitive type and color columns must be bound together.In the second step, the adversary computespt,SAiv, which is the probability that t contains SAiv. In other words, it is the probability that t is successfully identified. Specifically, let pSAivt,B represent the probability that t contains SAiv given that t is in bucket B. Then, the probability pt,SAiv can be computed as(4)pt,SAiv=∑Bpt,BpSAivt,B.In a VLPR tableT, when the (m, n)-bucket model is used for any individual t, pt,SA1v,SA2v,…,SAnv meets the following formula:(5)pt,SA1v,SA2v,…,SAnv≤∑MBpt,MBMBSA1v′·MBSA2v′···MBSAnv′mn.Here,v′ denotes the most frequent value in SAi, and MBSAiv′ is the number of values v′ that are contained in the SAi in MB. For example, in Table 3 bucket 1, v′ is Toyota and MBSAiv′ is 2. In formula (5), m is the number of t’s in every bucket, and n is the number of sensitive columns.Proof.
In formula (4), if tSAi∉BSAi1≤i≤d−n, then(6)pt,B=0.
In the previous formula,d and n represent the number of QI attributes and sensitive attributes, respectively. Therefore, formula (4) is converted into the following formula:(7)pt,SAiv=∑MBpt,MBpSAivt,MB.
For all buckets,v is always less than v′; then,(8)MBSAiv≤MBSAiv′.
Ifn = 1 and SA1 is the sensitive column, then you obtain(9)pt,SA1v=∑MBpt,MBpSAvt,MB,MBSA1v≤MBSA1v.
Hence,(10)pSA1v|t,MB=MBSA1vm≤MBSA1v′m,pt,SA1v≤∑MBpt,MBMBSA1v′m.
Therefore, whenn = 1, formula (5) is true.
If n = 2 andSA1 and SA2 are the sensitive columns, then you obtain(11)pt,SA1v,SA2v=∑MBpt,MBpSA1v|t,MBpSA2v|t,MB,SA1v,MBSA1v≤MBSA1v′,MBSA2v≤MBSA2v′.
Hence,(12)pSA1v|t,MB=MBSA1vm≤MBSA1v′m,pSA2v|t,MB,SA1v=MBSA2vm≤MBSA2v′m,pt,SA1v,SA2v=∑MBpt,MBMBSA1vmMBSA2vm≤∑MBpt,MBMBSA1v′·MBSA2v′m2.
Therefore, whenn = 2, formula (5) is true.
Suppose that whenn = k and SA1,SA2,…,SAk are the sensitive columns, the following formula (13) is true.(13)pt,SA1v,SA2v,…,SAkv=∑MBpt,MBMBSA1vmMBSA2vm⋯MBSAkvm≤∑MBpt,MBMBSA1v′·MBSA2v′···MBSAkv′mk.
Whenn = k + 1 and SA1,SA2,…,SAk,SAk+1 are the sensitive columns, you obtain(14)pt,SA1v,SA2v,…,SAkv,SAk+1v=∑MBpt,MBMBSA1vmMBSA2vm⋯MBSAk+1vm≤∑MBpt,MBMBSA1v′·MBSA2v′···MBSAkv′mk⋅MBSAk+1vm.
BecauseMBSAk+1v/m≤MBSAk+1v′/m, you obtain(15)pt,SA1v,SA2v,…,SAk+1v≤∑MBpt,MBMBSA1v′·MBSA2v′···MBSAk+1v′mk+1.
In summary, formula (5) is proven to be correct.


## 5.2.4. Analysis

In the (m, n)-bucket model, under the condition of a constant m, let p′=MBSAiv′/m≤1. This means that the greater the value of n, the lower the probability of t being successfully identified. Under the condition of a constant n, in general, the greater the value of m, the greater the probability that p′ decreases. When m increases by 1, only if the added value is equal to SAiv′p′ increases; otherwise, it decreases. Since SAi usually contains many different values, the probability of it being not equal to SAiv′ is always greater than the probability that the added value is equal to SAiv′.


## 5.2.5. (m, n)-Bucket Algorithm

This section presents an algorithm to implement the (m, n)-bucket model. It calculates the maximum linking probability of each individual. The procedure is presented in Algorithm 2.Algorithm 2: (m, n)-Bucket algorithm.
(1)
Divide eachm tuple into one bucket according to the time series(2)
forti in VLPR 1(3)
T_suspect = ∅, Bucket = ∅, MB = ∅, P_one = ∅, P_all = ∅(4)
fortj in VLPR 2(5)
iftjtime∈titime+Ex−Tt,titime+Ex+Tt & tjQIn==tiQIn (n∈n+1,n+2,…,d)(6)
addtj to T_suspect(7)
add all tuples with the same bucket id astj into Buckets(8)
for each bucket in Buckets(9)
if any tuples in bucket with the sameSAn (n∈1,2,…,n) as ti(10)
add bucket to MB(11)
if MB is not empty(12)
s_num = the number of tuples with the same QIn (n∈n+1,n+2,…,d) as ti(13)
for each bucket in MB(14)
calculate the number of maximum values in each of the sensitive columns,nameda1,a2,…,an(15)
calculate the number of tuples with the sameQIn (n∈n+1,n+2,…,d) as ti, named b(16)
then p_max_onemb = (b/s_num) ∗ (a1/m) ∗ (a2/m) ∗ … ∗ (an/m)(17)
addp_max_onemb to P_one(18)
p_all_one = the sum of all p_all_onemb in P_one(19)
addp_all_one to P_all(20)
returnP_allThe variabletjQIn denotes the nonsensitive columns of vehicle tj (line 5). The data structures T_suspect and Buckets store the suspect tuples and suspect buckets, respectively (lines 6 and 7). SAn denotes the sensitive columns (line 9). MB stores the matching buckets (line 10). The variable s_num is the number of tuples with the same QIn as ti (line 12). The variable p_max_onemb is the maximum probability of one matching bucket (line 16). The data structure P_one stores all the p_max_onemb of one tuple, and the variable p_all_one is the sum of all the p_all_onemb in P_one. The data structure P_all stores all p_all_one.For example, in Table3, suppose that the times of all tuples meet the requirements. That is, for tj in Table 3, tjtime∈titime+Ex−Tt,titime+Ex+Tt. The adversary gets one tuple ti=purple, large, Toyota from VLPR 1. The maximum probability of ti that the adversary can guess from Table 3 is calculated as follows. Suppose that the brand and type columns are the sensitive columns, where SAn is the brand and type column and QIn is the color column. The tuple tj denotes t2, t4, t7, t9, and t11. In other words, the tuples t2, t4, t7, t9, and t11 are stored in T_suspect. The tuples in buckets 1, 2, 3, and 4 are added into Buckets. We can get that bucket 4 is not the matching bucket because the brand column does not contain “Toyota.” Therefore, MB stores buckets 1, 2, and 3. The variable s_num is the number of “purple” responses in MB, namely, s_num = 4. In bucket 1, the most frequent value in the brand column is “Toyota,” and its number is 2. In the type column, every value has the same number, so the maximum number is 1. Therefore, in bucket 1, a1=2, a2=1, b = 2, and p_max_onemb = (2/4)∗(1/3)∗(2/3) = 1/9. In bucket 2, p_max_onemb = (1/4)∗(1/3)∗(1/3) = 1/36. In bucket 3, p_max_onemb = (2/4)∗(1/3)∗(1/3) = 1/18. Then, p_all_one = 1/9 + 1/36 + 1/18 = 7/36. Hence, the adversary can guess the same tuple of ti in Table 3 with the highest probability of 7/36.


## 6. Evaluation Criteria

In this section, the criteria that are used to evaluate the performances of the (m, n)-bucket model and address the data requirements for privacy preservation are discussed. To evaluate the performance of the (m, n)-bucket model, the proposed adversary model is used. The percentage of correctly linked trajectories (denoted as pr) is proposed to evaluate the privacy preservation. Let pr be the probability that the trajectories of one vehicle can be successfully linked between two VLPRs. It can be calculated by using the correct number of inferences divided by the total number of trajectories passing through both the VLPRs.It is important to ensure that after the privacy preservation method is applied, the published datasets can still be used for traffic modeling or other research purposes, such as the impact of different vehicle types on environmental pollution and people’s preferences for vehicle colors and brands. According to the needs or priorities of different users, data managers can release data with differentms and ns by using the (m, n)-bucket model that is proposed in this paper. In other words, high-priority users can access data with smaller ms and ns while low-priority users can access data with larger ms and ns.


## 7. Experiment

### 7.1. Experiments for Case 1 and Case 2

In this section, the proposed adversary is used to evaluate the effectiveness of the (m, n)-bucket model by making privacy attacks. The evaluation is done using VLPR data that were collected at Shenluo highway (Case 1) and the intersection of Songcheng road (Case 2), in Guangdong Province, China. The datasets have 3 discrete attributes as summarized in Table 4. The number of vehicles in Case 1 and Case 2 is illustrated in detail in Table 5. In Case 2, the reason why the number of vehicles (both VLPR 1 and VLPR 3) is much larger than other junctions is that it is the main road.Table 4
Description of attributes.
AttributeTypeNumber of distinct valuesBrandCategorical18ColorCategorical11TypeCategorical4Table 5
The numbers of vehicles in Case 1 and Case 2.
ExperimentTime/dateNumber of vehicles (both VLPR 1 and VLPR 2)Number of vehicles (both VLPR 1 and VLPR 3)Number of vehicles (both VLPR 1 and VLPR 4)Case 12018/07/30 10:00–10:592352018/07/30 11:00–11:592742018/07/30 12:00–12:59265Case 22018/07/0911545971782018/07/1011353542042018/07/11784587201The geometry of the network is shown in Figure5. The road network is located in Foshan, China. Shenluo road belongs to highway and Songcheng road is an urban road. In Case 1, vehicles can only travel from VLPR 1 to VLPR 2 because there is no other exit between them. The road length between VLPR 1 and VLPR 2 is approximately 10 kilometers. The data that are collected between 10:00 a.m. and 12:00 p.m. are used in Case 1. The road network in Case 2 includes two intersections and the length between them is approximately 0.7 kilometers. For one vehicle trace that is at the downstream VLPR 1, it may be the same vehicle as the target trace in the previously given released traces in upstream VLPR 2, VLPR 3, and VLPR 4. The data that are used in Case 2 were collected from July 9th to 11th. The numbers of traces in the two cases are illustrated in detail in Table 5. Based on the proposed method, it is assumed here that the adversary has access to the released vehicle traces within each VLPR. This kind of data could be archived historical data. Using the proposed adversary model to attack the released datasets, the performance of the (m, n)-bucket model is evaluated with respect to privacy.Figure 5
Network geometry. (a) Shenluo highway. (b) Intersection of Songcheng road.
(a)(b)Suppose that the original VLPR data are released and the proposed adversary model is used to track the vehicle trajectories between the upstream and downstream VLPRs with different thresholds. Figure6 illustrates the change of p with the different rates, where the x-coordinate is the rate, and the y-coordinate is the tracking probability. Figure 6(a) shows the performance in Case 1 from 10:00 a.m. to 12:00 p.m., where 10 h represents the probability that the vehicle trajectories are successfully linked between 10 and 11 o’clock and so on. Figure 6(b) shows the performance in Case 2 from July 9th to 11th, where 2-1 July 9th denotes the probability that the vehicle trajectories are successfully linked between VLPR 2 and VLPR 1 on July 9th and so on.Figure 6
The change curves ofp with different rates. (a) Shenluo highway. (b) Intersection of Songcheng road.
(a)(b)Figure6 illustrates that releasing all of the original data within each VLPR is useful to preserving privacy. However, if Tt is more than 0.7 times the estimated travel time, this is not sufficient since there is still a large proportion of vehicle traces (approximately 94% in Case 1 and more than 90% in Case 2) that can be successfully tracked. However, the general performance of the adversary model varies from one case to another, depending on the road topology between the upstream and downstream VLPRs. For example, if vehicles get off the road or end their trips in the middle of the VLPR pair, the estimated travel time would be inaccurate, eventually leading to a decline in the successful linking rate. In conclusion, in order to obtain the maximum linking rate, the value range of Tt is suggested to be no less than 0.7.We assume that the adversary is always able to track vehicle trajectories with the maximum probability. In Case 1 and Case 2, the privacy performances with differentms and ns are illustrated in Figure 7, where the x-coordinate is m and the y-coordinate is the tracking probability. In Figure 7, type means that only the column type is the sensitive column; type & color means that the type and color columns are the sensitive columns; type & color & brand means that the type, color, and brand columns are the sensitive columns; and so on. Figure 7(a) represents the results of Case 1. Figure 7(b) denotes the results between VLPR 1 and VLPR 2 in Case 2, Figure 7(c) represents the results between VLPR 1 and VLPR 3 in Case 2, and Figure 7(d) denotes the results between VLPR 1 and VLPR 4 in Case 2.Figure 7
The change curve ofp with different ms and ns. (a) The results of Case 1. (b) The results of Case 2 (VLPR 1 and VLPR 2). (c) The results of Case 2 (VLPR 1 and VLPR 3). (d) The results of Case 2 (VLPR 1 and VLPR 4).
(a)(b)(c)(d)As seen from Figure7, if only one column is the sensitive column, the probability converges at a certain value and does not continue to decline. For the same curve, p decreases at first as m increases. When m increases to a certain value, p converges within an interval range. The convergence rate is different for different sensitive columns. For different ns, p declines at different rates. The larger n is, the faster p drops. If n and m are big enough, the probability can even reach close to zero. For Case 1 and Case 2, p changes similarly, which proves that the adversary model that is proposed in this paper is not only useful to the simple situation (Case 1) but also useful to the intersection situation (Case 2).


### 7.2. Comparison

To verify the effectiveness of the (m, n)-bucket model that is proposed in this paper, the following experiment is performed using the 2018/07/30 12:00–12:59 data in Case 1. Since the calculated probability is the maximum probability (denoted as pt,SAiv in Section 4.2.3) of each individual being linked while the actual linking probability (denoted as pr) is for all individuals, in order to compare pt,SAiv and pr, the average value of pt,SAiv for all individual t’s is used as the total calculated probability (denoted as pc). The results are shown in Figure 8, where pc-type represents the calculated probability with type as the sensitive column, pr-type denotes the actual linking probability with type as the sensitive column, and so on. In general, pc is greater than pr, but there are special circumstances. For example, in Figure 8(b), when m is equal to 2, the pr-type-brand is greater than the pc-type-brand. This is because a small probability does not necessarily mean that the link fails. The results show that the derived mathematical model can well expound the privacy protection principle of the (m, n)-bucket model.Figure 8
The probabilitiespc and pr with different ms and ns. (a) The comparison of pc and pr with one SA. (b) The comparison of pc and pr with two SAs. (c) The comparison of pc and pr with three SAs.
(a)(b)(c)


## 7.1. Experiments for Case 1 and Case 2

In this section, the proposed adversary is used to evaluate the effectiveness of the (m, n)-bucket model by making privacy attacks. The evaluation is done using VLPR data that were collected at Shenluo highway (Case 1) and the intersection of Songcheng road (Case 2), in Guangdong Province, China. The datasets have 3 discrete attributes as summarized in Table 4. The number of vehicles in Case 1 and Case 2 is illustrated in detail in Table 5. In Case 2, the reason why the number of vehicles (both VLPR 1 and VLPR 3) is much larger than other junctions is that it is the main road.Table 4
Description of attributes.
AttributeTypeNumber of distinct valuesBrandCategorical18ColorCategorical11TypeCategorical4Table 5
The numbers of vehicles in Case 1 and Case 2.
ExperimentTime/dateNumber of vehicles (both VLPR 1 and VLPR 2)Number of vehicles (both VLPR 1 and VLPR 3)Number of vehicles (both VLPR 1 and VLPR 4)Case 12018/07/30 10:00–10:592352018/07/30 11:00–11:592742018/07/30 12:00–12:59265Case 22018/07/0911545971782018/07/1011353542042018/07/11784587201The geometry of the network is shown in Figure5. The road network is located in Foshan, China. Shenluo road belongs to highway and Songcheng road is an urban road. In Case 1, vehicles can only travel from VLPR 1 to VLPR 2 because there is no other exit between them. The road length between VLPR 1 and VLPR 2 is approximately 10 kilometers. The data that are collected between 10:00 a.m. and 12:00 p.m. are used in Case 1. The road network in Case 2 includes two intersections and the length between them is approximately 0.7 kilometers. For one vehicle trace that is at the downstream VLPR 1, it may be the same vehicle as the target trace in the previously given released traces in upstream VLPR 2, VLPR 3, and VLPR 4. The data that are used in Case 2 were collected from July 9th to 11th. The numbers of traces in the two cases are illustrated in detail in Table 5. Based on the proposed method, it is assumed here that the adversary has access to the released vehicle traces within each VLPR. This kind of data could be archived historical data. Using the proposed adversary model to attack the released datasets, the performance of the (m, n)-bucket model is evaluated with respect to privacy.Figure 5
Network geometry. (a) Shenluo highway. (b) Intersection of Songcheng road.
(a)(b)Suppose that the original VLPR data are released and the proposed adversary model is used to track the vehicle trajectories between the upstream and downstream VLPRs with different thresholds. Figure6 illustrates the change of p with the different rates, where the x-coordinate is the rate, and the y-coordinate is the tracking probability. Figure 6(a) shows the performance in Case 1 from 10:00 a.m. to 12:00 p.m., where 10 h represents the probability that the vehicle trajectories are successfully linked between 10 and 11 o’clock and so on. Figure 6(b) shows the performance in Case 2 from July 9th to 11th, where 2-1 July 9th denotes the probability that the vehicle trajectories are successfully linked between VLPR 2 and VLPR 1 on July 9th and so on.Figure 6
The change curves ofp with different rates. (a) Shenluo highway. (b) Intersection of Songcheng road.
(a)(b)Figure6 illustrates that releasing all of the original data within each VLPR is useful to preserving privacy. However, if Tt is more than 0.7 times the estimated travel time, this is not sufficient since there is still a large proportion of vehicle traces (approximately 94% in Case 1 and more than 90% in Case 2) that can be successfully tracked. However, the general performance of the adversary model varies from one case to another, depending on the road topology between the upstream and downstream VLPRs. For example, if vehicles get off the road or end their trips in the middle of the VLPR pair, the estimated travel time would be inaccurate, eventually leading to a decline in the successful linking rate. In conclusion, in order to obtain the maximum linking rate, the value range of Tt is suggested to be no less than 0.7.We assume that the adversary is always able to track vehicle trajectories with the maximum probability. In Case 1 and Case 2, the privacy performances with differentms and ns are illustrated in Figure 7, where the x-coordinate is m and the y-coordinate is the tracking probability. In Figure 7, type means that only the column type is the sensitive column; type & color means that the type and color columns are the sensitive columns; type & color & brand means that the type, color, and brand columns are the sensitive columns; and so on. Figure 7(a) represents the results of Case 1. Figure 7(b) denotes the results between VLPR 1 and VLPR 2 in Case 2, Figure 7(c) represents the results between VLPR 1 and VLPR 3 in Case 2, and Figure 7(d) denotes the results between VLPR 1 and VLPR 4 in Case 2.Figure 7
The change curve ofp with different ms and ns. (a) The results of Case 1. (b) The results of Case 2 (VLPR 1 and VLPR 2). (c) The results of Case 2 (VLPR 1 and VLPR 3). (d) The results of Case 2 (VLPR 1 and VLPR 4).
(a)(b)(c)(d)As seen from Figure7, if only one column is the sensitive column, the probability converges at a certain value and does not continue to decline. For the same curve, p decreases at first as m increases. When m increases to a certain value, p converges within an interval range. The convergence rate is different for different sensitive columns. For different ns, p declines at different rates. The larger n is, the faster p drops. If n and m are big enough, the probability can even reach close to zero. For Case 1 and Case 2, p changes similarly, which proves that the adversary model that is proposed in this paper is not only useful to the simple situation (Case 1) but also useful to the intersection situation (Case 2).


## 7.2. Comparison

To verify the effectiveness of the (m, n)-bucket model that is proposed in this paper, the following experiment is performed using the 2018/07/30 12:00–12:59 data in Case 1. Since the calculated probability is the maximum probability (denoted as pt,SAiv in Section 4.2.3) of each individual being linked while the actual linking probability (denoted as pr) is for all individuals, in order to compare pt,SAiv and pr, the average value of pt,SAiv for all individual t’s is used as the total calculated probability (denoted as pc). The results are shown in Figure 8, where pc-type represents the calculated probability with type as the sensitive column, pr-type denotes the actual linking probability with type as the sensitive column, and so on. In general, pc is greater than pr, but there are special circumstances. For example, in Figure 8(b), when m is equal to 2, the pr-type-brand is greater than the pc-type-brand. This is because a small probability does not necessarily mean that the link fails. The results show that the derived mathematical model can well expound the privacy protection principle of the (m, n)-bucket model.Figure 8
The probabilitiespc and pr with different ms and ns. (a) The comparison of pc and pr with one SA. (b) The comparison of pc and pr with two SAs. (c) The comparison of pc and pr with three SAs.
(a)(b)(c)


## 8. Conclusion

In this paper, an adversary model based on the passing time, color, type, and brand of VLPR data is developed to evaluate the performance of the proposed (m, n)-bucket model based on time series. When tracking vehicles between two VLPRs, releasing original data within VLPRs helps protect privacy but not at a satisfactory level; that is, this method of publishing data can lead to a high risk of privacy disclosure. Therefore, a data publishing model that can protect privacy is needed.The proposed (m, n)-bucket model is useful for privacy preservation. It overcomes the limitations of generalization and bucketization that can only handle single-column SA and data without time correlation requirements. The proposed model is a promising technique for handling high-dimensional data because ns can be any value in the model. People can set different ms and ns as needed. Meanwhile, the mathematical principle of the model for preventing privacy disclosures is expounded. Our experiments demonstrate that the proposed model has great significance in privacy preservation.It is worth mentioning that just because only three QI attributes of vehicles are selected for the modeling discussions, it does not mean that the proposed model is only applicable to data with three QI attributes. The more vehicle QI attributes are considered, the greater the tracking probability will be. Fortunately, the model that is presented in this paper applies to any number of QI attributes. Three QI attributes for vehicles are selected just to verify the validity of the (m, n)-bucket model. Which column is the SA is not the focus of this paper, and this study will be one of the next research directions. Although the method presented in this paper can usually achieve good results, it still has some limitations. We cannot deal with vehicles that are moving too fast or too slow. Because the estimated travel time is estimated using the log-normal distribution function, if the vehicle moves too fast or too slow, it is hard to estimate.The model can be used to evaluate other scenarios for protecting confidential information, such as personalized privacy protection and continuous data publication. It is recommended that these issues be studied according to the proposed model.



---

*Source: 6026140-2020-06-23.xml*