Auditing Keyword Queries Over Text Documents (2021)

Abstract: Data security and privacy is an issue of growing importance in the healthcare domain. In this paper, we present an auditing system to detect privacy violations for unstructured text documents such as healthcare records. Given a sensitive document, we present an anomaly detection algorithm that can find the top-k suspicious keyword queries that may have accessed the sensitive document. Since unstructured healthcare data, such as medical reports and query logs, are not easily available for public research, in this paper, we show how one can use the publicly available DBLP data to create an equivalent healthcare data and query log, which can then be used for experimental evaluation.

## introduction large business enterprises, hospitals, etc., maintain a large amount of digital information in the form of structured, semi-structured, and unstructured data. with growing concern among users regarding the privacy of their data, such organizations are required to design a robust data management system. thus, the goal of dbms has expanded, to include additional features, such as enforcing data privacy and security @xcite , in addition to the primary goal of easy and efficient retrieval. lot of research has been done @xcite @xcite to prevent and detect privacy violation for structured data (e.g. sql) and semistructured data (e.g. xml) @xcite . however, to the best of our knowledge, there is no existing work that detects privacy violations in access to unstructured text documents using keyword queries. detecting privacy violations for text * work done during graduate course at indian institute of technology hyderabad documents has not been explored much because it is difficult to audit keyword queries for text data, which is explained later in this section. organizations tend to maintain their sensitive data in a structured or semi-structured format. however, just as the strength of a chain is equal to its weakest link; similarly, an organization with very secured access to structured and semi-structured can still face privacy violations due to its unsecured unstructured data repositories. example alice has undergone breast cancer medical treatment in healthco hospital. a few weeks after she returned from the hospital, she started getting advertisements on natural products to treat breast cancer. she blamed healthco for disclosing her sensitive disease data to outsiders. healthco has a strong security system that will not allow outsiders to directly access alice's information. healthco has to prove that either nobody has misused alice's private information or find the employees from healthco whose access to the information seems suspicious. one can use access control policies to secure access to sensitive documents so that only authorized users can access those documents. however, this can restrict access to crucial information at times of emergency. for example, in a hospital, if we create a strict access control policy over medical reports, then it may lead to the inaccessibility of information during crucial hours. an auditing system can help in such scenarios by allowing a relaxed access control policy, and then providing means to detect privacy violations through auditing. the auditing models that have been proposed for structured or semi-structured data @xcite @xcite cannot be used for text documents due to the difference in the query model. structured and semi-structured data is often accessed using precise query languages, such as sql or xquery, which returns the result using the boolean retrieval model. in these query models, there is no notion of ordering among returned tuples or elements. a query is marked suspicious if its result contains any sensitive tuple, or if a sensitive tuple can be inferred from the query result. the auditing techniques proposed for these types of data do not have a notion of the degree of suspiciousness for a query. text documents are commonly accessed using keyword queries, which are not precise. and thus, neither the query nor the result indicates what information the user was looking for. each query returns a long list of documents ordered by some relevant measure, and in most cases, users may look at only the top few results. the major success of ir is due to the ordered nature of its result set. thus, rather than just returning a long list of queries that had the particular sensitive document in its result, we need to define a suspiciousness order for the queries, using various factors such as the rank of the document in the result, the relevance of the document to the query, access anomalousness, etc. auditing is common in the healthcare domain as it involves sensitive patient data. to our knowledge, there is only one publicly available healthcare dataset 1 of medical reports. the dataset has been reported for around 200 hundred patients and has no associated query log. since there is no existing big publicly available dataset from healthcare that can be used to evaluate auditing systems for unstructured data. in this paper, one of our main contributions is to model healthcare data using dblp data, which is a large dataset that contains bibliographic information about computer science journals and proceedings. in the medical domain, access is anomalous if someone accesses sensitive information that one is normally not required to access. doctors or nurses are allowed to access sensitive information based on their needs. as different staff have different roles in a hospital and the role determines whether an access is anomalous or not, we show how one can model such roles and accesses using bibliographic data. this paper is organized as follows: section 2 contains related work. section 3 discusses the auditing model and system architecture. section 4 discusses proposed algorithms. section 6 presents evaluation. finally, section 7 concludes the paper 1 https://webscope.sandbox.yahoo.com/catalog.php with some directions for future work. ## related work inspired by the hippocratic oath foot_0 , the hippocratic databases were proposed by @xcite that impose data privacy and security protocols on the data. @xcite address the problem of detecting privacy violations in the case of relational databases. in this work, the authors proposed a framework for detecting whether or not a relational database is adhering to data disclosure policies. users specify sensitive information in the form of audit expressions. the audit component takes audit expressions and returns all the queries that accessed sensitive data during execution. @xcite also study the problem of auditing sql queries. given a forbidden view of a relational database, which should be confidential, and a batch of sql queries posted over the database. it determines whether a query batch is suspicious or not with respect to the forbidden view. @xcite use the database views are used to make the decisions on privacy violations. the work proposes to solve the problem of data privacy by looking for the data leak from a view of the database. @xcite proposed an audit system for sensitive xml databases and xpath query language that uses an audit query to describe sensitive information. it also discusses privacy violations in the case of an attacker who submits multiple queries. @xcite @xcite propose access control approaches for xml data sources ranging from policies to fragments of xml databases. another interesting approach towards data privacy comes from inference methods by @xcite . inference based methods stem from the fact that the access control methods can only block direct access to the sensitive, while there still exists ways of inferring the sensitive data through indirect means. we propose an auditing model for unstructured text documents. our work is motivated by various works done in the structured and semi-structured database to ensure data privacy. ## text auditing system in this section we walk-through the various components of the text auditing system and further illustrate the working example introduced in section 1. figure 1 presents the skeletal view of the auditing system. users access the unstructured data repository using keyword queries, where the documents are ranked using any ir ranking algorithm. given a query, we store the following information in its query log: query id, query, query timestamp, the id of the user who issued the query, and the ids of top-n documents returned for the query. using the query log we maintain an access index, which greatly improves the performance of our auditing system. access index is an inverted index from document to queries. for each document id, we have a posting list that contains the ids of all the queries that contain the document in their top-n results a user can submit an audit request audit(d), where d is the sensitive document. the access index is used to find all the queries that had the document d in their top-n result. we call this query set the candidate queries. here, we assume that users will not be interested in results appearing below the top-n. henceforth, we first find the candidate set of suspicious queries using the stored query log. a query from the candidate set is termed anomalous if its score crosses a certain threshold. in section 4, we shall decode how a simple suspicious candidate query transcends into an anomalous one. let us carry forward the example in section 1 in-order to better understand the audit scenario. the in query 2, 3 and 5 are from employees of the gynaecology and cardiology department, who are not typically expected to access breast cancer-related information. although query 3 and 5 are not asking for any information directly related to alice, they still have high sscore because alice's audit document has high relevance for these queries. both barbara and chris might be trying to access the information indirectly. the former is trying to get all breast cancer patients from a particular location, and the latter knows that those who have +ve estrogen receptors are likely to have breast cancer. although query 2 is accessing some information about alice, it has low sscore because it has low relevance to alice's breast cancer data. if we want the top-2 anomalous queries, then query 5 and query 3 will be returned by our system as they have high suspicious scores and are also anomalous. given the imprecise nature of keyword queries and the lack of user's background information, such as role, department, etc., it is difficult to compute sscore or ascore for queries. in general, it is difficult to get the background information of users as it may not be available or one user may have multiple roles. in this paper, we present an algorithm that computes the ascore without having the prior background information of users who issued the query. ## algorithms in section 3, we explained how we use the access index to find all queries that had the audit document in the top-n query result. we call them as the candidate suspicious queries. we now discuss the elements that make up the sscore and ascore for each candidate query. ## evaluation as introduced in section 5, we carry out our experiments on a surrogate dblp dataset. for this, we use the ground-truth generated in section 5.3. the first step in detecting anomalous queries is to find candidate suspicious queries (csq). in this regard, figure 2 shows the relationship between the number of outliers vs sssore. from the graph one can observe that queries with sscore less than 0.1 are not a threat as there are no outliers with sscore less than 0.1. thus while finding csqs, we can exclude all the queries with sscore less than 0.1. interestingly, queries with high sscore are not a threat either. these queries seem to be issued by genuine users. this is expected for genuine users, as it is okay to access sensitive documents that are of relevance to them. most of the outliers are concentrated around sscore value 0.2. these queries are either issued by users who are unable to form a proper query, maybe due to a lack of domain knowledge, or those who are trying to make indirect access. since these queries are less precise, they have low sscore. ## conclusion we present one of the first of its type approaches to detect privacy violation in access of unstructured text documents using keyword queries that is mainly useful for healthcare domain. since healthcare data is difficult to obtain, we also demonstrate the construction of a substitute dataset for healthcare. the proposed system shows promising results.