Privacy preserving in location data release: A differential privacy approach

Communication devices with GPS chips allow people to generate large volumes of location data. However, location datasets have been confronted with serious privacy concerns. Recently, several privacy techniques have been proposed but most of them lack a strict privacy notion, and can hardly resist the number of possible attacks. This paper proposes a private release algorithm to randomize location datasets in a strict privacy notion, differential privacy. This algorithm includes three privacy-preserving operations: Private Location Clustering shrinks the randomized domain and Cluster Weight Perturbation hides the weights of locations, while Private Location Selection hides the exact locations of a user. Theoretical analysis on utility confirms an improved trade-off between the privacy and utility of released location data. The experimental results further suggest this private release algorithm can successfully retain the utility of the datasets while preserving users’ privacy.

A differentially private algorithm for location data release

The rise of mobile technologies in recent years has led to large volumes of location information, which are valuable resources for knowledge discovery such as travel patterns mining and traffic analysis. However, location dataset has been confronted with serious privacy concerns because adversaries may re-identify a user and his/her sensitivity information from these datasets with only a little background knowledge. Recently, several privacy-preserving techniques have been proposed to address the problem, but most of them lack a strict privacy notion and can hardly resist the number of possible attacks. This paper proposes a private release algorithm to randomize location dataset in a strict privacy notion, differential privacy, with the goal of preserving users’ identities and sensitive information. The algorithm aims to mask the exact locations of each user as well as the frequency that the user visits the locations with a given privacy budget. It includes three privacy-preserving operations: private location clustering shrinks the randomized domain and cluster weight perturbation hides the weights of locations, while private location selection hides the exact locations of a user. Theoretical analysis on privacy and utility confirms an improved trade-off between privacy and utility of released location data. Extensive experiments have been carried out on four real-world datasets, GeoLife, Flickr, Div400 and Instagram. The experimental results further suggest that this private release algorithm can successfully retain the utility of the datasets while preserving users’ privacy.

Privacy preserving data release for tagging recommender systems

Tagging recommender systems allow Internet users to annotate resources with personalized tags. The connection among users, resources and these annotations, often called a folksonomy, permits users the freedom to explore tags, and to obtain recommendations. Releasing these tagging datasets accelerates both commercial and research work on recommender systems. However, tagging recommender systems has been confronted with serious privacy concerns because adversaries may re-identify a user and her/his sensitive information from the tagging dataset using a little background information. Recently, several private techniques have been proposed to address the problem, but most of them lack a strict privacy notion, and can hardly resist the number of possible attacks. This paper proposes an private releasing algorithm to perturb users' profile in a strict privacy notion, differential privacy, with the goal of preserving a user's identity in a tagging dataset. The algorithm includes three privacy-preserving operations: Private Tag Clustering is used to shrink the randomized domain and Private Tag Selection is then applied to find the most suitable replacement tags for the original tags. To hide the numbers of tags, the third operation, Weight Perturbation, finally adds Laplace noise to the weight of tags. We present extensive experimental results on two real world datasets, De.licio.us and Bibsonomy. While the personalization algorithm is successful in both cases, our results further suggest the private releasing algorithm can successfully retain the utility of the datasets while preserving users' identity.

An efficient solution for privacy-preserving, secure remote access to sensitive data

Sharing data that contains personally identifiable or sensitive information, such as medical records, always has privacy and security implications. The issues can become rather complex when the methods of access can vary, and accurate individual data needs to be provided whilst mass data release for specific purposes (for example for medical research) also has to be catered for. Although various solutions have been proposed to address the different aspects individually, a comprehensive approach is highly desirable. This paper presents a solution for maintaining the privacy of data released en masse in a controlled manner, and for providing secure access to the original data for authorized users. The results show that the solution is provably secure and maintains privacy in a more efficient manner than previous solutions.

Correlated differential privacy: hiding information in non-IID data set

Privacy preserving on data mining and data release has attracted an increasing research interest over a number of decades. Differential privacy is one influential privacy notion that offers a rigorous and provable privacy guarantee for data mining and data release. Existing studies on differential privacy assume that in a data set, records are sampled independently. However, in real-world applications, records in a data set are rarely independent. The relationships among records are referred to as correlated information and the data set is defined as correlated data set. A differential privacy technique performed on a correlated data set will disclose more information than expected, and this is a serious privacy violation. Although recent research was concerned with this new privacy violation, it still calls for a solid solution for the correlated data set. Moreover, how to decrease the large amount of noise incurred via differential privacy in correlated data set is yet to be explored. To fill the gap, this paper proposes an effective correlated differential privacy solution by defining the correlated sensitivity and designing a correlated data releasing mechanism. With consideration of the correlated levels between records, the proposed correlated sensitivity can significantly decrease the noise compared with traditional global sensitivity. The correlated data releasing mechanism correlated iteration mechanism is designed based on an iterative method to answer a large number of queries. Compared with the traditional method, the proposed correlated differential privacy solution enhances the privacy guarantee for a correlated data set with less accuracy cost. Experimental results show that the proposed solution outperforms traditional differential privacy in terms of mean square error on large group of queries. This also suggests the correlated differential privacy can successfully retain the utility while preserving the privacy.

A survey on differential privacy and applications

Privacy preserving in data release and mining is a hot topic in the information security field currently. As a new privacy notion, differential privacy (DP) has grown in popularity recently due to its rigid and provable privacy guarantee. After analyzing the advantage of differential privacy model relative to the traditional ones, this paper surveys the theory of differential privacy and its application on two aspects, privacy preserving data release (PPDR) and privacy preserving data mining (PPDM). In PPDR, we introduce the DP-based data release methodologies in interactive/non-interactive settings and compare them in terms of accuracy and sample complexity. In PPDM, we mainly summarize the implementation of DP in various data mining algorithms with interface-based/fully access-based modes as well as evaluating the performance of the algorithms. We finally review other applications of DP in various fields and discuss the future research directions.

End-Permian catastrophe by a bolide impact: evidence of a gigantic release of sulfur from the mantle

Our studies in southern China have revealed a remarkable sulfur and strontium isotope excursion at the end of the Permian, along with a coincident concentration of impact- metamorphosed grains and kaolinite and a significant decrease in manganese, phosphorous, calcium, and microfossils (foraminifera). These data suggest that an asteroid or a comet hit the ocean at the end of Permian time and caused a rapid and massive release of sulfur from the mantle to the ocean-atmosphere system, leading to significant oxygen consumption, acid rain, and the most severe biotic crisis in the history of life on Earth.

Attack vector analysis and privacy-preserving social network data publishing

This paper addresses the problem of privacy-preserving data publishing for social network. Research on protecting the privacy of individuals and the confidentiality of data in social network has recently been receiving increasing attention. Privacy is an important issue when one wants to make use of data that involves individuals' sensitive information, especially in a time when data collection is becoming easier and sophisticated data mining techniques are becoming more efficient. In this paper, we discuss various privacy attack vectors on social networks. We present algorithms that sanitize data to make it safe for release while preserving useful information, and discuss ways of analyzing the sanitized data. This study provides a summary of the current state-of-the-art, based on which we expect to see advances in social networks data publishing for years to come.

Using clinical trial data and linked administrative health data to reduce the risk of adverse events associated with the uptake of newly released drugs by older Australians : a model process

Background
The study was undertaken to evaluate the contribution of a process which uses clinical trial data plus linked de-identified administrative health data to forecast potential risk of adverse events associated with the use of newly released drugs by older Australian patients.

Methods
The study uses publicly available data from the clinical trials of a newly released drug to ascertain which patient age groups, gender, comorbidities and co-medications were excluded in the trials. It then uses linked de-identified hospital morbidity and medications dispensing data to investigate the comorbidities and co-medications of patients who suffer from the target morbidity of the new drug and who are the likely target population for the drug. The clinical trial information and the linked morbidity and medication data are compared to assess which patient groups could potentially be at risk of an adverse event associated with use of the new drug.

Results
Applying the model in a retrospective real-world scenario identified that the majority of the sample group of Australian patients aged 65 years and over with the target morbidity of the newly released COX-2-selective NSAID rofecoxib also suffered from a major morbidity excluded in the trials of that drug, indicating a substantial potential risk of adverse events amongst those patients. This risk was borne out in post-release morbidity and mortality associated with use of that drug.

Conclusions
Clinical trial data and linked administrative health data can together support a prospective assessment of patient groups who could be at risk of an adverse event if they are prescribed a newly released drug in the context of their age, gender, comorbidities and/or co-medications. Communication of this independent risk information to prescribers has the potential to reduce adverse events in the period after the release of the new drug, which is when the risk is greatest.

Note: The terms 'adverse drug reaction' and 'adverse drug event' have come to be used interchangeably in the current literature. For consistency, the authors have chosen to use the wider term 'adverse drug event' (ADE).

Using clinical trial data and linked administrative health data to reduce the risk of adverse events associated with the uptake of newly released drugs by older Australians: a model process

BACKGROUND: The study was undertaken to evaluate the contribution of a process which uses clinical trial data plus linked de-identified administrative health data to forecast potential risk of adverse events associated with the use of newly released drugs by older Australian patients. METHODS: The study uses publicly available data from the clinical trials of a newly released drug to ascertain which patient age groups, gender, comorbidities and co-medications were excluded in the trials. It then uses linked de-identified hospital morbidity and medications dispensing data to investigate the comorbidities and co-medications of patients who suffer from the target morbidity of the new drug and who are the likely target population for the drug. The clinical trial information and the linked morbidity and medication data are compared to assess which patient groups could potentially be at risk of an adverse event associated with use of the new drug. RESULTS: Applying the model in a retrospective real-world scenario identified that the majority of the sample group of Australian patients aged 65 years and over with the target morbidity of the newly released COX-2-selective NSAID rofecoxib also suffered from a major morbidity excluded in the trials of that drug, indicating a substantial potential risk of adverse events amongst those patients. This risk was borne out in post-release morbidity and mortality associated with use of that drug. CONCLUSIONS: Clinical trial data and linked administrative health data can together support a prospective assessment of patient groups who could be at risk of an adverse event if they are prescribed a newly released drug in the context of their age, gender, comorbidities and/or co-medications. Communication of this independent risk information to prescribers has the potential to reduce adverse events in the period after the release of the new drug, which is when the risk is greatest.Note: The terms 'adverse drug reaction' and 'adverse drug event' have come to be used interchangeably in the current literature. For consistency, the authors have chosen to use the wider term 'adverse drug event' (ADE).

Capture, hold, release: an ontology of motion capture

In proposing an ontology of motion capture, this paper identifies three modalities — capture, hold, release — to conceptualise the peculiar affordances of motion capture technology in its relationship to a performer's movement. Motion capture is unique among contemporary moving image media in its capacity to re-perform a performer'srecorded movement a potentially limitless number of times, e.g. as applied to innumerable different CG characters. Unlike live-action film or even rotoscoping (motion capture's closest equivalent), the movement extracted from the captured performance lives on, but only by way of the inimagable (non-visible) domain of motion data.Motion data 'holds' movement itself in inimagable form, and 'releases' it in the domain of the digital moving image. This tri-fold conception relates an important dimension of (Heideggerian) Being to the idea of movement as fundamental to an ontology or 'being' of motion capture. At the same time, the proposed ontology challenges the 'illusion of life' metaphor as the accepted definition of (motion capture) animation.The Oscar's Special Rules for the Animated Feature Film Award asserts that 'by itself' motion capture does not qualify as an animation method. The notion that a technology could do or be anything 'by itself' affords a conceptual leap toward Heideggerian thinking on the nature of Being as embodied in temporality, in which past, present and future are unified.In its capacity to operate outside the domain of the digital moving image, the concept of 'movement itself' not only articulates an ontology of motion capture: motion capture itself can be understood to be brought into being by movement, thus also challenging the notion that capture technology has a parasitic relationship to a performer's originary performance.