Big Data Privacy

Question 1

Steps: Operationalizing data anonymization

Answer 1

1. Consider a taxonomy / classification of personal data
2. Reflect on the underlying data disclosure / sharing scenarios
3. Define your attacker model
4. Apply appropriate data anonymization models and techniques
5. Assess utility (loss) & residual risks

Question 2

Big Data Privacy: Possible Attacks and Attacker Models

Answer 2

• Membership disclosure: Attacker can(not) tell that a given person is in the dataset
• Sensitive attribute disclosure: Attacker can(not) tell that a given person has a certain sensitive attribute
• Identity disclosure: Attacker can(not) tell which record corresponds to a given person

Question 3

Data Anonymization Models

Answer 3

• Data Suppression-based models: Focus on preserving the privacy of respondents (i.e., those individuals who are included in the dataset)
• Data Pertubation-based models: Focus on protecting the privacy of both respondents and people not included in the dataset

Question 4

Data Suppression-based models: Vorgehen

Answer 4

• Remove/Suppress (explicit or/and quasi) identifiers before releasing the (micro)data
• While not modifying sensitive attributes and thus guaranteeing high data utility
• Each anonymized entry/dataset should be indistinguishably related to no less than a certain number of individuals in the population
• Typically no mathematical provable guarantee of anonymity

Question 5

Data Pertubation-based models: Vorgehen

Answer 5

• Anonymized data(set) must be insensitive to the insertion or deletion of an entry / a tuple in the dataset
• Noises typically added to the dataset
• And thus often resulting in sub-optimal / poorer data utility
• Typically provides provable guarantee of anonymity

Question 6

Data Pertubation-based models: Metrics

Answer 6

• e-Differential Privacy

Question 7

Data Suppression-based models: Metrics

Answer 7

• k-anonymity
• l-diversity
• t-closeness

Question 8

Limitations of k-anonymity

Answer 8

• Homogenity attack: When the set of all sensitive attribute values has little diversity, then information may be leaked
• Background Knowledge Attack: In the presence of side-information any information may become a quasi-identifier

Question 9

Limitations of l-diversity

Answer 9

• Similarity attack: When the values in a q*-block are distinct but semantically similar
  -> L-diversity does not consider the semantic closeness of attributes

Question 10

Arten von strukturierten Daten

Answer 10

• Identifiers
• Quasi Identifiers
• Sensitive Information