“L-diversity”的意思、由来-开放百科全书

l-diversity is a form of group based anonymization that is used to preserve privacy in data sets by reducing the granularity of a data representation. This reduction is a trade off that results in some loss of effectiveness of data management or mining algorithms in order to gain some privacy. The l-diversity model is an extension of the k-anonymity model which reduces the granularity of data representation using techniques including generalization and suppression such that any given record maps onto at least k-1 other records in the data. The l-diversity model handles some of the weaknesses in the k-anonymity model where protected identities to the level of k-individuals is not equivalent to protecting the corresponding sensitive values that were generalized or suppressed, especially when the sensitive values within a group exhibit homogeneity. The l-diversity model adds the promotion of intra-group diversity for sensitive values in the anonymization mechanism.

Attacks on k-anonymity

While k-anonymity is a promising approach to take for group based anonymization given its simplicity and wide array of algorithms that perform it, it is however susceptible to many attacks. When background knowledge is available to an attacker, such attacks become even more effective. Such attacks include:

Formal definition

Given the existence of such attacks where sensitive attributes may be inferred for k-anonymity data, the l-diversity method was created to further k-anonymity by additionally maintaining the diversity of sensitive fields. The book Privacy-Preserving Data Mining – Models and Algorithms (2008)^[1] defines l-diversity as being:

The paper t-Closeness: Privacy beyond k-anonymity and l-diversity (2007)^[2] defines l-diversity as being:

Machanavajjhala et. al. (2007)^[3] define “well-represented” in three possible ways:

Aggarwal and Yu (2008) note that when there is more than one sensitive field the l-diversity problem becomes more difficult due to added dimensionalities.

See also

References

1. ^{{Cite book|title = Privacy-Preserving Data Mining – Models and Algorithms|last = Aggarwal|first = Charu C.|publisher = Springer|year = 2008|isbn = 978-0-387-70991-8|location = |pages = 11–52 |chapter-url = http://charuaggarwal.net/generalsurvey.pdf|chapter = A General Survey of Privacy-Preserving Data Mining Models and Algorithms|last2 = Yu|first2 = Philip S.}}
2. ^{{Cite book|title = t-Closeness: Privacy Beyond k-Anonymity and l-Diversity|journal = IEEE 23rd International Conference on Data Engineering, 2007. ICDE 2007|date = April 2007|pages = 106–115|doi = 10.1109/ICDE.2007.367856|first = Ninghui|last = Li|first2 = Tiancheng|last2 = Li|first3 = S.|last3 = Venkatasubramanian|isbn = 978-1-4244-0802-3|citeseerx = 10.1.1.158.6171}}
3. ^{{Cite journal|title = L-diversity: Privacy Beyond K-anonymity|journal = ACM Trans. Knowl. Discov. Data|date = March 2007|issn = 1556-4681|volume = 1|issue = 1|pages = 3–es|doi = 10.1145/1217299.1217302|first = Ashwin|last = Machanavajjhala|first2 = Daniel|last2 = Kifer|first3 = Johannes|last3 = Gehrke|first4 = Muthuramakrishnan|last4 = Venkitasubramaniam|quote = Background Knowledge Attack. Alice has a pen-friend named Umeko who is admitted to the same hospital as Bob and whose patient records also appear in the table shown in Figure 2. Alice knows that Umeko is a 21-year-old Japanese female who currently lives in zip code 13068. Based on this information, Alice learns that Umeko’s information is contained in record number 1,2,3, or 4. Without additional information, Alice is not sure whether Umeko caught a virus or has heart disease. However, it is well known that Japanese have an extremely low incidence of heart disease. Therefore Alice concludes with near certainty that Umeko has a viral infection.}}