Privacy Preserving Human Mobility Analysis

Human mobility analysis is very useful in urban planning, ecology, epidemiology and resource planning.

Analysts of this field are accustomed to use call data records (CDR). Following information can be derived from CDRs:

- Home and work location

- Commute distance

- Calls Per day

- Class Probability and call time

- Hourly locations

However above information is private information of an individual. If such information is accurately derived from the dataset the dataset is said to compromise with the privacy.

For analysis of data there are various techniques available to generate synthetic CDRs. They are Random Waypoint (RWP) and this technique generates CDR from random distribution and Weighted RWP (WRWP) which derives CDR by using weighted distribution of start location and end locations.

Sibren Issacman et al devised a highly accurate method to derive accurate CDR suitable for analysis yielding highly accurate results as derived from actual CDR or original census data. The name of technique is WHERE means “Work and Home extracted regions” which starts by computing distributions for home and work locations, commute distance, calls per day, class probability and call time and hourly locations. Then based on these distributions WHERE will generate synthetic CDR. This method is highly accurate as it makes use of more information from actual data instead of having only a weighted set of inputs for WRWP.

However, as this is based on actual distribution, there is some probability to derive actual information from the synthetic data. To provide protection to PII it becomes necessary to use privacy preserving technique like differential privacy. This is done by a variant of WHERE known as DP-WHERE (Differentially private WHERE)

In DP-WHERE after getting the distributions we add noise to the distribution and the use the noisy distribution to generate the synthetic data.

Due to law of the land in most of the countries CDRs are not released for analysis. If some accurate provable mechanism can be devised and this data can be brought out then there can be huge potential for research in the field of urban planning, ecology, epidemiology and resource planning.

Conclusion: A lot of work in the fields of urban planning, ecology, epidemiology and resource planning is not being done as the data is not available so there is a huge potential for data sanitizers to work and provide PII free data to analysts

 

References

1. Sibren Isaacman et al, Human Mobility Modeling at Metropolitan Scales, Proceedings of the 10th International Conference on Mobile Systems, Applications, and Services, http://doi.acm.org/10.1145/2307636.2307659
2.  Darakhshan Mir et al, DP-WHERE: Differentially private modeling of human mobility, IEEE International Conference on Big Data, http://ieeexplore.ieee.org/xpl/articleDetails.jsp?arnumber=6691626

Privacy in Health-care

Privacy in Health care: Differential Privacy Techniques in Health-care data

Healthcare data is usually of the following type

- Categorical data (codes, drugs, tests, geographical information)

- Numerical data (age, duration of stay in hospital, time since last visit)

Analysts of healthcare domain are accustomed to analyze data in a particular format. They perform various types of analysis by applying techniques like transforms on formatted data. Hence it becomes necessary to provide the data they need in same format.

Addition of Laplace noise to numeric data can distort the values significantly. Differential privacy works under the assumption that individuals are independent of each other. If this assumption is violated then inferences can be made.0

Issues

- Many healthcare datasets are highly correlated or have natural constraints.

- Independent distortions of data may not make sense.

- If two drugs are said to have an effect on a patient and distorted data does not show that effect then dataset is loses trustworthiness.

It is really important to prove that DP in such datasets adds value and provides valid results.

Privacy Budgeting

There are various scenarios in which it is necessary to provide individual information for analysis. In this case it based on the priority of privacy system may have to restrict release of some amount information. This brings us to the concept of privacy budget.

In other domains privacy budget is depicted in terms of epsilon but analysts of healthcare domain may not be comfortable in working with core privacy concepts. So it is necessary to related epsilon to some common notation of privacy to allow easier communication.

Based on certain input query we get a value for a particular patient depicting his/her eligibility for participation in the analysis. Providing unrestricted access to database may reveal extra information. If the individual participates in the analysis then we may add noise to it.

When a query is expected to have large counts than high budget must be provided to ensure that the query can be executed.

Conclusion: Healthcare community still needs to disclose a lot of information hence there is high scope for research data privacy in the healthcare domain.

References:

Fida K. Dankar and Khaled El Emam, Practicing Differential Privacy in Health Care: A Review, Transactions of Data Privacy, http://dl.acm.org/citation.cfm?id=2612156.2612159

Privacy in Real Time Data Release

Consider a scenario where an entity is sharing data at real time to a monitoring for raising an alarm in case something goes wrong. So it makes it necessary to share the data at real-time. However, if the data contains some personally identifiable information which needs to be protected then data owner may be reluctant to share the data even for monitoring.

The dilemma:

Data owning entity is ready to share the data to the monitoring service if it need not share its PII (personally identifiable information)

Technically speaking the goal of the monitoring system is to track patterns and identify exceptional conditions and raise alarm it does not need any personally identifiable information for its task.

Opportunity:

So we as privacy providers need to identify mechanism where data owning entity can share information without PII and monitoring system should be able to perform monitoring with same accuracy.

Solution:

FAST technique: Filtering and adaptive sampling of differentially privacy time series monitoring

FAST is a novel technique for sharing statistical data in real time. FAST uses differential privacy to project user specific data or personally identifiable information and also to ensure that over statistical results are accurate. It adds Laplace noise by sampling the time series into intervals of different size to ensure accuracy of the outcome. The size of sample is varied to by using adaptive sampling technique. Following is the block diagram of the system.

Data stream is fed into the system and it a sample of some default size and adds noise to the sample. Then this perturbed stream is released as output. This stream also goes to the filtering module which predicts the outcome of next stream and identifies the accuracy of the prediction by calculating errors.

The errors are calculated by using a PID controller (Proportional, Integral, derivative). PID controller calculated three errors proportional error, integral error and derivative error. Proportional error is used to keep controller in proportion to current error. Integral error is used to eliminate offset. Derivative error is used to prevent large errors.

Then correction is performed on the size of sample by correction module. Then adaptive sampler modifies the size of sample and takes next sample. This forms a feedback loop to the sampler which is unique contribution of the FAST technique.

Conclusion: There is tremendous opportunity to apply privacy techniques to data that is to be released in real time in various domains.

References:

Liyue Fan and Li Xiong, An Adaptive Approach to Real-Time Aggregate Monitoring With Differential Privacy, IEEE Transactions on Knowledge and Data Engineering, http://ieeexplore.ieee.org/xpl/login.jsp?tp=&arnumber=6542629