Stanford InfoLab Publication Server

Achieving Anonymity via Clustering

Aggrawal, Gagan and Feder, Tomas and Kenthapadi, Krishnaram and Khuller, Samir and Panigrahy, Rina and Thomas, Dilys and Zhu, An (2006) Achieving Anonymity via Clustering. In: 25th ACM SIGMOD-SIGACT-SIGART Symposium on Principles of Database Systems (PODS 2006), June 26-29, 2006, Chicago, Illinois.

WarningThere is a more recent version of this item available.



Publishing data for analysis from a table containing personal records, while maintaining individual privacy, is a problem of increasing importance today. The traditional approach of de-identifying records is to remove identifying fields such as social security number, name etc. However, recent research has shown that a large fraction of the US population can be identified using non-key attributes (called quasi-identifiers) such as date of birth, gender, and zip code~\cite{swe00}. Sweeney~\cite{swe02} proposed the $k$-anonymity model for privacy where non-key attributes that leak information are suppressed or generalized so that, for every record in the modified table, there are at least $k-1$ other records having exactly the same values for quasi-identifiers. We propose a new method for anonymizing data records, where quasi-identifiers of data records are first clustered and then cluster centers are published. To ensure privacy of the data records, we impose the constraint that each cluster must contain no fewer than a pre-specified number of data records. This technique is more general since we have a much larger choice for cluster centers than $k$-Anonymity. In many cases, it lets us release a lot more information without compromising privacy. We also provide constant-factor approximation algorithms to come up with such a clustering. This is the first set of algorithms for the anonymization problem where the performance is independent of the anonymity parameter $k$. We further observe that a few outlier points can significantly increase the cost of anonymization. Hence, we extend our algorithms to allow an $\epsilon$ fraction of points to remain unclustered, \ie, deleted from the anonymized publication. Thus, by not releasing a small fraction of the database records, we can ensure that the data published for analysis has less distortion and hence is more useful. Our approximation algorithms for new clustering objectives are of independent interest and could be applicable in other clustering scenarios as well.

Item Type:Conference or Workshop Item (Paper)
Uncontrolled Keywords:K-anonymity, Clustering, Data Mining, Data Privacy, Publishing Anonymized Data
Subjects:Computer Science
Computer Science > Data Mining
Projects:PORTIA (DB-Privacy)
Related URLs:Project Homepage
ID Code:777
Deposited By:Import Account
Deposited On:05 Jun 2006 17:00
Last Modified:18 Dec 2008 14:33

Available Versions of this Item

Download statistics

Repository Staff Only: item control page