Download Privacy-Preserving Data Mining

Privacy-Preserving Data Mining
Rebecca Wright
Computer Science Department
Stevens Institute of Technology
www.cs.stevens.edu/~rwright
PORTIA Site Visit
12 May, 2005
The Data Revolution
• The current data revolution is fueled by the perceived,
actual, and potential usefulness of the data.
• Most electronic and physical activities leave some kind
of data trail. These trails can provide useful information
to various parties.
• However, there are also concerns about appropriate
handling and use of sensitive information.
• Privacy-preserving methods of data handling seek to
provide sufficient privacy as well as sufficient utility.
Advantages of Privacy Protection
• protection of personal information
• protection of proprietary or sensitive information
• enables collaboration between different data
owners (since they may be more willing or able to
collaborate if they need not reveal their
information)
• compliance with legislative policies
Overview
• Introduction
• Primitives
• Higher-level protocols
– Distributed data mining
– Publishable data
– Coping with massiveness
– Beyond privacy-preserving data mining
• Implementation and experimentation
• Lessons learned, conclusions
Models for Distributed Data Mining, I
• Horizontally Partitioned
P1
…
…
…
P2
…
…
P3
…
…
• Vertically Partitioned
P1
…
…
…
…
…
…
…
…
P2
…
…
…
…
…
…
…
…
Models for Distributed Data Mining, II
• Fully Distributed
• Client/Server(s)
…
SERVER(S)
P2
…
Each holds
database
P3
…
Pn-1
…
Pn
…
…
P1
CLIENT
Wishes to
compute
on servers’
data
Cryptography vs. Randomization
cryptographic approach
inefficiency
privacy loss
randomization approach
inaccuracy
Cryptography vs. Randomization
inefficiency
cryptographic approach
privacy loss
randomization approach
inaccuracy
Secure Multiparty Computation
• Allows n players to privately compute a function f of
their inputs.
P
1
Pn
P2
• Overhead is polynomial in size of inputs and complexity
of f [Yao86, GMW87, BGW88, CCD88, ...]
• In theory, can solve any private distributed data mining
problem. In practice, not efficient for large data.
Primitives for PPDM
• Common tools include secret sharing,
homomorphic encryption, secure scalar product,
secure set intersection, secure sums, and other
statistics.
• PORTIA work:
– [BGN05]: homomorphic encryption of 2-DNF
formulas (arbitrary additions, one multiplication),
based on bilinear maps. (P)
– [AMP04]: Medians, kth ranked element. (P)
– [FNP04]: set intersection and cardinality.
Higher-Level Protocols
• [LP00]: private protocol for lnx and xlnx
• Various protocols to search remote, encrypted, or
access controlled data (e.g. for keywords, items in
common): [BBA03(P), Goh03, FNP04, BCOP04,
ABG+05(P), EFH#]
• [YZW05]: frequency mining protocol. (P)
Data Mining Models
• [WY04,YW05]: privacy-preserving construction of
Bayesian networks from vertically partitioned data.
• [YZW05]: classification from frequency mining in fully
distributed model (naïve Bayes classification, decision
trees, and association rule mining). (P)
• [JW#]: privacy-preserving k-means clustering for
arbitrarily partitioned data. (In vertically partitioned
case, similar to two-party [VC03].)
• [AST05]: privacy-preserving computation of
multidimensional aggregates on vertically or horizontally
partitioned data using randomization.
Privacy-Preserving Bayes Networks [WY04,YW05]
Goal: Cooperatively learn Bayesian network
structure on the combination of DBA and DBB ,
ideally without either party learning anything except
the Bayesian network itself.
Alice
Bob
DBA
DBB
K2 Algorithm for BN Learning
• Determining the best BN structure for a given data set is NP-hard,
so heuristics are used in practice.
• The K2 algorithm [CH92] is a widely used BN structure-learning
algorithm, which we use as the starting point for our solution.
• Considers nodes in sequence. Adds new parent that most increases
a score function f, up to a maximum number of parents per node.
α 0!α 1!
f (i, π (i)) = ∏
(α 0 + α 1 + 1)!
Our Solution: Approximate Score
Modified score function: approximates the same relative
ordering, and lends itself well to private computation.
• Apply natural log to f and use Stirling’s approximation
• Drop constant factor and bounded term. Result is:
g(i, π (i)) = ∑ ( 12 (ln α 0 + ln α1 − ln t) +
(α 0 ln α 0 + α1 ln α1 − t ln t ))
where t = α0 + α1 + 1
Our Solution: Components
Sub-protocols used:
• Privacy-preserving scalar product protocol: based on
homomorphic encryption
• Privacy-preserving computation of α-parameters: uses
scalar product
• Privacy-preserving score computation: uses α-parameters,
[LP00] protocols for lnx and xlnx
• Privacy-preserving score comparison: uses [Yao86]
All intermediate values (scores and parameters) are
protected using secret sharing. [YW05] improves on
[MSK04] for parameter computation.
Overview
• Introduction
• Primitives
• Higher-level protocols
– Distributed data mining
– Publishable data
– Coping with massiveness
– Beyond privacy-preserving data mining
• Implementation and experimentation
• Lessons learned, conclusions
Publishable Data
• Goal: Modify data before publishing so that results have
good privacy and good utility.
– Some situations favor one more than the other.
– May prevent some things from being learned at all.
• [DN04]: Extends privacy definitions of [EGS03,DN03]
relating a priori and a posteriori knowledge, and provides
solutions in a moderated publishing model.
• [CDMSW04]: provide quantifiable definitions of privacy
and utility. One’s privacy is guaranteed to the extent
that one does not stand out from others.
Publishable Data: k-Anonymity
• Modify database before publishing so (quasi-identifier of)
every record in the database is identical to at least k – 1 other
records [Swe02, MW04].
• [AFK+05]: optimal k-anonymization is NP-hard even if
the data values are ternary. Presents efficient
approximation algorithms for k-anonymization. (P)
• [ZYW05]: in two formulations, present solutions for a
data publisher to learn a k-anonymized version of a fully
distributed database without learning anything else. (P)
Coping with Massiveness
• Data mining on massive data sets in an important
field in its own right.
• It is also privacy-relevant, because:
– Massive data sets are likely to be distributed and multiply
owned.
– Efficiency improvements are needed in order to have any
hope of adding overhead for privacy.
• [FKMSZ05]: Stream algorithms for massive graphs (P)
• [DKM04]: Approximate massive-matrix computations
(P)
Beyond Privacy-Preserving Data Mining
Enforce policies about what kind of queries or
computations on data are allowed.
• [JW#]: Extends private inference control of [WS04] to
work with more complex query functions. Client learns
query result if and only if inference rule is met (and
learns nothing else).
• [KMN05]: Simulatable auditing to ensure that query
denials do not leak information. (P)
• [ABG+04]: P4P: Paranoid Platform for Privacy
Preferences. Mechanism for ensuring released data is
usable only for allowed tasks. (P)
Overview
• Introduction
• Primitives
• Higher-level protocols
– Distributed data mining
– Publishable data
– Coping with massiveness
– Beyond privacy-preserving data mining
• Implementation and experimentation
• Lessons learned, conclusions
Implementation and Experimentation
• secure scalar product protocol [SWY04]
• MySQL private information retrieval (PIR) [BBFS#]
• Fairplay: a system implementing Yao’s two party secure
function evaluation [MNPS04]
• Bayesian network implementation [KRFW#] (D)
• secure computation of surveys using Fairplay and use for
Taulbee survey [FPRS04] (P,D)
Survey Software [FPRS04] (P,D)
• User-friendly, open-source, free implementation using Fairplay
[MNPS04], suitable for use with CRA’s Taulbee salary survey.
Not adopted.
• CRA’s reasons:
– Need for data cleaning, multiyear comparisons, unanticipated use
– “Perhaps most member departments will trust us.”
• Provost Offices’ reasons:
– No legal basis for using this privacy-preserving protocol on data that
we otherwise don’t disclose
– Correctness and security claims are hard and expensive to assess,
despite open-source implementation.
– All-or-none adoption by Ivy+ peer group. Can’t make decision
unilaterally.
Future Directions in Experimentation
• Combine these and others into a general-purpose privacypreserving data mining experimental platform. Useful
for:
– fast prototyping of new protocols
– efficiency, accuracy comparisons of different approaches
• Experiment with real data and real uses.
– need to find a user community that has explicitly expressed
interest, and that could potentially accomplish something via
PPDM that it currently cannot accomplish.
– [Scha04]: genetics researchers may form such a community
Other Future Directions
• Preprocessing of data for PPDM.
• Privacy-preserving data solutions that use both
randomization and cryptography in order to gain
some of the advantages of both.
• Policies for privacy-preserving data mining:
languages, reconciliation, and enforcement.
• Incentive-compatible privacy-preserving data
mining.
Conclusions
• Increasing use of computers and networks has led to a
proliferation of sensitive data.
• Without proper precautions, this data could be misused.
• Many technologies exist for supporting proper data handling,
but much work remains, and some barriers must be overcome
in order for them to be deployed.
• Cryptography is a useful component, but not the whole
solution.
• Technology, policy, and education must work together.