Combinatorial Algorithms for String Sanitization

Abstract

String data are often disseminated to support applications such as location-based service provision or DNA sequence analysis. This dissemination, however, may expose sensitive patterns that model confidential knowledge (e.g., trips to mental health clinics from a string representing a user’s location history). In this article, we consider the problem of sanitizing a string by concealing the occurrences of sensitive patterns, while maintaining data utility, in two settings that are relevant to many common string processing tasks. In the first setting, we aim to generate the minimal-length string that preserves the order of appearance and frequency of all non-sensitive patterns. Such a string allows accurately performing tasks based on the sequential nature and pattern frequencies of the string. To construct such a string, we propose a time-optimal algorithm, TFS-ALGO. We also propose another time-optimal algorithm, PFS-ALGO, which preserves a partial order of appearance of non-sensitive patterns but produces a much shorter string that can be analyzed more efficiently. The strings produced by either of these algorithms are constructed by concatenating non-sensitive parts of the input string. However, it is possible to detect the sensitive patterns by “reversing” the concatenation operations. In response, we propose a heuristic, MCSR-ALGO, which replaces letters in the strings output by the algorithms with carefully selected letters, so that sensitive patterns are not reinstated, implausible patterns are not introduced, and occurrences of spurious patterns are prevented. In the second setting, we aim to generate a string that is at minimal edit distance from the original string, in addition to preserving the order of appearance and frequency of all non-sensitive patterns. To construct such a string, we propose an algorithm, ETFS-ALGO, based on solving specific instances of approximate regular expression matching. We implemented our sanitization approach that applies TFS-ALGO, PFS-ALGO, and then MCSR-ALGO, and experimentally show that it is effective and efficient. We also show that TFS-ALGO is nearly as effective at minimizing the edit distance as ETFS-ALGO, while being substantially more efficient than ETFS-ALGO.

Reverse-Safe Text Indexing

“…We used the following publicly available datasets: MSNBC (MSN), which contains page categories visited by users on msnbc.com over a 24-hour period; the complete genome of Escherichia coli (EC); KASANDR (KAS), which contains product categories in the Kelkoo price comparison site; and a dataset containing 27 Primate mitochondrial genomes (PR). MSN was used in the work of Gkoulalas-Divanis and Loukides [2011], Gwadera et al [2013], and Loukides and Gwadera [2015], EC was used in the work of Bernardini et al [2020a], was used in the work of Sidana et al [2017], and PR was used in the work of Thankachan et al [2017]. We also generated a uniformly random string of length 100M over an alphabet of size 10, and used its prefixes of length 1M, .…”

“…To alleviate these concerns and comply with legislation such as HIPAA [U.S. Department of Health & Human Services 1996] in the United States and GDPR [European Parliament 2015] in the European Union, it is necessary to guarantee that using data structures does not lead to the reconstruction of the stored individuals' data. This is a fundamentally different privacy goal than that of existing privacy-preserving techniques, such as anonymization [Chen et al 2012a, b;Heatherly et al 2013;Xu et al 2016], sanitization [Bernardini et al 2019[Bernardini et al , 2020a[Bernardini et al , 2020c[Bernardini et al , 2020dBonomi et al 2016;Gkoulalas-Divanis and Loukides 2011;Gwadera et al 2013;Loukides and Gwadera 2015;Wang et al 2013], query auditing [Nabar et al 2008], or access control [Bertino et al 2011]. Anonymization aims at preventing the disclosure of individuals' identities and/or sensitive information.…”

On Breaking Truss-Based Communities

“…A4. Preventing the detection of confidential communities by sanitizing a graph prior to its dissemination, in the spirit of sanitization works on transaction [21] or sequential data [4]. The edges identified in the output of the CB problem must be removed to hide these communities in the sanitized graph.…”

“…(b) The subgraph induced by all edges except the (dashed) edge (0, 4) is the maximal 4-truss of the graph. (c) The graph obtained after removing the set {(0, 1), (3,4), (5,6)} of (dashed) edges contains no 4-truss. (d) The graph obtained after removing the set {(3, 6), (5, 7)} of (dashed) edges is a graph in which the (gray) nodes 5 and 6 are not contained in any 4-truss.…”

“…An optimal solution to MIN--TBS with = 4 on the graph of Fig. 1c is the set of (dashed) edges ′ = {(0, 1), (3,4), (5,6)}. This is because removing these edges leads to a graph with no 4truss and because removing any fewer edges leads to a graph that contains a 4-truss.…”