String Sanitization: A Combinatorial Approach

Abstract

String data are often disseminated to support applications such as location-based service provision or DNA sequence analysis. This dissemination, however, may expose sensitive patterns that model confidential knowledge (e.g., trips to mental health clinics from a string representing a user's location history). In this paper, we consider the problem of sanitizing a string by concealing the occurrences of sensitive patterns, while maintaining data utility. First, we propose a time-optimal algorithm, TFS-ALGO, to construct the shortest string preserving the order of appearance and the frequency of all non-sensitive patterns. Such a string allows accurately performing tasks based on the sequential nature and pattern frequencies of the string. Second, we propose a time-optimal algorithm, PFS-ALGO, which preserves a partial order of appearance of non-sensitive patterns but produces a much shorter string that can be analyzed more efficiently. The strings produced by either of these algorithms may reveal the location of sensitive patterns. In response, we propose a heuristic, MCSR-ALGO, which replaces letters in these strings with carefully selected letters, so that sensitive patterns are not reinstated and occurrences of spurious patterns are prevented. We implemented our sanitization approach that applies TFS-ALGO, PFS-ALGO and then MCSR-ALGO and experimentally show that it is effective and efficient.

Hide and Mine in Strings: Hardness and Algorithms

“…In this paper, we study the fundamental relation between data sanitization [1], [4], [27] (also known as knowledge hiding) and frequent pattern mining [19], [22], [25]. The objective of frequent pattern mining in strings is to obtain all patterns occurring frequently enough in a string, or in a collection of strings.…”

“…There may also be constraints for the mined strings (e.g., to be of fixed length k [3], [9]). In string sanitization, the privacy objective is to transform a string to ensure that a given set of sensitive patterns, modeling confidential knowledge, does not occur in the sanitized version of the string; sensitive patterns are selected based on domain expertise [4], [15], [27]. This transformation may incur some utility loss that should be minimized.…”

“…This transformation may incur some utility loss that should be minimized. Recent methods achieve this using combinatorial algorithms [4], [5]. Let W be the input string over Σ, k > 0 be an integer, and S be the set of sensitive length-k substrings.…”

“…Let W be the input string over Σ, k > 0 be an integer, and S be the set of sensitive length-k substrings. These methods construct a string X such that: (I) X contains no element of S as a substring; (II) the total order and thus the frequency of all non-sensitive length-k substrings of W is preserved in X; and (III) the length of X is minimized [4], or the edit distance between W and X is minimized [5]. These methods work by copying carefully selected substrings of W into X and separating them by a special letter # / ∈ Σ.…”

“…Further, let X TR = GAC#ACC#CCC#CAT, X MIN = GACCC#CAT and X ED = GAC#AA#ACCC#CAT be three sanitized strings. All three strings contain no sensitive pattern and preserve the total order and thus the frequency of all nonsensitive length-3 patterns of W : X TR is the trivial solution of interleaving the non-sensitive length-3 patterns of W with #; X MIN is the shortest possible such string [4]; and X ED is a string closest to W in terms of edit distance [5].…”