title: A Probabilistic Approach to Mitigate Composition Attacks on Privacy in Non-Coordinated Environments.
abstract: Organizations share data about individuals to drive business and comply with law and regulation. However, an adversary may expose confidential information by tracking an individual across disparate data publications using quasi-identifying attributes (e.g., age, geocode and sex) associated with the records. Various studies have shown that well-established privacy protection models (e.g.,k-anonymity and its extensions) fail to protect an individual's privacy against this "composition attack". This type of attack can be thwarted when organizations coordinate prior to data publication, but such a practice is not always feasible. In this paper, we introduce a probabilistic model called (d, α)-linkable, which mitigates composition attack without coordination. The model ensures thatdconfidential values are associated with a quasi-identifying group with a likelihood of α. We realize this model through an efficient extension tok-anonymization and use extensive experiments to show our strategy significantly reduces the likelihood of a successful composition attack and can preserve more utility than alternative privacy models, such as differential privacy.
authors.affiliation: School of Information Technology and Mathematical Science, University of South Australia, Mawson Lakes, SA-5095, Australia.
authors.forename: A H M
authors.initials: AH
authors.lastname: Sarowar Sattar
authors.affiliation: School of Information Technology and Mathematical Science, University of South Australia, Mawson Lakes, SA-5095, Australia.
authors.forename: Jiuyong
authors.initials: J
authors.lastname: Li
authors.affiliation: School of Information Technology and Mathematical Science, University of South Australia, Mawson Lakes, SA-5095, Australia.
authors.forename: Jixue
authors.initials: J
authors.lastname: Liu
authors.affiliation: Department of Biomedical Informatics, Vanderbilt University, Nashville, Tennessee, USA.
authors.forename: Raymond
authors.initials: R
authors.lastname: Heatherly
authors.affiliation: Department of Biomedical Informatics, Vanderbilt University, Nashville, Tennessee, USA ; Department of Electrical Engineering and Computer Science, Vanderbilt University, Nashville, Tennessee, USA.
authors.forename: Bradley
authors.initials: B
authors.lastname: Malin
keywords: Anonymization; Composition attack; Data publication; Databases; Privacy