Adaptive selection method of desensitization algorithm based on privacy risk assessment

Lijun ZU; Yalin CAO; Xiaohua MEN; Zhihui LYU; Jiawei YE; Hongyi LI; Liang ZHANG

doi:10.11959/j.issn.2096-109x.2023037

您当前的位置：

首页 >

文章列表页 >

Adaptive selection method of desensitization algorithm based on privacy risk assessment

Papers | 更新时间：2024-06-03

- Adaptive selection method of desensitization algorithm based on privacy risk assessment
- Chinese Journal of Network and Information Security Vol. 9, Issue 3, Pages: 49-59(2023)
- 作者机构：
  
  1. 复旦大学金融科技研究院，上海 200433
  2. 中国银联股份有限公司，上海 201210
  3. 华为技术有限公司，江苏南京 210012
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2023037
  CLC： TP393
- Online First：2023-06，
  
  Published：25 June 2023
- 稿件说明：
移动端阅览
Lijun ZU, Yalin CAO, Xiaohua MEN, et al. Adaptive selection method of desensitization algorithm based on privacy risk assessment[J]. Chinese Journal of Network and Information Security, 2023, 9(3): 49-59.
DOI：

Lijun ZU, Yalin CAO, Xiaohua MEN, et al. Adaptive selection method of desensitization algorithm based on privacy risk assessment[J]. Chinese Journal of Network and Information Security, 2023, 9(3): 49-59. DOI： 10.11959/j.issn.2096-109x.2023037.

摘要

金融行业业务处理中含大量的敏感数据。金融业务的快速发展导致数据种类激增，目前绑定待脱敏金融数据以及脱敏算法的方式效率较低，依靠安全专家经验对脱敏数据进行人工检查与风险评估耗时长。脱敏算法的选择不当导致脱敏处理后的金融数据存在潜在隐私泄露风险。国内外研究大多侧重脱敏方法的实现和隐私保护技术，极少从自动化角度对脱敏算法进行研究。为提高脱敏效率和隐私保护透明度，通过梳理现有隐私保护技术特点、业务场景对数据质量需求、金融机构对安全风险要求、数据属性等因素，搭建自适应选择脱敏策略推荐框架，建立通用隐私风险和数据质量双目标评估函数，基于多决策因素体系和脱敏效果评估，实现脱敏算法和参数的自适应选择。相较于传统数据脱敏方式，所提方法能有效解决人工干预带来的脱敏数据可用性差和个人数据隐私保护性不足等问题，在多类金融机构数据测试集实验下，所提方法推荐准确率达到 95%以上，脱敏后的隐私风险非常接近预期隐私风险水平，差距小于 10%，推荐效率相较于专家人工处理时间提升100倍。

Abstract

The financial industry deals with a vast amount of sensitive data in its business operations.However

the conventional approach of binding financial data for desensitization and using desensitization algorithms is becoming inefficient due to the fast-paced growth of financial businesses and the proliferation of data types.Additionally

manual verification and assessment of desensitized data by security experts are time-consuming and may carry potential privacy risks due to the improper selection of desensitization algorithms.While prior research has emphasized desensitization methods and privacy-preserving technologies

limited work has been conducted on desensitization algorithms from the perspective of automation.To address this issue

an adaptive recommendation framework was propose for selecting desensitization strategies that consider various factors

such as existing privacy protection technologies

data quality requirements of business scenarios

security risk requirements of financial institutions

and data attributes.Specifically

a dual-objective evaluation function was established for privacy risk and data quality to optimize the selection of desensitization algorithm parameters for different algorithms.Furthermore

the desensitization algorithm and parameters were adaptively selected by considering the data attributes through a multi-decision factor system and desensitization effect evaluation system.Compared to traditional approaches

the proposed framework effectively tackle issues of reduced data usability and inadequate personal data privacy protection that derive from manual intervention.Testing on a dataset with multiple financial institution types

the experiments show that the proposed method achieves a recommendation accuracy exceeding 95%

while the desensitized privacy risk level differed by less than 10% from the expected level.Additionally

the recommendation efficiency is 100 times faster than expert manual processing.

关键词

Keywords

references

王卓 , 刘国伟 , 王岩 , 等 . 数据脱敏技术发展现状及趋势研究 [J ] . 信息通信技术与政策 , 2020 ( 4 ): 18 - 22 .

WANG Z , LIU G W , WANG Y , et al . Research on the development and trend of data masking technology [J ] . Information and Communications Technology and Policy , 2020 , 46 ( 4 ): 18 - 22 .

中华人民共和国个人信息保护法 [S ] . 2021 .

Personal Information Protection Law of The People's Republic of China [S ] . 2021 .

王茂华 , 郝云力 , 褚亚伟 . 具有隐私保护功能的数据加密算法 [J ] . 计算机工程与应用 , 2014 ,( 23 ): 87 - 90 .

WANG M H , HAO Y L , CHU Y W . Data encryption algorithm with privacy protection function [J ] . Computer Engineering and Applications , 2014 , 0 ( 23 ): 87 - 90 .

周期律 , 张旭春 , 蔡仕志 . 商业银行客户姓名脱敏技术研究 [J ] . 中国金融电脑 , 2014 ( 6 ): 65 - 68 .

ZHOU Q L , ZHANG X C , CAI S Z . Research on commercial bank customer name desensitization technology [J ] . Financial Computer of China , 2014 ( 6 ): 65 - 68 .

LATANYA S , K-ANONYMITY . A model for protecting privacy [J ] . International Journal of Uncertainty,Fuzziness and Knowledgebased Systems:IJUFKS , 2002 , 10 ( 5 ): 557 - 570 .

WANG M , JIANG Z , ZHANG Y , et al . T-closeness slicing:a new privacy-preserving approach for transactional data publishing [J ] . INFORMS Journal on Computing , 2018 , 30 ( 3 ): 438 - 453 .

SORIA-COMAS J , DOMINGO-FERRER J , SANCHEZ D , et al . t-closeness through microaggregation:Strict privacy with enhanced utility preservation [J ] . IEEE Transactions on Knowledge and Data Engineering , 2015 , 27 ( 11 ): 3098 - 3110 .

DONG J , ROTH A , SU W J . Gaussian differential privacy [J ] . Journal of the Royal Statistical Society Series B:Statistical Methodology , 2022 , 84 ( 1 ): 3 - 37 .

CYNTHIA D , JING L . Differential privacy and robust statistics [C ] // Proceedings of the 41st Annual ACM Symposium on Theory of Computing , 2009 : 371 - 380 .

BENALOH J . Dense probabilistic encryption [C ] // Proceedings of the Workshop on Selected Areas of Cryptography . 1994 : 120 - 128 .

AGGARWAL N , GUPTA C P , SHARMA I . Fully homomorphic symmetric scheme without bootstrapping [C ] // Proceedings of 2014 International Conference on Cloud Computing and Internet of Things . 2014 : 14 - 17 .

VENU D , MAYURI A V R , NEELAKANDAN S , et al . An efficient low complexity compression based optimal homomorphic encryption for secure fiber optic communication [J ] . Optik , 2022 ,252:168545.

ZHANG X , LIU C , NEPAL S , et al . A hybrid approach for scalable sub-tree anonymization over big data using MapReduce on cloud [J ] . Journal of Computer and System Sciences , 2014 , 80 ( 5 ): 1008 - 1020 .

MOHAMMADIAN E , Noferesti M , JALILI R . FAST:fast anonymization of big data streams [C ] // Proceedings of the 2014 International Conference on Big Data Science and Computing . 2014 : 1 - 8 .

徐李阳 , 李慧芹 , 赵文华 , 等 . 基于卷积神经网络的敏感数据自动脱敏方法 [J ] . 自动化应用 , 2021 ( 10 ): 86 - 88 .

XU L Y , LI H Q , ZHAO W H , et al . Automatic desensitization method of sensitive data based on convolutional neural network [J ] . Automation Application , 2021 ( 10 ): 86 - 88 .

MADAN S , GOSWAMI P . Adaptive privacy preservation approach for big data publishing in cloud using k-anonymization [J ] . Recent Advances in Computer Science and Communications , 2021 , 14 ( 8 ): 2678 - 2688 .

CHOROMANSKI K M , JEBARA T , TANG K . Adaptive anonymity via b-matching [J ] . Advances in Neural Information Processing Systems , 2013 , 26 : 3192 - 3200 .

佟玲玲 , 李鹏霄 , 段东圣 , 等 . 面向异构大数据环境的数据脱敏模型 [J ] . 北京航空航天大学学报 , 2022 , 48 ( 2 ): 249 - 257 .

TONG L L , LI P X , DUAN D S , et al . Data masking model for heterogeneous big data environment [J ] . Journal of Beijing University of Aeronautics and Astronautics , 2022 , 48 ( 2 ): 249 - 257 .

WAGNER , ISABEL , ECKHOFF , et al . Technical privacy metrics:a systematic survey [J ] . ACM Computing Surveys (CSUR) , 2018 , 51 ( 3 ): 1 - 38 .

ORACLE . Oracle data masking [EB ] .

IBM . InfoSphere optim data privacy [EB ] .

INFORMATICA . Data masking [EB ] .

熊金波 , 王敏燊 , 田有亮 , 等 . 面向云数据的隐私度量研究进展 [J ] . 软件学报 , 2018 , 29 ( 7 ): 1963 - 1980 .

XIONG J B , WANG M S , TIAN Y L , et al . Research Progress on Privacy Measurement for Cloud Data [J ] . Journal of Software , 2018 , 29 ( 7 ): 1963 - 1980 .

乔宏明 , 梁奂 . 运营商面向大数据应用的数据脱敏方法探讨 [J ] . 移动通信 , 2015 ( 13 ): 17 - 20 , 24 .

QIAO H M , LIANG H . Discussion on operators' data desensitization methods for big data applications [J ] . Mobile Communications , 2015 ( 13 ): 17 - 20 , 24 .

GB/T 42460-2023,信息安全技术个人信息去标识化效果分级评估指南 [S ] . 北京:中国标准出版社 , 2023 .

GB/T 42460-2023,Information security technology—Gguide for evaluating the effectiveness of personal information de-identification [S ] . Beijing:Standards Press of China , 2023 .

XU W , YUAN K , LI W , et al . An emerging fuzzy feature selection method using composite entropy-based uncertainty measure and data distribution [J ] . IEEE Transactions on Emerging Topics in Computational Intelligence , 2023 , 7 ( 1 ): 76 - 88 .

FUNG B , WANG K , CHEN R , et al . Privacy-preserving data publishing:a survey of recent developments [J ] . ACM computing surveys , 2010 , 42 ( 4 ): 1 - 53 .

BAYARDO R J , AGRAWAL R . Data privacy through optimal k-anonymization [C ] // 21st International Conference on Data Engineering , 2005 : 217 - 228 .

LU Q , WANG C , XIONG Y , et al . Personalized privacy-preserving trajectory data publishing [J ] . Chinese Journal of Electronics , 2017 , 26 ( 2 ): 285 - 291 .

XIAO X , TAO Y . Personalized privacy preservation [C ] // Proceedings of the 2006 ACM SIGMOD International Conference on Management of Data . 2006 : 229 - 240 .

姜火文 , 曾国荪 , 马海英 . 面向表数据发布隐私保护的贪心聚类匿名方法 [J ] . 软件学报 , 2017 , 28 ( 2 ): 341 - 351 .

JIANG H W , ZENG G S , MA H Y . Greedy clustering-anonymity method for privacy preservation of table datapublishing [J ] . Journal of Software , 2017 , 28 ( 2 ): 341 - 351 .

Views

292

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

AI-based risk assessment and early warning method for futures trading

Technology and practice of intelligent governance for financial data security

Preliminary study on the reform of machine learning teaching

Survey of artificial intelligence data security and privacy protection

Model of cyberspace threat early warning based on cross-domain and collaboration

Related Author

Li Meng

Chang Fei

Wang Junjie

Hu Yi

Qiao Yan

Weng Zhenhao

Guo Jinsheng

Liu Yibo

Related Institution

Huishang Futures Co., Ltd.

School of Computer Science and Information Engineering, Hefei University of Technology

Key Laboratory of Knowledge Engineering with Big Data, Hefei University of Technology

School of Computer Science, Fudan University

Institute of Financial Technology, Fudan University

⁰