Introduction to Privacy-Preserving Data Publishing: Concepts and Techniques (Chapman & Hall CRC Data Mining and Knowledge Discovery Series)

355 Pages·2010·5.08 MB·English

by  Benjamin C.M. Fung

Introduction to
Privacy-Preserving
Data Publishing
Concepts and Techniques
C9148_FM.indd 1 7/8/10 12:56:45 PM
Chapman & Hall/CRC Chapman & Hall/CRC
Data Mining and Knowledge Discovery Series Data Mining and Knowledge Discovery Series
SERIES EDITOR
Vipin Kumar
University of Minnesota
Department of Computer Science and Engineering
Minneapolis, Minnesota, U.S.A
Introduction to
AIMS AND SCOPE
This series aims to capture new developments and applications in data mining and knowledge Privacy-Preserving
discovery, while summarizing the computational tools and techniques useful in data analysis. This
series encourages the integration of mathematical, statistical, and computational methods and
techniques through the publication of a broad range of textbooks, reference works, and hand-
Data Publishing
books. The inclusion of concrete examples and applications is highly encouraged. The scope of the
series includes, but is not limited to, titles in the areas of data mining and knowledge discovery
methods and applications, modeling, algorithms, theory and foundations, data and knowledge
visualization, data mining systems and tools, and privacy and security issues.
Concepts and Techniques
PUBLISHED TITLES
UNDERSTANDING COMPLEX DATASETS: TEXT MINING: CLASSIFICATION, CLUSTERING,
DATA MINING WITH MATRIX DECOMPOSITIONS AND APPLICATIONS
David Skillicorn Ashok N. Srivastava and Mehran Sahami
COMPUTATIONAL METHODS OF FEATURE BIOLOGICAL DATA MINING
SELECTION Jake Y. Chen and Stefano Lonardi
Huan Liu and Hiroshi Motoda
INFORMATION DISCOVERY ON ELECTRONIC
CONSTRAINED CLUSTERING: ADVANCES IN HEALTH RECORDS
ALGORITHMS, THEORY, AND APPLICATIONS Vagelis Hristidis
Sugato Basu, Ian Davidson, and Kiri L. Wagstaff Benjamin C. M. Fung, Ke Wang,
TEMPORAL DATA MINING
KNOWLEDGE DISCOVERY FOR Theophano Mitsa
COUNTERTERRORISM AND LAW ENFORCEMENT
David Skillicorn RELATIONAL DATA CLUSTERING: MODELS, Ada Wai-Chee Fu, and Philip S. Yu
ALGORITHMS, AND APPLICATIONS
MULTIMEDIA DATA MINING: A SYSTEMATIC Bo Long, Zhongfei Zhang, and Philip S. Yu
INTRODUCTION TO CONCEPTS AND THEORY
KNOWLEDGE DISCOVERY FROM DATA STREAMS
Zhongfei Zhang and Ruofei Zhang
João Gama
NEXT GENERATION OF DATA MINING
STATISTICAL DATA MINING USING SAS
Hillol Kargupta, Jiawei Han, Philip S. Yu,
APPLICATIONS, SECOND EDITION
Rajeev Motwani, and Vipin Kumar
George Fernandez
DATA MINING FOR DESIGN AND MARKETING
INTRODUCTION TO PRIVACY-PRESERVING DATA
Yukio Ohsawa and Katsutoshi Yada
PUBLISHING: CONCEPTS AND TECHNIQUES
THE TOP TEN ALGORITHMS IN DATA MINING Benjamin C. M. Fung, Ke Wang, Ada Wai-Chee Fu,
Xindong Wu and Vipin Kumar and Philip S. Yu
GEOGRAPHIC DATA MINING AND
KNOWLEDGE DISCOVERY, SECOND EDITION
Harvey J. Miller and Jiawei Han
C9148_FM.indd 2 7/8/10 12:56:46 PM
Chapman & Hall/CRC Chapman & Hall/CRC
Data Mining and Knowledge Discovery Series Data Mining and Knowledge Discovery Series
SERIES EDITOR
Vipin Kumar
University of Minnesota
Department of Computer Science and Engineering
Minneapolis, Minnesota, U.S.A
Introduction to
AIMS AND SCOPE
This series aims to capture new developments and applications in data mining and knowledge Privacy-Preserving
discovery, while summarizing the computational tools and techniques useful in data analysis. This
series encourages the integration of mathematical, statistical, and computational methods and
techniques through the publication of a broad range of textbooks, reference works, and hand-
Data Publishing
books. The inclusion of concrete examples and applications is highly encouraged. The scope of the
series includes, but is not limited to, titles in the areas of data mining and knowledge discovery
methods and applications, modeling, algorithms, theory and foundations, data and knowledge
visualization, data mining systems and tools, and privacy and security issues.
Concepts and Techniques
PUBLISHED TITLES
UNDERSTANDING COMPLEX DATASETS: TEXT MINING: CLASSIFICATION, CLUSTERING,
DATA MINING WITH MATRIX DECOMPOSITIONS AND APPLICATIONS
David Skillicorn Ashok N. Srivastava and Mehran Sahami
COMPUTATIONAL METHODS OF FEATURE BIOLOGICAL DATA MINING
SELECTION Jake Y. Chen and Stefano Lonardi
Huan Liu and Hiroshi Motoda
INFORMATION DISCOVERY ON ELECTRONIC
CONSTRAINED CLUSTERING: ADVANCES IN HEALTH RECORDS
ALGORITHMS, THEORY, AND APPLICATIONS Vagelis Hristidis
Sugato Basu, Ian Davidson, and Kiri L. Wagstaff Benjamin C. M. Fung, Ke Wang,
TEMPORAL DATA MINING
KNOWLEDGE DISCOVERY FOR Theophano Mitsa
COUNTERTERRORISM AND LAW ENFORCEMENT
David Skillicorn RELATIONAL DATA CLUSTERING: MODELS, Ada Wai-Chee Fu, and Philip S. Yu
ALGORITHMS, AND APPLICATIONS
MULTIMEDIA DATA MINING: A SYSTEMATIC Bo Long, Zhongfei Zhang, and Philip S. Yu
INTRODUCTION TO CONCEPTS AND THEORY
KNOWLEDGE DISCOVERY FROM DATA STREAMS
Zhongfei Zhang and Ruofei Zhang
João Gama
NEXT GENERATION OF DATA MINING
STATISTICAL DATA MINING USING SAS
Hillol Kargupta, Jiawei Han, Philip S. Yu,
APPLICATIONS, SECOND EDITION
Rajeev Motwani, and Vipin Kumar
George Fernandez
DATA MINING FOR DESIGN AND MARKETING
INTRODUCTION TO PRIVACY-PRESERVING DATA
Yukio Ohsawa and Katsutoshi Yada
PUBLISHING: CONCEPTS AND TECHNIQUES
THE TOP TEN ALGORITHMS IN DATA MINING Benjamin C. M. Fung, Ke Wang, Ada Wai-Chee Fu,
Xindong Wu and Vipin Kumar and Philip S. Yu
GEOGRAPHIC DATA MINING AND
KNOWLEDGE DISCOVERY, SECOND EDITION
Harvey J. Miller and Jiawei Han
C9148_FM.indd 3 7/8/10 12:56:46 PM
Chapman & Hall/CRC
Taylor & Francis Group
6000 Broken Sound Parkway NW, Suite 300
Boca Raton, FL 33487-2742
© 2011 by Taylor and Francis Group, LLC
Chapman & Hall/CRC is an imprint of Taylor & Francis Group, an Informa business
No claim to original U.S. Government works
Printed in the United States of America on acid-free paper
10 9 8 7 6 5 4 3 2 1
International Standard Book Number: 978-1-4200-9148-9 (Hardback)
This book contains information obtained from authentic and highly regarded sources. Reasonable efforts
have been made to publish reliable data and information, but the author and publisher cannot assume
responsibility for the validity of all materials or the consequences of their use. The authors and publishers
have attempted to trace the copyright holders of all material reproduced in this publication and apologize to
copyright holders if permission to publish in this form has not been obtained. If any copyright material has
not been acknowledged please write and let us know so we may rectify in any future reprint.
Except as permitted under U.S. Copyright Law, no part of this book may be reprinted, reproduced, transmit-
ted, or utilized in any form by any electronic, mechanical, or other means, now known or hereafter invented,
including photocopying, microfilming, and recording, or in any information storage or retrieval system,
without written permission from the publishers.
For permission to photocopy or use material electronically from this work, please access www.copyright.
com (http://www.copyright.com/) or contact the Copyright Clearance Center, Inc. (CCC), 222 Rosewood
Drive, Danvers, MA 01923, 978-750-8400. CCC is a not-for-profit organization that provides licenses and
registration for a variety of users. For organizations that have been granted a photocopy license by the CCC,
a separate system of payment has been arranged.
Trademark Notice: Product or corporate names may be trademarks or registered trademarks, and are used
only for identification and explanation without intent to infringe.
Library of Congress Cataloging‑in‑Publication Data
Introduction to privacy-preserving data publishing : concepts and techniques / Benjamin
C.M. Fung … [et al.].
p. cm. -- (Data mining and knowledge discovery series)
Includes bibliographical references and index.
ISBN 978-1-4200-9148-9 (hardcover : alk. paper)
1. Database security. 2. Confidential communications. I. Fung, Benjamin C. M. II.
Title. III. Series.
QA76.9.D314I58 2010
005.8--dc22 2010023845
Visit the Taylor & Francis Web site at
http://www.taylorandfrancis.com
and the CRC Press Web site at
http://www.crcpress.com
C9148_FM.indd 4 7/8/10 12:56:46 PM
To Akina, Cyrus, Daphne, and my parents
- B.F.
To Lucy, Catherine, Caroline, and Simon
- K.W.
To my family
- A.F.
To my family
- P.Y.
Contents
List of Figures xv
List of Tables xvii
List of Algorithms xxi
Preface xxiii
Acknowledgments xxix
About the Authors xxxi
I The Fundamentals 1
1 Introduction 3
1.1 Data Collection and Data Publishing . . . . . . . . . . . . . 4
1.2 What Is Privacy-PreservingData Publishing? . . . . . . . . 7
1.3 Related Research Areas . . . . . . . . . . . . . . . . . . . . . 9
2 Attack Models and Privacy Models 13
2.1 Record Linkage Model . . . . . . . . . . . . . . . . . . . . . . 14
2.1.1 k-Anonymity . . . . . . . . . . . . . . . . . . . . . . . 15
2.1.2 (X,Y)-Anonymity . . . . . . . . . . . . . . . . . . . . 18
2.1.3 Dilemma on Choosing QID . . . . . . . . . . . . . . . 18
2.2 Attribute Linkage Model . . . . . . . . . . . . . . . . . . . . 19
2.2.1 (cid:2)-Diversity . . . . . . . . . . . . . . . . . . . . . . . . 20
2.2.2 Confidence Bounding. . . . . . . . . . . . . . . . . . . 23
2.2.3 (X,Y)-Linkability . . . . . . . . . . . . . . . . . . . . 23
2.2.4 (X,Y)-Privacy . . . . . . . . . . . . . . . . . . . . . . 24
2.2.5 (α,k)-Anonymity . . . . . . . . . . . . . . . . . . . . . 24
2.2.6 LKC-Privacy . . . . . . . . . . . . . . . . . . . . . . . 25
2.2.7 (k,e)-Anonymity . . . . . . . . . . . . . . . . . . . . . 26
2.2.8 t-Closeness . . . . . . . . . . . . . . . . . . . . . . . . 27
2.2.9 Personalized Privacy . . . . . . . . . . . . . . . . . . . 27
2.2.10 FF-Anonymity . . . . . . . . . . . . . . . . . . . . . . 28
2.3 Table Linkage Model . . . . . . . . . . . . . . . . . . . . . . 29
2.4 Probabilistic Model . . . . . . . . . . . . . . . . . . . . . . . 30
2.4.1 (c,t)-Isolation . . . . . . . . . . . . . . . . . . . . . . . 30
vii
viii Contents
2.4.2 (cid:4)-Differential Privacy . . . . . . . . . . . . . . . . . . . 30
2.4.3 (d,γ)-Privacy . . . . . . . . . . . . . . . . . . . . . . . 31
2.4.4 Distributional Privacy . . . . . . . . . . . . . . . . . . 31
2.5 Modeling Adversary’s Background Knowledge . . . . . . . . 32
2.5.1 Skyline Privacy . . . . . . . . . . . . . . . . . . . . . . 32
2.5.2 Privacy-MaxEnt . . . . . . . . . . . . . . . . . . . . . 33
2.5.3 Skyline (B,t)-Privacy . . . . . . . . . . . . . . . . . . 33
3 Anonymization Operations 35
3.1 Generalization and Suppression . . . . . . . . . . . . . . . . 35
3.2 Anatomization and Permutation . . . . . . . . . . . . . . . . 38
3.3 Random Perturbation . . . . . . . . . . . . . . . . . . . . . . 41
3.3.1 Additive Noise . . . . . . . . . . . . . . . . . . . . . . 41
3.3.2 Data Swapping . . . . . . . . . . . . . . . . . . . . . . 42
3.3.3 Synthetic Data Generation . . . . . . . . . . . . . . . 42
4 Information Metrics 43
4.1 General Purpose Metrics . . . . . . . . . . . . . . . . . . . . 43
4.1.1 Minimal Distortion . . . . . . . . . . . . . . . . . . . . 43
4.1.2 ILoss . . . . . . . . . . . . . . . . . . . . . . . . . . . 44
4.1.3 Discernibility Metric . . . . . . . . . . . . . . . . . . . 44
4.1.4 Distinctive Attribute . . . . . . . . . . . . . . . . . . . 45
4.2 Special Purpose Metrics . . . . . . . . . . . . . . . . . . . . . 45
4.3 Trade-Off Metrics . . . . . . . . . . . . . . . . . . . . . . . . 47
5 Anonymization Algorithms 49
5.1 Algorithms for the Record Linkage Model . . . . . . . . . . . 49
5.1.1 Optimal Anonymization . . . . . . . . . . . . . . . . . 49
5.1.2 Locally Minimal Anonymization . . . . . . . . . . . . 51
5.1.3 Perturbation Algorithms . . . . . . . . . . . . . . . . . 54
5.2 Algorithms for the Attribute Linkage Model . . . . . . . . . 55
5.2.1 (cid:2)-Diversity Incognito and (cid:2)+-Optimize . . . . . . . . . 55
5.2.2 InfoGain Mondrian . . . . . . . . . . . . . . . . . . . . 56
5.2.3 Top-Down Disclosure. . . . . . . . . . . . . . . . . . . 56
5.2.4 Anatomize . . . . . . . . . . . . . . . . . . . . . . . . 57
5.2.5 (k,e)-Anonymity Permutation . . . . . . . . . . . . . 58
5.2.6 Personalized Privacy . . . . . . . . . . . . . . . . . . . 58
5.3 Algorithms for the Table Linkage Model . . . . . . . . . . . . 59
5.3.1 δ-Presence Algorithms SPALM and MPALM . . . . . 59
5.4 Algorithms for the Probabilistic Attack Model . . . . . . . . 59
5.4.1 (cid:4)-Differential Additive Noise. . . . . . . . . . . . . . . 61
5.4.2 αβ Algorithm . . . . . . . . . . . . . . . . . . . . . . . 61
5.5 Attacks on Anonymous Data . . . . . . . . . . . . . . . . . . 61
5.5.1 Minimality Attack . . . . . . . . . . . . . . . . . . . . 61
5.5.2 deFinetti Attack . . . . . . . . . . . . . . . . . . . . . 63
Contents ix
5.5.3 Corruption Attack . . . . . . . . . . . . . . . . . . . . 64
II Anonymization for Data Mining 67
6 Anonymization for Classification Analysis 69
6.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . 69
6.2 Anonymization Problems for Red Cross BTS . . . . . . . . . 74
6.2.1 Privacy Model . . . . . . . . . . . . . . . . . . . . . . 74
6.2.2 Information Metrics . . . . . . . . . . . . . . . . . . . 75
6.2.3 Problem Statement . . . . . . . . . . . . . . . . . . . . 81
6.3 High-Dimensional Top-Down Specialization (HDTDS) . . . . 82
6.3.1 Find the Best Specialization. . . . . . . . . . . . . . . 83
6.3.2 Perform the Best Specialization . . . . . . . . . . . . . 84
6.3.3 Update Score and Validity . . . . . . . . . . . . . . . . 87
6.3.4 Discussion . . . . . . . . . . . . . . . . . . . . . . . . . 87
6.4 Workload-AwareMondrian . . . . . . . . . . . . . . . . . . . 89
6.4.1 Single CategoricalTarget Attribute. . . . . . . . . . . 89
6.4.2 Single Numerical Target Attribute . . . . . . . . . . . 90
6.4.3 Multiple Target Attributes . . . . . . . . . . . . . . . 91
6.4.4 Discussion . . . . . . . . . . . . . . . . . . . . . . . . . 91
6.5 Bottom-Up Generalization . . . . . . . . . . . . . . . . . . . 92
6.5.1 The Anonymization Algorithm . . . . . . . . . . . . . 92
6.5.2 Data Structure . . . . . . . . . . . . . . . . . . . . . . 93
6.5.3 Discussion . . . . . . . . . . . . . . . . . . . . . . . . . 95
6.6 Genetic Algorithm . . . . . . . . . . . . . . . . . . . . . . . . 95
6.6.1 The Anonymization Algorithm . . . . . . . . . . . . . 96
6.6.2 Discussion . . . . . . . . . . . . . . . . . . . . . . . . . 96
6.7 Evaluation Methodology . . . . . . . . . . . . . . . . . . . . 96
6.7.1 Data Utility . . . . . . . . . . . . . . . . . . . . . . . . 97
6.7.2 Efficiency and Scalability . . . . . . . . . . . . . . . . 102
6.8 Summary and Lesson Learned . . . . . . . . . . . . . . . . . 103
7 Anonymization for Cluster Analysis 105
7.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . 105
7.2 Anonymization Framework for Cluster Analysis . . . . . . . 105
7.2.1 Anonymization Problem for Cluster Analysis . . . . . 108
7.2.2 Overview of Solution Framework . . . . . . . . . . . . 112
7.2.3 Anonymization for Classification Analysis . . . . . . . 114
7.2.4 Evaluation . . . . . . . . . . . . . . . . . . . . . . . . 118
7.2.5 Discussion . . . . . . . . . . . . . . . . . . . . . . . . . 121
7.3 Dimensionality Reduction-Based Transformation . . . . . . . 124
7.3.1 Dimensionality Reduction . . . . . . . . . . . . . . . . 124
7.3.2 The DRBT Method . . . . . . . . . . . . . . . . . . . 125
7.4 Related Topics . . . . . . . . . . . . . . . . . . . . . . . . . . 126
7.5 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126
x Contents
III Extended Data Publishing Scenarios 129
8 Multiple Views Publishing 131
8.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . 131
8.2 Checking Violations of k-Anonymity on Multiple Views . . . 133
8.2.1 Violations by Multiple Selection-Project Views . . . . 133
8.2.2 Violations by Functional Dependencies . . . . . . . . . 136
8.2.3 Discussion . . . . . . . . . . . . . . . . . . . . . . . . . 136
8.3 Checking Violations with Marginals . . . . . . . . . . . . . . 137
8.4 MultiRelational k-Anonymity . . . . . . . . . . . . . . . . . . 140
8.5 Multi-Level Perturbation . . . . . . . . . . . . . . . . . . . . 140
8.6 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 141
9 Anonymizing Sequential Releases with New Attributes 143
9.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . 143
9.1.1 Motivations . . . . . . . . . . . . . . . . . . . . . . . . 143
9.1.2 Anonymization Problem for Sequential Releases. . . . 147
9.2 Monotonicity of Privacy . . . . . . . . . . . . . . . . . . . . . 151
9.3 Anonymization Algorithm for Sequential Releases . . . . . . 153
9.3.1 Overview of the Anonymization Algorithm . . . . . . 153
9.3.2 Information Metrics . . . . . . . . . . . . . . . . . . . 154
9.3.3 (X,Y)-Linkability . . . . . . . . . . . . . . . . . . . . 155
9.3.4 (X,Y)-Anonymity . . . . . . . . . . . . . . . . . . . . 158
9.4 Extensions . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159
9.5 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159
10 Anonymizing Incrementally Updated Data Records 161
10.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . 161
10.2 Continuous Data Publishing . . . . . . . . . . . . . . . . . . 164
10.2.1 Data Model . . . . . . . . . . . . . . . . . . . . . . . . 164
10.2.2 Correspondence Attacks . . . . . . . . . . . . . . . . . 165
10.2.3 Anonymization Problem for Continuous Publishing . . 168
10.2.4 Detection of Correspondence Attacks. . . . . . . . . . 175
10.2.5 Anonymization Algorithm for Correspondence Attacks 178
10.2.6 Beyond Two Releases . . . . . . . . . . . . . . . . . . 180
10.2.7 Beyond Anonymity . . . . . . . . . . . . . . . . . . . . 181
10.3 Dynamic Data Republishing . . . . . . . . . . . . . . . . . . 181
10.3.1 Privacy Threats . . . . . . . . . . . . . . . . . . . . . 182
10.3.2 m-invariance . . . . . . . . . . . . . . . . . . . . . . . 183
10.4 HD-Composition . . . . . . . . . . . . . . . . . . . . . . . . . 185
10.5 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 190
Contents xi
11 Collaborative Anonymization for Vertically Partitioned
Data 193
11.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . 193
11.2 Privacy-PreservingData Mashup . . . . . . . . . . . . . . . . 194
11.2.1 Anonymization Problem for Data Mashup . . . . . . . 199
11.2.2 Information Metrics . . . . . . . . . . . . . . . . . . . 201
11.2.3 Architecture and Protocol . . . . . . . . . . . . . . . . 202
11.2.4 Anonymization Algorithm for Semi-Honest Model . . 204
11.2.5 Anonymization Algorithm for Malicious Model . . . . 210
11.2.6 Discussion . . . . . . . . . . . . . . . . . . . . . . . . . 217
11.3 Cryptographic Approach . . . . . . . . . . . . . . . . . . . . 218
11.3.1 Secure Multiparty Computation . . . . . . . . . . . . 218
11.3.2 Minimal Information Sharing . . . . . . . . . . . . . . 219
11.4 Summary and Lesson Learned . . . . . . . . . . . . . . . . . 220
12 Collaborative Anonymization for Horizontally Partitioned
Data 221
12.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . 221
12.2 Privacy Model . . . . . . . . . . . . . . . . . . . . . . . . . . 222
12.3 Overview of the Solution . . . . . . . . . . . . . . . . . . . . 223
12.4 Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . . . 224
IV Anonymizing Complex Data 227
13 Anonymizing Transaction Data 229
13.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . 229
13.1.1 Motivations . . . . . . . . . . . . . . . . . . . . . . . . 229
13.1.2 The Transaction Publishing Problem . . . . . . . . . . 230
13.1.3 Previous Works on Privacy-PreservingData Mining . 231
13.1.4 Challenges and Requirements . . . . . . . . . . . . . . 232
13.2 Cohesion Approach . . . . . . . . . . . . . . . . . . . . . . . 234
13.2.1 Coherence . . . . . . . . . . . . . . . . . . . . . . . . . 235
13.2.2 Item Suppression . . . . . . . . . . . . . . . . . . . . . 236
13.2.3 A Heuristic Suppression Algorithm . . . . . . . . . . . 237
13.2.4 Itemset-Based Utility . . . . . . . . . . . . . . . . . . 240
13.2.5 Discussion . . . . . . . . . . . . . . . . . . . . . . . . . 241
13.3 Band Matrix Method . . . . . . . . . . . . . . . . . . . . . . 242
13.3.1 Band Matrix Representation . . . . . . . . . . . . . . 243
13.3.2 Constructing Anonymized Groups . . . . . . . . . . . 243
13.3.3 Reconstruction Error. . . . . . . . . . . . . . . . . . . 245
13.3.4 Discussion . . . . . . . . . . . . . . . . . . . . . . . . . 246
13.4 km-Anonymization . . . . . . . . . . . . . . . . . . . . . . . . 247
13.4.1 km-Anonymity . . . . . . . . . . . . . . . . . . . . . . 247
13.4.2 Apriori Anonymization . . . . . . . . . . . . . . . . . 248
13.4.3 Discussion . . . . . . . . . . . . . . . . . . . . . . . . . 250