Articles in Press

Anna Monreale^(b),(c),(*), Gennady Andrienko^(a), Natalia Andrienko^(a), Fosca Giannotti^(b),(d), Dino Pedreschi^(c),(d), Salvatore Rinzivillo^(b), Stefan Wrobel^(a)

Transactions on Data Privacy 3:2 (2010) 91 - 121

Abstract, PDF

(a) Fraunhofer IAIS; Sankt Augustin; Germany.

(b) KddLab ISTI-CNR; Pisa; Italy.

(d) Center for Complex Network Research, Northeastern University, Boston, MA.

e-mail:annam @di.unipi.it; gennady.andrienko @iais.fraunhofer.de; natalia.andrienko @iais.fraunhofer.de; fosca.giannotti @isti.cnr.it; pedre @di.unipi.it; rinzivillo @isti.cnr.it; stefan.wrobel @iais.fraunhofer.de

Abstract

Wireless networks and mobile devices, such as mobile phones and GPS receivers, sense and track the movements of people and vehicles, producing society-wide mobility databases. This is a challenging scenario for data analysis and mining. On the one hand, exciting opportunities arise out of discovering new knowledge about human mobile behavior, and thus fuel intelligent info-mobility applications. On other hand, new privacy concerns arise when mobility data are published. The risk is particularly high for GPS trajectories, which represent movement of a very high precision and spatio-temporal resolution: the de-identification of such trajectories (i.e., forgetting the ID of their associated owners) is only a weak protection, as generally it is possible to re-identify a person by observing her routine movements. In this paper we propose a method for achieving true anonymity in a dataset of published trajectories, by defining a transformation of the original GPS trajectories based on spatial generalization and k-anonymity. The proposed method offers a formal data protection safeguard, quantified as a theoretical upper bound to the probability of re-identification. We conduct a thorough study on a real-life GPS trajectory dataset, and provide strong empirical evidence that the proposed anonymity techniques achieve the conflicting goals of data utility and data privacy. In practice, the achieved anonymity protection is much stronger than the theoretical worst case, while the quality of the cluster analysis on the trajectory data is preserved.

^* Corresponding author.