An Anatomization Model for Multiple Sensitive Attributes based on the Domain of Sensitive Values and the Confidence of Data Re-Identification

Abstract Purpose: An anatomization model is presented in this work. It is proposed to address privacy violation issues in datasets that have multiple sensitive attributes. Both major aims of the proposed model is to balance the data utility and data privacy in datasets when they are released to utilize in the outside scope of the data-collecting organizations. Methods: To achieve the aims of the proposed model, the sensitive attributes of datasets are separated to be two groups. That is, the nominal and continuous sensitive attributes. With all nominal sensitive attributesi of datasets, the data utility and data privacy are balanced by C as the maximum confidence of data re-identification and the summation of the diameter of the sensitive values that are available in the specified sensitive hierarchy for each nominal sensitive attribute. Another group of sensitive attributes, the continuous sensitive attributes, the data utility and data privacy of each sensitive attribute sx are balanced by Rsx as the minimum confidence range of data re-identification and the summation of the different ranges of all partitions that are available in the datasets. For privacy preservation, before datasets will be released, their tuples are partitioned by considering the values of each sensitive value with C and Rsx. With each nominal sensitive attribute, the summation of sensitive value diameters of all partitions is minimized. With each continuous sensitive attribute, the summation of the different ranges of all partitions must also be minimized. Moreover, every partition is separated into both tables, i.e., the quasi-identifier and sensitive tables, such that each partition of them is utilized by joining the set of its defined tuple identifiers. Results: The proposed model is evaluated by using extensive experiments. The experimental results indicate that the proposed model is more effective and efficient than the compared models. Moreover, datasets are satisfied by the privacy preservation constraint of the proposed model, they can guarantee the confidence of data re-identification.