Citation Context

...e willing to give not true values but modified values of certain fields. Given a population that satisfies the above assumptions, we address the concrete problem of building decision-tree classifiers =-=[BFOS84]-=- [Qui93] and show that that it is possible to develop accurate models while re1 specting users' privacy concerns. Classification is one the most used tasks in data mining. Decision-tree classifiers ar...

Citation Context

...et O(m 2 ) time. Stopping Criterion With omniscience, we would stop when the reconstructed distribution was statistically the same as the original distribution (using, say, thes2 goodness-of-fit test =-=[Cra46]-=-). An alternative is to compare the observed randomized distribution with the result of randomizing the current estimate of the original distribution, and stop when these two distributions are statist...

Citation Context

...obal method and requires knowledge of values in other records. The problem of reconstructing original distribution from a given distribution can be viewed in the general framework of inverse problems =-=[EHN96]-=-. In [FJS97], it was shown that for smooth enough distributions (e.g. slowly varying time signals), it is possible to to fully recover original distribution from non-overlapping, contiguous partial su...

Citation Context

...on of data cells of small size (e.g. [Cox80]), and clustering entities into mutually exclusive atomic populations (e.g. [YC77]). The perturbation family includes swapping values between records (e.g. =-=[Den82]-=-), replacing the original database by a sample from the same distribution (e.g. [LST83] [LCL85] [Rei84]), adding noise to the values in the database (e.g. [TYW84] [War65]), adding noise to the results...

Citation Context

...sire to be able to provide statistical information (sum, count, average, maximum, minimum, pth percentile, etc.) without compromising sensitive information about individuals (see excellent surveys in =-=[AW89]-=- [Sho82].) The proposed techniques can be broadly classified into query restriction and data perturbation. The query restriction family includes restricting the size of query result (e.g. [Fel72] [DDS...

Citation Context

... 0.5 and-0.5 to each point gives similar results. 4 Decision-Tree Classification over Randomized Data 4.1 Background We begin with a brief review of decision tree classification, adapted from [MAR96] =-=[SAM96]-=-. A decision tree [BFOS84] [Qui93] is a class discriminator that recursively partitions the training set until each partition consists entirely or dominantly of examples from the same class. Each non-...

Citation Context

... values between records (e.g. [Den82]), replacing the original database by a sample from the same distribution (e.g. [LST83] [LCL85] [Rei84]), adding noise to the values in the database (e.g. [TYW84] =-=[War65]-=-), adding noise to the results of a query (e.g. [Bec80]), and sampling the result of a query (e.g. [Den80]). There are negative results showing that the proposed techniques cannot satisfy the conflict...

Citation Context

... between 0.5 and-0.5 to each point gives similar results. 4 Decision-Tree Classification over Randomized Data 4.1 Background We begin with a brief review of decision tree classification, adapted from =-=[MAR96]-=- [SAM96]. A decision tree [BFOS84] [Qui93] is a class discriminator that recursively partitions the training set until each partition consists entirely or dominantly of examples from the same class. E...

Citation Context

...eu998] [Off98]. Privacy issues are further exacerbated now that the World Wide Web makes it easy for the new data to be automatically collected and added to databases [HE98] [Wes98a] [Wes98b] [Wes99] =-=[CRA99a]-=- [Cra99b]. The concerns over massive collection of data are naturally extending to analytic tools applied to data. Data mining, with its promise to efficiently discover valuable, non-obvious informati...

Citation Context

...ve in preventing unauthorized access to the system. Other relevant work includes efforts to create tools and standards that provide platform for implementing a system such as ours (e.g. [Wor] [Ben99] =-=[GWB97]-=- [Cra99b] [AC99] [LM99] [LEW99]). Paper Organization We discuss privacy-preserving methods in Section 2. We also introduce a quantitative measure to evaluate the amount of privacy offered by a method ...

Citation Context

...lap amongst successive queries (e.g. [DJL79]), keeping audit trail of all answered queries and constantly checking for possible compromise (e.g. [CO82]), suppression of data cells of small size (e.g. =-=[Cox80]-=-), and clustering entities into mutually exclusive atomic populations (e.g. [YC77]). The perturbation family includes swapping values between records (e.g. [Den82]), replacing the original database by...

Citation Context

...to query restriction and data perturbation. The query restriction family includes restricting the size of query result (e.g. [Fel72] [DDS79]), controlling the overlap amongst successive queries (e.g. =-=[DJL79]-=-), keeping audit trail of all answered queries and constantly checking for possible compromise (e.g. [CO82]), suppression of data cells of small size (e.g. [Cox80]), and clustering entities into mutua...

Citation Context

...turally extending to analytic tools applied to data. Data mining, with its promise to efficiently discover valuable, non-obvious information from large databases, is particularly vulnerable to misuse =-=[CM96]-=- [The98] [Off98] [ECB99]. A fruitful direction for future research in data mining will be the development of techniques that incorporate privacy concerns [Agr99]. Specifically, we address the followin...

Citation Context

...unauthorized access to the system. Other relevant work includes efforts to create tools and standards that provide platform for implementing a system such as ours (e.g. [Wor] [Ben99] [GWB97] [Cra99b] =-=[AC99]-=- [LM99] [LEW99]). Paper Organization We discuss privacy-preserving methods in Section 2. We also introduce a quantitative measure to evaluate the amount of privacy offered by a method and evaluate the...

Citation Context

...tion (e.g. [LST83] [LCL85] [Rei84]), adding noise to the values in the database (e.g. [TYW84] [War65]), adding noise to the results of a query (e.g. [Bec80]), and sampling the result of a query (e.g. =-=[Den80]-=-). There are negative results showing that the proposed techniques cannot satisfy the conflicting objectives of providing high quality statistics and at the same time prevent exact or partial disclosu...

Citation Context

...ys in [AW89] [Sho82].) The proposed techniques can be broadly classified into query restriction and data perturbation. The query restriction family includes restricting the size of query result (e.g. =-=[Fel72]-=- [DDS79]), controlling the overlap amongst successive queries (e.g. [DJL79]), keeping audit trail of all answered queries and constantly checking for possible compromise (e.g. [CO82]), suppression of ...

Citation Context

... effective in preventing unauthorized access to the system. Other relevant work includes efforts to create tools and standards that provide platform for implementing a system such as ours (e.g. [Wor] =-=[Ben99]-=- [GWB97] [Cra99b] [AC99] [LM99] [LEW99]). Paper Organization We discuss privacy-preserving methods in Section 2. We also introduce a quantitative measure to evaluate the amount of privacy offered by a...

Citation Context

... be able to provide statistical information (sum, count, average, maximum, minimum, pth percentile, etc.) without compromising sensitive information about individuals (see excellent surveys in [AW89] =-=[Sho82]-=-.) The proposed techniques can be broadly classified into query restriction and data perturbation. The query restriction family includes restricting the size of query result (e.g. [Fel72] [DDS79]), co...

Citation Context

...atomic populations (e.g. [YC77]). The perturbation family includes swapping values between records (e.g. [Den82]), replacing the original database by a sample from the same distribution (e.g. [LST83] =-=[LCL85]-=- [Rei84]), adding noise to the values in the database (e.g. [TYW84] [War65]), adding noise to the results of a query (e.g. [Bec80]), and sampling the result of a query (e.g. [Den80]). There are negati...

Citation Context

...swapping values between records (e.g. [Den82]), replacing the original database by a sample from the same distribution (e.g. [LST83] [LCL85] [Rei84]), adding noise to the values in the database (e.g. =-=[TYW84]-=- [War65]), adding noise to the results of a query (e.g. [Bec80]), and sampling the result of a query (e.g. [Den80]). There are negative results showing that the proposed techniques cannot satisfy the ...

Citation Context

...W89] [Sho82].) The proposed techniques can be broadly classified into query restriction and data perturbation. The query restriction family includes restricting the size of query result (e.g. [Fel72] =-=[DDS79]-=-), controlling the overlap amongst successive queries (e.g. [DJL79]), keeping audit trail of all answered queries and constantly checking for possible compromise (e.g. [CO82]), suppression of data cel...

Citation Context

...opulations (e.g. [YC77]). The perturbation family includes swapping values between records (e.g. [Den82]), replacing the original database by a sample from the same distribution (e.g. [LST83] [LCL85] =-=[Rei84]-=-), adding noise to the values in the database (e.g. [TYW84] [War65]), adding noise to the results of a query (e.g. [Bec80]), and sampling the result of a query (e.g. [Den80]). There are negative resul...

Citation Context

...riable has a uniform distribution, between [\Gammaff; + ff]. The mean of the random variable is 0. ffl Gaussian: The random variable has a normal distribution, with means= 0 and standard deviation oe =-=[Fis63]-=-. We fix the perturbation of an entity. Thus, it is not possible for snoopers to improve the estimates of the value of a field in a record by repeating queries [AW89]. 2.1 Quantifying Privacy For quan...

Citation Context

...ccess to the system. Other relevant work includes efforts to create tools and standards that provide platform for implementing a system such as ours (e.g. [Wor] [Ben99] [GWB97] [Cra99b] [AC99] [LM99] =-=[LEW99]-=-). Paper Organization We discuss privacy-preserving methods in Section 2. We also introduce a quantitative measure to evaluate the amount of privacy offered by a method and evaluate the proposed metho...

Citation Context

...d not have to cope with information that has been intentionally distorted. Closely related, but orthogonal to our work, is the extensive literature on access control and security (e.g. [Din78] [ST90] =-=[Opp97]-=- [RG98]). Whenever sensitive information is exchanged, it must be transmitted over a secure channel and stored securely. For the purposes of this paper, we assume that appropriate access controls and ...

Citation Context

...riginal database by a sample from the same distribution (e.g. [LST83] [LCL85] [Rei84]), adding noise to the values in the database (e.g. [TYW84] [War65]), adding noise to the results of a query (e.g. =-=[Bec80]-=-), and sampling the result of a query (e.g. [Den80]). There are negative results showing that the proposed techniques cannot satisfy the conflicting objectives of providing high quality statistics and...

Citation Context

...and requires knowledge of values in other records. The problem of reconstructing original distribution from a given distribution can be viewed in the general framework of inverse problems [EHN96]. In =-=[FJS97]-=-, it was shown that for smooth enough distributions (e.g. slowly varying time signals), it is possible to to fully recover original distribution from non-overlapping, contiguous partial sums. Such par...

Citation Context

...orks did not have to cope with information that has been intentionally distorted. Closely related, but orthogonal to our work, is the extensive literature on access control and security (e.g. [Din78] =-=[ST90]-=- [Opp97] [RG98]). Whenever sensitive information is exchanged, it must be transmitted over a secure channel and stored securely. For the purposes of this paper, we assume that appropriate access contr...

Citation Context

...alytic tools applied to data. Data mining, with its promise to efficiently discover valuable, non-obvious information from large databases, is particularly vulnerable to misuse [CM96] [The98] [Off98] =-=[ECB99]-=-. A fruitful direction for future research in data mining will be the development of techniques that incorporate privacy concerns [Agr99]. Specifically, we address the following question. Since the pr...

Citation Context

...globally [Tim97] [Eco99] [eu998] [Off98]. Privacy issues are further exacerbated now that the World Wide Web makes it easy for the new data to be automatically collected and added to databases [HE98] =-=[Wes98a]-=- [Wes98b] [Wes99] [CRA99a] [Cra99b]. The concerns over massive collection of data are naturally extending to analytic tools applied to data. Data mining, with its promise to efficiently discover valua...

Citation Context

...clusive atomic populations (e.g. [YC77]). The perturbation family includes swapping values between records (e.g. [Den82]), replacing the original database by a sample from the same distribution (e.g. =-=[LST83]-=- [LCL85] [Rei84]), adding noise to the values in the database (e.g. [TYW84] [War65]), adding noise to the results of a query (e.g. [Bec80]), and sampling the result of a query (e.g. [Den80]). There ar...

Citation Context

...Eco99] [eu998] [Off98]. Privacy issues are further exacerbated now that the World Wide Web makes it easy for the new data to be automatically collected and added to databases [HE98] [Wes98a] [Wes98b] =-=[Wes99]-=- [CRA99a] [Cra99b]. The concerns over massive collection of data are naturally extending to analytic tools applied to data. Data mining, with its promise to efficiently discover valuable, non-obvious ...

Citation Context

... ultra large databases that record unprecedented amount of transactional information. In tandem with this dramatic increase in digital data, concerns about informational privacy have emerged globally =-=[Tim97]-=- [Eco99] [eu998] [Off98]. Privacy issues are further exacerbated now that the World Wide Web makes it easy for the new data to be automatically collected and added to databases [HE98] [Wes98a] [Wes98b...

Citation Context

...ccuracy the original distributions of the values of the confidential attributes. We adopt from the statistics literature two methods that a person may use in our system to modify the value of a field =-=[CS76]-=-: ffl Value-Class Membership. Partition the values into a set of disjoint, mutually-exhaustive classes and return the class into which the true value x i falls. ffl Value Distortion. Return a value x ...

Citation Context

...ery result (e.g. [Fel72] [DDS79]), controlling the overlap amongst successive queries (e.g. [DJL79]), keeping audit trail of all answered queries and constantly checking for possible compromise (e.g. =-=[CO82]-=-), suppression of data cells of small size (e.g. [Cox80]), and clustering entities into mutually exclusive atomic populations (e.g. [YC77]). The perturbation family includes swapping values between re...

Citation Context

...[Tim97] [Eco99] [eu998] [Off98]. Privacy issues are further exacerbated now that the World Wide Web makes it easy for the new data to be automatically collected and added to databases [HE98] [Wes98a] =-=[Wes98b]-=- [Wes99] [CRA99a] [Cra99b]. The concerns over massive collection of data are naturally extending to analytic tools applied to data. Data mining, with its promise to efficiently discover valuable, non-...

Citation Context

...queries and constantly checking for possible compromise (e.g. [CO82]), suppression of data cells of small size (e.g. [Cox80]), and clustering entities into mutually exclusive atomic populations (e.g. =-=[YC77]-=-). The perturbation family includes swapping values between records (e.g. [Den82]), replacing the original database by a sample from the same distribution (e.g. [LST83] [LCL85] [Rei84]), adding noise ...

Citation Context

...merged globally [Tim97] [Eco99] [eu998] [Off98]. Privacy issues are further exacerbated now that the World Wide Web makes it easy for the new data to be automatically collected and added to databases =-=[HE98]-=- [Wes98a] [Wes98b] [Wes99] [CRA99a] [Cra99b]. The concerns over massive collection of data are naturally extending to analytic tools applied to data. Data mining, with its promise to efficiently disco...

Citation Context

...s, is particularly vulnerable to misuse [CM96] [The98] [Off98] [ECB99]. A fruitful direction for future research in data mining will be the development of techniques that incorporate privacy concerns =-=[Agr99]-=-. Specifically, we address the following question. Since the primary task in data mining is the development of models about aggregated data, can we develop accurate models without access to precise in...

Citation Context

... extending to analytic tools applied to data. Data mining, with its promise to efficiently discover valuable, non-obvious information from large databases, is particularly vulnerable to misuse [CM96] =-=[The98]-=- [Off98] [ECB99]. A fruitful direction for future research in data mining will be the development of techniques that incorporate privacy concerns [Agr99]. Specifically, we address the following questi...

Citation Context

...ve to cope with information that has been intentionally distorted. Closely related, but orthogonal to our work, is the extensive literature on access control and security (e.g. [Din78] [ST90] [Opp97] =-=[RG98]-=-). Whenever sensitive information is exchanged, it must be transmitted over a secure channel and stored securely. For the purposes of this paper, we assume that appropriate access controls and securit...

Citation Context

... literature on estimating attribute distributions from partial information [BDF + 97]. In the OLAP literature, there is work on approximating queries on sub-cubes from higher-level aggregations (e.g. =-=[BS97]-=-). However, these works did not have to cope with information that has been intentionally distorted. Closely related, but orthogonal to our work, is the extensive literature on access control and secu...

Citation Context

... these works did not have to cope with information that has been intentionally distorted. Closely related, but orthogonal to our work, is the extensive literature on access control and security (e.g. =-=[Din78]-=- [ST90] [Opp97] [RG98]). Whenever sensitive information is exchanged, it must be transmitted over a secure channel and stored securely. For the purposes of this paper, we assume that appropriate acces...

Citation Context

...rized access to the system. Other relevant work includes efforts to create tools and standards that provide platform for implementing a system such as ours (e.g. [Wor] [Ben99] [GWB97] [Cra99b] [AC99] =-=[LM99]-=- [LEW99]). Paper Organization We discuss privacy-preserving methods in Section 2. We also introduce a quantitative measure to evaluate the amount of privacy offered by a method and evaluate the propos...