Method for anonymizing network data using differential privacy
The invention described herein is directed to methods and systems for protecting network trace data. Network traces are used for network management, packet classification, traffic engineering, tracking user behavior, identifying user behavior, analyzing network hierarchy, maintaining network security, and classifying packet flows. In some embodiments, network trace data is protected by subjecting network trace data to data anonymization using an anonymization algorithm that simultaneously provides sufficient privacy to accommodate the organization need of the network trace data owner, provides acceptable data utility to accommodate management and/or network investigative needs, and provides efficient data analysis, at the same time.
1. A computer-implemented method, comprising:
using differential privacy to anonymize network traces comprising the following steps:
(i) implementing a prefix-preserving technique to anonymize IP addresses of network traffic data, said prefix-preserving technique comprising permuting n leading digits as a network part, and for remaining digits clustering addresses into K clusters as a host part; and randomizing addresses within each of said K clusters;
(ii) implementing a per class differential privacy mechanism comprising conditional privacy measuring privacy of anonymized traffic data, wherein said measuring depends on mutual information between raw and anonymized records at a certain confidence level, wherein information loss is related to a mismatch amount among records before and after, wherein conditional privacy is based on differential entropy of a random variable, wherein the differential entropy of A given B=b is
h ( A|B )=∫ Ω A,B f A,B ( a,b )log 2 f A|B=b ( a ) da db (1)
where A is a random variable that describes the data, and B is a variable that gives information on A, wherein Q _(A,B) identifies a domain of A and B, wherein average conditional privacy of A given B is
Π( A|B )=2 h(A|B) (2)
wherein if D_i is an attribute value of the original data and D_i{circumflex over ( )}′ is the value after anonymization, then conditional privacy for anonymizing the attribute is
2 h(D i |D i ′) where h ( D i |D i ′)
is the conditional entropy of the original data given the anonymized data, and conditional privacy is calculated and averaged over all attributes;
(iii) utilizing differential privacy in a condensation method comprising clustering records based on features of network trace data, partitioning said network trace data into three clusters, wherein each cluster has packets or flows with similar features, and computing mean values of these features and adding Laplace noise to the mean values to obtain perturbed mean values, and replacing said mean values with said perturbed mean values;
wherein the method does not add any burden to a data analyser, and wherein said Data analyser analyzes network traffic data without modification;
wherein the method is performed on a computing device having memory and a hardware processor, and programming instructions saved to the memory and executable on the hardware processor for performing the steps to effect the methods steps.
2. A computer-implemented system for performing the methods herein, comprising: a computing device having a memory and a hardware processor and program instructions saved to the memory and executable by the processor for running an application configured to perform the method steps of claim 1 .