A Utility-aware Anonymization Model for Multiple Sensitive Attributes Based on Association Concealment

Relational data usually contain multiple Sensitive Attributes (<italic>SAs</italic>) and Quasi-Identifiers (<italic>QIs</italic>). Privacy leakage may occur if they are published directly. Therefore, many privacy models have been proposed. However, one of the most challenging issues is the association between attributes, which can cause both identity disclosure and attribute disclosure. Furthermore, these models always prioritize privacy over utility, so a rigorous (but often unnecessary) setting of privacy parameters could cause poor utility or even useless data. In this paper we propose a scheme called MSAAC that addresses both issues. To balance data privacy and utility, MSAAC adopts a utility-aware (<inline-formula><tex-math notation="LaTeX">$\alpha ,\beta$</tex-math></inline-formula>) privacy model. To guide data publishers to set <inline-formula><tex-math notation="LaTeX">$\alpha$</tex-math></inline-formula> and <inline-formula><tex-math notation="LaTeX">$\beta$</tex-math></inline-formula> reasonably, MSAAC has built-in measures on privacy gain and utility loss, and quantitatively trades privacy for utility and vice versa. Our second contribution is quantifying the association of <italic>SA-SA</italic> using lift degree and the association of <italic>QI-SA</italic> using a chi-square value. Based on them, MSAAC applies suppression and permutation techniques to properly anonymize them. Through both theoretical and experimental results, we show MSAAC can achieve better privacy while retaining higher utility than state-of-the-art solutions.