VERİ MAHREMİYETİ: SALDIRILAR, KORUNMA VE YENİ BİR ÇÖZÜM ÖNERİSİ

Year 2018, Volume: 4 Issue: 2, 21 - 34, 31.12.2018

Yılmaz Vural

https://doi.org/10.18640/ubgmd.517767

Abstract

Günlük yaşantımızın ayrılmaz parçası haline gelen elektronik
uygulamalar aracılığıyla çeşitliliği ve büyüklüğü her
geçen gün artan veriler toplanmakta ve işlenmektedir. Farklı
amaçlar için işlenen bu veriler içerisinde kişileri doğrudan
veya dolaylı olarak tanımlayan kişisel veriler de yer almaktadır.
Kişisel verilerin işlenmesi sırasında gerekli olan idari ve
teknik tebirlerin alınmaması veri ihlallerinin yaşanmasına neden
olmaktadır. Veri ihlallerinin kişilere, kurumlara ve ülkelere
verdiği zararların azaltılması amacıyla mahremiyet koruyucu
önlemlerin alınması gerekmektedir. Veri mahremiyeti, veri
sahiplerinin mahremiyeti ile veri paylaşımının taraflara
sağlayacağı fayda arasındaki en iyi dengeyi bulmaya çalışan
zor bir problemdir Bu çalışmada, literatürdeki mahremiyet
koruyucu yöntemler incelenmiş, incelenen yöntemlerin güçlü ve
zayıf yönleri araştırılmış, veri faydası metrikleri
değerlendirilmiş ve mahremiyetle ilgili saldırılar gözden
geçirilmiştir. Çalışma kapsamında elde edilen bulgular, yapılan
araştırmalar, tespitler ve değerlendirmeler sonucunda veri
faydasını gözeterek mahremiyeti sağlamaya yönelik yeni bir veri
çoğaltma yaklaşımı sunulmuştur. Önerilen veri çoğaltma
yaklaşımının, veri faydasını koruyarak mahremiyet saldırılarını
önemli oranda azaltacağı, karşılaşılan olumsuzlukları
önleyeceği ve en önemlisi kişisel verilerin korunmasına önemli
katkılar sağlayacağı değerlendirilmektedir.

Keywords

Anonimleştirme, Kişisel verilerin korunması, Mahremiyet korumalı veri paylaşımı, Mahremiyet modelleri, Mahremiyet saldırıları, Veri çoğaltma

References

• Samarati, P., “Protecting respondent’s privacy in micro data release”, IEEE Transaction on Knowledge and Data Engineering, Cilt 13, No 6, 1010-1027, 2001.
• Korolova, A., Protecting privacy while mining and sharing user data, Doktora Tezi, Stanford Üniversitesi, Bilgisayar Mühendisliği Bölümü, 2012.
• Verykios, S.V., Bertino, E., Fovino, N.I., Provenza, P.L., Saygin, Y., Theodoridis, Y., “State-of-the-art in Privacy Preserving Data Mining”, ACM SIGMOD Record, Cilt 33, Sayı 1, 50-57, 2004.
• Sweeney, L., “k-Anonymity: A model for protecting privacy,” International Journal of Uncertainty Fuzziness and Knowledge-Based Systems, Cilt 10, Sayı 5, 557–570, 2002.
• Sweeney, L., “Computational Disclosure Control for Medical Microdata: The Datafly System”, Proceedings of an International Workshop and Exposition, Washington DC, ABD, 442-453, 1997.
• İnternet: President's Information Technology Advisory Committee, “Revolutionizing health care through information technology”, http://www​. itrd.gov/pitac​/meetings/2004/20040617​/20040615_hit.pdf, 2012.
• İnternet: Barbaro, M., Zeller, T., “A Face Is Exposed for AOL Searcher No. 4417749”, http://www.nytimes.com/2006/08/09/technology/09aol.html? pagewanted=all&_r=0, 2006.
• İnternet: Üstün, G., “e-devlet Skandalı”, http://www.milliyet.com.tr/Ekonomi/ HaberDetay.aspx?aType=HaberDetay&Kategori=ekonomi&ArticleID=972537&Date=30.07.2008&b,200.
• İnternet: “Someone Hacked and Leaked Entire Turkish Citizenship Database Online”, https://www.hackread.com/turkish-citizenship-database-hacked-leaked.
• Gökçe, H., Abul, O., “Sensitive knowledge hiding application”, Electrical, Electronics and Computer Engineering (ELECO), Bursa,Türkiye, 558-562, 2010.
• Gehrke, J., “Models and Methods for Privacy-Preserving Data Analysis and Publishing ”, The 22nd International Conference on Data Engineering, Atlanta, ABD, 105-106, 2006.
• Fung, B. C. M., Wang, K., Chen, R., Yu, P. S., “Privacy-preserving data publishing: A survey of recent developments”, ACM Computing Surveys (CSUR), Cilt 42, Sayı 4, 523-553, 2010.
• Machanavajjhala, A., Gehrke, J., Kifer, D.,Venkitasubramaniam, M., “ℓ-Diversity: Privacy beyond k-anonymity,” The 22nd International Conference on Data Engineering, Atlanta, USA, 2006.
• Chaum, D.L., “Untraceable electronic mail, return addresses, and digital pseudonyms,”, Communications of the ACM, Cilt 24, Sayı 2, 84-90, 1981.
• Jakobsson, M., Juels, A., Rivest, R.L., “Making mix nets robust for electronic voting by randomized partial checking, ”, In Proceedings of the 11th USENIX Security Symposium, San Franscisco, 339-353, 5-9 Agustos 2002.
• Martin, D. J., Kifer, D., Machanavajjhala, A., Gehrke, J., Halpern, J.Y., “Worst-case background knowledge for privacy-preserving data publishing”, ICDE 2007 IEEE 23rd International Conference, İstanbul, Türkiye,126-135, 2007.
• Xiao X., Tao Y., “Anatomy: Simple and Effective Privacy Preservation”, Proc. of the 32nd International Conference on Very Large Data Bases, Seoul, Kore,139−150, 2006.
• Koudas, N., Srivastava, D., Yu, T., Zhang, Q., “Aggregate Query Answering on Anonymized Tables”, ICDE 2007 IEEE 23rd International Conference, İstanbul, Türkiye, 116-125, 2007.
• Gayatri Nayak and Swagatika Devi (2011), “A Survey On Privacy Preserving Data Mining: Approaches And Techniques”, International Journal of Engineering Science and Technology, Cilt 3, Sayı 3, 2127-2133, 2011.
• Lindell, Y., Pinkas, B., “Privacy Preserving Data Mining”, 20th Annual International Cryptology Conference, California, USA, 36-53, 2000.
• Hand, D., Mannila, H., Smyth, P., “Principles of DataMining”, MIT Press, 2001.
• Vaidya, J., Clifton, C., “Privacy-Preserving Data Mining: Why, How, and When” IEEE Security & Privacy, Cilt 2, Sayı 6, 19-27, 2004.
• Du, W., Atallah, M. J., “Secure Multi-Party Computation Problems and Their Applications: A Review and Open Problems”, In Proceedings of New Security Paradigms Workshop, New Mexico, ABD, 11-20, 2001.
• Adam, N. R., Worthmann, J. C., “Security-control methods for statistical databases: a comparative study” ACM Computing Surveys (CSUR), Cilt 21, Sayı 4, 515–556, 1989.
• T. P. Hong, K. T. Yang, C. W. Lin and S. L. Wang, “Evolutionary privacy preserving data mining”, World Automation Congress (WAC), Kobe, Japonya 1-7, 2010.
• Evfimievski, A., Srikant, R., Agrawal, R., Gehrke, J., “Privacy preserving mining of association rules”, Information Systems, Cilt 29, Sayı 2004, 343-364, 2003.
• Qi, X., Zong, M., “An Overview of Privacy Preserving Data Mining”, Procedia Environmental Sciences, Cilt 12, Sayı B-2012, 1341-1347, 2011.
• Agrawal, R., Srikant, R., “Privacy Preserving Data Mining”, ACM SIGMOD Record, Cilt 29, Sayı 2, 439-450, 2000.
• Muralidhar, K., Sarathy, R., “A Theoretical Basis for Perturbation Methods” Statistics and Computing, Cilt 13, Sayı 4, 329-335, 2003.
• Evfimievski, A., “Randomization in Privacy Preserving Data Mining” ACM SIGKDD Explorations Newsletter, Cilt 4, Sayı 2, 43-48, 2002.
• Kargupta, H., Datta, S., Wang, Q., Sivakumar, K., “On the Privacy Preserving Properties of Random Data Perturbation Techniques”, The Third IEEE International Conference on Data Mining, Florida, ABD, 99-106, 2003.
• Huang, Z., Du, W., Chen, B., “Deriving Private Information from Randomized Data” In Proceedings of the 2005 ACM SIGMOD Conference, Baltimore, ABD, 37-48 2005.
• Kim, J. J., Winkler, W. E., “Multiplicative noise for masking continuous data” Statistical Research Division U.S. Bureau of the Census, Washington D.C., ABD, 2003.
• Liu, K., Kargupta, H., Ryan, J., “Random projection-based multiplicative data perturbation for privacy preserving distributed data mining”, IEEE Transactions on Knowledge and Data Engineering (TKDE), Cilt 18, Sayı 1, 92–106, 2006.
• Ferrer-Domingo, J., Mateo-Sanz, J.M., “A Comparative Study Of Microaggregation Methods”, Qüestiió Journal, Cilt. 22, Sayı. 3, 511–526, 1998.
• Ferrer-Domingo, J., Mateo-Sanz, J.M., “Practical data-oriented microaggregation for statistical disclosure control,” IEEE Transactions on Knowledge and Data Engineering (TKDE), Cilt 14, Sayı. 1, 189–201, 2002.
• Ferrer-Domingo, J., Torra, V., “Ordinal, continuous and heterogeneous k anonymity through microaggregation,” Data Mining and Knowledge Discovery, Cilt. 11, Sayı. 2, 195–212, 2005.
• Yao, A. C., “How to generate and exchange secrets”, In Proceedings 27th IEEE Symposium on Foundations of Computer Science, Toronto, Kanada, 162–167, 1986.
• Lindell, Y., Pinkas, B., “Secure Multiparty Computation for Privacy-Preserving Data Mining” The Journal of Privacy and Confidentiality, Cilt 1, Sayı 1, 59-98, 2009.
• Sheikh, R., Mishra, D.K., Kumar, B., “Secure Multiparty Computation:From Millionaires Problem to Anonymizer” Information Security Journal: A Global Perspective, Cilt 20, Sayı 1, 25-33, 2011.
• Yao, A.C., “Protocols for secure computations ”, Proceedings of the 23rd Annual Symposium on Foundations of Computer Science, Washington, ABD, 160-164, 1982.
• Goldreich, O., Micali, S., Wigderson, A., “How to Play any Mental Game: A Completeness Theorem for Protocols with Honest Majority”, Proc. 19th ACM Symp. Theory of Computing, New York, ABD, 218–229, 1987.
• Sheikh, R., Kumar, B., Mishra, D. K., “Privacy-Preserving k-Secure Sum Protocol”, In the International Journal of Computer Science and Information Security, Cilt 6, Sayı 2 , 184-188, 2009.
• Atallah M.J., Kerschbaum, F., Du, W., “Secure and Private Sequence Comparisons,” Proceedings of the 2003 ACM workshop on Privacy in the electronic society, New York, ABD, 39-44, 2003.
• Goldwasser, S., “Multi party computations: past and present”, Proceedings of the sixteenth annual ACM symposium on Principles of distributed computing, New York, ABD, 1-6, 1997.
• Maurer, U., “Secure Multi-Party Computation made Simple”, Discrete Applied Mathematics, Cilt. 154, Sayı 2, 370-381, 2006.
• Yongcheng, L., Jiajin, L., Jian, W., “Survey of Anonymity Techniques for Privacy Preserving”, 2009 International Symposium on Computing, Communication and Control (ISCCC 2009), Singapur, 248-252, 2011.
• Xiao, X., Tao, Y., “Personalized privacy preservation”, Proceedings of the 2006 ACM SIGMOD International Conference on Management of Data, New York, ABD, 229–240, 2006.
• Li, H., Ma, J., Fu, S., “Analyzing mechanism-based attacks in privacy-preserving data publishing”, International Journal for Light and Electron Optics, Cilt 124, Sayı 24, 6939-6945, 2013.
• Samarati, P., Sweeney, L., “Protecting privacy when disclosing information:k-anonymity and its enforcement through generalization and suppression”, SRI International, Technical Report, SRI-CSL-98-04, 1998.
• Liu, K., Terzi, E., “Towards identity anonymization on graphs”, ACM SIGMOD International Conference on Management of Data (SIGMOD), New York, ABD, 93-106, 2008.
• Hay, M., Miklau, G., Jensen, D., Weis, P., Srivastava, S., “Anonymizing social networks”, Technical report, University of Massachusetts, 2007.
• Zou, L., Chen, L., Özsu, M.T., “K-automorphism: A general framework for privacy preserving network publication”, Very Large Data Base Endowment, Cilt 2, Sayı 1, 946-957, 2009.
• Zhou, B., Pei, J., “Preserving privacy in social networks against neighborhood attacks”, IEEE International Conference on Data Engineering (ICDE), Cancun, Meksika, 506-515, 2008.
• Wu, X., Ying, X., Liu, K., Chen, L., “A Survey Of Algorithms For Privacy-Preservation Of Graphs And Social Networks”, Managing and Mining Graph Data, Cilt 40, Editör: Aggarwal, C., Wang, H., Kluwer Academic Publishers, 421-453, 2010.
• Cormode, G., Srivastava, D., Yu, T., Zhang, Q., “Anonymizing bipartite graph data using safe groupings”, The VLDB Journal, Cilt 19, Sayı 1, 115-139, 2008.
• Li, N., Li, T., Venkatasubramanian, S.,“t-Closeness: Privacy beyond k-anonymity and ℓ-diversity”, In Proceedings of the International Conference on Data Engineering (ICDE), İstanbul, Türkiye, 106–115, 2007.
• Rubner, Y., Tomasi, C., Guibas, L. J., “The earth mover’s distance as a metric for image retrieval”, International Journal of Computer Vision, Cilt 40, Sayı 2, 99–121, 2000.
• Dwork, C., “Differential privacy”, Theory and Applications of Models of Computation, Cilt 4978, Editörler: Agrawal, M., Du, D. Z., Duan, Z., Li, A., Springer Berlin Heidelberg, 1–19, 2008.
• Dwork, C., “Differential Privacy: A Survey of Results”, Theory and Applications of Models of Computation, Cilt 4052, Editörler: Bugliesi, M., Preneel, B., Sassone, V., Wegener, I., Springer Berlin Heidelberg, 1–12, 2006.
• Du, W., Zhan, Z. “Using randomized response techniques for privacy-preserving data mining”, International Conference on Knowledge Discovery and Data Mining, San Francisco,, ABD, 505-510, 2003.
• Zhang, N., Wang, S., Zhao, W. “A new scheme on privacy-preserving data classification”, International Conference on Knowledge Discovery and Data Mining, Chicago, ABD, 374–382, 2005.
• Zhang, L., Zhang, W., “Generalization-based privacy-preserving data collection” International Conference on Data Warehousing and Knowledge Discovery, Las Vegas, ABD,115–124, 2008.
• Xue, M., Papadimitriou, P., Raissi, C., Kalnis, P., Pung, H.K., “Distributed Privacy Preserving Data Collection using Cryptographic Techniques”, Stanford University, Technical Report, 2009.
• Williams, A., Barker, K., “Controlling inference: avoiding p-level reduction during analysis”, Proceedings of the Fifth Australian Symposium on ACSW Frontiers, Ballarat, Avustralya ,193-200, 2007.
• Chen B., LeFevre, K., Ramakrishnan R., “Privacy skyline: Privacy withmultidimensional adversarial knowledge”, In Proceedings of the International Conference on Very Large Data Bases (VLDB), Viyana, Avusturya, 770–781, 2007.
• Xu, Y., Wang, K., Fu, A.W., Wong, R.C., “Publishing Skewed Sensitive Microdata”, Proceedings of the 2010 SIAM International Conference on Data Mining, Columbus, Ohio, ABD, 84-93, 2010.
• Wang, H., Han, J., Wang, J., Wang, L., “(l, e)-Diversity - A Privacy Preserving Model to Resist Semantic Similarity Attack”, Journal of Computers, 59-64, 2014.
• Wong, R.C, Fu, A.W, Wang, K., Pei, J., “Minimality attack in privacy preserving data publishing”, In Proceedings of the International Conference on Very Large Data Bases (VLDB), Viyana, Avusturya, 543–554, 2007.
• Kifer, D., “Attacks on privacy and deFinetti’s theorem”, In Proceedings of the 2009 ACM SIGMOD International Conference on Management of data, Rhode Island, ABD, 127–138, 2009.
• İnternet: Wikipedia, “de Finetti's theorem”, http://en.wikipedia.org/wiki/De_Finetti%27s_theorem.
• Sweeney, L., “Datafly: A system for providing anonymity in medical data”. Proceedings of the IFIP TC11 WG11.3 Eleventh International Conference on Database Securty XI: Status and Prospects, Londra, İngiltere, 356–381, 1998.
• Sweeney, L. “Achieving k-anonymity privacy protection using generalization and suppression”, International Journal of Uncertainty, Fuzziness and Knowledge-based Systems, Cilt 10, Sayı 5, 571–588, 2002.
• Wang, K., Fung, B. C. M., “Anonymizing sequential releases”, Proceedings of the 12th
• ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (SIGKDD), Philadelphia, ABD, 414–423, 2006.
• Iyengar, V. S., “Transforming data to satisfy privacy constraints”.Proceedings of the 8th ACM International Conference on Knowledge Discovery and Data Mining (SIGKDD), Edmonton, Alberta, Kanada, 279–288, 2002.
• Bayardo, R. J., Agrawal, R., “Data privacy through optimal k-anonymization”, Proceedings of IEEE 21st International Conference on Data Enginering (ICDE 2005), Tokyo, Japonya, 217–228, 2005.
• Fung, B. C. M., Wang, K., Yu, P. S., “Top-down specialization for information and privacy preservation”. Proceedings of IEEE 21st International Conference on Data Engineering (ICDE 2005), Tokyo, Japonya, 205–216, 2005.
• Fung, B. C. M., Wang, K., Yu, P. S., “Anonymizing classification data for privacy preservation”, IEEE Transactions on Knowledge and Data Engineering, Cilt 19, Sayı 5, 711–725, 2007.