A study of event frequency profiling with differential privacy
A study of event frequency profiling with differential privacy
复制标题
DOI：
10.1145/3377555.3377887
复制
发表时间：
2020-02
期刊：
影响因子：
--
通讯作者：
Hailong Zhang;Yu Hao;S. Latif;Raef Bassily;A. Rountev
中科院分区：
文献类型：
--
作者：
Hailong Zhang;Yu Hao;S. Latif;Raef Bassily;A. Rountev
程序概要分析被广泛用于度量运行时执行属性——例如，方法和语句执行的频率。这种分析可以应用于已部署的软件，以获得关于被分析软件的许多实例的行为的性能洞察。然而，这样的数据收集引起了隐私问题：例如，它揭示了软件用户是否（以及多久）访问某个特定的软件功能。人们对为许多类别的数据分析增加隐私保护的兴趣越来越大，但是这些技术还没有被充分研究用于程序事件分析。我们提出了一种用于部署软件的隐私保护事件频率分析的设计。目标软件的每个实例都收集自己的事件频率概况，然后将其随机化。由此产生的噪声数据具有良好定义的隐私属性，通过强大的差分隐私机制来表征。在从许多软件实例中收集这些数据之后，分析基础设施在调整随机化影响的同时计算出人口范围内频率的估计值。该方法采用静态分析来确定必须在所有有效的运行时概要文件中保持的约束，并使用二次规划来减少这些约束下估计的误差。我们的实验研究了随机化的不同选择及其对频率估计精度的影响。我们的结论是，对于事件频率分析这一基本问题，设计良好的解决方案既可以实现高精度，又可以实现有原则的隐私设计。
Program profiling is widely used to measure run-time execution properties---for example, the frequency of method and statement execution. Such profiling could be applied to deployed software to gain performance insights about the behavior of many instances of the analyzed software. However, such data gathering raises privacy concerns: for example, it reveals whether (and how often) a software user accesses a particular software functionality. There is growing interest in adding privacy protections for many categories of data analyses, but such techniques have not been studied sufficiently for program event profiling. We propose the design of privacy-preserving event frequency profiling for deployed software. Each instance of the targeted software gathers its own event frequency profile and then randomizes it. The resulting noisy data has well-defined privacy properties, characterized via the powerful machinery of differential privacy. After gathering this data from many software instances, the profiling infrastructure computes estimates of population-wide frequencies while adjusting for the effects of the randomization. The approach employs static analysis to determine constraints that must hold in all valid run-time profiles, and uses quadratic programming to reduce the error of the estimates under these constraints. Our experiments study different choices for randomization and the resulting effects on the accuracy of frequency estimates. Our conclusion is that well-designed solutions can achieve both high accuracy and principled privacy-by-design for the fundamental problem of event frequency profiling.