Balancing Privacy and Analysis in Data Sanitization

CCR-0311671在数据清理中平衡隐私和分析Matt Bishop在处理入侵时，一个组织可能需要与其他组织共享日志和网络跟踪。然而，要共享的数据可能包含第一组织不希望透露给其他方的敏感信息。解决方案是通过从数据中删除信息来净化数据。这是为了保护组织的隐私。但是，删除的数据可能是其他组织必须执行的数据分析所必需的。本研究探讨了隐私和安全分析之间的紧张关系。本研究的目标是：（1）开发一种净化语言来描述隐私和安全分析的需求，以便可以自动检查需求的不一致性：（2）确定“完美净化”可能发生的条件，如果有的话;以及（3）检查清理动态数据集的问题，该数据集随着清理的进行而改变。这将涉及开发和测试清理语言从网络中提取的数据和包含学生成绩的文件上。前者将提供静态和动态数据的示例。本文将通过将净化过程转化为功能并分析其范围和域来研究完美的净化，这项工作的意义在于隐私和安全的平衡，以前的工作主要集中在以特定的方式净化数据，而不是分析隐私和安全之间的平衡，以及当隐私和安全分析的需求发生冲突时，允许净化器在特定的需求中进行选择。它的影响是，如果成功，结果可以用于各种领域，其中隐私和分析（不仅仅是安全分析）必须平衡。

CCR-0311671Balancing Privacy and Analysis in Data SanitizationMatt BishopWhen handling an intrusion, one organization may need to sharelogs and network traces with other organizations. However, thedata to be shared may contain sensitive information that thefirst organization does not wish to disclose to the other parties.The solution is to sanitize the data by removing information fromthe data. This protects the privacy of the organization. However,the data removed may be essential for the analysis of the data thatthe other organizations must perform. This research explores thetension between privacy and security analysis. The goals of thisresearch are to: (1) develop a sanitizing language to describethe requirements for privacy and security analysis in such a waythat the requirements can be automatically checked for inconsistencies;(2) determine the conditions under which "perfect sanitization"can occur, if any; and (3) examine the problem of sanitizinga dynamic data set that changes as the sanitization proceeds.This will involve developing and testing the sanitizationlanguage on both data extracted from a network, and on filescontaining student grades. The former will provide examples of bothstatic and dynamic data. Perfect sanitization will be studied bytranslating the sanitization process into functions and analyzingtheir ranges and domains.The significance of this work is in the balance of privacy and security.Previous work focuses on sanitizing data in an ad hoc manner, ratherthan analyzing the balance between privacy and security and allowingthe sanitizers to choose among particular requirements when the needsof privacy and security analysis conflict. Its impact is that ifsuccessful, the results can be used in a wide variety of fields inwhich privacy and analysis (not just security analysis) mustbe balanced.