# A Multi-Level Privacy-Preserving Approach to Hierarchical Data Based on Fuzzy Set Theory

^{1}

^{2}

^{*}

## Abstract

**:**

## 1. Introduction

- We utilize the fuzzy set theory to obtain the sensitivity levels for sensitive numerical and categorical attribute values, and present the privacy model (${\alpha}_{lev}^{h}$, k)-anonymity for hierarchical data with multi-level sensitivity. This model can solve the similarity attack, and provide reasonable privacy protection for sensitive value in different sensitivity level.
- We improve the privacy-preserving approach in hierarchical data to obtain the anonymous data that satisfies (${\alpha}_{lev}^{h}$, k)-anonymity.
- We do experiments to compare our approach with the existing anonymous method ClusTree proposed in [16]. Experiment results demonstrate that our approach is superior to ClusTree in terms of utility and security.

## 2. Related Work

#### 2.1. Preserving Privacy for Publishing Relational Data

_{i}, k)-anonymity privacy preservation based on sensibility grading. However, the levels are artificially assigned. Some researches proposed fuzzy based methods for privacy preserving [24,25]. They used fuzzy sets to transform sensitive values to semantic values and published the data with fuzzy sensitive information, which decreases the utility of sensitive information and still does not resist similarity attacks.

#### 2.2. Preserving Privacy for Publishing Hierarchical Data

^{(m, n)}-anonymity for tree-structured data. By using generalization and structure decomposition methods, they ensured that the number of matching records not less than k when the attacker knows up to m nodes in a tree and to n structural relations between these nodes. But the method cannot resist the attack with stronger background knowledge. In addition, they used structural decomposition that destroys the structural information of the hierarchical data. Ozalp et al. [16] extended l-diversity to hierarchical data. They utilized generalization and suppression to anonymize the hierarchical data, and make the hierarchical records in an equivalence class to be indistinguishable in terms of the QIs and structure and the sensitive values for the union-compatible vertices in an equivalence class satisfies the requirements of l-diversity. This method is very scalable for the general anonymous method of hierarchical data. However, this method does not consider the different sensitivity of sensitive attribute values in anonymous hierarchical data, so the anonymous hierarchical data still does not resist similarity attack. In this paper, we use fuzzy set theory to partition rank for sensitive values of union-compatible vertices, and propose a multi-level privacy-preserving approach in hierarchical data to solve similarity attacks.

## 3. Problem Descriptions

#### 3.1. Attack Model

#### 3.2. Basic Definitions in Hierarchical Data

_{i}if c

_{i}∈ children(v), where children(v) is the children of vertex v. Such tree is denoted by T(V, E), where V and E are the sets of vertices and edges in the tree, respectively.

_{QIt}and v

_{QI}, which contains the names of QI attributes and the values of corresponding QIs, respectively; (3) each vertex v also has two m-tuples (0 ≤ m ≤ 1), v

_{SAt}and v

_{SA}, which contains the name of sensitive attribute and the value of corresponding sensitive attribute, respectively; (4) assume that |v

_{QI}| + |v

_{SA}| ≥ 1 to eliminate empty vertices. For a vertex v of a hierarchical data record, v

_{QI}is the label of v and v

_{SA}is next to v. For Figure 1, v

_{QIt}= {major program, year of birth}, v

_{Sat}= {GPA}, v

_{QI}= {Computer Science, 1990}, and v

_{SA}= {3.75}.

**Definition 1**

**(Union-Compatibility)**

**[16].**Two vertices v and v′ are union-compatible if and only if v

_{QIt}= v′

_{QIt}and v

_{SAt}= v′

_{SAt}.

**Definition 2**

**(QI-isomorphism)**

**[16].**Let T

_{1}(V

_{1}, E

_{1}) and T

_{2}(V

_{2}, E

_{2}) are two hierarchical data records. T

_{1}(V

_{1}, E

_{1}) is isomorphic to T

_{2}(V

_{2}, E

_{2}) if and only if there exists a bijection f: V

_{1}→ V

_{2}, such that:

- (1)
- For x, y ∈ V
_{1}, there exists an edge e_{i}∈ E_{2}from f(x) to f(y) if and only if there exists an edge e_{j}∈ E_{1}from x to y. - (2)
- f(r
_{1}) = r_{2}, where r_{1}∈ V_{1}and r_{2}∈ V_{2}be the roots of T_{1}(V_{1}, E_{1}) and T_{2}(V_{2}, E_{2}), respectively. - (3)
- For all pairs (x, x′), where x ∈ V
_{1}and x′ = f(x), x and x′ are union-compatible and x_{QI}= x′_{QI}.

**Definition 3**

**(Equivalence Class of Hierarchical Records)**

**[16].**Let Q = {T

_{1},T

_{2},...,T

_{k}} is a collection of k hierarchical data records. We say Q is an equivalence class, if for $\forall i,j\in \{1,\dots ,k\}$, T

_{i}and T

_{j}are QI-isomorphic.

**Definition 4**

**(Class Representative)**

**[16].**Let Q = {T

_{1},T

_{2},...,T

_{k}} be an equivalence class in hierarchical data, and f

_{i}(1 ≤ i ≤ k-1) be a bijection that maps T

_{1}′s vertices to T

_{i+1}′s vertices as in QI-isomorphism. $\widehat{T}$ is the class representative for Q if $\widehat{T}$ is QI-isomorphic to T

_{1}with a bijection function f and $\forall v\in \widehat{T}$, v

_{SA}= {f(v)

_{SA}, f

_{1}(f(v))

_{SA},..., f

_{k−1}(f(v))

_{SA}}.

_{1}, x

_{2}, ..., x

_{o}} be a multiset of values from the domain of a sensitive attribute A. X satisfies l-diversity if $\forall {x}_{i}\in X$, p(x

_{i}) ≤ 1/l, where p(x

_{i}) is the frequency of s

_{i}in X. For an equivalence class Q in hierarchical data, $\widehat{T}$ is the class representative for Q. If for $\forall v\in \widehat{T}$, v

_{SA}satisfies l-diversity, then $\widehat{T}$ satisfies l-diversity. Given a hierarchical data D, an anonymous hierarchical data D

^{*}satisfies l-diversity, if the class representative of any equivalence class in D

^{*}satisfies l-diversity. The l-diversity hierarchical data does not prevent similarity attack, since it does not consider the different sensitivity of sensitive attribute values.

#### 3.3. Privacy Model

_{A}: U → [0, 1] is called a membership function on U, where the set A, which consists of μ

_{A}(u) (u ∈ U), is a fuzzy set on U, and μ

_{A}(u) is the membership degree of u to A [30,31,32]. The trapezoidal distribution [33] is used to give the membership functions for fuzzy sets low, very low, middle, very high and high, denoted by A

_{1}, A

_{2}, A

_{3}, A

_{4}, and A

_{5}, respectively. Let U be the domain of a numerical attribute (for categorical attribute, a numerical attribute can be obtained according to the frequency of every value), and min and max be the minimum and maximum values in U, respectively. The five fuzzy sets have values in the range [min, a

_{2}], [a

_{1}, a

_{3}], [a

_{2}, a

_{4}], [a

_{3}, a

_{5}] and [a

_{4}, max], respectively, where a

_{3}= (min + max)/2, a

_{1}= min + (a

_{3}-min)/3, a

_{2}= min + 2(a

_{3}-min)/3, a

_{4}= a

_{3}+ (max-a

_{3})/3, a

_{5}= a

_{3}+ 2(max-a

_{3})/3. That is, a

_{1}, a

_{2}, a

_{3}, a

_{4}and a

_{5}uniformly divide the interval [min, max]. The membership functions for A

_{i}(i = 1, 2, ..., 5) are shown as follows.

_{Ai}(u)|i ∈ {1, 2, 3, 4, 5}} is the level which u belongs to. We transform the value level to sensitivity level. For some sensitive attributes, the higher the value level is, the larger the sensitivity level is, e.g., income; but it is reversed for other sensitive attributes, e.g., student’s cumulative GPA. For a numerical attribute, we divide the five levels from 1 to 5 for sensitivity. Level 5 is the highest and level 1 is the lowest. The higher sensitivity level is, the stronger privacy protection will be given.

_{3}= 2, a

_{1}= 2/3, a

_{2}= 4/3, a

_{4}= 8/3 and a

_{5}= 10/3. The membership degree of u

_{i}to A

_{j}are shown in Table 1, where u

_{i}∈ {0.8, 1.6, 2.3, 2.7, 3.5, 3.9} and A

_{j}∈ {low, very low, middle, very high, high}. We can know that 0.8, 1.6, 2.3, 2.7, 3.5 and 3.9 are belong to low, very low, middle, very high, high and high, respectively. Their sensitivity levels are 5, 4, 3, 2, 1 and 1, respectively.

_{1}, a

_{2}, a

_{3}, a

_{4}and a

_{5}equally divide the [min, max]. p

_{1}, p

_{2}, p

_{3}and p

_{4}are the points of intersection of membership functions ${\mu}_{{A}_{1}}$ and ${\mu}_{{A}_{2}}$, ${\mu}_{{A}_{2}}$ and ${\mu}_{{A}_{3}}$, ${\mu}_{{A}_{3}}$ and ${\mu}_{{A}_{4}}$, and ${\mu}_{{A}_{4}}$ and ${\mu}_{{A}_{5}}$, respectively. The ranges of low, very low, middle, very high and high are [min, p

_{1}], [p

_{1}, p

_{2}], [p

_{2}, p

_{3}], [p

_{3}, p

_{4}] and [p

_{4}, max], respectively.

**Definition 5**

**((${\mathit{\alpha}}_{\mathit{l}\mathit{e}\mathit{v}}^{\mathit{h}}$, k)-anonymity in Hierarchical Data).**

_{SA}which belong to the sensitivity level i is less than or equal to ${\alpha}_{lev}^{h}[i]$, where ${\alpha}_{lev}^{h}=\{0.8,0.6,0.4,0.2,0.1\}$.

## 4. The Anonymization Method

_{1}and T

_{2}. Without loss of generality, we assume that T

_{1}has fewer subtrees than T

_{2}. The output is the information loss of anonymizing the two records.

_{1}and T

_{2}, stored in variables a and b, respectively, whether satisfy the anonymous constraint check_cons(a, b), shown as follows:

_{SA}, which lie in sensitivity level i, is less than or equal to k*${\alpha}_{lev}^{h}[i]$. If check_cons(a, b) is 0, tree(a) and tree(b) are suppressed, where tree(a

_{i}) (a

_{i}∈ {a, b}) denotes the subtree rooted a

_{i}; otherwise, the values in QI of a and b are generalized. Let subtrees(a) and subtrees(b) represent the set of subtrees under a and b, respectively. There are three cases: (1) subtrees(a) = ∅ and subtrees(b) = ∅, which indicates that a and b are leaves of hierarchical records, i.e., no vertex need to be processed, and algorithm returns the total cost in tree(a) and tree(b); (2) subtrees(a) = ∅ and subtrees(b) ≠ ∅, and we suppress all vertices under b to keep the structural consistency, and return the total cost; (3) subtrees(a) ≠ ∅ and subtrees(b) ≠ ∅, the subtrees under a and b need to be further processed. To minimize the information loss caused by anonymization, the subtrees under the a and b need to be optimally matched. Let subtrees(a) = {U

_{1}, U

_{2}, ..., U

_{m}} and subtrees(b) = {V

_{1}, V

_{2}, ..., V

_{n}} For every subtrees U

_{i}of a, we find the subtrees V

_{j}of b with minimum MLevAnonytree(U

_{i}, V

_{j}), as shown in lines 12–23. For every pair (i, j) in pairs, we call MLevAnonytree(U

_{i}, V

_{j}) to generalize them. In lines 26 and 27, we suppress the unpaired subtrees of b if they exist.

Algorithm 1. MLevAnonytree(T_{1}, T_{2}) |

Input: Two hierarchical data records T_{1} and T_{2}Output: Anonymous information loss1 a ← root(T _{1}); b ← root(T_{2});2 if check_condition(a, b) then3 suppress tree(a) and tree(b); 4 return cost(tree(a)) + cost(tree(b));5 for i = 1 to |a_{QI}| do6 replace a _{QI}[i] and b_{QI}[i] with their generalized value;7 if subtrees(a) = ∅ and subtrees(b) = ∅ then8 return cost(tree(a)) + cost(tree(b));9 if subtrees(a) = ∅ and subtrees(b) ≠ ∅ then10 suppress all vertices under b; 11 return cost(tree(a)) + cost(tree(b));12 pairs ← ∅; 13 for i = 1 to m do14 min_cost ← ∞; 15 paired_index ← ∅; 16 for j = 1 to n do17 if j ∈ pairs then18 continue;19 x ← U _{i}; y ← V_{j};20 loss ← MLevAnonytree(x, y); 21 if loss < min_cost then22 min_cost ← loss; paired_index ← j; 23 pairs.append(i, paired_index); 24 for (i, j) ∈ pairs do25 MLevAnonytree (U _{i}, V_{j});26 if there are unpaired subtrees in b thensuppress them; 27 return cost(tree(a)) + cost(tree(b)); |

_{i}in H, we compute the information loss by adding T

_{i}to Q, and then sort H in ascending order according to the information loss. We select other k-1 records from the first 50 records to decrease the runtime of algorithm. In lines 17 and 18, when the number of records in H is less than k, the algorithm suppresses the all records in H.

Algorithm 2. MLevCluTree(H, ${\alpha}_{lev}^{h}$, k) |

Input: A hierarchical data H = {T_{1}, T_{2}, ..., T_{n}}, and privacy parameters ${\alpha}_{lev}^{h}$, k;Output: anonymous dataset H′ which satisfies (${\alpha}_{lev}^{h}$, k)-anonymity1 H′ ← ∅; 2 while H ≥ k do3 pick randomly a record x from H; H ← H-x; 4 initialize Q with x and C _{rep} ← x;5 Q_cost ← ∅; 6 for i = 1 to |H| do7 loss ← MLevAnonytree(copy(x), copy(T _{i}));8 Q_cost.append(loss); 9 use Q_cost to sort H in ascending order; 10 cand_set ← H[1:50]; 11 for j = 2 to k do12 y′ ← argmin _{y}_{ ∈ cand_set}(MLevAnonytree(copy(C_{rep}), copy(y)));13 H ← H- y′; cand_set ← cand_set- y′; Q ← Q ∪ y′; 14 update C _{rep};15 H′←H′∪Q; 16 if H ≠ ∅ then17 suppress all records in H; 18 return H′; |

## 5. Experimental Results

#### 5.1. Evaluation Metrics

_{QI}| is the number of QI attributes in ω, and LM′(q) = (|u

_{q}| − 1)/(|u| − 1) is the information loss of generalizing q to u

_{q}. The larger information loss is, the lower utility is. LM cost is an important index to evaluate the utility of the anonymous method.

_{rep}. v is a vertex in C

_{rep}, m is the number of sensitive values in v, and z is the number of sensitivity levels. The dissimilarity degree of v is defined as:

_{ij}is the distance between the sensitivity levels of the ith and jth sensitive values, and z

_{ij}is the distance between the ith and jth sensitivity levels. The dissimilarity degree of Q is

_{rep}. The larger Degree(Q) is, the larger the difference between the sensitive values is, the stronger the ability to resist attacks is and the higher the security is.

#### 5.2. Experimental Analysis

## 6. Conclusions

## Author Contributions

## Funding

## Conflicts of Interest

## References

- Zavadskas, E.K.; Mardani, A.; Turskis, Z.; Jusoh, A.; Nor, K. Development of TOPSIS method to solve complicated decision-making problems—An overview on developments from 2000 to 2015. Int. J. Inf. Technol. Decis. Mak.
**2016**, 15, 645–682. [Google Scholar] [CrossRef] - Zavadskas, E.K.; Turskis, Z.; Kildienė, S. State of art surveys of overviews on MCDM/MADM methods. Technol. Econ. Dev. Econ.
**2014**, 20, 165–179. [Google Scholar] [CrossRef] - Li, Z.; Sun, D.; Zeng, H. Intuitionistic Fuzzy Multiple Attribute Decision-Making Model Based on Weighted Induced Distance Measure and Its Application to Investment Selection. Symmetry
**2018**, 10, 261. [Google Scholar] [CrossRef] - Li, D.; He, J.; Cheng, P.; Wang, J.; Zhang, H. A Novel Selection Model of Surgical Treatments for Early Gastric Cancer Patients Based on Heterogeneous Multicriteria Group Decision-Making. Symmetry
**2018**, 10, 223. [Google Scholar] [CrossRef] - Ma, X.; Zhan, J.; Ali, M.I.; Mehmood, N. A survey of decision making methods based on two classes of hybrid soft set models. Artif. Intell. Rev.
**2018**, 49, 511–529. [Google Scholar] [CrossRef] - Zhan, J.; Xu, W. Two types of coverings based multigranulation rough fuzzy sets and applications to decision making. Artif. Intell. Rev.
**2018**. [Google Scholar] [CrossRef] - Zhan, J.; Liu, Q.; Herawan, T. A novel soft rough set: Soft rough hemirings and its multicriteria group decision making. Appl. Soft Comput.
**2017**, 54, 393–402. [Google Scholar] [CrossRef] - Hu, C.K.; Liu, F.B.; Hu, C.F. A Hybrid Fuzzy DEA/AHP Methodology for Ranking Units in a Fuzzy Environment. Symmetry
**2017**, 9, 273. [Google Scholar] [CrossRef] - Kang, J.; Han, J.; Park, J.H. Design of IP Camera Access Control Protocol by Utilizing Hierarchical Group Key. Symmetry
**2015**, 7, 1567–1586. [Google Scholar] [CrossRef] [Green Version] - Lee, G. Hierarchical Clustering Using One-Class Support Vector Machines. Symmetry
**2015**, 7, 1164–1175. [Google Scholar] [CrossRef] [Green Version] - Samarati, P.; Sweeney, L. Generalizing data to provide anonymity when disclosing information. In Proceedings of the ACM Symposium on Principles of Database Systems, Seattle, WA, USA, 1–3 June 1998; p. 188. [Google Scholar]
- Fung, B.C.M.; Wang, K.; Chen, R.; Yu, P.S. Privacy-preserving data publishing: A survey of recent development. ACM Comput. Surv.
**2010**, 42, 14. [Google Scholar] [CrossRef] - Machanavajjhala, A.; Kifer, D.; Gehrke, J.; Venkitasubramaniam, M. l-diversity: Privacy beyond k-anonymity. ACM Trans. Knowl. Discov Data
**2007**, 1, 3. [Google Scholar] [CrossRef] - Wong, C.R.; Li, J.; Fu, A.; Wang, K. (α, k)-anonymity: An enhanced k-anonymity model for privacy preserving data publishing. In Proceedings of the 12th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, Philadelphia, PA, USA, 20–23 August 2006; pp. 754–759. [Google Scholar]
- Li, N.; Li, T.; Venkatasubramanian, S. t-closeness: Privacy beyond k-anonymity and l-diversity. In Proceedings of the IEEE 23rd International Conference on Data Engineering, Istanbul, Turkey, 15–20 April 2007; pp. 106–115. [Google Scholar]
- Ozalp, I.; Gursoy, M.E.; Nergiz, M.E.; Saygin, Y. Privacy-preserving publishing of hierarchical data. ACM Trans. Priv. Secur.
**2016**, 19, 7. [Google Scholar] [CrossRef] - Lefevre, K.; Dewitt, D.J.; Ramakrishnan, R. Incognito: Efficient full-domain k-anonymity. In Proceedings of the 2005 ACM SIGMOD International Conference on Management of Data, Baltimore, MD, USA, 14–16 June 2005; pp. 49–60. [Google Scholar]
- Fung, B.C.M.; Wang, K.; Yu, P.S. Top-down specialization for information and privacy preservation. In Proceedings of the 21st International Conference on Data Engineering, Tokoyo, Japan, 5–8 April 2005; pp. 205–216. [Google Scholar]
- Aggarwal, G.; Feder, T.; Kenthapadi, K.; Khuller, S.; Panigrahy, R.; Thomas, D.; Zhu, A. Achieving anonymity via clustering. ACM Trans. Algorithms
**2010**, 6, 49. [Google Scholar] [CrossRef] - Ghinita, G.; Karras, P.; Kalnis, P.; Mamoulis, N. A framework for efficient data anonymization under privacy and accuracy constraints. ACM Trans. Database Syst.
**2009**, 32, 9. [Google Scholar] [CrossRef] - Wang, J.; Du, K.; Luo, X.; Li, X. Two privacy-preserving approaches for data publishing with identity reservation. Knowl. Inf. Syst.
**2018**. [Google Scholar] [CrossRef] - Han, J.; Yu, J.; Yu, H.; Jia, J. A multi-level l-diversity model for numerical sensitive attributes. J. Comput. Res. Dev.
**2011**, 48, 147–158. [Google Scholar] - Jin, H.; Zhang, Z.; Liu, S.; Ju, S. (α
_{i}, k)-anonymity Privacy Preservation Based on Sensitivity Grading. Comput. Eng.**2011**, 37, 12–17. [Google Scholar] - Wang, Q.; Yang, C.; Liu, H. Fuzzy based methods for privacy preserving. Appl. Res. Comput.
**2013**, 30, 518–520. [Google Scholar] - Kumari, V.V.; Rao, S.S.; Raju, K.; Ramana, K.V.; Avadhani, B.V.S. Fuzzy based approach for privacy preserving publication of data. Int. J. Comput. Sci. Netw. Secur.
**2008**, 8, 115–121. [Google Scholar] - Yang, X.; Li, C. Secure XML publishing without information leakage in the presence of data inference. In Proceedings of the Thirtieth International Conference on Very Large Data Bases, Toronto, ON, Canada, 31 August–3 September 2004; pp. 96–107. [Google Scholar]
- Landberg, A.H.; Nguyen, K.; Pardede, E.; Rahayu, J.W. δ-dependency for privacy-preserving XML data publishing. J. Biomed. Inform.
**2014**, 50, 77–94. [Google Scholar] [CrossRef] [PubMed] - Nergiz, M.E.; Clifton, C.; Nergiz, A.E. Multirelational k-anonymity. IEEE Trans. Knowl. Data Eng.
**2009**, 21, 1104–1117. [Google Scholar] [CrossRef] - Gkountouna, O.; Terrovitis, M. Anonymizing collections of tree-structured data. IEEE Trans. Knowl. Data Eng.
**2015**, 27, 2034–2048. [Google Scholar] [CrossRef] - Zadeh, L.A. Fuzzy sets. Inf. Control
**1965**, 8, 338–353. [Google Scholar] [CrossRef] [Green Version] - Jorba, L.; Adillon, R. Interval Fuzzy Segments. Symmetry
**2018**, 10, 309. [Google Scholar] [CrossRef] - Bi, L.; Dai, S.; Hu, B. Complex Fuzzy Geometric Aggregation Operators. Symmetry
**2018**, 10, 251. [Google Scholar] [CrossRef] - Klir, G.J.; Clair, U.S.; Yuan, B. Fuzzy Set Theory: Foundations and Applications; Prentice-Hall, Inc.: Upper Saddle River, NJ, USA, 1997. [Google Scholar]

**Figure 4.**An anonymous example: (

**a**) Two raw hierarchical data records; (

**b**) The anonymous results; (

**c**) Class representative of results.

**Figure 6.**Dissimilarity degree of equivalence class on two datasets: (

**a**) Dataset A with h = 2; (

**b**) Dataset B with h = 3.

**Figure 7.**Execution time on two synthetic datasets: (

**a**) Dataset A with h = 2; (

**b**) Dataset B with h = 3.

GPA | 0.8 | 1.6 | 2.3 | 2.7 | 3.5 | 3.9 | |
---|---|---|---|---|---|---|---|

Value Level | |||||||

Low | 0.40 | 0 | 0 | 0 | 0 | 0 | |

Very low | 0.20 | 0.60 | 0 | 0 | 0 | 0 | |

Middle | 0 | 0.40 | 0.55 | 0 | 0 | 0 | |

Very high | 0 | 0 | 0.45 | 0.95 | 0 | 0 | |

High | 0 | 0 | 0 | 0.025 | 0.625 | 0.925 |

Value Level | GPA | Letter Grade | Evaluation Score | Sensitivity Level | ${\mathit{\alpha}}_{\mathit{l}\mathit{e}\mathit{v}}^{\mathit{h}}$ |
---|---|---|---|---|---|

Low | [0, 0.89) | E | [0, 0.25) | 5 | 0.1 |

Very low | [0.89, 1.67) | D−, D, D+ | [0.25, 0.42) | 4 | 0.2 |

Middle | [1.67, 2.33) | C−, C, C+ | [0.42, 0.58) | 3 | 0.4 |

Very high | [2.33, 3.11) | B−, B, B+ | [0.58, 0.78) | 2 | 0.6 |

High | [3.11, 4] | A−, A, A+ | [0.78, 1] | 1 | 0.8 |

© 2018 by the authors. Licensee MDPI, Basel, Switzerland. This article is an open access article distributed under the terms and conditions of the Creative Commons Attribution (CC BY) license (http://creativecommons.org/licenses/by/4.0/).

## Share and Cite

**MDPI and ACS Style**

Wang, J.; Cai, G.; Liu, C.; Wu, J.; Li, X.
A Multi-Level Privacy-Preserving Approach to Hierarchical Data Based on Fuzzy Set Theory. *Symmetry* **2018**, *10*, 333.
https://doi.org/10.3390/sym10080333

**AMA Style**

Wang J, Cai G, Liu C, Wu J, Li X.
A Multi-Level Privacy-Preserving Approach to Hierarchical Data Based on Fuzzy Set Theory. *Symmetry*. 2018; 10(8):333.
https://doi.org/10.3390/sym10080333

**Chicago/Turabian Style**

Wang, Jinyan, Guoqing Cai, Chen Liu, Jingli Wu, and Xianxian Li.
2018. "A Multi-Level Privacy-Preserving Approach to Hierarchical Data Based on Fuzzy Set Theory" *Symmetry* 10, no. 8: 333.
https://doi.org/10.3390/sym10080333