θ-Sensitive k-Anonymity: An Anonymization Model for IoT based Electronic Health Records

Abstract

The Internet of Things (IoT) is an exponentially growing emerging technology, which is implemented in the digitization of Electronic Health Records (EHR). The application of IoT is used to collect the patient’s data and the data holders and then to publish these data. However, the data collected through the IoT-based devices are vulnerable to information leakage and are a potential privacy threat. Therefore, there is a need to implement privacy protection methods to prevent individual record identification in EHR. Significant research contributions exist e.g., p⁺-sensitive k-anonymity and balanced p⁺-sensitive k-anonymity for implementing privacy protection in EHR. However, these models have certain privacy vulnerabilities, which are identified in this paper with two new types of attack: the sensitive variance attack and categorical similarity attack. A mitigation solution, the $\theta$-sensitive k-anonymity privacy model, is proposed to prevent the mentioned attacks. The proposed model works effectively for all k-anonymous size groups and can prevent sensitive variance, categorical similarity, and homogeneity attacks by creating more diverse k-anonymous groups. Furthermore, we formally modeled and analyzed the base and the proposed privacy models to show the invalidation of the base and applicability of the proposed work. Experiments show that our proposed model outperforms the others in terms of privacy security (14.64%).

1. Introduction

The current highly-connected technological society generates a huge amount of digital data—termed Big Data, collected through internet-enabled devices, termed the Internet of Things (IoT) [1]. Billions of these IoT devices sense and collect the data e.g., the patient’s Electronic Health Records (EHR) [1,2,3,4]. The collected data are then shared with corporate or government bodies for research and policymaking. However, the privacy of the individual records is an important goal when sharing data that is collected through the IoT enabled devices [1,2,3,4,5,6]. This is because these data contain names or some unique identification (explicit identifiers—${\mathrm{A}}^{\mathrm{ei}}$), such as age, gender, zip code (quasi-identifiers—${\mathrm{A}}^{\mathrm{qi}}$), and some health-related private information (sensitive attributes—${\mathrm{A}}^{\mathrm{s}}$) [7,8,9,10,11,12]. To preserve privacy, eliminating the ${\mathrm{A}}^{\mathrm{ei}}$ before sharing or publishing the data is not enough [11]. For an attacker or an adversary, the quasi-identifiers (QIs) are the partial identifiers that can be used to link to some externally available data e.g., voting or census data, to identify an individual ${\mathrm{A}}^{\mathrm{s}}$, known as a linking attack [10,11,12].

To implement data privacy, a lot of cryptographic techniques [13,14] have been proposed. However, these techniques have high computational overheads. Another simple approach is data anonymization. Data anonymization is about concealing an individual’s identity in a small crowd of records before data publishing. The publishing of such anonymized records are known as Privacy Preserving Data Publishing (PPDP) [11]. A plethora of PPDP methods have been proposed [7,8,9,10,11,12,15,16,17,18,19]. These techniques are broadly classified into:

• Identity disclosure prevention: Generalizing [7,8,9] the QI values of a group of records from more specific values to less specific values e.g., k-anonymity [7,8], where every record should be indistinguishable from at least k-1 other records. An individual having probability higher than 1/k cannot be re-identified by an intruder/attacker.
• Attribute disclosure prevention: Preventing to reveal private information (${\mathrm{A}}^{\mathrm{s}}$ information) about an individual. Examples are l-diversity [15] and t-closeness [16] privacy models.

In this paper, a variance-based privacy model is proposed to prevent attribute disclosure risk. For sensitive attribute privacy, the p+-sensitive k-anonymity, (p, α)-sensitive k-anonymity [17] privacy model is a state-of-the-art privacy model where the sensitive values are categorized into four categories. For creating a k-anonymous group of records called an equivalence class (EC), a l-diversity [15] is applied. However, two new possible attacks are applied: sensitive variance attack and categorical similarity attack. These attacks breach the privacy of the p+-sensitive k-anonymity and (p, α)-sensitive k-anonymity [17] algorithm, due to the ${\mathrm{A}}^{\mathrm{s}}$ values from the single sensitive category or a low diversity at ${\mathrm{A}}^{\mathrm{s}}$ category level. The proposed mitigation solution: the $\theta$-Sensitive k-anonymity privacy model, is a numerical measure of privacy strength for thwarting the attribute disclosure risk. The proposed approach also appends small amounts of noise tuple(s) to increase the variability in an EC, if needed. To minimize the utility loss, the proposed algorithm uses a bottom-up generalization (i.e., the local recoding mechanism [18]) because it minimally distorts the data compared to global recoding techniques [12]. The following section presents the motivation of our work.

1.1. Motivation

Broadly examining the PPDP models for preventing attribute disclosure risk [11,15,16,17,18], it was concluded that the worthiness of each model exists in the diversity of an EC where the sensitive values belongs to different categories. Such variability of ${\mathrm{A}}^{\mathrm{s}}$ values creates a diverse EC. Different privacy models employ different techniques to achieve variability in k-anonymous ECs. The repeated frequencies of same sensitive values are the only obstruct in achieving the required diversity in an EC. The privacy models in [17] and [18] provide a meaningful approach in dealing with the attribute disclosure problem, however the following limitations have been observed.

• p⁺-sensitive k-anonymity and (p, α)-sensitive k-anonymity [17]: This model is a modified version of the p-sensitive k-anonymity [19], for preventing a similarity attack. However, the p⁺-sensitive k-anonymity and (p, α)-sensitive k-anonymity models have zero diversity at the ${\mathrm{A}}^{\mathrm{s}}$ category level, which may lead to a categorical similarity attack. A more powerful possible attack by an adversary is the sensitive variance attack, due to the low variability at ${\mathrm{A}}^{\mathrm{s}}$ category level. With an upsurge in the adversary’s knowledge (background knowledge—BK) the privacy level can be breached, which may cause attribute disclosures. The proposed $\theta$-sensitive k-anonymity privacy model provides a privacy solution to prevent all such attacks.
• Balanced p⁺-sensitive k-anonymity and (p, α)-sensitive k-anonymity [18]: This model is an enhanced version of p⁺-sensitive k-anonymity model. It balances the categorical level sensitive attributes in each EC. However, it still has low diversity at ${\mathrm{the} \mathrm{A}}^{\mathrm{s}}$ category level and works only for more than three k-anonymous size ECs.

To solve the problems of homogeneity, categorical similarity, and sensitive variance attacks in the p⁺-sensitive k-anonymity and (p, α)-sensitive k-anonymity model [17], we propose the $\theta$-Sensitive k-anonymity privacy model in this paper. The categorical level similarity and small EC size problems in the balanced p⁺-sensitive k-anonymity and (p, α)-sensitive k-anonymity model [18] are also addressed by achieving a more balanced and diverse EC even at the category level and its execution on small k size EC, i.e., k = 2.

1.2. Contributions

The proposed $\theta$-sensitive k-anonymity privacy model multiplies variance (${\sigma }^2$) of a fully diverse EC with an observed value (observation 1) which produces a threshold value $\theta$. The $\theta$ value ensures prevention against attribute disclosure in an EC which collectively results in the privacy of the given dataset.

The contributions of this paper are as follows:

• A new $\theta$-sensitive k-anonymity privacy model is proposed where privacy in an EC is achieved through a threshold value, i.e., $\theta$. The $\theta$ value for an EC is obtained by multiplying variance and an observation value. The variance-based diversity in an EC prevents the sensitive variance attack, which automatically prevents the categorical similarity attack. In the proposed model, the ${\mathrm{A}}^{\mathrm{s}}$ values checking is not only performed with next ECs, but a cross check is also performed during the last EC. If the required privacy is not achievable with the existing ${\mathrm{A}}^{\mathrm{s}}$ values, then a noise is added for the required diversity.
• We formally modeled and analyzed the base model in [17] and the proposed $\theta$-sensitive k-anonymity privacy model using High Level Petri-Nets (HLPN).
• Based on the above points, simulation results show that our proposed $\theta$-sensitive k-anonymity model has only 0.002679% higher privacy leakage than its counterpart p⁺-sensitive k-anonymity model which has 14.65% higher privacy leakage with the base line privacy.

Paper Organization. The remainder of the paper is organized as follows. Section 2 explains related work. Preliminaries are discussed in Section 3. The considered attacks and problem statement in p⁺-sensitive k-anonymity along with its formal analysis are presented in Section 4. Section 5 discusses the proposed $\theta$-sensitive k-anonymity model and its formal analysis. In Section 6, the experiments and evaluations are provided. Section 7 concludes the paper.

2. Related Work

In this section, the literature related to the proposed privacy model is studied from various aspects. The data collected through the various IoT enabled devices [1,2,3,4,5,6,20,21] must be anonymized before publishing because of the private information contained in it. Anonymized data are published for the sake of its maximum utility without disclosing the private information of an individual. For anonymization, the privacy models can be broadly classified into semantic [22,23] or syntactic [7,8,9,10,11,12,13,14,15,16,17,18,19] approaches. The semantic privacy models add a random amount of noise for preserving privacy, e.g., differential privacy models [22,23]. In differential privacy, the deletion or addition of an individual’s record or noise does not affect the data analysis results while preserving the privacy. Syntactic privacy models create a k-indistinguishable [7] ECs. In syntactic privacy, two main privacy disclosure risks are: identity disclosure [7,8,9,10,12] and attribute disclosure [11,15,16,17,18]. The k-anonymity [7,8] is an example of preventing identity disclosure that generalizes a set of records with respect to QIs. These k-anonymous records are indistinguishable from other k-1 records in a dataset. However, k-anonymity lacks the ability to provide attribute level protection. Attribute disclosure releases the value of confidential attributes corresponding to an identified individual record. Although in l-diversity [15], l distinct groups for the ${\mathrm{A}}^{\mathrm{s}}$ in an EC are required. However, the skewness and similarity attacks can breach the privacy because l-well sensitive attribute groups are not always possible over the existing ${\mathrm{A}}^{\mathrm{s}}$s. Similarly for t-closeness [16], the threshold for ${\mathrm{A}}^{\mathrm{s}}$ and its distance distribution in an EC has low data utility, and the earth mover distance (EMD) is not an efficient prevention for attribute linkage [24,25].

In [26] by Torra, identity and attribute disclosure were both addressed. Jose et al. [27] proposed an adaptive two-step iterative anonymization approach. A privacy leakage for an attribute linkage attack was possible because of having numerous versions. An extended k-anonymity model was proposed by Rahimi et al. [28] to protect identity and attribute information. However, a BK attack is possible because the publisher is unaware of the adversary’s knowledge. The k-join-anonymity model proposed by Sowmiyaa et al. [29] was the same as k-anonymity, which focuses only on identity disclosure risk. The (α, k)-anonymity model proposed by Wong et al. [30], used a global recoding technique, which has a high utility loss and, due to table linkage attack, it was susceptible to the disclosure of attributes.

The (k, e)-anonymization model proposed by Zhang et al. [31] publishes separate tables, consisting of ${\mathrm{A}}^{\mathrm{s}}$ and QI to reduce the relationship between them, and where instead of generalization, a permutation-based approach has been adopted. Although in aggregated search, not using QI-generalization is recommended for accuracy improvement. However, a probabilistic attack is possible over the ${\mathrm{A}}^{\mathrm{s}}$ due to the one-time publication of the microdata. The (ɛ, m)-anonymity model [32] deals with the numeric ${\mathrm{A}}^{\mathrm{s}}$, however it is limited to work for categorical ${\mathrm{A}}^{\mathrm{s}}$. Xiao et al. [33] worked on personalized anonymity that uses a greedy personalized generalization approach. This model de-associated ${\mathrm{A}}^{\mathrm{s}}$ and QI instead of modifying the association between them.

In Reference [19], the p-sensitive k-anonymity found the closest neighbor. This model was then improved by Sun at al. [17] with a top-down specialization. The generated anonymized datasets should be from at least p distinct ${\mathrm{A}}^{\mathrm{s}}$ values categories for each EC. However, the developed algorithm in [17] is vulnerable to privacy leakage from sensitive variance, categorical similarity, and homogeneity attacks. In this paper, these privacy limitations were mitigated using the proposed $\theta$–sensitive k-anonymity algorithm. The proposed privacy model is a syntactic privacy model for preventing attribute disclosure risk, which adds a fixed amount of noise to create k-anonymous ECs.

3. Preliminaries

Let an original Microdata Table (MT $) =\left\{\mathrm{EI},\mathrm{QI},\mathrm{S}\right\}$ (i.e., Table 1a) be the private static data (i.e., one-time release) for a publisher to publish. The $\mathrm{t}\in \mathrm{MT}$ is a tuple that belongs to an individual i, such that EI = {${\mathrm{A}}_1^{\mathrm{ei}}$, ${\mathrm{A}}_2^{\mathrm{ei}},{ \mathrm{A}}_3^{\mathrm{ei}}\dots {\mathrm{A}}_{\mathrm{h}}^{\mathrm{ei}}$}, QI = {${\mathrm{A}}_1^{\mathrm{qi}}$, ${\mathrm{A}}_2^{\mathrm{qi}},{ \mathrm{A}}_3^{\mathrm{qi}}\dots { \mathrm{A}}_{\mathrm{m}}^{\mathrm{qi}}$}, and S = {${\mathrm{A}}^{\mathrm{s}}$} (this work considers only single ${\mathrm{A}}^{\mathrm{s}}$). The k-anonymized data essentially consists of ${\mathrm{A}}^{\mathrm{qi}}$ and ${\mathrm{A}}^{\mathrm{s}}$, while ${\mathrm{A}}^{\mathrm{ei}}\mathrm{s}$ are removed. This is because an adversary can link the ${\mathrm{A}}^{\mathrm{qi}}$ with some external information (e.g., voter or census data) to perform a record linkage attack (i.e., identity disclosure) [34]. However, the k-anonymous ${\mathrm{A}}^{\mathrm{qi}}$ values prevent the record against the record linkage attack in an EC. For example, consider some common diseases in a 2-anonymous (Table 1b) obtained from the original microdata Table 1a.

Table 2. Summary of notations used.

Symbol	Description	Symbol	Description
$\mathsf{M}\mathsf{T}$	Microdata Table	${\mathrm{A}}_{\mathrm{i}}^{\mathrm{qi}}$	Quasi identifier for ith end user
$\mathrm{MMT}$	Micro Mask Table	${\mathrm{A}}^{\mathrm{s}}$	Sensitive Attributes
A	Attributes in MT	${\mathrm{A}}^{\mathrm{id}}$	Identifier Attribute
PD	Published Data	${\mathrm{A}}_{\mathrm{ECc}}^{\mathrm{s}}$	Sensitive value in an ${\mathrm{EC}}_{\mathrm{c}}$
$\mathrm{ECs}$	Set of Equivalence classes	${\mathrm{A}}_{\mathrm{ECn}}^{\mathrm{s}}$	Sensitive value in an ${\mathrm{EC}}_{\mathrm{n}}$
${\mathrm{EC}}_{\mathrm{i}}$	k-anonymous group of tuples with the combination of ${\mathrm{A}}_{\mathrm{i}}^{\mathrm{qi}}$ and ${\mathrm{A}}^{\mathrm{s}}$	${\mathrm{A}}_{\mathrm{ECn}-1}^{\mathrm{s}}$	Sensitive value in an ${\mathrm{EC}}_{\mathrm{n}-1}$
${\mathrm{EC}}_{\mathrm{c}}$	Equivalence Class current	${\mathrm{A}}_{\mathrm{ECb}}^{\mathrm{s}}$	Sensitive value in an ${\mathrm{EC}}_{\mathrm{b}}$
${\mathrm{EC}}_{\mathrm{b}}$	Equivalence Class broken	$\mathrm{N}$	Noise
${\mathrm{V}}_{{\mathrm{EC}}_{\mathrm{i}}}$	Variance for ${\mathrm{EC}}_{\mathrm{i}}$	$\mathrm{M}$	Total number of record in an EC
${\mathrm{MS}}_{\mathrm{n}}$	Max frequency of ${\mathrm{A}}_{\mathrm{i}}^{\mathrm{s}}$ in an ECn	${\mathrm{MS}}_{\mathrm{c}}$	Max frequency of ${\mathrm{A}}_{\mathrm{i}}^{\mathrm{s}}$ in an ECc
${\mathrm{MS}}_{\mathrm{n}-1}$	Max frequency of ${\mathrm{A}}_{\mathrm{i}}^{\mathrm{s}}$ in an ECn-1	${\mathrm{MS}}_{\mathrm{b}}$	Max frequency of ${\mathrm{A}}_{\mathrm{i}}^{\mathrm{s}}$ in an ECb
$\mathrm{P}$	Places used in formal modeling	${\mathrm{G}}_{\mathrm{i}}^{\mathrm{qi}}$	QI-group at index i
$\phi$	Data Types in formal modeling

summarizes the notations used in this paper.

Definition 1.

k-anonymity [7,8]: Relation R having ${\mathrm{A}}^{\mathrm{qi}}$ over the schema R(A₁,A₂, …, A_n) in a masked microdata table T’ is said to be k-anonymous if and only if, for any combination ${\mathrm{A}}_{\mathrm{i}}^{\mathrm{qi}}\times$ t(${\mathrm{A}}_{\mathrm{in}}^{\mathrm{qi}}$) values from start to end, is greater than or equal to k in R.

$$\mathrm{iff} |\forall \{{\mathrm{A}}_{\mathrm{i}}^{\mathrm{qi}}\times \mathrm{t}({\mathrm{A}}_{\mathrm{in}}^{\mathrm{qi}})\}|\in \mathrm{T}\prime \ge k$$

where k is the anonymity level (as shown in Table 1b). The k-anonymity model blends the k records into at least a k-1 crowd but it does not impose any restrictions on the algorithm to sufficiently protect the individuals. Consequently, the probability of linking a victim to a specific record through ${\mathrm{A}}^{\mathrm{qi}}$s is at most 1/k.

Definition 2.

l-Diversity [15]: A QI block in a masked microdata table T’ having m QI-blocks $Q{I}_{j }(1\le j\le m)$ is l-diverse, if it contains more than or equal to l well significant ${\mathrm{A}}^{\mathrm{s}}$ values. In an l-diverse modified microdata table T’, every QI block is l-diverse.

$$\mathrm{iff} |\forall \{{\mathrm{A}}_{\mathrm{i}}^{\mathrm{qi}}\times {\mathrm{A}}_{\mathrm{i}}^{\mathrm{s}}\}|\in \mathrm{T}\prime \ge l$$

Definition 3.

t-closeness [16]: An EC is considered as t-closed if the distance between the distribution of the sensitive data in a class and the distribution of sensitive data in the whole table is equal to or less than threshold t. If every EC is t-closed, the whole table is t-closed. To calculate the distance while studying the transportation problem, researchers have explored some methods [33,35]. However, most of them focused on the Earth Mover Distance (EMD) method [15,36]. The EMD(P, Q) measures the minimum cost for transforming one distribution P to another distribution Q. It depends on the amount and distance of mass moved.

Definition 4.

p-sensitive k-anonymity [19]: The masked microdata table T’ is p-sensitive k-anonymous if it is k-anonymous and each EC in T’ has at least p distinct ${\mathrm{A}}^{\mathrm{s}}$ values.

$$\begin{gathered} \mathrm{iff} |\forall \{{\mathrm{A}}_{\mathrm{i}}^{\mathrm{qi}}\times \mathrm{t}({\mathrm{A}}_{\mathrm{in}}^{\mathrm{qi}})\}|\in \mathrm{T}\prime \ge k \wedge \\ (\forall \mathrm{G}:\{{\mathrm{A}}_{\mathrm{i}}^{\mathrm{qi}}\times {\mathrm{A}}_{\mathrm{i}}^{\mathrm{s}}\}\in \mathrm{T}\prime •{\mathrm{A}}_{\mathrm{n}}^{\mathrm{s}}\leftarrow \mathrm{Count}(\mathrm{Dist}({\mathrm{A}}_{\mathrm{i}}^{\mathrm{s}}))\ge p) \end{gathered}$$

where G represents an EC that already satisfies k-anonymity and is a set of ${\mathrm{A}}_{\mathrm{i}}^{\mathrm{s}}$ and ${\mathrm{A}}_{\mathrm{i}}^{\mathrm{qi}}$. The value of ${\mathrm{A}}_{\mathrm{n}}^{\mathrm{s}}$ must be equal to or greater than p, where ${\mathrm{A}}_{\mathrm{n}}^{\mathrm{s}}$ represents distinct ${\mathrm{A}}^{\mathrm{s}}$ values in an EC.

Definition 5.

Categorical similarity attack: If an adversary knows that the l-diverse modified microdata T’ (satisfying k-anonymity and l-diversity) has sensitive values belong to the single sensitive category in an EC from a p distinct ${\mathrm{A}}^{\mathrm{s}}$ categories.

Definition 6.

Sensitive variance attack: The privacy leakage in an EC due to the low variability of sensitive values from p distinct ${\mathrm{A}}^{\mathrm{s}}$ categories.

Definition 7.

High-Level Petri Nets (HLPN) [37]: The behavior of the system with its mathematical properties are modeled specifically via HLPN. An HLPN is a combination of 7-tuples $N=(P,T,F,\phi ,R_n,L,M_0),$ where $P$ represented by circles are the set of places. $T$ is the set of transitions in the system represented by rectangular boxes, such that $P\cap T=\varnothing$. $F$ represents the flow relations such that $F\subseteq (P\times T)\cup (T{\displaystyle \cup }P)$. $\phi$. maps places $P$ to the data types. $R_n$ represents the rules or properties for transitions that verify the correctness of the underlying system. $L$ represents labels on $F$, and $M_0$ is the initial marking.

The following section reviews the p⁺-sensitive k-anonymity model, to highlight its shortcomings concerning sensitive variance or an S-Variance attack.

4. Problem Statement

Definitions 8 and 9 describe the p⁺-sensitive k-anonymity and $(p, \alpha )$-sensitive k-anonymity models [17], respectively.

Definition 8.

p⁺-sensitive k-anonymity [17]: A masked microdata T’, fulfills k-anonymity and for each ${\mathrm{A}}^{\mathrm{s}}$ value belongs to distinct categories must be equal to or greater than p for each EC in T’.

$$\begin{gathered} (\forall \mathrm{G}:\{{\mathrm{A}}_{\mathrm{i}}^{\mathrm{qi}}\times {\mathrm{A}}_{\mathrm{i}}^{\mathrm{s}}\}\in \mathrm{G}\cup \mathrm{C} \wedge \\ \forall \mathrm{C}\in \mathrm{G}•{\mathrm{C}}_{\mathrm{n}}\leftarrow \mathrm{Count}(\mathrm{Dist}(\mathrm{C}))\ge \mathrm{p}) \end{gathered}$$

where C depicts ${\mathrm{A}}^{\mathrm{s}}$ values categorizations that already fulfill a p-sensitive k-anonymous approach. ${\mathrm{C}}_{\mathrm{n}}$ represents distinct categories in

Table 3. Category table.

Category ID	Sensitive Values
1	HIV, Cancer
2	Hepatitis, Phthisis
3	Asthma, Obesity
4	Indigestion, Flu

[17] and must be equal to or greater than p. Table 4a obtained from Table 1a, shows p⁺-sensitive k-anonymity model in which p = 2, k = 4 and c = 2. The ECs column in Table 4a is not part of a published table.

Definition 9.

$(p,\alpha )$-sensitive k-anonymity [17]: A modified microdata table T’ that fulfills the k-anonymity property and there must be p distinct sensitive attribute values in each QI-group having a minimum weight of at least $\alpha$.

$$(\forall \mathrm{G}:\{{\mathrm{A}}_{\mathrm{i}}^{\mathrm{qi}}\times {\mathrm{A}}_{\mathrm{i}}^{\mathrm{s}}\}\in \mathrm{T}\prime \wedge { \mathrm{A}}_{\mathrm{n}}^{\mathrm{s}} \ge \mathrm{p} \wedge {\mathrm{w}}_{\mathrm{c}} \ge \mathsf{\alpha })$$

where $\mathrm{G}$ represents all groups in masked micro table T’ that already fulfill the p-sensitive k-anonymity property. Weight should be assigned to each category and each sensitive value p must have weight in each category i.e., ${\mathrm{w}}_{\mathrm{c}}$ that must be at least $\alpha$. Table 4b obtained from Table 1a, shows $(p,\alpha )$-sensitive k-anonymity.

The sensitive variance and categorical similarity attacks have minor difference concerning the variability of ${\mathrm{A}}^{\mathrm{s}}$ in an EC. The sensitive variance attack is more powerful than categorical similarity attack, i.e., categorical similarity attack $\in$ sensitive variance attack. Therefore, the attribute disclosure through the sensitive variance attack automatically covers the disclosures through the categorical similarity attack. The EC2 and EC3 in Table 4a obtained through the p⁺-sensitive k-anonymous approach have categorical similarity and sensitive variance attacks and are explained in

Table 5. Variance calculation for different equivalence classes (ECs) in Table 4a.

EC2						EC3
Sensitive Values	$x$	$f$	$x^2$	$f\ast x$	$f\ast x^2$	Sensitive Values	$x$	$f$	$x^2$	$f\ast x$	$f\ast x^2$
Hepatitis	1	1	1	1	1	Flu	1	2	1	2	2
Phthisis	2	1	4	2	4	Cancer	2	1	4	2	4
Asthma	3	1	9	3	9	HIV	3	1	9	3	9
Obesity	4	1	16	4	16			$N={\displaystyle \sum }f=4$		${\displaystyle \sum }fx=7$	${\displaystyle \sum }f{x}^2=15$
		$N={\displaystyle \sum }f=4$		${\displaystyle \sum }fx=10$	${\displaystyle \sum }f{x}^2=30$
Variance (${\sigma }^2)$	$\left(\frac{{\displaystyle \sum }{\mathrm{fX}}^2}{\mathrm{N}}-{(\frac{{\displaystyle \sum }\mathrm{fX}}{\mathrm{N}})}^2\right)=\left(\frac{30}{4}-{(\frac{10}{4})}^2\right)=1.25$					Variance $({\sigma }^2)$	$\left(\frac{{\displaystyle \sum }{\mathrm{fX}}^2}{\mathrm{N}}-{(\frac{{\displaystyle \sum }\mathrm{fX}}{\mathrm{N}})}^2\right)=\left(\frac{15}{4}-{(\frac{7}{4})}^2\right)=0.69$

. Table 5 shows the variance calculation for these ECs, where a high variance for more diverse EC2 and small variance for less diverse EC3 can be seen.

To calculate the variance of the ECs, an ordered weight is given to the ${\mathrm{A}}^{\mathrm{s}}$ values in such a way that the higher the frequency (f), the lower the weight (x) will be. For example, consider EC3 in Table 4a, i.e., Flu = 2, Cancer = 1, HIV = 1. The numeric value against each sensitive value represents its frequency occurrence in EC3. If an EC, e.g., EC2 is fully diverse i.e., size 4 and 4-diverse, then the order weight will be Hepatitis = 1, Phthisis = 1, Asthma = 1, Obesity = 1. In EC2, because of having a single occurrence for each ${\mathrm{A}}^{\mathrm{s}}$ value, has a higher variance than EC3.

An adversary, using the category table (Table 3), can analyse the ECs in Table 4a and Table 4b published in [17]. The variability in some of the ECs is low concerning the category table. Therefore, the adversary can isolate the sensitive values that belong to a specific category and hence to individual records, and thus breaches the identity of an individual.

Critical Review of p⁺-Sensitive k-Anonymity Model

We formally modeled the p⁺-sensitive k-anonymity algorithm to check its invalidation concerning a sensitive variance attack. The detail formal verification of the working of p⁺-sensitive k-anonymity privacy model along with its properties is given in [18] from Rule 1 to Rule 7, which gets original data input from the end-user and processes it. The sensitive variance attack over the p⁺-sensitive k-anonymity model is shown in Figure 1, where the arrow heads show the data flow.

Table 6. Types used in high-level Petri nets (HLPN) for p+-sensitive k-anonymity.

Data Types	Description
k	User input for k-anonymity
p	p-sensitivity numeric value
C	Distinct categories set
Condition	Boolean value 1 or 0
Sn	Total distinct ${\mathrm{A}}^{\mathrm{s}}$ values
Cn	Total distinct categories
${\mathrm{A}}_{\mathrm{i}}^{\mathrm{si}}$	Sensitive Attribute for ith end user
${\mathrm{A}}_{\mathrm{i}}^{\mathrm{id}}$	Identifier attribute for ith end user

shows variable types and their descriptions. The places $P$ and its description are shown in

Table 7. Data-types, places, and their mapping.

Places	Description
$\mathit{\phi }$(MT)	ℙ (${\mathrm{A}}^{\mathrm{qi}}$×${\mathrm{A}}^{\mathrm{s}}$×${\mathrm{A}}^{\mathrm{id}})$
$\mathit{\phi }$(MMT)	ℙ (${\mathrm{A}}^{\mathrm{qi}}$ × ${\mathrm{A}}^{\mathrm{s}}$ × k)
$\mathit{\phi }$(KLevel)	ℙ (k)
$\mathit{\phi }$(CondTF)	ℙ (Condition)
$\mathit{\phi }$(Gi)	ℙ (${\mathrm{A}}^{\mathrm{qi}}$ × ${\mathrm{A}}^{\mathrm{s}}$ × k)
$\mathit{\phi }$(ds)	ℙ (${\mathrm{A}}^{\mathrm{s}})$
$\mathit{\phi }$(CountDs)	ℙ (Sn)
$\mathit{\phi }$(${\mathbf{Gi}}^{\prime }$)	ℙ (${\mathrm{A}}^{\mathrm{qi}}$× ${\mathrm{A}}^{\mathrm{s}}$ × k× C)
$\mathit{\phi }$(PLevel)	ℙ (p)
$\mathit{\phi }$(CompC)	ℙ (${\mathrm{C}}_{\mathrm{n}}$)
$\mathit{\phi }$(Publish Data)	ℙ (${\mathrm{A}}^{\mathrm{qi}}$ × ${\mathrm{A}}^{\mathrm{s}}$)
$\mathit{\phi }$(BK)	ℙ (${\mathrm{A}}^{\mathrm{id}}$ × ${\mathrm{A}}^{\mathrm{qi}})$
$\mathit{\phi }$(SA Disc)	ℙ (${\mathrm{A}}_{\mathrm{i}}^{\mathrm{qi}}$×${\mathrm{A}}_{\mathrm{i}}^{\mathrm{si}}$ ×${\mathrm{A}}_{\mathrm{i}}^{\mathrm{id}})$

. The attacker model in Figure 1 consists of three entities: the end-user, the adversary, and the trusted data publisher.

In Figure 1, Transitions $T$, which are input to the HLPN model, consist of patients’ records (original data). A trusted data publisher further processes the data to minimize an attribute disclosure risk. Generalization and removing identifying attributes transform the data into masked data. After generalization, the masked microdata table is ready to be published. An adversary then exploits the published data for its benefits.

In this paper, the first seven rules in [18] are outlined briefly. For input k, the data publisher processes the original data to perform data generalization via the $\mathrm{Generalize}()$ function and each EC is stored at place the micro mask table (MMT); The publisher confirms the k-anonymity condition. If successful, $Condition$ variable is set to $true$. For each EC, the $\mathrm{Dist}()$ function calculates the distinct ${\mathrm{A}}^{\mathrm{s}}$ values and stores its count at place $\mathrm{ds}$. To further process the array of t ${\mathrm{A}}^{\mathrm{s}}$, the $\mathrm{Count}()$ function counts the ${\mathrm{S}}_{\mathrm{n}}$ and stores it at place $\mathrm{Count} \mathrm{Ds}$. Before the calculation of ${\mathrm{C}}_{\mathrm{n}}$, p-sensitive k-anonymity is verified in masked data. Transition $CheckPK$ checks at least p distinct ${\mathrm{A}}^{\mathrm{s}}$ values in each EC in the whole table. $PLevel$ stores the input transition p value for comparison. Apart from the checking condition for k-anonymity, another checking for p value is done. If it returns $true$ it means the data already fulfills k-anonymity. This concludes a successful transition, ensures the p-sensitive k-anonymous property. Next, computing ${\mathrm{A}}^{\mathrm{s}}$ values categories using function $\mathrm{Get}\_\mathrm{Cat}()$. Both ${\mathrm{A}}^{\mathrm{s}}$ values and categories are stored at place $\mathrm{Gi}\prime$ for further processing. Actual improvement to the prior model and source for p+-sensitive k-anonymity is the transition $CheckPPK$. Distinct categories are calculated in a column, using the sensitive values. $\mathrm{Comp} \mathrm{C}$ stores this ‘number’ of distinct categories. The ${\mathrm{C}}_{\mathrm{n}}$ involved in each EC is checked with transition $CheckPPK$ to confirm that there must be at least p distinct categories. The minimum value for p is 2. The p+-sensitive k-anonymity properties are fulfilled if the $condition$ variable returns $true$.

The p⁺-sensitive k-anonymity model is highly vulnerable against a sensitive variance attack. The main reason is the existence of non-diverse (low variance) ${\mathrm{A}}^{\mathrm{s}}$ values similar to ‘Flu’ in Table 4a and Table 4b, and ‘HIV’ in Table 4b. In Rule (1) through function $\mathrm{S}$-$\mathrm{Variance}\_ \mathrm{Attck}()$, an adversary performs an attack on the released data using some external source of information, i.e., BK. In Rule (1):

$$\begin{array}{l}\mathit{R}(\mathrm{Attack})=\forall \mathrm{i}40 \in \mathrm{x}40, \mathrm{i}42 \in \mathrm{x}42, \mathrm{i}43\in \mathrm{x}43 , \forall \mathrm{i}2\in \mathrm{x}2|\\ \mathrm{S}-\mathrm{Variance}\_\mathrm{Attck}(\mathrm{i}40\left[2\right],\mathrm{i}42\left[2\right])\to \mathrm{i}43\left[2\right]=\mathrm{i}2\left[1\right] \wedge \mathrm{i}43\left[2\right]=\mathrm{i}2\left[3\right]\end{array}$$

The adversary takes the union of the published data with the external information and BK to plot an EC. In this way, specific individuals correspond to some specific ECs that belong to homogenous categories and hence sensitive values from a specific category disclose an individual. Therefore, a sensitive variance attack occurs due to low variance in corresponding ECs.

5. The Proposed $\theta$-Sensitive k-Anonymity Privacy Model

5.1. Threshold $\theta$-Sensitivity

The goal of the proposed $\theta$-Sensitive k-anonymity privacy model is to prevent the attribute disclosure of the individual records in MT, collected through the IoT [2,3,4,5,6] enabled devices. Each EC in MT must satisfy the threshold $\theta$ value. The $\theta$-Sensitivity, is the product of variance (${\sigma }^2$) and Observation 1 (µ) as shown in Equation (1).

$$\theta =\mathrm{Variance} \mathrm{of} \mathrm{a} \mathrm{fully} \mathrm{diverse} \mathrm{EC} ({\sigma }^2)\ast \mathrm{Observation} 1(\mu )$$

(1)

The variance value represents the diversity in an EC. High variance means high diversity in an EC and vice versa, since achieving 100% diversity is almost impossible in all cases. However, the variance-based optimal frequency distribution of ${\mathrm{A}}^{\mathrm{s}}$ values with some fixed amount of noise addition achieves an enhanced data privacy in an EC. The proposed method in this paper is simple and effective. During examining each EC, if the variance of an EC is greater than $\theta$ i.e., fully diverse, the next EC is examined. Otherwise, the variance for the same EC is increased by swapping the ${\mathrm{A}}^{\mathrm{s}}$ values from the successor ECs or by adding some noise records, to make it above $\theta$. Because of the required noise addition, our proposed model implies $\epsilon$-differential privacy [22,23] but the proposed approach is a syntactic anonymization [9] approach.

5.1.1. Variance (${\mathsf{\sigma }}^2$)

The variance calculation in Table 5 for ECs depicts the variability in a numerical form. To standardize the $\theta$ value for different size ECs, to prevent the sensitive variance attack, initially, we consider a fully diverse EC, e.g., if EC size = 2 variance = 0.25, if EC size = 3 variance = 0.67, if EC size = 4 variance = 1.25, if EC size = 5 variance = 2, and so on, then multiplying the variance with an observed value from Observation 1 ($\mu$).

5.1.2. Observation 1 ($\mathsf{\mu }$)

A decimal multiplied part: Observation 1 (µ), for getting $\theta$, the threshold value has full control over the EC diversity. During the simulation in Python, different values for µ were checked to get a suitable $\theta$ value. After executing the dataset for different k size ECs, the values of µ in the range of 0.5 to 0.9 were concluded. A smaller observed µ value results in the frequent repetition of sensitive values in an EC, and higher observed value produces a more diverse EC. However, “what observed value should be chosen for different size ECs?”, is explained below.

Consider again, the 2⁺-Sensitive 4-anonymous Table 4a, EC2 variance = 1.25, and EC3 variance = 0.69. The difference is because of the duplicated sensitive value i.e., Flu, in EC3. We propose an efficient way of removing the frequency repetition of sensitive values to achieve a more diverse EC. For this, we calculated the $\theta$ value. For example, consider a fully diverse EC of size 4 with variance = 1.25 and multiply it with an observed value, ranges between 0.5 and 0.9. Since, 1.25 * 0.5 = 0.625 is less than 0.69 and 1.25 * 0.6 = 0.75, which is greater than 0.69. The difference between the two values i.e., 1.25 and 0.69, is because of only one duplicated value “Flu”. Thus, it depends on privacy requirements and the level of diversity we are interested to achieve. In this paper, we perform a very strict $\theta$ calculation to get fully diverse ECs. Therefore, for example in the implementation part of the proposed Algorithm 1, we multiply a variance of 4 size EC with an observed value µ= 0.6 to have a fully diverse EC. The same technique is applied to all other ECs as well. The $\theta$ obtained in this way in line 8 of the proposed Algorithm 1 in Section 5.2, is then checked in the conditional part at line 10 inside a loop to check all ECs concerning $\theta$ requirements.

Definition 10.

$\theta$-Sensitive k-anonymity: The modified microdata table T’ fulfills $\theta$-sensitive k-anonymity, if it fulfills k-anonymity and for each EC in T’, the variance for each EC must be at least $\theta$.

$$\mathrm{iff} |\forall \{{\mathrm{A}}_{\mathrm{i}}^{\mathrm{qi}}\times \mathrm{t}({\mathrm{A}}_{\mathrm{in}}^{\mathrm{qi}})\}|\in \mathrm{T}\prime \ge k \wedge (\forall \mathrm{G}:\{{\mathrm{A}}_{\mathrm{i}}^{\mathrm{qi}}\times {\mathrm{A}}_{\mathrm{i}}^{\mathrm{s}}\}\in \mathrm{T}\prime •{\mathrm{A}}_{\mathrm{n}}^{\mathrm{s}}\leftarrow \mathrm{Count}(\mathrm{Dist}({\mathrm{A}}_{\mathrm{i}}^{\mathrm{s}}))\ge \theta )$$

where G represents a QI-group or EC that already satisfies k-anonymity and is a set of ${\mathrm{A}}_{\mathrm{i}}^{\mathrm{s}}$ and ${\mathrm{A}}_{\mathrm{i}}^{\mathrm{qi}}$. The value of ${\mathrm{A}}_{\mathrm{n}}^{\mathrm{s}}$ must be equal to or greater than p, where ${\mathrm{A}}_{\mathrm{n}}^{\mathrm{s}}$ is the number of distinct sensitive values in a QI-group. The proposed $\theta$-sensitive k-anonymity model produces the anonymized Table 8a (with noise) from the original microdata Table 1a and Table 8b (without noise) from Table 4b. The ${\mathrm{A}}^{\mathrm{qi}}$ values in Table 8a and Table 8b are generalized through local recoding (bottom-up generalization) which improves the utility of the anonymized data. The 4-diverse ECs in Table 8a and Table 8b have sensitive values from a minimum of three different sensitive categories in Table 3. Therefore, these tables have more attribute privacy and are more protected from a sensitive variance attack.

5.2. The Proposed $\theta$-Sensitive k-Anonymity Algorithm

The proposed $\theta$-sensitive k-anonymity algorithm starts execution by checking the k size to create an EC (minimum cardinality k = 2), at line 3. The algorithm can be executed on different size of k. However, if the minimum cardinality fails, the condition becomes $false$ and jumps to line 50. If it is $true$, the $for$ loop works from line 5 to 7, to calculate the variance for each m size ${\mathrm{G}}_{\mathrm{i}}^{\mathrm{qi}}$ or ${\mathrm{EC}}_{\mathrm{i}}$ that belongs to k-anonymous ECs and assigns them to an array i.e., ${\mathrm{V}}_{{\mathrm{EC}}_{\mathrm{i}}}$.

Line 8 multiplies an average observed value $\mu$ and variance ${\mathsf{\sigma }}^2$ for an EC to get a threshold $\theta$ (i.e., Equation (1)). This $\theta$ value ensures the maximum level of diversity in an EC. $\theta$ mainly depends on $\mu$. If $\mu$ is smaller for an EC, low diverse EC will be obtained and vice versa. What level of diversity we want to have in an EC is completely controlled by $\mu$. Deeply observing l-diversity [15] and t-closeness [16] and performing experiments while executing the algorithm in Python, the $\mu$ value is kept to achieve maximum diversity. The algorithm starts working from lines 9–49, which checks the obtained variances against user input k for each m size EC to $\theta$. At line 10, if ${\mathrm{V}}_{\mathrm{EC}}$ is greater than $\theta$, line 46 is executed and the algorithm moves on to next EC. If it is less than $\theta$, the current EC is named as ${\mathrm{EC}}_{\mathrm{c}}$, and the next index EC is named as ${\mathrm{EC}}_{\mathrm{b}}$. Lines 12–45, each part inside if statement has two major functionalities; swapping and require noise addition.

The else part of an if statement executes the ECs from first till ${\mathrm{EC}}_{\mathrm{n}-1}$, and its first part processes the last EC (lines 13–25). At line 12, if ${\mathrm{EC}}_{\mathrm{c}}$ is the last class, i.e., ${\mathrm{EC}}_{\mathrm{n}}$, then from ${\mathrm{A}}_{{\mathrm{EC}}_{\mathrm{n}}}^{\mathrm{s}}$ the value of ${\mathrm{MS}}_{\mathrm{n}}$ is calculated. Similarly, the value of ${\mathrm{MS}}_{\mathrm{n}-1}$ is calculated from ${\mathrm{EC}}_{\mathrm{n}-1}$. At line 15, a $\mathrm{crossCheck}()$ function checks the existence of most frequent ${\mathrm{A}}^{\mathrm{s}}$ that does not exist in each other ECs. The $\mathrm{swap}()$ function may be executed. The purpose of the cross-check is not to further increase or decrease ${\mathrm{V}}_{{\mathrm{EC}}_{\mathrm{n}-1}}$ because it has already been processed by the else part of the current if statement. This function is for the last EC to increase its diversity. If any of the ${\mathrm{A}}^{\mathrm{s}}$ value from ${\mathrm{EC}}_{\mathrm{n}}$ exists in ${\mathrm{EC}}_{\mathrm{n}-1}$ or vice versa, the swapping at line 17 will not be performed. If swapping is performed, ${\mathrm{V}}_{{\mathrm{EC}}_{\mathrm{n}}}$ is calculated to check with $\theta$ (line 20). If ${\mathrm{V}}_{{\mathrm{EC}}_{\mathrm{n}}}$ is still less than $\theta$, then the algorithm jumps to line 43 to add a distinct ${\mathrm{A}}^{\mathrm{s}}$ value as noise to increase its variance and to achieve a high diversity.

To process the first EC until the ${\mathrm{EC}}_{\mathrm{n}-1}$, the else part of if statement executes (line 12). The algorithm finds an ${\mathrm{EC}}_{\mathrm{b}}$ with $\theta$ greater than ${\mathrm{EC}}_{\mathrm{c}}$ (lines 27–31). The if statement checks ${\mathrm{EC}}_{\mathrm{b}}$ f$ound$ condition, when it is satisfied, then a function $\mathrm{mfsv}()$ is executed on both ${\mathrm{EC}}_{\mathrm{c}}$ and ${\mathrm{EC}}_{\mathrm{b}}$, which calculates the most frequent sensitive values in both ECs. Before swapping the values for ${\mathrm{MS}}_{\mathrm{c}}$ and ${\mathrm{MS}}_{\mathrm{b}}$, a function $\mathrm{backCheck}()$ checks the existence of ${\mathrm{MS}}_{\mathrm{b}}$ in ${\mathrm{EC}}_{\mathrm{c}}$, which is an EC ahead of ${\mathrm{EC}}_{\mathrm{b}}$. If the value of ${\mathrm{MS}}_{\mathrm{b}}$ exists in ${\mathrm{EC}}_{\mathrm{c}}$, then that MS value is removed from a temporary array in Algorithm 1.

	Algorithm 1: $\mathit{\theta }$-sensitive k-anonymity
	Input: Microdata Table (MT)
	Output: $: \theta -\mathrm{sensitive} k-\mathrm{anonymous}$ table (MMT)
1	$\mathrm{Procedure}: \theta -\mathrm{sensitive} k-\mathrm{anonymity} (\mathrm{MMT}, \mathsf{\theta },\mathrm{k})$
2	$\mathrm{Let} k\subseteq \mathrm{MMT}$
3	$if|k| \ge 2$$then$
4	$\mathrm{Condition}=\mathrm{true}$;
5	$for each \mathrm{m} \mathrm{size} \mathrm{EC} \mathrm{in} {\mathrm{G}}_{\mathrm{i}}^{\mathrm{qi}}:\{{\mathrm{A}}_{\mathrm{i}}^{\mathrm{qi}}\times { \mathrm{A}}_{\mathrm{i}}^{\mathrm{s}}\} \in k$ do	►${\mathrm{G}}_{\mathrm{i}}^{\mathrm{qi}}$ set, consists of ${\mathrm{A}}_{\mathrm{i}}^{\mathrm{qi}}\&{\mathrm{A}}_{\mathrm{i}}^{\mathrm{s}}$
6	${\mathrm{V}}_{{\mathrm{EC}}_{\mathrm{i}}}\leftarrow \mathrm{Compute} \mathrm{vari}({\mathrm{A}}_{{\mathrm{EC}}_{\mathrm{i}}}^{\mathrm{s}})$	►$\mathrm{vari}({\mathrm{A}}_{{\mathrm{EC}}_{\mathrm{i}}}^{\mathrm{s}}$), calculate variance for each m size EC.
7	$end for$
8	$\mathsf{\theta }\leftarrow {\mathsf{\mu } \ast \mathsf{\sigma }}^2$	►$\mathsf{\theta }$, required threshold
9	$for each {\mathrm{m} \mathrm{size} \mathrm{EC}}_{\mathrm{i}}{ \mathrm{in} \mathrm{G}}_{\mathrm{i}}^{\mathrm{qi}}:\{{\mathrm{A}}_{\mathrm{i}}^{\mathrm{qi}}\times { \mathrm{A}}_{\mathrm{i}}^{\mathrm{s}}\} \in k do$	►${\mathrm{G}}_{\mathrm{i}}^{\mathrm{qi}}$ set, consists of ${\mathrm{A}}_{\mathrm{i}}^{\mathrm{qi}}$ and ${\mathrm{A}}_{\mathrm{i}}^{\mathrm{s}}$
10	$if {\mathrm{V}}_{{\mathrm{EC}}_{\mathrm{c}}}<\theta then$
11	${\mathrm{EC}}_{\mathrm{b}}\leftarrow {\mathrm{EC}}_{\mathrm{c}}+1$
12	$if {\mathrm{EC}}_{\mathrm{n}}={\mathrm{EC}}_{\mathrm{c}}$
13	${\mathrm{MS}}_{\mathrm{n}}\leftarrow \mathrm{Compute} \mathrm{mfsv}({\mathrm{A}}_{{\mathrm{EC}}_{\mathrm{n}}}^{\mathrm{s}})$	►mfsv(), max frequent ${\mathrm{A}}_{{\mathrm{EC}}_{\mathrm{n}}}^{\mathrm{s}}$
14	${\mathrm{MS}}_{\mathrm{n}-1}\leftarrow \mathrm{Compute} \mathrm{mfsv}({\mathrm{A}}_{{\mathrm{EC}}_{\mathrm{n}-1}}^{\mathrm{s}})$	►mfsv(),max frequent ${\mathrm{A}}_{{\mathrm{EC}}_{\mathrm{n}-1}}^{\mathrm{s}}$
15	$\mathrm{notExist}\leftarrow \mathrm{crossCheck}({\mathrm{MS}}_{{\mathrm{EC}}_{\mathrm{n}}},{\mathrm{MS}}_{{\mathrm{EC}}_{\mathrm{n}-1}})$	►crossCheck(), check both side existence
16	$if \mathrm{notExist}$
17	$\mathrm{swap}({\mathrm{MS}}_{\mathrm{n}},{\mathrm{MS}}_{\mathrm{n}-1})$	►swap(), last and 2nd last ECs MS values
18	$end if$
19	${\mathrm{V}}_{{\mathrm{EC}}_{\mathrm{n}}}\leftarrow \mathrm{Compute} \mathrm{vari}({\mathrm{A}}_{{\mathrm{EC}}_{\mathrm{n}}}^{\mathrm{s}})$
20	$if {\mathrm{V}}_{{\mathrm{EC}}_{\mathrm{n}}}<\theta$
21	$Break$
22	$\mathrm{jump} \mathrm{to} \mathrm{else} \mathrm{part} \mathrm{of} \mathrm{condition} \mathrm{line} 43$
23	$else$
24	$Break$
25	$end if$
26	$else$
27	$for {\mathrm{EC}}_{\mathrm{b}}{\mathrm{till} \mathrm{EC}}_{\mathrm{n}}{\mathrm{in} \mathrm{G}}_{\mathrm{i}}^{\mathrm{qi}}:\{{\mathrm{A}}_{\mathrm{i}}^{\mathrm{qi}}\times { \mathrm{A}}_{\mathrm{i}}^{\mathrm{s}}\} \in \mathrm{K}$
28	$if{ \mathrm{V}}_{{\mathrm{EC}}_{\mathrm{b}}}>\theta$
29	$Break loop$
30	$end if$
31	$Break loop$
32	$if {\mathrm{EC}}_{\mathrm{b}}=\mathrm{found}$
33	${\mathrm{MS}}_{\mathrm{c}}\leftarrow \mathrm{Compute} \mathrm{mfsv}({\mathrm{A}}_{{\mathrm{EC}}_{\mathrm{c}}}^{\mathrm{s}})$	►mfsv(), max frequency ${\mathrm{A}}_{{\mathrm{EC}}_{\mathrm{c}}}^{\mathrm{s}}$
34	${\mathrm{MS}}_{\mathrm{b}}\leftarrow \mathrm{Compute} \mathrm{mfsv}({\mathrm{A}}_{{\mathrm{EC}}_{\mathrm{b}}}^{\mathrm{s}})$	►mfsv(), max frequency ${\mathrm{A}}_{{\mathrm{EC}}_{\mathrm{b}}}^{\mathrm{s}}$
35	${\mathrm{MS}}_{\mathrm{b}}\leftarrow \mathrm{backCheck}({\mathrm{MS}}_{{\mathrm{EC}}_{\mathrm{c}}},{\mathrm{MS}}_{{\mathrm{EC}}_{\mathrm{b}}})$	►backCheck() find MS value in ${\mathrm{MS}}_{{\mathrm{EC}}_{\mathrm{b}}}$, not exists ${\mathrm{in} \mathrm{MS}}_{{\mathrm{EC}}_{\mathrm{c}}}$
36
37	$\mathrm{swap}({\mathrm{MS}}_{\mathrm{c}},{\mathrm{MS}}_{\mathrm{b}})$	►swap(), exchange MS values
38	${\mathrm{V}}_{{\mathrm{EC}}_{\mathrm{c}}}\leftarrow \mathrm{Compute} \mathrm{vari}({\mathrm{A}}_{{\mathrm{EC}}_{\mathrm{c}}}^{\mathrm{s}})$	►vari(), again compute variance
39	$if {\mathrm{V}}_{{\mathrm{EC}}_{\mathrm{c}}}>\mathsf{\theta }$
40	${\mathrm{EC}}_{\mathrm{c}}+=1$
41	$end if$
42	$else$
43	$\mathrm{NS}\leftarrow \mathrm{Compute} \mathrm{addNoise}({\mathrm{A}}_{{\mathrm{EC}}_{\mathrm{c}}}^{\mathrm{s}})$	►addNoise(), until variance>$\mathsf{\theta }$
44	$end if$
45	$end if$
46	$else$
47	${\mathrm{EC}}_{\mathrm{c}}+=1$
48	$end if$
49	$end for$
50	$else$
51	$\mathrm{Condition}=\mathrm{false};$
52	$end if$

${\mathrm{MS}}_{{\mathrm{EC}}_{\mathrm{b}}}$ and next MS in same ${\mathrm{EC}}_{\mathrm{b}}$ is checked with ${\mathrm{MS}}_{\mathrm{c}}$. This process continues until it finds a ${\mathrm{A}}^{\mathrm{s}}$ value in ${\mathrm{MS}}_{{\mathrm{EC}}_{\mathrm{b}}}$ that do not exist in ${\mathrm{MS}}_{\mathrm{c}}$. Line 37 then swaps these two MS values along with their corresponding records. Two important purposes are achieved through this swap function. First, reducing the frequency of repeated ${\mathrm{A}}^{\mathrm{s}}$ and second, increasing diversity in ${\mathrm{EC}}_{\mathrm{c}}$ which results in increasing ${\mathrm{V}}_{{\mathrm{EC}}_{\mathrm{c}}}$. The ${\mathrm{V}}_{{\mathrm{EC}}_{\mathrm{c}}}$ is again calculated and is checked with $\theta$, if it is greater than $\theta$, counter for ${\mathrm{EC}}_{\mathrm{c}}$ moves to the next EC.

Here, the absence of the else statement adds noise instantly, in a situation when the variance is less than $\theta$, because more than one swapping for a specific ${\mathrm{EC}}_{\mathrm{c}}$ is possible. We add noise only once after completely checking the frequency of each ${\mathrm{A}}^{\mathrm{s}}$ in an EC. For example, if to produce a 4-anonymous EC table from Table 1a, after one swapping e.g., ‘HIV’ swaps with ‘Obesity’, the resulting EC1 in Table 8a will become 3-diverse and its variance will not meet $\theta$, the else part might add noise to increase variance even though there is a duplicated ${\mathrm{A}}^{\mathrm{s}}$ ‘Cancer’ value that still exists in ${\mathrm{EC}}_{\mathrm{c}}$. To reduce the frequency of the next duplicated ${\mathrm{A}}^{\mathrm{s}}$ value i.e., ‘Cancer’, by swapping it with another ${\mathrm{A}}^{\mathrm{s}}$ in ${\mathrm{EC}}_{\mathrm{b}}$ if one exists, noise is not added at this moment. This is achieved by going control back to line 10, and since this increased variance is still less than $\theta$, the procedure repeats and from an ${\mathrm{EC}}_{\mathrm{b}}$ a new ${\mathrm{A}}^{\mathrm{s}}$ is swapped with the next duplicated ${\mathrm{A}}^{\mathrm{s}}$ value. In this way, two swapping procedures are performed and 2-diverse ${\mathrm{EC}}_{\mathrm{c}}$ will become 4-diverse without adding any unnecessary noise, which results in increasing data utility and a more diverse EC.

${\mathrm{EC}}_{\mathrm{b}}$ is found because of a variance greater than $\theta ,$ there are chances that no EC exists in a given dataset having a higher variance than $\theta ,$ in this case, the loop will not break (line 29). In that case, the algorithm will jump to line 43. It will add a dummy record with distinct ${\mathrm{A}}^{\mathrm{s}}$ value(s) via function $\mathrm{addNoise}()$. Such an addition is considered as noise to the real data just like the addition of noise in differential privacy [22,23]. This algorithm performs very intelligent swapping and adds noise intelligently. The purpose of these two functions (i.e., $\mathrm{swap}()$ and $\mathrm{addNoise}())$, is to increase the diversity keeping the utility as high as possible, which is easily achieved in our algorithm as shown in the experimental evaluation, Section 6.

The sanitized Table 4a from p⁺-sensitive k-anonymity is prone to homogeneity, categorical similarity, and sensitive variance attacks, and Table 8a from $\theta$-sensitive k-anonymity secures the data from such attacks because of more diversity, even at the category level, i.e., the maximum value for category c is 4 through $\theta$-sensitive k-anonymity, where, for Table 4a, the maximum value for c is 2. Table 8a provides more protection against the categorical similarity attack. Further swapping of values is not possible in the last EC; thus, a single tuple is added as noise to increase the diversity and to prevent categorical similarity attack and sensitive variance attack. Such a small amount of noise does not highly affect the utility of the data. Table 4b is a base table to obtain Table 8b using the $\theta$-sensitive k-anonymity approach. Table 8b is also highly diverse at the categorical level and there are no repeated sensitive values. Thus, there is no need to add noise and to have a high value of variance. The anonymized data, both in Table 8a and Table 8b, obtained through the proposed $\theta$-sensitive k-anonymity algorithm, have no attribute disclosure risk and are defensive against homogeneity [11], categorical similarity, and sensitive variance attacks, and even secure from skewness attacks [12].

5.3. Analysis of $\theta$-Sensitive k-Anonymity Model Using Formal Modeling and Analysis

The proposed $\theta$-sensitive k-anonymity model mitigates the vulnerability discussed in Section 4. Modeling the $\theta$-sensitive k-anonymity via HLPN has the same end-user, data publisher, and unknown adversary, as shown in Figure 2.

Table 9. Types used in HLPN for $\theta$-sensitive k-anonymity.

Data Types	Descriptions
M	Size of an EC
Condition	Boolean value 1 or 0
$\sigma$	A float type value to define Sigma
µ	A float type value to define Mu
$\theta$	A float type value to define Theta
Found ${\mathrm{EC}}_{\mathrm{b}}$	Equivalence class b when it is found
${\mathrm{AdjEC}}_{\mathrm{c}}$	Adjust Equivalence class c
${\mathrm{AdjEC}}_{\mathrm{n}}$	Adjust Equivalence class n
${\mathrm{VarEC}}_{\mathrm{s}}$	Variance of different Equivalence classes
${\mathrm{VarAdjEC}}_{\mathrm{n}}$	Adjust variance for Equivalence class n
${\mathrm{VarAdjEC}}_{\mathrm{c}}$	Adjust variance for Equivalence class c

and

Table 10. Mapping of data types in $\theta$-sensitive k-anonymity model.

Places	Descriptions
$\mathit{\phi }$($\mathrm{MT}$)	ℙ (${\mathrm{A}}^{\mathrm{id}}\times {\mathrm{A}}^{\mathrm{qi}}\times {\mathrm{A}}^{\mathrm{s}}$)
$\mathit{\phi }$($\mathrm{MMT}$)	ℙ (${\mathrm{EC}}_{\mathrm{c}}\times {\mathrm{EC}}_{\mathrm{b}}\times {\mathrm{EC}}_{\mathrm{n}}\times k)$
$\mathit{\phi }$($\mathrm{KValue}$)	ℙ (k)
$\mathit{\phi }$($\mathrm{CondTF}$)	ℙ (Condition)
$\mathit{\phi }$($\mathrm{Sigma}$)	ℙ ($\sigma$)
$\mathit{\phi }$($\mathrm{Mu}$)	ℙ ($\mu$)
$\mathit{\phi }$($\mathrm{Theta}$)	ℙ ($\theta$)
$\mathit{\phi }$(${\mathrm{Found} \mathrm{EC}}_{\mathrm{b}}$)	ℙ (${\mathrm{EC}}_{\mathrm{b}}$)
$\mathit{\phi }$(${\mathrm{VarEC}}_{\mathrm{s}}$)	ℙ (${\mathrm{V}}_{{\mathrm{EC}}_{\mathrm{c}}}\times {\mathrm{V}}_{{\mathrm{EC}}_{\mathrm{b}}}\times {\mathrm{V}}_{{\mathrm{EC}}_{\mathrm{n}}}$)
$\mathit{\phi }$(${\mathrm{AdjEC}}_{\mathrm{c}}$)	ℙ (${\mathrm{EC}}_{\mathrm{c}}$)
$\mathit{\phi }$(${\mathrm{AdjEC}}_{\mathrm{n}}$)	ℙ (${\mathrm{EC}}_{\mathrm{n}}$)
$\mathit{\phi }$(${\mathrm{StrictEC}}_{\mathrm{n}-1}$)	ℙ (${\mathrm{EC}}_{\mathrm{n}-1}$)
$\mathit{\phi }$(${\mathrm{VarAdjEC}}_{\mathrm{n}}$)	ℙ (${\mathrm{V}}_{{\mathrm{EC}}_{\mathrm{n}}}$)
$\mathit{\phi }$(${\mathrm{VarAdjEC}}_{\mathrm{c}}$)	ℙ (${\mathrm{V}}_{{\mathrm{EC}}_{\mathrm{c}}}$)
$\mathit{\phi }$($\mathrm{Need} \mathrm{Noise}$)	ℙ (${\mathrm{V}}_{{\mathrm{EC}}_{\mathrm{c}} }\times {\mathrm{A}}^{\mathrm{id}}\times {\mathrm{A}}^{\mathrm{qi}}\times {\mathrm{A}}^{\mathrm{s}}$)
$\mathit{\phi }$($\mathrm{PublshdData}$)	ℙ (${\mathrm{A}}^{\mathrm{qi}}\times {\mathrm{A}}^{\mathrm{s}}$)
$\mathit{\phi }$($\mathrm{BK}$)	ℙ (${\mathrm{A}}^{\mathrm{id}}\times {\mathrm{A}}^{\mathrm{qi}}$)
$\mathit{\phi }$($\mathrm{SA} \mathrm{Disc}$)	ℙ (${\mathrm{A}}_{\mathrm{i}}^{\mathrm{qi}}$×${ \mathrm{A}}_{\mathrm{i}}^{\mathrm{si}}$ × ${\mathrm{A}}_{\mathrm{i}}^{\mathrm{id}}$)

, respectively, show variable types and places, and their corresponding descriptions.

The $\theta$-sensitive k-anonymity algorithm was modeled through the HLPN rules for the microdata input. The data publisher initially verifies the k-value input. The original data is k-anonymized (bottom-up generalization) after finalizing the individual records in an EC obtained through variance calculations. In Rule (2), the k-anonymity masks the data. In Rule (2):

$\mathit{R}(\mathrm{MaskData})≔\forall \mathrm{i}2\in \mathrm{x}2, \mathrm{i}3\in \mathrm{x}3,\mathrm{i}4\in \mathrm{x}4 |$

$$\mathrm{i}4\left[1\right]≔\mathrm{Mask} \{\mathrm{i}2\left[2\right]\}\wedge \mathrm{i}4\left[2\right]≔\mathrm{Mask}\{\mathrm{i}2\left[3\right]\} \wedge \mathrm{x}4\prime ≔\mathrm{x}4 \cup \{\mathrm{i}4\left[1\right],\mathrm{i}4\left[2\right],\mathrm{i}3\}$$

If an input k is less than the minimum size of an EC (i.e., <2) the condition fails. For cardinality having a minimum value of 2 or above, the algorithm executes. The k-anonymity for true or false are depicted in Rule (3).

$$\begin{array}{l}\mathit{R}(\mathrm{Check} k)≔\forall \mathrm{i}5\in \mathrm{x}5, \mathrm{i}6 \in \mathrm{x}6 |\\ \mathrm{Count}(\mathrm{i}5\left[1\right])\ge \mathrm{i}5\left[3\right]\to \mathrm{i}6\left[1\right]≔\mathrm{TRUE} \vee \mathrm{Count}(\mathrm{i}5\left[1\right])\ngeqq \mathrm{i}5\left[3\right]\to \mathrm{i}6\left[1\right]≔\mathrm{FALSE}\wedge \mathrm{x}6\prime ≔\mathrm{x}6\cup \{\mathrm{i}6\left[1\right]\}\end{array}$$

The threshold $\theta$ is calculated in Rule (4). Variance for a fully diverse ECs for a specific k is calculated using the $\mathrm{var}()$ function. The important contributed functions are $\mathrm{swap}()$ and $\mathrm{addNoise}()$ functions, through which the algorithm processes all ECs. Transition $Adjust Var$ performs all these swapping and noise additions in corresponding ECs. In Rule (5), $Compute Var$ transitions for the initial ECs. For the rest of the ECs, the same transition can be used in the same manner. In Rule (4):

$$\begin{array}{l}\mathit{R}(\mathrm{Calc} \mathrm{Theta})≔\forall \mathrm{i}10\in \mathrm{x}10, \mathrm{i}11\in \mathrm{x}11,\mathrm{i}12\in \mathrm{x}12|\\ \mathrm{i}12≔\{\mathrm{i}11\ast {(\mathrm{i}10)}^2\} \wedge \mathrm{x}12\prime ≔\mathrm{x}12\cup \{\mathrm{i}12\}\end{array}$$

In Rule (5):

$$\begin{array}{l}\mathit{R}(\mathrm{Compute} \mathrm{Var})≔\forall \mathrm{i}8 \in \mathrm{x}8, \mathrm{i}9\in \mathrm{x}9|\\ \mathrm{i}9\left[1\right]≔\mathrm{Compute} \mathrm{Var}(\mathrm{i}8\left[1\right])\wedge \mathrm{i}9\left[2\right]≔\mathrm{i}8\left[2\right]) \wedge \mathrm{x}9\prime ≔\mathrm{x}9 \cup \{\mathrm{i}9\left[1\right],\mathrm{i}9\left[2\right]\}\end{array}$$

The $\theta$-sensitive k-anonymity model’s main functionalities are described in Rule (6) and Rule (7). Variance in each k-anonymous EC with respect to $\theta$ is checked in Rule (6). If variance of ${\mathrm{EC}}_{\mathrm{c}}$ is greater than $\theta$ (i.e., ($\mathrm{i}14\left[1\right]>\mathrm{i}13$)), move to next ${\mathrm{EC}}_{\mathrm{c}}$ and update the value in place MMT. If the variance of ${\mathrm{EC}}_{\mathrm{c}}$ is less than $\theta$ (i.e., $(\mathrm{i}14\left[1\right]<\mathrm{i}13)$), then transaction stops. We try to find ${\mathrm{EC}}_{\mathrm{b}}$, and swap required available ${\mathrm{A}}^{\mathrm{s}}$ values from ${\mathrm{EC}}_{\mathrm{b}}$. After performing all needed swapping, if the variance of ${\mathrm{AdjEC}}_{\mathrm{c}}$ is still less than $\theta$ (i.e., ($\mathrm{i}32<\mathrm{i}13)$), the noise is added to increase its diversity. In Rule (6):

$$\begin{array}{l}\mathit{R}(\mathrm{Check}\mathrm{Variance})≔\forall \mathrm{i}13\in \mathrm{x}13,\mathrm{i}14\in \mathrm{x}14, \mathrm{i}15\in \mathrm{x}15,\mathrm{i}19\in \mathrm{x}19, \mathrm{i}23\in \mathrm{x}23,\mathrm{i}24\in \mathrm{x}24, \mathrm{i}32\in \mathrm{x}32,\mathrm{i}33\in \mathrm{x}33|\\ \wedge \{((\mathrm{i}14\left[1\right]>\mathrm{i}13)\to \mathrm{i}16\left[1\right]≔\mathrm{i}15\left[1\right]+1\\ \wedge \mathrm{x}16\prime ≔\mathrm{x}16\left[2\right]\cup \{\mathrm{i}16\})≔((\mathrm{i}14\left[1\right]<\mathrm{i}13)\to \mathrm{i}16\left[2\right]≔\mathrm{i}15\left[1\right]+1\\ \wedge \mathrm{x}16\prime ≔\mathrm{x}16\left[2\right]\cup \{\mathrm{i}16\})≔((\mathrm{i}14\left[2\right]>\mathrm{i}13))\to \mathrm{i}19\wedge \mathrm{x}{19}^{\prime }:=\mathrm{x}19\cup \{\mathrm{i}19\})≔((\mathrm{i}24<\mathrm{i}13)\to \mathrm{i}25\\ \wedge \mathrm{x}25≔\mathrm{x}25\cup \{\mathrm{i}25\})≔((\mathrm{i}32<\mathrm{i}13)\to \mathrm{i}33\wedge \mathrm{x}33≔\mathrm{x}33\cup \{\mathrm{i}33\})\} \end{array}$$

The proposed $\theta$-sensitive k-anonymity algorithm starts by processing each k size EC. The function $\mathrm{Comp} \mathrm{mfsv}( )$ computes the max frequency of ${\mathrm{A}}_{{\mathrm{EC}}_{\mathrm{c}}}^{\mathrm{s}}{\mathrm{and} \mathrm{A}}_{{\mathrm{EC}}_{\mathrm{b}}}^{\mathrm{s}}$, named as ${\mathrm{MS}}_{{\mathrm{EC}}_{\mathrm{c}}}$ and ${\mathrm{MS}}_{{\mathrm{EC}}_{\mathrm{b}}}$, respectively. A one-way checking function: $\mathrm{backCheck}()$, checks for the existence of ${\mathrm{MS}}_{{\mathrm{EC}}_{\mathrm{b}}}$ at ${\mathrm{FoundEC}}_{\mathrm{b}}$ that do not exist in earlier ${\mathrm{EC}}_{\mathrm{c}}$.

${\mathrm{MS}}_{\mathrm{b}}$ is swapped with ${\mathrm{MS}}_{\mathrm{c}}$ after the checking succeeds and is saved in place Adj${\mathrm{EC}}_{\mathrm{c}}$. ${\mathrm{EC}}_{\mathrm{c}}$ minimizes the frequency of the ${\mathrm{A}}^{\mathrm{s}}$ value and increases diversity. While processing the last EC, i.e., ${\mathrm{EC}}_{\mathrm{n}}$, swapping is not possible in the forward direction. Thus swapping with previous EC is performed with a condition that the variance of already processed ${\mathrm{EC}}_{\mathrm{n}-1}$ should not be decreased with $\theta$. The $\mathrm{crossCheck}()$ function confirms two-way checking, that the values for both ${\mathrm{MS}}_{\mathrm{n}}$ and ${\mathrm{MS}}_{\mathrm{n}-1}$ are distinct and it should not change the variance of ${\mathrm{EC}}_{\mathrm{n}-1}$ at place ${\mathrm{StrictEC}}_{\mathrm{n}-1}$ to an undesired value again. In that case, we call it strict ${\mathrm{EC}}_{\mathrm{n}-1}$. In other words, in addition to increasing the diversity in ${\mathrm{EC}}_{\mathrm{n}}$, it is also not increasing the frequency of ${\mathrm{A}}^{\mathrm{s}}$ value at place ${\mathrm{EC}}_{\mathrm{n}-1}$. Values are then swapped and are saved at place ${\mathrm{AdjEC}}_{\mathrm{n}}$. Rule (7) shows the whole process. In Rule (7):

$$\begin{gathered} \mathit{R}(\mathrm{Adjst} \mathrm{Var})≔\forall \mathrm{i}17\in \mathrm{x}17,\mathrm{i}20\in \mathrm{x}20,\mathrm{i}21\in \mathrm{x}21,\mathrm{i}28\in \mathrm{x}28,\mathrm{i}29\in \mathrm{x}29| \\ (\mathrm{i}17\left[1\right]\ne \mathrm{i}17\left[3\right])\to \mathrm{Comp} \mathrm{mfsv}(\mathrm{i}20\left[1\right],\mathrm{i}17\left[1\right]) \wedge \mathrm{True} \\ ≔\mathrm{backCheck}(\mathrm{i}20\left[1\right],\mathrm{i}17\left[1\right]) \\ \wedge \mathrm{i}21≔\mathrm{swap}(\mathrm{i}20\left[1\right],\mathrm{i}17\left[1\right]) \wedge \mathrm{x}21\prime ≔\mathrm{x}21\cup \{\mathrm{i}21\} \\ (\mathrm{i}17\left[1\right]=\mathrm{i}17\left[3\right])\to \mathrm{Comp} \mathrm{mfsv}{(\mathrm{i}17\left[3\right],\mathrm{i}28\left[1\right])}_{ }\wedge \mathrm{True} \\ ≔\mathrm{crossCheck}{(\mathrm{i}17\left[3\right],\mathrm{i}28\left[1\right])}_{ } \\ \wedge \mathrm{i}29≔\mathrm{swap}{(\mathrm{i}17\left[3\right],\mathrm{i}28\left[1\right])}_{ }\wedge \mathrm{x}29\prime ≔\mathrm{x}29\cup \{\mathrm{i}29\left[1\right]\} \end{gathered}$$

If the variance of ${\mathrm{AdjEC}}_{\mathrm{c}}$ is still less than $\theta$ (i.e., $(\mathrm{i}34\left[1\right]<\mathrm{i}35)$), a dummy record called noise is added whenever needed throughout the variance adjustment process. In Rule (8), we have given the final noise addition case for last ${\mathrm{AdjEC}}_{\mathrm{n}}$. Its purpose is to increase the variance at a level greater than $\theta$. It will produce a highly diverse EC even if there are not enough diverse records in MMT. In Rule (8):

$$\begin{gathered} \mathit{R}(\mathrm{Add} \mathrm{Noise})≔\forall \mathrm{i}34\in \mathrm{x}34,\mathrm{i}35\in \mathrm{x}35,\mathrm{i}36\in \mathrm{x}36| \\ ( \mathrm{i}34\left[1\right]<\mathrm{i}35)\to \mathrm{i}36≔\mathrm{addNoise}(\mathrm{i}34\left[2\right],\mathrm{i}34\left[3\right],\mathrm{i}34\left[4\right]) \\ \wedge \mathrm{x}36\prime ≔\mathrm{x}36\cup \{\mathrm{i}36\left[1\right],\mathrm{i}36\left[2\right],\mathrm{i}36\left[3\right]\} \end{gathered}$$

In Rule (9), an adversary attacks against the individual’s ${\mathrm{A}}^{\mathrm{s}}$ values. Adversary combines the already available BK (i.e., $\mathrm{i}40\left[2\right]$) with the published data (i.e., $\mathrm{i}38\left[2\right]$) and performs attack to disclose the patient’s identity (i.e., $\mathrm{i}2\left[2\right]$) and the sensitive values (i.e., $\mathrm{i}2\left[3\right]$). $\theta$-sensitive k-anonymity model can provide better privacy protection to prevent from attribute disclosure attacks because it considers the high value of variance due to swapping and noise addition in corresponding ECs. The diversity of sensitive attribute values in ECs prevents the adversarial BK and is more effective as compared to the p⁺-sensitive k-anonymity model. Therefore, the adversary did not get private information for the target individual and the attack results in a null value. In Rule (9):

$$\begin{gathered} \mathit{R}(\mathrm{S}-\mathrm{Variance} \mathrm{Attack}):=\forall \mathrm{i}38\in \mathrm{x}38, \mathrm{i}40\in \mathrm{x}40, \mathrm{i}41\in \mathrm{x}41| \\ \mathrm{Att}\_\mathrm{Dis}(\mathrm{i}38\left[2\right],\mathrm{i}40\left[2\right])\ne (\mathrm{i}2\left[1\right]\cup \mathrm{i}2\left[2\right]\cup \mathrm{i}2\left[3\right]) \\ (\mathrm{i}41\left[2\right] \cup \mathrm{i}41\left[3\right])=\varnothing \end{gathered}$$

6. Experimental Evaluation

In this section, the experiments that were performed to show the effectiveness of the proposed $\theta$-sensitive k-anonymity privacy model in comparison to the p⁺-sensitive k-anonymity model are described. The proposed algorithm wisely diversified the A^S values in a balanced way inside each EC without using the categorical approach. The utility and quality of the anonymized released data were checked with numerous quality measures.

6.1. Experimental Setup

All experiments were performed on a machine with an Intel Core i5 2.39 GHz processor with 4 GB RAM, using the Windows 10 operating system. The algorithm was written in Python 3.7. We used the Adults database, which contained age, zip code, salary, and occupation attributes, which is openly accessible at the UC Irvine Machine Learning Repository, https://archive.ics.uci.edu/ml/datasets. We considered the age, zip code, salary as ${\mathrm{A}}^{\mathrm{qi}}\mathrm{s}$ and occupation as ${\mathrm{A}}^{\mathrm{s}}$.

Experimental results show the usefulness of the proposed $\theta$-sensitive k-anonymity privacy model and protection against the categorical similarity attack and sensitive variance attack as compared to the p⁺-sensitive k-anonymity model. The quality of the sanitized publicly released data was evaluated with four utility metrics: discernibility penalty (DCP) [18,38,39], normalized average QI-group (C_AVG) [17,18,38], noise calculation, and query accuracy [18,33]. The execution time of both algorithms was analyzed at the end of the experiments.

6.2. Discernibility Penalty (DCP)

The DCP proposed in [38] and used in [18,39] is an assignment of penalty (cost) to each tuple in the generalized data set. Through this penalty, the sanitized tuple cannot be distinguished among other tuples in the result set. Minimizing the discernibility cost is an optimal objective. The penalty for a tuple t that belongs to an EC of size |EC|, i.e., $\mathrm{t} ϵ \mathrm{EC}$, will be |EC| and the penalty for each EC is ${|\mathrm{EC}|}^2$. The complete DCP penalty for the overall sanitized released dataset $R^{\ast }$ can be seen in Equation (2).

$$\mathrm{DCP} ({\mathrm{R}}^{\ast })={\displaystyle \sum }_{\mathrm{i}=1}^{|\{\mathrm{EC}\}|}{|{\mathrm{EC}}_{\mathrm{i}}|}^2$$

(2)

where $\{\mathrm{EC}\}$ are the total number of ECs in ${\mathrm{R}}^{\ast }$. A baseline can be obtained from the most optimal DCP score calculations as shown in [10]. For example, if k = 2 and the number of anonymized tuples are 10, the DCP optimal score will be $2^2+2^2+2^2+2^2+2^2=20$. This optimal score is called the baseline. The approach to generate groups followed in this paper was based on k size, inclusive of the noise tuple(s). Higher k means bigger group size, so the baseline moves up because of a high DCP score. The p⁺-sensitive k-anonymity model generated groups based on p. It means the number of tuples can be greater than p in a k-anonymous class. Figure 3 shows the DCS score for $\theta$-sensitive k-anonymity, including a comparison with p⁺-sensitive and baseline. In comparison to p⁺-sensitivity, the DCP score, through the proposed $\theta$-sensitive k-anonymity algorithm, is almost equal to the baseline, which implies that the proposed model assigned an optimal penalty to each EC and produced an optimal DCP score. The magnified subplots in Figure 3 with k = 12 and k = 16 for $\theta$-sensitive k-anonymity shows the very minor difference with baseline. This minor difference can also be seen in

Table 11. DCP experiment values for each k.

k	Baseline	θ-Sensitive	p+-Sensitive
2	320300	320303	571227
4	640600	640605	778626
6	960900	960912	1214207
8	1281200	1281215	1467959
10	1601500	1601520	1876310
12	1921800	1921824	2096543
14	2242100	2242145	2632775
16	2562400	2562470	3017773
18	2882700	2882812	3315591
20	3203000	3203166	3628936
Average Val.	1761650	1761697.2	2059994.7
Diff. of θ and p+ avg. values with base avg. value	--	47.2	298344.7
Percent Closer to baseline	--	0.002679235	14.65
% diff. between θ and p+	--	14.64	--
This means that our proposed approach θ-sensitive, k-anonymity is 14.64% better than p+-sensitive k-anonymity and 0.002679% closer to the baseline.

, with an average DCP score of 47.2 or 0.002679% with a baseline obtained from the simulation while calculating the DCP for the anonymized dataset ${\mathrm{R}}^{\ast }$.

6.3. Normalized Average (C_AVG)

C_AVG is another mathematically sound measurement that measures the quality of the sanitized data by the EC average size. It was proposed in [38] and applied in [17,18]. Below in Equation (3), C_AVG can be calculated as

$${\mathrm{C}}_{\mathrm{AVG}}=(\frac{|{\mathrm{R}}^{\ast }|}{|\{\mathrm{EC}\}|})÷k$$

(3)

where $|{\mathrm{R}}^{\ast }|$ is the overall sanitized released dataset and $|\{\mathrm{EC}\}|$ are the total number of ECs in ${\mathrm{R}}^{\ast }$. Data utility and C_AVG are inversely proportional. Low C_AVG value indicates high information utility. The optimal goal is to have a minimum size of ECs in ${\mathrm{R}}^{\ast }$. Figure 4 shows C_AVG for p⁺-sensitive k-anonymity and $\theta$-sensitive k-anonymity over k-anonymity. p⁺-sensitive has lower data utility over small k, where there is a high data utility for large k. The proposed technique has a very balanced and sustainable utility for each input value of k. Thus, the proposed $\theta$-sensitive k-anonymity model performs efficiently for all sizes of k, compared to the p⁺-sensitive k-anonymity model.

6.4. Noise Addition

Among different masking methods, one popular approach is the perturbation of data, i.e., noise addition. These are dummy tuples, added to the original data that helps in achieving the required diversity similar to the differential privacy [22,23]. The reason is if there are not enough ${\mathrm{A}}^{\mathrm{s}}$ values to swap with, especially in the second last and last ECs, the gap is filled with the noise tuples to prevent with disclosure risk. So, one of the reasons for such a good performance of the proposed model is the cost of noise addition. Figure 5 shows the number of tuples added as a noise for different values of k. These tuples are added to achieve the required value of the threshold $\theta$. For different values of k, the algorithm responds differently but the maximum number of noise tuples added for a specific value of k is only six tuples. In the processed “Adult” dataset, the total number of tuples was 160,150 and only 34 noise tuples, i.e., 0.021% of the total size, were added in total. Such an amount of utility loss is negligible. This small amount of noise addition is sometimes due to get a round number when dividing the dataset size by the k size input, for example, 160150/4 = 40037.5 and 160152/4 = 40038.

6.5. Query Accuracy

Query accuracy measures precision for aggregate queries to check the utility of the anonymized data. It has been used by various research works [18,33]. To answer the aggregate queries, the built-in COUNT operator is used, where ${\mathrm{A}}^{\mathrm{qi}}$s are the query predicates. Consider ${\mathrm{R}}^{\ast }$ to be a sanitized release from original microdata $\mathrm{R}$ having maximum m as ${\mathrm{A}}^{\mathrm{qi}}$s$;{ \mathrm{A}}_{\mathrm{i}}^{\mathrm{qi}}$ ($1\le i\le m)$, where $\mathrm{D}({\mathrm{A}}_{\mathrm{i}}^{\mathrm{qi}})$ is the domain of i^th QI. The SQLQuery in Equation (4) for the COUNT query will work as

$$\mathrm{SQLQuery} = \mathrm{select} \mathrm{COUNT}(\ast ){ \mathrm{from} \mathrm{R}}^{\ast }{ \mathrm{where} \mathrm{A}}_1^{\mathrm{qi}}\in \mathrm{D}({\mathrm{A}}_1^{\mathrm{qi}}) \mathrm{AND} ...{ \mathrm{AND} \mathrm{A}}_m^{\mathrm{qi}} \in \mathrm{D}({\mathrm{A}}_m^{\mathrm{qi}})$$

(4)

Against each query, at least one or a few number of tuples should be selected from each EC based on query predicates. Two important parameters for query predicates are (1) query dimensionality q, and (2) the query selectivity $\vartheta$. Query dimensionality comprises of the number of QIs in query predicate while query selectivity is the number of values for each attribute ${\mathrm{A}}_i, (1\le i\le n)$. The query selectivity is calculated as, $\vartheta =\frac{|{\mathrm{T}}_{\mathrm{Q}}|}{|\mathrm{R}|}$, where $|{\mathrm{T}}_{\mathrm{Q}}|$ are the output number of tuples after using query Q on relation R, and $|\mathrm{R}|$ are the total number of tuples in the whole dataset. Query error i.e., Error(Q), is calculated in Equation (5).

$$\mathrm{Error}(\mathrm{Q})=\frac{|\mathrm{count}({\mathrm{R}}^{\ast })-\mathrm{count}(\mathrm{R})|}{\mathrm{count}(\mathrm{R})}$$

(5)

where $\mathrm{count}({\mathrm{R}}^{\ast })$ depicts result set from the COUNT query on an anonymized dataset while $\mathrm{count}(\mathrm{R})$ is the result set from the COUNT query on the original microdata. More selective queries have a high error rate.

Figure 6a shows the query error for the input value of k. We compare the p⁺-sensitive k-anonymity and $\theta$-sensitive k-anonymity using the query error rate for 1000 randomly generated aggregate queries. The error rate increases for the high value of k because of the high range in ${\mathrm{A}}^{\mathrm{qi}}$s. This selects a greater number of tuples than the original microdata and hence high error rate. In Figure 6b, it is depicted that the more we select tuples based on predicates, the higher the error rate will be in the anonymized data.

6.6. Execution Time

Figure 7 shows the execution time for both p⁺-sensitive k-anonymity model and for the proposed $\theta$-sensitive k-anonymity model. The execution time for both of the algorithms increased with an increase in value of k because of the increase in ${\mathrm{A}}^{\mathrm{qi}}\mathrm{s}$ generalization range. Since we did not consider the sensitive values categorization, our approach took a small amount of time to execute as compared to its counterpart. In the $\theta$-sensitive k-anonymity model, a higher execution time for k = 10, k = 16 and k = 20 was because of the time taken to add more noise tuples to achieve the required diversity.

7. Conclusions

In this paper, the huge amount of data (i.e., Big Data) collected through the IoT-based devices were anonymized using the proposed $\theta$-sensitive k-anonymity privacy model in comparison to p⁺-sensitive k-anonymity model. The purpose was to prevent an attribute disclosure risk in anonymized data. The p⁺-sensitive k-anonymity model was considered to be vulnerable to a privacy breach from sensitive variance, categorical similarity, and homogeneity attacks. These attacks were mitigated by implementing the proposed $\theta$-sensitive k-anonymity privacy model using Equation (1). In the proposed solution, the threshold $\theta$ value decides the diversity level for each EC of the dataset. The vulnerabilities in the p⁺-sensitive k-anonymity model and the effectiveness of the proposed $\theta$-sensitive k-anonymity model were formally modeled through HLPN, which further ensures the validation of the proposed technique. The experimental work proved the privacy implementation and an improved utility of the released data using different mathematical measures. For future work consideration, the proposed algorithm can be extended to 1:M (single record having many attribute values) [40], to multiple sensitive attributes (MSA) [41,42,43], or can be modeled by considering the dynamic data set [44] approach.