KR101969126B1 - System and method for recommending public data generalization level guaranteeing data anonymity and useful to data analysis - Google Patents

Abstract

The present invention relates to a public data generation system and method useful for data analysis while ensuring data anonymity. The system includes a K-value anonymity condition for the original data and a generalization level definition A generalization level combination generator for generating all possible generalization level combinations within the allowable range of the generalization level for each attribute defined; a generalization level combination for calculating the anonymity rate and the balance rate for each of the generated generalization level combinations And a generalization level combination recommendation unit for evaluating the values of each combination in consideration of the calculated anonymity rate and balance rate calculation unit and the calculated balance rate and anonymity rate of the combination and providing a predetermined number of generalization level combinations in order of value , It is possible to prevent the identification of the sensitive information of the data, For use in seats and able to have enough information to have the data.

Description

BACKGROUND OF THE INVENTION 1. Field of the Invention [0001] The present invention relates to a system and method for generating public data that is useful for data analysis while ensuring data anonymity.

The present invention relates to a system and method for generating public data, and more particularly, to a system and method for generating public data, and more particularly to a system and method for generating public data, To a public data generation system and method for generating public data useful for analysis.

With the introduction of new technologies such as the Internet of things, cloud computing, and big data, the amount and type of data to be processed has increased, and the disclosure and sharing of data containing sensitive information of individuals has become active. However, data containing such sensitive information increases the likelihood of identifying an individual in the data, and identification of an individual increases the risk of abuse of such information by causing the leakage of sensitive information of the individual. Accordingly, when disclosing data, it is necessary to unidentify the data so that a particular individual is not identified in order to prevent leakage of sensitive information of the individual. When data is unidentified, identifiers that can identify individuals must be removed, and quasi identifiers that allow individuals to be identified by a combination of attributes that can not be identified by a single attribute should be anonymized . In order to anonymize the semi-identifier, the generalization level of the semi-identifier attributes should be adjusted. Increasing the generalization level of the semi-identifier attribute increases the number of records of the same information, and it becomes difficult to identify the record.

As a method of anonymizing data, a method of satisfying K-anonymity has been studied. The K-anonymity technique is a link-defense-protected privacy protection model that reduces the association of a database to prevent individuals from being identified in the data set. First, a K value (where K is a coefficient indicating the level of anonymity) is determined, and in a given data set, the quasi-identifier attribute values have at least K records having the same value so that they can not be easily combined with other information. This modifies a portion of the data set so that all records have the same (non-distinct) K-1 records as themselves.

Referring to the table above, there is a hospital record of a disease, including a 28-year-old male Hong Gil-dong in a 13053 area of prostatitis, a 21-year-old male Hong Gil Nam, who lives in a prostate- A 29 - year - old woman named Hong Gil - ja, a 23 - year - old female living in 13053 with hypertension, is included in the record. The original data before applying K-anonymity can identify individuals with certain diseases through the 'break', 'area code', 'age' and 'gender' attributes. The data to be released is generalized to [semi-code, age, sex], which is a semi-identifier, in order to generate data that satisfies anonymity. If anonymization is performed so that individuals are not identified from these four records, at least four data are handled in the same form with a K value of 4, and the data can be expressed as [130, 2, P]. As a result of applying anonymity, the records in the table have three or more records each having the same information, and all four of them are the same information. The concept of K-anonymity is to make K or more identical records so that any kind of illness is not rediscovered.

As we have seen, if K value is 1, all values can be distinguished in the same form as existing database, but anonymization is impossible. Conversely, an increase in K will increase anonymity, but if the K value is infinite, it will not be possible to distinguish all the contents of the database. Thus, if only the purpose of satisfying K-anonymity is aimed at, the anonymity is increased but the amount of information held by the data is small. The information here is the degree of detail of the data. For example, if the value of the birthdate attribute is '861215', it has all the information up to 'year, month, and day', but if it is anonymous '8612 **' There is no information about 'work'. In this case, the latter data is less information than the former. As the level of anonymization of data increases, there is less data representing the value of each property, so the number of records having the same information increases and the amount of information possessed by the data is small. This is an anonymity, Since the data having only information is analyzed, the value as analytical data may be deteriorated. And if the value of the data is low, the accuracy of the data analysis is likely to fall.

The anonymization of existing data guarantees the anonymity of the data, but there is a problem that it is not certain that sufficient information is needed to use the data again for analysis. Therefore, there is a need for an anonymizing method that keeps the value of the data by keeping the minimum generalization level for each data attribute while satisfying the K-anonymity to some extent, while making the statistical characteristic of the data as possible as possible while making it impossible to identify the individual.

Korean Patent Publication No. 10-2012-0063050 (June 15, 2012) Korean Patent Laid-Open Publication No. 10-2013-0049528 (2013.05.14)

SUMMARY OF THE INVENTION Accordingly, the present invention has been made keeping in mind the above problems occurring in the prior art,

In order to ensure that the disclosure of data has sufficient information to utilize the published data for data analysis while preventing the identification of the sensitive information of the data, Data that meets data anonymity can be generated as open data while minimizing the level of generalization as much as possible.

And to provide a public data generation system and method.

In order to achieve the above object, a public data generation system useful for data analysis while ensuring data anonymity of the present invention includes a K-value anonymity condition for original data and a generalization level acceptable range for each quasi-identifier attribute A generalization level combining unit for generating all possible generalization level combinations within the allowable range of the generalized level defined by the attribute, and anonymity rate and balance rate for each of the generated generalization level combinations according to the attribute A generalization level combination which evaluates the value of each combination in consideration of the calculated anonymity rate and balance rate calculation unit and the calculated balance rate and anonymity rate of the combination and provides a predetermined number of generalization level combinations in order of value Recommendation section.

Meanwhile, a public data generating method useful for data analysis while ensuring data anonymity of the present invention includes a generalization level defining step of defining a K value, which is a K-anonymity condition for original data, and a generalization level allowable range for each semi-identifier property,

A generalization level combination generation step of generating all possible generalization level combinations within the defined generalization level tolerance defined for each attribute, anonymization rate and anonymity ratio calculation method for calculating anonymity rate and balance rate for each of the generated generalization level combinations by attribute, And a generalization level combination recommendation step of evaluating the value of each combination in consideration of the calculated balance rate and anonymity rate of the combination and providing a predetermined number of generalization level combinations in the order of higher value.

As described above, the open data generation system and method useful for data analysis while ensuring data anonymity according to the present invention provides the following effects.

Identifying the sensitive information of the data by providing the level of data generalization that satisfies the data anonymity by adjusting the generalization level of the semi-identifier attribute within the range of the generalization level selected by the person to be disclosed in the data disclosure. But also to have enough information for the data to be used for data analysis again.

FIG. 1 is a block diagram schematically showing an overall configuration of a public data generating system useful for data analysis while ensuring data anonymity according to an embodiment of the present invention. Referring to FIG.
FIG. 2A is a table showing an exemplary generalization level according to an exemplary quasi-identifier attribute according to an exemplary embodiment of the present invention.
FIG. 2B is a tree diagram illustrating the structure of an exemplary gender attribute generalization level according to an embodiment of the present invention.
FIG. 2C is a tree diagram illustrating a structure of a generalization level of an exemplary trial attribute according to an embodiment of the present invention. FIG.
FIG. 2D is a tree diagram illustrating the structure of the generalization level of an exemplary age attribute according to an embodiment of the present invention. FIG.
FIG. 2E is a tree diagram illustrating a structure of a generalization level of an exemplary income quadrant attribute according to an embodiment of the present invention.
FIG. 2F is a diagram showing a structure of a generalized level of an exemplary base year attribute according to an embodiment of the present invention.
3 is a table of distinguished records for original data generated by a generalization level combination generator according to an embodiment of the present invention.
4 is a flowchart illustrating an overall flow of a public data generation method useful for data analysis while ensuring data anonymity according to an embodiment of the present invention.
FIG. 5 is a flowchart illustrating a data structure of each step in a public data generation method useful for data analysis while ensuring data anonymity according to an embodiment of the present invention.

BRIEF DESCRIPTION OF THE DRAWINGS The advantages and features of the present invention and the manner of achieving them will become apparent with reference to the embodiments described in detail below with reference to the accompanying drawings. The present invention may, however, be embodied in many different forms and should not be construed as being limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the concept of the invention to those skilled in the art. Is provided to fully convey the scope of the invention to those skilled in the art, and the invention is only defined by the scope of the claims. Like reference numerals refer to like elements throughout the specification.

And the terms used in the following detailed description are predefined as follows.

An identifier is a property that is uniquely assigned to directly identify an individual. For example, a resident registration number, a passport number, an alien registration number, a driver's license number, a medical record number, a health insurance number, . A quasi-identifier is an attribute that can not identify a record as a single attribute but can identify a record by a combination of two or more attributes. For example, age, sex, zip code, blood type, height, weight . Attribute value is sensitive information related to an individual and can easily identify a specific individual when easily combined with other information such as age, gender, nationality, address, postal code, military service, marital status, religion , And hobbies.

As we have seen in the background, anonymization is an adjustment of data in order to prevent identification of open data. In the present invention, anonymization is performed by adjusting the level of generalization of data. The data generalization level refers to the level of information that the data has. If the amount of information possessed by the data is high, the level of generalization is low. If the information possessed by the data is small, the level of generalization is high. Low level of generalized data can reduce the amount of lost information and can improve the accuracy of the analysis due to accurate data values. However, when the data is released with low generalization level, it is sensitive to leakage because it contains a lot of information. On the other hand, data with high generalization level may be less accurate because of the large amount of information lost, but it is less sensitive to information leakage because the amount of information is small. In the present invention, the target of definition of the data generalization level is set as the semi-identifier attribute of the original data after removing the identifier attribute from the original data.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS A public data generating system useful for data analysis while assuring data anonymity of the present invention will be described in detail with reference to the accompanying drawings.

FIG. 1 is a block diagram schematically showing an overall configuration of a public data generating system useful for data analysis while ensuring data anonymity according to an embodiment of the present invention. Referring to FIG.

1, a public data generation system according to an exemplary embodiment of the present invention includes a generalization level definition unit that defines a K value, which is a K-anonymity condition for original data, and a generalization level allowable range for each quasi identifier attribute 100), a generalization level combination generator (200) for generating all possible generalization level combinations within an allowable generalization level allowable range based on the allowable generalization level per attribute defined in the generalization level defining unit (100) An anonymity rate and balance rate calculation unit 300 for calculating anonymity rate and balance rate for each of the generalization level combinations for each attribute generated by the generalization level combination generation unit 200 and anonymity rate And the balancing rate calculating unit 300, the value of each combination is evaluated in consideration of the balancing rate and anonymity rate of each combination, and a predetermined number of generalization levels It comprises a generalized level combinations like portion 400 to provide a sum. The disclosed public data generation system of the present invention allows the publicizer who has recommended the generalization level combinations to select a generalized level combination that is considered most efficient for data analysis among the recommended generalized level combinations and satisfies the selected generalized level combination The data that satisfies the anonymity condition is generated as the open data, and the data that does not satisfy the anonymity condition can be generated as the pending data.

The generalization level defining unit 100 defines a K-value, which is a K-anonymity condition for the original data, and a generalization level allowable range for each quasi-identifier attribute. The generalization level defining unit 100 may receive a K value corresponding to a characteristic of analyzing data released from a person who wants to disclose data (hereinafter referred to as a publicizer) and a generalization level acceptable range for each quasi identifier attribute. The generalization level allowance for each attribute is the allowable range of generalization level for each attribute that the public thinks. For example, if the generalization level of an attribute is from 0 to 5, and the publicizer has a generalization allowance of 1 to 3, then the publisher will enter the level 1 to 3 as the generalization level tolerance of that attribute.

Specifically, in the present invention, as described above, the data generalization level is defined as a quasi-identifier attribute of the original data. Thus, the generalization level of each quasi-identifier attribute is as shown in FIG. The generalization 0 level of each attribute is the original data state where no generalization is performed, and the generalization maximum level of each attribute is the most generalized according to the property of each attribute.

For example, suppose that the semi-identifier attribute is gender, attempt, age group, income quintile, base year. The generalization level tree according to each quasi-identifier attribute is as shown in Figs. 2B to 2F.

The generalization level of the gender attribute is composed of a tree as shown in FIG. 2B, and the level is 0 to 1. The first level consists of one node, which is a group of all genderless genders, and the 0 level consists of two nodes, the sex and the sex.

The generalization level of the trial attribute is composed of a tree as shown in FIG. 2C, and the level is 0 to 3. The third level is composed of one node, which is a group containing all the attempts that are not divided into trials. The second level is composed of two nodes, Central and South, and the first level is the metropolitan area, Kangwon area, Chungcheong area, It is composed of 7 nodes of Southeast, Honam and Cheju. 0 level is Seoul, Gyeonggi, Incheon, Gangwon, Chungbuk, Sejong, Chungnam, Daejeon, Gyeongbuk, Daegu, Ulsan, Busan, Gyeongnam, Jeonbuk, Jeonnam, It consists of 17 nodes.

The generalization level of the age attribute is composed of a tree as shown in FIG. 2D, and the level is 0 to 4. Age group attributes are grouped into 5-year-olds from 0 to 99 years old, and those over 100 years old are grouped as '100 years old or older'. 0 to 4 years are expressed as 0 in the leaf node, 5 to 9 years are expressed as 1, and so on. Thus, groups 0 to 99 are represented as nodes 0 to 19, and node 20 is represented as 100 years or more. 4 levels are divided into two groups of 0 ~ 12 and 13 ~ 20 levels in the 3rd level and 0 ~ 4, 5 ~ 8, 9 ~ 12, 13 ~ 16, and 17 to 20 nodes. 1 level is composed of 10 nodes of 0 to 2, 3 to 4, 5 to 6, 7 to 8, 9 to 10, 11 to 12, 13 to 14, 15 to 16, 17 to 18, 19 to 20, The last 0 level consists of 21 nodes grouped into the 5-year-old units described above.

The generalization level of the income class attribute is composed of a tree as shown in FIG. 2E, and the level is 0 to 3. The income quintile is a node, which is a general criterion. The third level consists of one node, which is a group of all income quintiles. The second level consists of two nodes, 1 ~ 6, 7 ~ 10. The first level consists of five nodes of 1 ~ 2, 3 ~ 4, 5 ~ 6, 7 ~ 8, 9 ~ 10, and 0 level consists of 10 nodes over the income of 0 ~ 10.

The generalization level of the base year attribute is composed of a tree as shown in FIG. 2f, and the level is 0 to 3. The base year range is from 2006 to 2015. The third level consists of one node, which is the entire base year group. The second level consists of two nodes, 2006 ~ 2011 and 2012 ~ 2015. The first level consists of five nodes: 2006 ~ 2007, 2008 ~ 2009, 2010 ~ 2011, 2012 ~ 2013, and 2014 ~ 2015, and the 0 level consists of 10 nodes each year of 2006 ~ 2015.

The generalization level combination generation unit 200 generates all the generalization level combinations that satisfy the generalization level range of each attribute based on the generalization level allowable range defined by the generalization level definition unit 100.

As an example of the above, it is assumed that the generic identifier attributes (generality) generated according to the generalization level tolerance range (box 510 in FIG. 5) defined by the generalization level defining unit 100 for gender, attempt, age group, Level combinations are the same as box 520 of FIG. Referring to box 520 of FIG. 5, column 1 of the generalization level combination has all possible generalization levels within the defined gender attribute generalization level tolerance, and column 2 contains all possible generalizations levels , And column 3 contains all possible generalizations within the defined income level attribute generalization level allowance.

The generalization level combination generator 200 generates data satisfying the respective generalization level combinations generated for the original data, and generates a discrimination result for each of the records having the same value of each attribute in the generated data as a set Create a record table.

As an example of the above, according to the respective generalization level combinations (box 520 in FIG. 5) generated for the original data (box 500 in FIG. 5) in which the semi-identifier attribute is gender, attempt, age range, 5 is the same as box 530 of FIG.

3 is a table of distinguished records for original data generated by a generalization level combination generator according to an embodiment of the present invention. Records having the same value among the records of the original data are bundled and stored together with their size information. Referring to FIG. 3, since the four records of the original data have the same value, the four records are grouped into one set in the distinguished record table, and the size information of '4' is also stored together. As described below with respect to the anonymity rate and balance rate calculation unit 300 according to the generalization level combination, when the anonymity rate and balance rate calculation unit 300 according to the generalization level combination performs the anonymity test, the anonymity condition K Compare the value with the size of each set. In the case of the anonymity condition K being 10, it is said that the anonymity condition is not satisfied because the set having the size 4 of the records in the distinguished record table illustrated in FIG. 3 is smaller than 10.

Based on the data generated by the generalization level combination generator 200, the anonymity rate and the balance rate calculator 300 for each generalization level combination can calculate the sum of the generalization level combinations for each attribute generated by the generalization level combination generator 200 Calculate the anonymity rate and the balance rate.

First, anonymity rate refers to the ratio of data that can be generated as public data through the anonymity satisfaction test for the K value, which is the anonymity satisfaction condition defined in the generalization level definition unit 100, It says. The anonymity rate is calculated for the generalization level combination, and the higher the value, the higher the generalization level combination.

These anonymous rate is the ratio of the number of satisfactory data anonymity conditions (n ') to the total number of data (n). The anonymity rate can be expressed as: < RTI ID = 0.0 >

The anonymity rate is greater than 0 and less than 1. For example,

, The anonymity rate of this combination is 800/1000 = 0.8 when the total number of data records is 1000 and the number of records satisfying the K value of the anonymity condition is 800.

Second, the balance rate refers to the degree of uniformity of the size of each record set in the differentiated record table (see FIG. 3) generated according to each generalized level combination in the generalized level combination generator 200. A generalized level combination with a high degree of balancedness proves that the records are evenly distributed without being concentrated in a particular set.

This balancing rate is calculated as the number of record sets satisfying the anonymity condition ( m ' ) for the total number ( m ) of records in the distinguished record table. The balance rate of the distinguished record table can be expressed by the following Equation 2:

In Equation (2), m is an ideal total number of record sets. Given an entire data set and an anonymity satisfaction criterion, given the value K, the total number of records is the total number of records assuming that the size of the entire record satisfies K. m ' is the number of recordsets whose size is greater than K. For example, if the total number of data records is 1000, and the anonymity condition K is 3, then m has a value of 33. At this time, if there are 20 recordsets satisfying anonymity, the balance rate is calculated as 20/33 = 0.606 .... Thus, the balancing rate indicates how much the size of each set of records is balanced in the distinguished record table, and whether the records are clustered or evened in one set by looking at the balance rate.

As an example of the above, it is the same as Box 540 of FIG. 5 to represent the combined anonymity and balance ratios calculated for the respective generalization level combinations (box 520 in FIG. 5) for the preprocessed data (box 530 in FIG. 5) .

The generalization level combination recommendation unit 400 evaluates the values of each combination in consideration of the balance rate and anonymity rate of each combination calculated in the anonymity rate and balance rate calculation unit 300 for each generalization level combination, Lt; / RTI > At this time, the value of each combination may be provided together.

Specifically, the generalization level combination recommendation unit 400 refers to anonymity rate and anonymity rate when the balance rate is the highest among all generalization level combinations for the anonymity rate and the balance rate calculated in the anonymity rate and balance rate calculation unit 300 according to the generalization level combination Find combinations with larger anonymity rates, and provide a certain number of combinations of generalization levels in the order of their anonymity and equilibrium rates closer to their optimal value (1,1).

As an example of the above, if the anonymity rate value when the balance rate is the largest in the combination anonymity rate and balance rate (box 540 in FIG. 5) calculated for each generalization level combination (box 520 in FIG. 5) (0.525, 0.824), 02112 (0.525, 0.814), 02022 (0.510, 0.863), 02202 (0.519, 0.803) in anonymity ratio of 0.8 or more. Provides a predetermined number of combinations of generalization levels for the combinations found in order of their closeness to the optimal value of (1, 1).

In addition, a publisher who recommends generalization level combinations can choose among the recommended generalization level combinations the generalization level combinations that are considered most efficient for data analysis, generate data satisfying the selected generalization level combination, The data that satisfies the condition of sex is generated as the public data, and the data that does not satisfy the condition of anonymity can be generated as the pending data.

In addition, the open data generation system according to an embodiment of the present invention may further include a database unit 500. The database unit 500 includes an original data DB 510 for storing original data to be disclosed, A generalization level DB 520 for storing a K value defined in the definition unit 100 and a generalization level allowable range for each quasi identifier attribute, generalization level combinations generated in the generalization level combination generation unit 200, A generalization level combination DB 530 for storing a record table distinguished from the preprocessed data and the preprocessed data in accordance with the anonymity rate and the balance rate calculated for each of the generalization level combinations by attribute, Rate DB 540. [0052]

Hereinafter, a public data generation method useful for data analysis while ensuring data anonymity of the present invention using the system configured as described above will be described. This will be described in detail as follows.

4 is a flowchart illustrating an overall flow of a public data generation method useful for data analysis while ensuring data anonymity according to an embodiment of the present invention.

4, first, the generalization level defining unit 100 sets the K value, which is the K-anonymity condition for the original data (box 500 in FIG. 5), and the generalization level allowable range (box 510 in FIG. 5) (S410). At this time, the generalization level defining unit 100 may receive the K value corresponding to the characteristic of analyzing the data released from the discloser and the generalization level allowable range according to the semi-identifier attribute.

Next, the generalization level combination generator 200 generates all possible generalization level combinations (box in FIG. 5) based on the generalization level allowable range per attribute defined in the generalization level defining unit 100, 520) (S420).

Then, the generalization level combination generator 200 generates data (box 530 in FIG. 5) that satisfies the respective generalization level combinations generated for the original data, and stores the records having the same value in the generated data A separate record table (see FIG. 3) having one set is generated (S430).

Then, based on the data generated by the generalization level combination generator 200, the anonymity rate and balance rate calculation unit 300 for each generalization level combination generates the generalization level combination for each attribute generated by the generalization level combination generator 200 Anonymity rate and balance rate (540 in FIG. 5) are calculated for each of the users (S440). At this time, the method of calculating the anonymity rate and the balance rate is as described above with respect to the anonymity rate and the balance rate calculation unit 300 according to the generalization level combination.

Finally, the generalization level combination recommendation unit 400 evaluates the values of the respective combinations in consideration of the balance rate and anonymity rate calculated in the anonymity rate and balance rate calculation unit 300 for each generalization level combination, (Box 550 of FIG. 5). ≪ / RTI > At this time, the generalization level combination recommender 400 determines whether the anonymity rate and the balance rate calculated by the anonymity rate and balance rate calculation unit 300 according to the generalization level combination are greater than the anonymity rate when the balance rate is the maximum among all the generalization level combinations Find combinations with large anonymity rates, and provide a predetermined number of combinations of generalization levels in order of their anonymity and balance rate being close to their optimal value (1,1).

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the present invention is not limited to the disclosed exemplary embodiments, but various modifications may be made without departing from the spirit of the invention.

100: generalization level definition unit
200: generalization level combination generator
300: Anonymity rate and balance rate calculation unit by generalization level combination
400: generalization level combination recommendation unit
500:

Claims (6)

A generalization level defining unit that defines a K-anonymity condition for the original data and a K-value and a generalization level acceptable range for each semi-identifier attribute;
A generalization level combination generator for generating all possible generalization level combinations within the defined generalization level tolerance for each attribute;
Anonymity rate and balance rate calculation unit for each combination of generalization level combinations for calculating anonymity rate and balance rate for each of the generated generalization level combinations; And
And a generalization level combination recommendation unit for evaluating values of each combination in consideration of the calculated balance ratio and anonymity rate of the combination, and providing a predetermined number of generalization level combinations in order of value,
Wherein the generalization level combination generator generates data satisfying each of the generalization level combinations generated for the original data and generates a discriminated record in which the records having the same value as each attribute in the generated data are a set Create a table,
Wherein the anonymity rate is a ratio of the K value satisfying data to the entire original data,
The balance rate represents an equal degree of size of each record set in the distinguished record table,
Wherein the generalization level combination recommendation unit selects a combination of a predetermined number of generalization level combinations in order of the anonymity rate and the balance rate closer to 1 out of the combinations having anonymity rate larger than the anonymity rate when the balance rate is maximum among all the generalization level combinations generated, To the public data. delete delete A generalized level definition step that defines a K-anonymity condition for the original data and a K-value and a generalization level allowable range for each semi-identifier property;
A generalization level combination generation step of generating all possible generalization level combinations within the defined generalization level tolerance for each attribute;
Anonymity rate and balance rate calculation step of calculating anonymity rate and balance rate for each of the generated generalization level combinations by the generalization level combination; And
Evaluating the values of the respective combinations in consideration of the calculated balance rate and anonymity rate of the combination, and providing a predetermined number of combinations of generalized levels in order of value;
Wherein the generalization level combination generation step comprises:
Generating data satisfying each of the generalization level combinations generated for the original data; And
Generating a distinguished record table in which the records having the same value of each attribute in the generated data are a set,
Wherein the anonymity rate is a ratio of the K value satisfying data to the entire original data,
The balance rate represents an equal degree of size of each record set in the distinguished record table,
The generalization level combining recommendation step may include a step of, in a case where the anonymity rate and the balance rate are close to 1 among the combinations having anonymity rate larger than the anonymity rate when the balance rate is the maximum among all the generalization level combinations generated, A combination of the public data and the public data. delete delete

Images