Abstract:Human mobility trajectories are increasingly collected by ISPs to assist academic research and commercial applications. Meanwhile, there is a growing concern that individual trajectories can be de-anonymized when the data is shared, using information from external sources (e.g., online social networks). To understand this risk, prior works either estimate the theoretical privacy bound or simulate de-anonymization attacks on synthetically created datasets. However, it is not clear how well the theoretical estimations are preserved in practice. In this article, we collected a large-scale ground-truth trajectory dataset from 2,161,500 users of a cellular network, and two matched external trajectory datasets from a large social network (56,683 users) and a check-in/review service (45,790 users) on the same user population. The two sets of large ground-truth data provide a rare opportunity to extensively evaluate a variety of de-anonymization algorithms (nine in total). We find that their performance in the real-world dataset is far from the theoretical bound. Further analysis shows that most algorithms have under-estimated the impact of spatio-temporal mismatches between the data from different sources, and the high sparsity of user generated data also contributes to the under-performance. Based on these insights, we propose four new algorithms that are specially designed to tolerate spatial or temporal mismatches (or both) and model location contexts and time contexts. Extensive evaluations show that our algorithms achieve more than 17 percent performance gain over the best existing algorithms, confirming our insights. Further, we propose two new location-privacy preserving mechanisms utilizing the spatio-temporal mismatches to better protect users' privacy against the de-anonymization attack. Evaluation results show that our proposed mechanisms can reduce the performance of de-anonymization attacks by over 8.0 percent, demonstrating the effectivene-s of our insights.

Mapping the Privacy-Utility Tradeoff in Mobile Phone Data for Development

The tradeoff between the utility and risk of location data and implications for public good

Temporal and cultural limits of privacy in smartphone app usage

Money Walks: A Human-Centric Study on the Economics of Personal Mobile Data

Anonymous or Not? Understanding the Factors Affecting Personal Mobile Data Disclosure

Privacy Guarantees for Personal Mobility Data in Humanitarian Response

Exposures Exposed: A Measurement and User Study to Assess Mobile Data Privacy in Context

Knowing Your Population: Privacy-Sensitive Mining of Massive Data

On the Trade-Off Between Privacy and Utility in Mobile Services - A Qualitative Study.

Towards Standardized Mobility Reports with User-Level Privacy

Predicting poverty and wealth from mobile phone metadata

Exploring the tradeoff between data privacy and utility with a clinical data analysis use case

Dynamic population mapping using mobile phone data

Anonymization and De-Anonymization of Mobility Trajectories: Dissecting the Gaps Between Theory and Practice

Managing Your Private and Public Data: Bringing Down Inference Attacks Against Your Privacy

Connecting the Dots: User Privacy is Not Preserved in ID-Removed Cellular Data

Privacy Preserving Techniques Applied to CPNI Data: Analysis and Recommendations

Location Privacy in Mobile Big Data: User Identifiability Via Habitat Region Representation

Mobile Communication Signatures of Unemployment

Enabling Humanitarian Applications with Targeted Differential Privacy

Utility-based Anonymization for Privacy Preservation with Less Information Loss