This article has been accepted for publication in a future issue of this journal, but has not been

fully edited. Content may change prior to final publication. Citation information: DOI
10.1109/ACCESS.2020.3045700, IEEE Access

Date of publication xxxx 00, 0000, date of current version xxxx 00, 0000.
Digital Object Identifier 10.1109/[Link]

Anonymization Techniques for Privacy

Preserving Data Publishing: A
Comprehensive Survey
ABDUL MAJEED1 and SUNGCHANG LEE1 , (Member, IEEE)
1
School of Information and Electronics Engineering, Korea Aerospace University, Deogyang-gu, Goyang-si, Gyeonggi-do 10540, South Korea (e-mail:
abdulmajid09398@[Link], sclee@[Link])
Corresponding author: Sungchang Lee (Email: sclee@[Link], Tel.: +82-10-3232-5237, Fax: +82-2-3159-9969)

ABSTRACT Anonymization is a practical solution for preserving user’s privacy in data publishing. Data
owners such as hospitals, banks, social network (SN) service providers, and insurance companies anonymize
their user’s data before publishing it to protect the privacy of users whereas anonymous data remains
useful for legitimate information consumers. Many anonymization models, algorithms, frameworks, and
prototypes have been proposed/developed for privacy preserving data publishing (PPDP). These mod-
els/algorithms anonymize users’ data which is mainly in the form of tables or graphs depending upon the
data owners. It is of paramount importance to provide good perspectives of the whole information privacy
area involving both tabular and SN data, and recent anonymization researches. In this paper, we presents
a comprehensive survey about SN (i.e., graphs) and relational (i.e., tabular) data anonymization techniques
used in the PPDP. We systematically categorize the existing anonymization techniques into relational
and structural anonymization, and present an up to date thorough review on existing anonymization
techniques and metrics used for their evaluation. Our aim is to provide deeper insights about the PPDP
problem involving both graphs and tabular data, possible attacks that can be launched on the sanitized
published data, different actors involved in the anonymization scenario, and major differences in amount of
private information contained in graphs and relational data, respectively. We present various representative
anonymization methods that have been proposed to solve privacy problems in application-specific scenarios
of the SNs. Furthermore, we highlight the user’s re-identification methods used by malevolent adversaries
to re-identify people uniquely from the privacy preserved published data. Additionally, we discuss the
challenges of anonymizing both graphs and tabular data, and elaborate promising research directions. To
the best of our knowledge, this is the first work to systematically cover recent PPDP techniques involving
both SN and relational data, and it provides a solid foundation for future studies in the PPDP field.

INDEX TERMS Privacy preserving data publishing, anonymization, privacy, utility, relational data, graphs
data, social networks, relational and structural anonymization, information privacy, adversary

I. INTRODUCTION themselves by watching digital contents. Meanwhile, the SNs

Most organizations such as hospitals, banks, insurance com- collect and store the relevant data about their users during
panies, and supermarkets collect relevant customers/ sub- the service provisioning, and at the time of account creation
scribers data to improve service quality (SQ). Apart from (i.e., joining the SNs). This collected data often contains in-
these physical organizations, an excessive amount of user’s formation about the user’s activities, demographics, finance,
data is collected by the virtual platforms such as social hobbies, location, perceptions, interests, preferences, politi-
networks (SN) service providers due to the extensive use of cal and religious views, online communities, and opinions.
SN all around the world. With the significant advancement in Furthermore, most users readily post other valuable data
the information and communication technologies (ICT), SNs including preferences in music, viewing choices, and social
enable people to interact with their friends, make new friends, problems such as an epidemic outbreak. Research has shown
seek information about the relevant subject matter or jobs, that analysis of this collected data with advanced data mining
spread reliable information at low cost, and also to entertain tools can assist organizations in improving SQ significantly.

VOLUME 4, 2016 1

This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see [Link]
 This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI
10.1109/ACCESS.2020.3045700, IEEE Access

Author et al.: Preparation of Papers for IEEE TRANSACTIONS and JOURNALS

For instance, it allows them to understand social trends, the sensitive attribute (SA), online groups affiliations, and
people’s sentiments and behaviors, and factors causing a cer- locations. Researchers have extended the concepts used for
tain disease outbreak. Accordingly, such information can be the tabular data anonymization to protect SN’s users privacy
leveraged for many scientific or business objectives including [24]–[26]. The two popular anonymization approaches used
targeted advertisement, relevant content recommendations, for the SN data are: naive and structural anonymization.
and effective decision making [1], [2]. Although the data In naive anonymization, only social link structure is pub-
sharing brings innovation and enables better decision mak- lished by removing the edges and nodes labels from the
ing, it may also jeopardize the privacy of users due to the G. However, Backstrom et al. [27] suggested that naive
existence of sensitive information in the data [3]. anonymization is prone to identity disclosure because the
Before publishing the users’ data with the researchers structure of the released graph may reveal the identity of the
or third parties, data owners ensure that the user’s private individuals corresponding to the nodes. In contrast, the struc-
information privacy is protected. This is typically done via tural anonymization approaches modify the structure of G to
data anonymization, which transforms the original data by effectively protect the user’s privacy. These approaches add
applying some operations on it to effectively protect user’s new edges, vertices, and/or modify the existing G structure
privacy without degrading the anonymous data utility [4]. to fulfill the privacy and utility requirements. For instance, in
Privacy preserving data publishing (PPDP) provides set of the k-degree anonymity [28], the G containing users and their
models, tools, and methods to safeguard against the privacy relationships is modified in such a way that each user U in a
threats that emerge from the data releasing with data miners G has the degree k. In some cases, the sensitive information
or analysts [5]. In recent years, PPDP has received con- (i.e., link information) is removed from the G for some users
siderable attention from the research community, and many during SN data anonymization. Zheng et al. [29] proposed a
approaches have been proposed for both SN and tabular data framework for preserving sensitive link information privacy
anonymization [6]–[10]. There are two famous settings of in SN data anonymization. Aside from the edges and vertices
PPDP, non-interactive and interactive [11]. In the former addition/deletion, advanced techniques such as edges switch
setting, the data owner publishes the complete dataset in an and rotation have also been proposed to solve the users’
anonymized form after applying some modifications on the privacy problems in SN data anonymization [30].
original data. However, in the later setting, the data owner The existing surveys related to PPDP cover important
does not publish the whole data set in a sanitized form like aspects such as anonymization techniques, anonymization
the former setting. Instead, data owner provides an interface operations, privacy models, data anonymity frameworks, and
to the data miners through which they may pose different sta- evaluating metrics employed by the PPDP mechanisms. Fung
tistical queries about the related data and get (possibly noisy) et al. [31] study systematically summarized and evaluated
answers. The k-anonymity model [12], and its ramifications different approaches used in the PPDP. Rajendran et al. [32]
are most widely used in the non-interactive setting of PPDP explained three prominent and most widely used anonymiza-
[13]–[17]. These approaches apply some modifications on tion models in a medical field, namely k-anonymity, `-
the original values of quasi identifiers, and protect the user’s diversity, and t-closeness. Gkoulalas et al. [33] presented a
privacy by making information less-specific. The differential comprehensive survey about the privacy threats and privacy
privacy (DP) [18], and DP based approaches are mostly models used in the PPDP. The authors provided details about
used in an interactive setting of PPDP [19]–[21]. Meanwhile, fourty-five anonymity algorithms in their study. Tran et al.
some studies have reported the DP based approaches for [34] presented a detailed survey about the privacy-preserving
non-interactive setting [22]. Both k-anonymity and DP based big data analytics. The authors explained the related studies
anonymization approaches, and their improved versions have and provided details about various PPDP practical scenarios
been extensively used in the PPDP. that needs further development from research community. In
In recent years, SN data is also published with the data- addition, researchers have presented surveys about the PPDP
minders for accomplishing multiple scientific and business techniques used in the big data era [35], [36]. A few surveys
objectives due to the phenomenal growth in SN use around address the SN data publishing problems, but only consid-
the globe [23]. SNs data is mostly in a graph G form, and ering possible breaches and briefly mentioning the privacy
it provides unprecedented opportunities for advanced data problems that emerge from SN users’ data publishing. Yang
analytics. A social graph data G(U, V ), where U is the list et al. [37] explained about the attack models and counter-
of users and V represents the set of edges modelling the measures in SN data publishing. The authors surveyed and
relationship between the users. The social connection among categorized the PPDP algorithms into two categories, namely
users in SNs can be of different types such as friend, sibling, anonymization and DP. Siddula et al. [38] provided a survey
and lover. Generally, each user in a SN has two types of the about the privacy models and methods used for the SN user’s
social connections. Among these connections, there is a set privacy protection. The authors explained the mechanism
of public connection (Vp ), and other connection Vs = V \ Vp used for the edges and nodes privacy protection in publishing
that are set private by the users, which needs privacy protec- G. Zho et al. [39] presented a survey about the anonymization
tion. Aside from the Vs privacy protection, there are many techniques used for SN data, and discussed the challenges
aspects in which SN users want privacy protection such as involved in the G anonymization compared to the relational
2 VOLUME 4, 2016

This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see [Link]
 This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI
10.1109/ACCESS.2020.3045700, IEEE Access

Author et al.: Preparation of Papers for IEEE TRANSACTIONS and JOURNALS

data anonymization. Zheleva et al. [40] presented a survey omy, individualism, and respect. There are four types of the
about privacy in SNs and statistical inference techniques. privacy such as information, bodily, territorial, and commu-
Abawajy et al. [41] presented a review of anonymization nication [46]. Information privacy is about collecting, man-
techniques employed on SN data, and privacy attacks and aging, analyzing, and publishing the personal data. Bodily
risks. Furthermore, some surveys related to across SNs user privacy is related to the physical harms from any kind of in-
identification [42], [43], edges and vertex modifications tech- vasive procedures/measures. Communication privacy refers
niques [44], and SN application specific scenarios have been to any form of communication such as phone calls or e-mails
reported in the literature [45]. privacy. Territorial privacy refers to placing boundaries on
This paper presents a comprehensive survey on recent irruption into a locality. This survey focuses on the informa-
anonymization techniques used for both SN and relational tion privacy, which encompasses systems/infrastructures that
data publishing. Specifically, our review explains anonymiza- collect, analyse, process, and publish user’s data. Concisely,
tion approaches related to the information privacy protection. we present the various anonymization approaches that were
The contributions of this review article in the field of PPDP is proposed to anonymize users’ data that can be either in the
summarized as: (i) it presents state-of-the-art anonymization form of graph or table. The overview of the user’s data in re-
techniques used for both SN (i.e., social graphs) and rela- lational and graphs form is presented in Figure 1. In relational
tional (i.e., tabular) data, and fundamental concepts and ideas data (Figure 1 (a)), each tuple contains four types of attributes
related to tables and graph data anonymization; (ii) it system- about users, direct identifiers (DI), non-sensitive attributes
atically categorizes the existing anonymization techniques (NSA), quasi identifiers (QIs), and sensitive attribute (SA).
into relational and structural anonymization, and presents an In contrast, the SN data shown in Figure 1 (b) represents
up-to-date thorough review on existing anonymization tech- the users information via nodes/edges labels. The relevant
niques and metrics used for their evaluation; (iii) it describes background about both types of data (i.e., tabular and graphs)
the anonymization techniques that have been proposed to is covered in subsequent subsections.
solve privacy problems in application-specific scenarios (e.g.,
collaborative filtering, topic and context modeling, and com-
munity clustering etc.) of the SNs; (iv) it presents various
methods and items that are exploited by malevolent adver-
saries for user’s re-identification across SNs; (v) it explains
various challenges faced by researchers while devising new
anonymization methods for tabular and SN data; (vi) it pro-
vides new insights on the privacy problems in future com-
puting paradigm that will be helpful in devising more secure
anonymization methodologies; and (vii) it discusses promis-
ing future research directions in the field of the PPDP that
need further development and research from both academia
and industry. Through this comprehensive overview, we hope
to provide a solid foundation for future studies in the PPDP
area.
The remainder of this review paper is organized as follows.
Section II explains the background regarding privacy types,
tabular and graph data overview, types of the user’s attributes,
operational utility levels of the SN data, privacy areas in the
SN, and privacy threats that occur in both SN and tabular
data publishing. Section III presents the dilemma of PPDP,
and explains its principal concepts and phases. Section IV
discusses the state-of-the-art relational anonymization tech-
niques used for tabular data. Section V discusses the recent
structural anonymization techniques used for the SN data.
The summary of the research contents presented in this ar-
ticle, and discussion about the privacy problems in the future
computing paradigm are provided in Section VI. Section VII
discusses promising open research directions/problems in the
PPDP area. Finally, Section VIII concludes the paper. FIGURE 1. Overview of the relational (i.e., tabular) and social network (i.e.,
graphs) users data.
II. BACKGROUND
Privacy is all about keeping personal information away from
the public access. Privacy is needed for the personal auton-
VOLUME 4, 2016 3

This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see [Link]
 This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI
10.1109/ACCESS.2020.3045700, IEEE Access

Author et al.: Preparation of Papers for IEEE TRANSACTIONS and JOURNALS

A. BACKGROUND ABOUT THE RELATIONAL/TABULAR have reported many interesting scenarios in which the
DATA protection from the membership disclosure is impera-
The original user’s data D is considered as a private ta- tive [48], [49].
ble which consists of multiple records (i.e., tuples). Each To protect the privacy of users in the published dataset,
record/tuple contains four types of attributes, and every data owners can apply one of the following anonymization
record has a unique id as shown in Figure 1(a). The detailed operations on the original user’s data given in a tabular form
overview of user’s attributes along with examples and their [50].
treatment in an anonymization process is illustrated in Figure
2. Based on the types of user’s attributes listed in Figure 2, • Generalization: This operation transforms the orig-
inal QI’s values into less-specific but semantically-
consistent values during anonymization process. For
example, the value 25 of a QI age can be generalized
with an interval [25 − 30] or < 30. This operation relies
on the taxonomy of each QI. The existing generalization
schemes can be classified to five types such as sub-tree
generalization, full domain generalization, unrestricted
sub-tree generalization, cell generalization, and multi-
dimensional generalization.
• Suppression: This operation hides an original value of
a QI with a special value (i.e., ’*’). For example, to
anonymize the value 25 of a QI age using suppression
operation, 5 can be replaced with an asterisk, resulting
2∗ as the suppressed value of QI. Record, value, and cell
suppression are the three most widely used suppression
variants in the tabular data anonymization.
• Permutation: In this operation, the records are parti-
tioned into several groups, and values of the SA are
shuffled within each group. Hence, the SA and QIs
relationships are de-associated within each group. This
operation may yield inaccurate analysis in terms of
anonymous data utility, but user’s privacy is signifi-
FIGURE 2. Description about the types of user’s attributes and their handling cantly preserved.
in an anonymization process.
• Perturbation: In this operation, the original data values
there exists three classes of privacy threats that can occur are replaced with some synthetically generated values.
during published data analysis [47], which are explained Moreover, the synthetic values are generated in a way
below: that statistical information do not differ much in both
• Identity disclosure (i.e., unique identification): It is a
datasets (i.e., real and synthetically generated datasets).
well-known privacy threat in the PPDP. It occurs when • Anatomization: This operation does not apply any mod-
an adversary can correctly associate an individual in ifications on the original data values and instead QIs
a privacy preserved published dataset. Generally, an and SA are separated into two tables. By doing so,
attacker use the information gathered from external the association between QIs and SA is broken, and
sources (i.e., voter registration list, online reposito- data is released as QIs and SA tables separately. In
ries, and factual information) to identify an individual some cases, the SA table contains the SA’s values and
uniquely. their frequency in the anonymized dataset for privacy
• Attribute disclosure (i.e., private information disclo-
preservation effectively.
sure): This type of privacy threat occurs when an in- Furthermore, in some cases, more than one operation are
dividual is linked with the information about his/her jointly used to anonymize users data set. Data publication
SA. For example, the information can be the person’s can be done either one or multiple times depending upon
value for the SA (i.e., crime in Figure 1(a), or salary in the requirements and information consumer’s needs. Typical
Figure 1(b)). This type of threat can be easily launched data publication scenarios include one and multiple time
in imbalanced datasets (i.e., the datasets lacking hetero- publication of the micro data. In the former scenario, the
geneity in SA’s values.). data is published once, and no re-publication is made even
• Membership disclosure (i.e., presence/absence disclo- after the changes in the original data. In contrast, in the
sure): This threat occurs when an adversary can deduce multiple releases, the anonymous data is re-published even
that an individual’s record is present/absent in the pub- after a single operation (insert, update, delete) that changes
lished dataset with a very high probability. Researchers the original data. Both scenarios have their own advantages
4 VOLUME 4, 2016

This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see [Link]
 This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI
10.1109/ACCESS.2020.3045700, IEEE Access

Author et al.: Preparation of Papers for IEEE TRANSACTIONS and JOURNALS

and disadvantages for data owners and information con- individual from a privacy preserved published graph.
sumers, respectively. After DIs and NSA removal from D For example, Tim (5th node) identification by an ad-
as a standard PPDP practice, the D contains only two types versary from the anonymous version (i.e., removing all
of user attributes, QIs and SA, represented as D{Q, S}. We nodes labels.) of a G given in Figure 1(b) is an example
can use set Q = {q1 , q2 , . . . , qp } to denote the QIs, where of identity disclosure (i.e., node re-identification).
qp is one type of QI such as gender or zip code. Set S • Edge disclosure (i.e., relationship/connection disclo-
represents the SA which can be of single type (i.e., disease) sure): It reveals the relationship between users. For
or multiple types (i.e., disease and salary) depending upon example, a patient-doctor relationship can be highly
the scenario. The multiple SA scenario is getting significant sensitive, and it must be protected. If a doctor is known
attention from the research community in recent years [51]. to be an expert in cancer treatment, the relationship
Plenty of solutions have been proposed for the relational data disclosure can occur with inference that patient might
anonymization considering the available data, SA scenarios be infected with a cancer.
(single, multiple), and the PPDP settings. We explain most • Content disclosure (i.e., vertex/edge labels disclosure):
famous anonymization solutions and their variants proposed It occurs when a sensitive label associated with an edge
0
for the tabular data anonymization in Section IV. or vertex is revealed from a G , and this reveled label
can be directly associated with a specific individual in
B. BACKGROUND ABOUT THE SOCIAL an original graph (i.e., G).
NETWORKS/GRAPHS DATA • Affiliation link disclosure (i.e., whether a person v ∈
The SN user’s data can be modeled with a graph G, rep- /∈ / to a particular affiliation group h): It occurs when
resented as G(V, E, A). It consists of user set V , social a link between a user v and an affiliation group h is
connections (i.e., friendship links) set E, where E ⊆ V × V , revealed with confidence ≥ t, and this revealed link
and the set A of users’ attributes. Set A, where A = {Q, S} can be directly associated with a v. The h can be
contains QIs and SA of the SN users, respectively. The prosecuted political group or a group centered around
overview of G along with the relevant details is depicted in an unconventional user’s preference (i.e., sexual/drugs
Figure 1(b). In literature, V , E, and A are also referred as preferences).
nodes, edges, and labels (i.e., user profile), respectively. The To protect the privacy of users in SN data publishing, data
SN data is extremely useful for many analytical purposes, the owners can apply one of the following anonymization opera-
operational utility of the SN data can be classified into three tions on the G prior to its publication with the analysts [53].
levels (l1 , l2 , l3 ), as outlined earlier [52].
• Graph modification: This operation changes the original
• l1 : Exposure of the graph structure only: In this expo- graph’s structure by adding/deleting edges or vertices.
sure level, the data owners (e.g., SN service providers) The criteria about the graph’s elements addition/deletion
only publish the graph structure (i.e., all profiles/labels depends on the objectives of data publishing, and pri-
information is removed prior to data publication). Thus, vacy protection level data owners want. Typical graph
the data-miners/analysts can analyze only the graph modifications techniques are of two types-constrained
structure without any concrete information about the and non-constrained graph modifications.
user’s profiles. • Graph generalization: This operation does not modify
• l2 : Exposure of the nodes’ profiles: In this expo- the graph structure, instead, it cluster the nodes and
sure level, the data owner publishes the profiles of edges into super nodes and edges. This operation works
nodes/users but hides the graph structure. For instance, in iterations, and in each iteration the connections be-
the node’s data is stored in a table/matrix, and released tween the super nodes and edges are established.
for the analytics and data mining purposes. • Graph computation (i.e., privacy-aware computation of
• l3 : Exposure of both graph structure and profiles of graphs): This operation computes the output data in
nodes (e.g., users): In this exposure level, the data owner response to the data miner queries. The G is not released
exposes both the graph structure and the nodes’ profiles with the data miners, instead, the graph properties (de-
after applying some modifications to the G’s structure gree, centralities, size, and other useful information) are
and users’ profiles. This level offers much higher utility computed and released.
to the legitimate information consumers compared to the • Hybrid operation/approach: This operation employs
previous two levels. combination of two or more anonymization operations
Although SN data publishing is invaluable for accomplish- simultaneously. For example, the graph generalization
ing multiple research and business objectives, the SN data and modifications can be jointly used to anonymize G
0
publishing can confront with the privacy threats of several to produce G .
types. Four well-known privacy threats that can happen after Privacy in SN data publishing has become an active area of
0
G publishing are summarized below. research in recent years. Pham et. al [54] explained that SN
• Identity disclosure (i.e., node re-identification): It occurs users privacy can be breached through three different ways
when an adversary can accurately associate/identify an such as user’s activities on the SNs sites, stored users data
VOLUME 4, 2016 5

This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see [Link]
 This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI
10.1109/ACCESS.2020.3045700, IEEE Access

Author et al.: Preparation of Papers for IEEE TRANSACTIONS and JOURNALS

in the SNs service providers’ servers/databases, and privacy SNs published data to infer someone’s real identity/private-
preserved SN published data. All three privacy areas in SN information. The revelation of such information can result
are visually presented in Figure 3 (a). The privacy in the first in unknown user profiling, thus targeting unsuspecting users
two areas can be preserved through guidelines, encryption with far-reaching implications including targeted marketing,
and watermarking techniques. Meanwhile, the privacy in the obtaining travel visas based on race or political viewpoints,
third area can be guaranteed only by devising/implementing deportation, or identity theft. Therefore, mining and sharing
new anonymization mechanisms. This article covers recent SNs data must not invade user’s privacy. To safeguard user’s
concepts, methods, and solutions concerning the third area of privacy in SN data publishing, many privacy preserving
privacy in the SNs (i.e., privacy preserved graph publishing). graph publishing (PPGP) methods have been proposed. We
describe most recent anonymization solutions proposed for
the PPGP in Section V.

III. OVERVIEW OF PRIVACY PRESERVING DATA

PUBLISHING AND ITS FUNDAMENTAL PHASES
Privacy preserving data publishing (PPDP) provides set of
tools, methods, solutions, and frameworks for sharing valu-
able information with analysts/researchers without jeopar-
dizing user’s privacy. PPDP has been extensively studied in
the literature for protecting different aspects of user’s private
information during published data analytics. Data is shared
with the analysts/ researchers for extracting the embedded
knowledge from it. Meanwhile, the anonymous data sharing
after applying anonymization operations, as outlined earlier
(see subsections II-A, II-B), adversaries can still infer the
information about user’s identity or private information by
leveraging the auxiliary information gathered from external
sources. Therefore, many studies have suggested the users’
privacy-protection in all stages of the information process-
ing cycle (i.e., collection, storage, processing, release, and
destruction/archival) [56]. The conceptual overview of the
PPDP process is presented in Figure 4 (a). In this con-
ceptual overview, we mainly present the overview of data
collected from the individuals, different actors involved in the
anonymization scenario, anonymization techniques applied
FIGURE 3. Overview of three privacy areas (adopted from [54]), and types of on respective data, anonymous data to be published for an-
users data collected and processed in SNs. alytics/mining purposes, and privacy breaches that can occur
during published data analytics. The typical PPDP scenario
The user data available on the SN sites is comprised of
involves five types of actors [57]. The brief description about
three types of information [55]. The taxonomy of the users
each actor along with examples is summarized in Figure 4
data present on the SNs is depicted in Figure 3(b). The
(b). In some cases, one actor can perform multiple roles
first type of data is related to user identity including the
in the PPDP scenario. For instance, data holders/owners
demographics and derived data (i.e., age). The second type
hold the collected data, and perform anonymization for its
of information is related to user’s socialism (i.e., friends,
releasing with analysts. Sometimes due to the lack of com-
friends-of-friends, activities, and online communities joined
puting resources or knowledge the data holder outsources
by the users etc.). The third type is related to the contents
the collected data for anonymization/publishing. Hence, the
users create on the SNs sites. It has three types: disclosed,
roles of data holder and data publisher can correspond to two
entrusted, and incidental data. Disclosed data is readily made
distinct/same actors.
available by the SNs users. Entrusted data includes the data
posted by a user on another user’s profile (i.e., comments). The typical PPDP process encompassed of the five fun-
The last type of data is the information collected/posted damental phases: (i) data collection from the individuals;
by other users on someone’s profile/wall. All these data (ii) collected data storage, understanding, and preparation
sources are invaluable for detailed analytics and appropriate for the anonymization; (iii) user’s data anonymization; (iv)
information collection/analysis. anonymous data releasing/ publishing; and (v) published data
Aside from the fact that all necessary and private infor- analysis for extracting embedded knowledge. Brief details of
mation needs protection from the malevolent adversaries, each phase of the PPDP is presented below.
some de-anonymization attacks can be launched on the
6 VOLUME 4, 2016

This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see [Link]
 This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI
10.1109/ACCESS.2020.3045700, IEEE Access

Author et al.: Preparation of Papers for IEEE TRANSACTIONS and JOURNALS

FIGURE 4. Privacy preserving data publishing (PPDP): (a) conceptual overview and (b) description of the actors involved in the PPDP scenario.

A. PHASE 1: DATA COLLECTION FROM THE the service providers collect and store the basic information
INDIVIDUALS about each user. In addition, many SNs sites collect the
In the first phase of PPDP, relevant data from the indi- valuable data about users without their consent. For example,
viduals/users is collected. Due to significant technological they can collect the device information, service consump-
development in recent years, the amount of data generated by tion temporal information, location information, and many
sensor networks, SNs sites, healthcare applications, internet, other useful information. Recently, with the inventions of
online banking, SN integrated third party applications, and advanced tools and technologies, many infrastructures collect
many other offline/online companies is drastically increasing. and process graphs data. The nine well-known graph based
This data is collected from individuals directly or via smart data collection sources are: (i) social networks, (ii) commu-
devices (i.e., cell phones, laptops, and notepads etc.). For nication data, (iii) mobility traces, (iv) healthcare and epi-
instance, if a patient visits a hospital for diagnosis, his/her demiological data, (v) citation networks, (vi) collaboration
personal information is collected for the better treatment. network, (vii) web graphs, (viii) autonomous system graphs,
Later, the patient’s personal information combined with the and (ix) computer networks. SN data is mostly represented
disease information is saved in the hospital database for the as a G along with the entities (i.e., users) information for
secondary use [58]. Similarly, the account opening process modeling/analysis purposes.
in a bank is subject to the collection of basic as well as sen-
sitive information about the customers. Aside from visiting B. PHASE 2: COLLECTED DATA STORAGE,
an organization (i.e., hospital or bank), in some cases, the UNDERSTANDING AND PREPARATION FOR THE
service providers collect relevant data from their users via ANONYMIZATION
questionnaires and interviews. Once the relevant users’ data is collected, the next phase
Recently, due to the significant development in ICTs, ma- is collected data storage, understanding, and preparation
jority of service providers have launched their own websites for further operations (i.e., anonymization). Companies
for the data collection from their respective users/customers. are using large scale databases for storing the collected
Furthermore, in an account creation process on the SNs sites, users’ data/information. The well-known SN, Facebook uses
VOLUME 4, 2016 7

This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see [Link]
 This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI
10.1109/ACCESS.2020.3045700, IEEE Access

Author et al.: Preparation of Papers for IEEE TRANSACTIONS and JOURNALS

MySQL database to store/manage many petabytes of data to the graph data. In contrast, the latter technique is used
about user’s social activities such as shares, comments, for tabular data anonymization. Although some researchers
and likes. Data understanding involves the analysis of the have used the relational anonymization techniques for SN
data types, different data representations, and (key, value)- data anonymization. But, due to the significant differences
pair understanding. Generally, the collected data about users in terms of the information contained in the graphs, rela-
can contain incorrect values, outliers, missing values for tional techniques cannot be directly applied to the SN data.
some attributes, and incomplete records. Therefore, it needs Therefore, the decision about the anonymization technique
preparation before the data anonymization process. The data depends upon the original data representation (i.e., graphs or
preparation includes: removal of the outliers present in the tables), and objectives of the data publishing.
data which are not appropriate for the analysis and can yield
inaccurate results/analysis. Furthermore, it eliminates those 3) Selection of the anonymization operation
records with unknown (i.e., missing) values from the user’s Once the appropriate anonymization technique is chosen, the
data. In some cases, the data processing model/algorithm next step is to employ the relevant anonymization operation
needs user’s information in a specified format. Therefore, the to distort the original data values or graph structure. The
appropriate formatting of the collected data, and enrichment anonymization operation for each technique are different, as
if required for the subsequent steps is performed in the data outlined earlier ( Subsections II-A, II-B). The selection about
preparation phase. With the help of data preparation/pre- the anonymization operation is dependent on the data type,
processing, cleaned data can be obtained which contains anonymization technique, and privacy and utility objectives.
complete information about each user, and it can be directly For example, in relational anonymization, the generalization
fed into the anonymization algorithm for anonymization. operation retains more semantics of the original data com-
pared to the suppression operation. In contrast, suppression
C. PHASE 3: DATA ANONYMIZATION operation is highly appropriate for the user’s privacy protec-
Data anonymization is a practical and most widely used tion compared to the generalization. In addition, due to the
solution for protecting user’s privacy in data publishing. In complex structure of a G, changes in the small portion of a
0
tabular data, data anonymization sanitizes the QI’s original G can drastically decrease utility of the G . Therefore, the
values to make information less specific for privacy protec- selection of the appropriate anonymization operation is made
tion and utility enhancements. In contrast, if users’ data is to effectively resolve the privacy and utility trade-off for real-
given in a G form, anonymization changes the graph structure world applications.
to protect privacy of users and their associated SA without
significantly decreasing anonymous graph’s utility. In addi- 4) Enforcement of the constrains (if any) in an
tion, anonymization can be tailored with the data owner’s pri- anonymization operation
vacy requirements, legitimate information consumer’s utility Aside from the selection of appropriate anonymization tech-
needs, and objectives of the data publishing. The typical nique and anonymization operation, some constrains can be
anonymization process includes following four main steps. enforced by the data owners during data anonymization. Such
All four steps are complementary, and can be employed to constrains can be about the privacy and utility thresholds,
0
produce the anonymous table T from an original table T or number of users in an equivalence class, distribution of the
0
anonymous graphs G from an original graph G. user’s private values in a class/cluster, and/or the number
0
of connections between users (i.e., degree) in a G . Such
1) Removal of directly identifiable information from the constraints are enforced during data anonymization process.
original data These constraints can be suggested by the data owners or can
At the beginning of the anonymization process, any informa- be derived from the data statistics. In addition, the constraints
tion that can identify someone directly/uniquely is removed can be employed by considering the adversaries capabilities
from the data. For example, the name, social security number and nature of the sensitive information contained in a T or G.
(SSN), email address, and cell phone number can be linked
with someone’s real identity. Hence, such information is D. ANONYMOUS DATA RELEASING/PUBLISHING
removed from the data before its anonymization. It can be The output of the anonymization process is the anonymous
0 0
removed at any stage, but the earlier removal can assist in G or T depending upon the representation/style of original
0 0
saving computing power significantly. user’s data. This anonymous G or T is set to be made pub-
licly available for the analytics. The recipients of the anony-
2) Choice of the anonymization technique mous data can be analysts, researchers, data-miners, analyt-
Many anonymization techniques have been proposed and ics firms, and third party applications. Before making the
implemented for different scenarios. In this work, our focus anonymous data publicly available, the data owners perform
is on the relational (i.e., tabular) data and SN (i.e., graphs) several checks to verify the user’s privacy protection and
data anonymization. Therefore, we categorize the existing anonymous data utility levels, respectively. After the detailed
anonymization techniques into two categories: structural and checks, the decision about the data release is made by the
relational anonymization. The former technique is applied data owners. In some cases, the data owners do not publish
8 VOLUME 4, 2016

This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see [Link]
 This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI
10.1109/ACCESS.2020.3045700, IEEE Access

Author et al.: Preparation of Papers for IEEE TRANSACTIONS and JOURNALS

full anonymous data, instead, some parts of the anonymous the advancements in ICTs, the scale and scope of the data
data are published first. Later, the complete anonymous table breaches is expanding. In recent years, the adversaries are
or graph is published. In addition, the anonymous data can be focusing for the users groups information theft for fulfillment
shared only with the relevant institutes via emails or posts. of the intended objectives. The group identity theft can
However, the anonymous data is generally published over lead to the negative perceptions about certain ethnic group,
the Internet so that a large number of people can access discrimination based on the race/religion, and loan declin-
the published data for the multi-facet analytics. Furthermore, ing to group of people whose previous loan return rating
the medium of data sharing and amount of data vary with was not satisfactory. Aside from the negative consequences
the setting (i.e., interactive and non-interactive) of the PPDP. of privacy breaches on the people’s life, data owners also
After releasing the data, the data owner has no control over lose their users’ trust in such circumstance. Therefore, users
the published data use and distributions. Meanwhile, it is expect that data owners protect their sensitive information’s
assumed that published data will be used only for the in- privacy during data release with the data-miners. Hence,
tended purposes, and any problem will be explicitly reported the academicians and researcher are suggesting/devising new
to the data owners. In some cases, the data owners and anonymization mechanisms to deal with this uprising social
data publishers can be two different parties. Data publishers problem (i.e., user’s privacy protection without significantly
release the anonymous data via their own mediums under the impacting data utility/quality).
publishing agreements with the actual data owners/holders.
IV. RELATIONAL ANONYMIZATION TECHNIQUES USED
E. PHASE 5: PUBLISHED DATA ANALYSIS FOR FOR TABULAR DATA ANONYMIZATION
EXTRACTING EMBEDDED KNOWLEDGE The general concept of relational anonymization is to pro-
0
Once anonymous data has been published, the intended recip- duce anonymous table T from an original Table T . Given a
ients collect it for the analysis. In case of the hospitals data, T containing p QIs, single/multiple SA (s), and N users, the
medical students collect the data for their research. They can relational anonymization employs a privacy model/algorithm
perform several kinds of test such as factors causing certain to modify the original values in such a way that user’s
disease, common disease in a certain age-groups people, and privacy can be protected while retaining significant utility in
symptoms of a particular disease. In addition, the banks data anonymous data for the analysis. The input to the relational
containing information about the loan return rating is valu- anonymization is a tabular data and output is also a tabular
able for the insurance companies. The SN data is suitable for data with modified values of user’s QIs, and shuffled/equally-
the digital service providers and marketing firms. Recently, distributed values of the SAs. A series of privacy models
many companies are mining the SN data at large scale for and algorithms have been proposed so for to anonymize
fulfilling their scientific and business objectives. In addition, tabular data containing user’s basic (i.e., QIs) and private
many third party applications are buying SN user’s data for information (e.g., SA). Four well-known and extensively
fulfilling their intended objectives. The published data is not used privacy models for relational data anonymization are
only for understanding the causes of some problems, but summarized below.
it can help in devising new rules and patterns that can be
useful for marketing purposes. With the help of data mining A. K-ANONYMITY PRIVACY MODEL
algorithms, one can analyze the published data for action- The k-anonymity [12] privacy model is a well-known
able insights. Furthermore, users clustering and analysis is syntatic privacy model, and it has been extensively used in the
beneficial for recommendations, preferences mining, target tabular data anonymization. Due to the conceptual simplicity,
marketing, information diffusion, information control, and this privacy model has attracted significant attention from the
information trustworthiness. Hence, data sharing has become research community, and many variants of this model have
a routine matter for some companies/organization due to been proposed by the researchers for data anonymity. The
the significant advantages in terms of improved decision k-anonymity model [12] protects user’s privacy by placing
making, policy enhancements, trends analysis, forecasting, at least k users in an equivalence class (EC) with same
predictions, and innovation. QI’s values. Hence, the probability of re-identifying someone
0 0
Unfortunately, data publishing can jeopardize user’s pri- from T becomes 1/k. A table T satisfies k-anonymity if for
0
vacy as adversaries can get copy of published data with aim to every tuple/record t of T there exist at least (k − 1) other
re-identify people uniquely by leveraging the large amount of tuples with the same QIs in an EC. The value of k is chosen
auxiliary information obtained from external sources. These by the data owners depending upon table size and privacy
information can be gathered from many sources including protection level. The k-anonymity privacy model overview
users’ profiles from the SN sites, voter registration list, and is shown in Figure 5. Primarily, the k-anonymity privacy
mobility traces etc. Generally, the adversaries possess strong model was devised for the protection of identity disclosure.
programming skills and tools knowledge. Therefore, with the Meanwhile, the k-anonymity privacy model is insufficient to
help of auxiliary information, tools understanding, advanced protect the sensitive information disclosure as shown in ECs,
programming skills, and understanding of anonymization C2 and C3 in Figure 5(b). The SA’s disclosure in these two
methods enable adversaries to breach user’s privacy. Due to ECs based on auxiliary information is 100%. Therefore, an
VOLUME 4, 2016 9

This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see [Link]
 This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI
10.1109/ACCESS.2020.3045700, IEEE Access

Author et al.: Preparation of Papers for IEEE TRANSACTIONS and JOURNALS

advanced privacy model, named `-diversity was proposed to The table in Figure 6(b) is an example of 2-diverse parti-
solve the shortcomings of the k-anonymity privacy model. tion of the table shown in Figure 6(a). Although, `-diversity
0
The utility of the anonymous table T produced by the k- privacy model provides superior privacy protection compared
anonymity model is relatively higher. to the k-anonymity model by considering the diversity in
SA’s values, but it does not consider the distribution of the
SA’s values. Hence, it is prone to the privacy breaches in ECs
in which one particular SA value is dominate over others (i.e.,
C1 ). For example, an EC Ci with ten users can satisfy 2-
diversity property with SA’s values ratio of 1 : 9. Although,
Ci is 2-diverse, but the SA values of someone’s can be
learned with 90% accuracy. The similar case is presented in
Figure 6(b), where the SA’s value, ’conservative’ disclosure
is 75% with accurate mapping of someone based on the
QI’s values. However, many variants of `-diversity model
have been proposed to solve these limitations. In addition, `-
diversity cannot be applied to the highly imbalanced (i.e., the
data sets in which SA’s values distributions is not uniform.)
databases. In addition, `-diversity privacy model degrades
anonymous data utility significantly by not considering QIs
distributions and similarities during anonymization.

C. T -CLOSENESS PRIVACY MODEL

The t-closeness privacy model [60] is a syntactic privacy
approach used for the tabular data anonymization. It was
proposed to solve the limitations of both k-anonymity and
`-diversity models in terms of privacy protection. A table T
FIGURE 5. 2-anonymity applied to the user’s relational data with six records.
satisfies t-closeness if its records/tuples are split into ECs
such that the distribution of SA in the whole T and the ECs
0
of a t-close table T are within t distance units of each other.
B. `-DIVERSITY PRIVACY MODEL The t-closeness privacy model suggests that the SA’s values
0
The `-diversity privacy model [59] was proposed to solve the distribution in any EC of T differs from the overall SA’s
k-anonymity model’s limitations. According to this model, values distribution in T by at most threshold t. The value of
an EC satisfies `-diversity property if there are at least ` t can be determined by considering the protection level of
0
"well-represented" values for the SA. A table T is said to the sensitive information and objectives of data publishing.
0
have `-diversity, if every EC of the T is `-diverse. The `- The table shown in Figure 7(b) (adapted from [61]) is 0.278-
diversity privacy model overview is shown in Figure 6. close w.r.t disease SA. The table shown in Figure 7(b) is
also 3-diverse (i.e., it contains three different values of SA
in each EC.). The t-closeness privacy model significantly
improves the user’s privacy, but it severely reduces the utility
of the released data. All of the above three privacy models are
among the most famous syntactic privacy models, and many
variants of these models have been proposed to resolve their
limitations in the PPDP. In addition, many algorithms as an
extension of these three privacy models have been proposed
to combat with some specific types of threats that emerge
from data sharing.
There exist many attacks that are possible, and can be
0
easily launched on the T . We can classify those attacks into
two categories: (i) background knowledge attack, and (ii)
flaws in an anonymization methods. In the former category of
privacy attacks, the adversary has some known information
about the target victim. For example, the QIs of an individual
or some other information about existence of someone’s
0
data in a T . The adversary uses such information to cause
a privacy breach. In the latter category of privacy attacks,
FIGURE 6. 2-diversity applied to the user’s relational data with four records.
the flaws in an anonymization methods assist adversary in
10 VOLUME 4, 2016

This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see [Link]
 This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI
10.1109/ACCESS.2020.3045700, IEEE Access

Author et al.: Preparation of Papers for IEEE TRANSACTIONS and JOURNALS

causing a privacy breach. For example, the homogeneity

(i.e., no heterogeneity in SA’s values in an EC) attack of P r[F (x) ∈ S] ≤ exp()P r[F (y) ∈ S] + δ (1)
the k-anonymity privacy model, skewness attack (i.e., no
In equation 1, variable x, y ∈ D1 , D2 ;  is a parameter; δ
considerations of the SA’s values’ distribution in an EC) of
indicates a degree of the relaxation, and the probability is
the `-diversity privacy model, and no semantic consideration
taking over the randomness of function F . In equation 1, if
(i.e., all disease information present in an EC belong to a
δ = 0 then F satisfies -differentially private. In case of the
same part/organ of a human body) in t-closeness privacy
query response (Rs ), the probability P r of DP model will be.
model lead to explicit privacy breaches in presence of the
auxiliary information. All these attacks are practical, and P r(A(D1 ) = Rs )
0
can be launched on a T . Hence, many improved variants of ≤ e (2)
P r(A(D2 ) = Rs )
these three privacy models, and adversarial modeling based
methods have been proposed to resolve these problems. In equation 2, A represents an anonymization algorithm, 
is a parameter, and its value is chosen by the data owners.
Generally, the smaller value of  is suitable for better privacy
preservation in the PPDP.
In DP method, noise is added using the Laplace mech-
anism. DP mathematically ensures that any analyst/ data-
miner seeing the result of a differentially private analysis
will make the same conclusion about any individual’s private
information, whether or not that individual’s private informa-
tion is included in the input to the analysis. The overview
of the DP is presented in Figure 8. Due to the strong privacy
guarantees, the DP model has been extended by many studies
for further improvements.

FIGURE 7. t-closeness (where t = 0.278) applied to the user’s relational

data with nine records.

D. DIFFERENTIAL PRIVACY MODEL

Differential privacy (DP) [18] is a well-known and math-
ematical definition-based privacy protection model. It is
mostly used for privacy protection in an interactive settings
of the PPDP. It protects the privacy of user by adding noise
to the original user’s data and it does not make assumptions FIGURE 8. Functional overview of the differential privacy (DP) model used in
the PPDP.
about the intruder scenarios. The DP belongs to the semantic
class of privacy models, and it yields superior privacy pro- Many latest studies adopted DP concept for resolving the
tection in PPDP compared to the syntactic privacy models. privacy issues in the both interactive and non-interactive
Considering the effectiveness of the DP model, U.S. census settings of the PPDP. There exist numerous anonymization
Bearu is planning to use the DP in their 2020 census, and all techniques which are ramifications of the four privacy mod-
future data products [62]. It has been reported in the literature els explained above. We summarize the approaches that
that DP provides a mathematically provable guarantee on extended the concepts of these four models in Table 1.
privacy preservation against many privacy attacks such as We categorize the anonymization approaches into four main
differencing, linkage, and reconstruction attacks. DP concept categories: (i) the k-anonymity model and its ramifications,
can be defined as: given a dataset D1 , and a neighbour dataset (ii) the `-diversity model and its ramifications, (iii) the t-
D2 . Both data-sets differ in one and only one record, defined closeness model and its ramifications, and (iv) the DP model
as ||D1 | − |D2 || = 1. In addition, a random function F with and its ramifications.
a range S, defined as S ⊆ Range(F ), satisfies DP if
VOLUME 4, 2016 11

This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see [Link]
 12
TABLE 1. Detailed comparisons of the different PPDP solutions used for relational data anonymization.

Privacy technique/model Type Restriction on the SA SA’s scenario Anonymity operation on the QIs Strength Weakness
k-anonymity privacy model [12] Syntactic none single generalization/suppression protection from the ID only in the PPDP insufficient to protect from the AD
p-sensitive k-anonymity [63] Syntactic p distinct SA’s values single generalization/suppression protection against both ID and AD high IL and computing complexity
p+ -sensitive k-anonymity [64] Syntactic p distinct SA categories single generalization protection from both ID and AD high utility loss on special purpose metrics
(α, k)-anonymity model [65] Syntactic α-threshold single generalization/suppression protection against both ID and AD high IL and QIs correlation loss
Complete (α, k)-anonymity [66] Syntactic α-threshold based protection single clustering protection against both ID and AD works only on the categorical data
M 3AR algorithm [67] Syntactic none single member migration privacy protection by DMAR AD is possible by not restricting SA’s values
M -SA k-anonymity [68] Syntactic diversity multiple new records addition better privacy and utility in the PPDP may yield inaccurate analysis
Predictive delimiter algorithm [69] Syntactic dis-association multiple records shuffling better privacy and accuracy prone to the LA, and high complexity
HSVD algorithm [70] Syntactic equal distribution multiple generalization protection against both ID and AD high IL during analytics in most cases
Overlap slicing algorithm [71] Syntactic permute SA values multiple bucketization reduces probability for adversaries to guess low privacy in less diverse ECs
the SA values of users
MSA(α, `) algorithm [72] Syntactic (α, `)-thresholds multiple clustering privacy protection in the MSA cases higher ID in presence of the BK
Cross-sampling algorithm [73] Syntactic perturbation single & multiple sampling stronger privacy guarantees explicit leakage of the SA’s values
Flexible GSC algorithm [74] Syntactic permutation single Gray-code and binary conversion privacy is equal or more than 1/k Can lead to sensitive patterns disclosures
`-diversity privacy model [59] Syntactic `-distinct SA’s values single generalization/suppression protection against the AD only. insufficient to protect ID and MD
Independent `-diversity [75] Syntactic `-independent SA’s value single perturbation and generalization protection against the AD lowest utility in terms of accuracy
LDSA algorithm [76] Syntactic semantic rules single generalization effective privacy protection lowest utility in terms of the IL
`-cover Algorithm [77] Syntactic `-diverse single safe generalizations better privacy protection missing experimental verification
(τ, `)-diversity [78] Syntactic generalize SA values single ordering of the QIs better privacy protection work with categorical attributes only
Fast p-sensitive `-diversity [79] Syntactic `-diverse multiple clustering protection against the AD prone to the ID in presence of BK
Recursive (c, `) diversity [80] Syntactic distinct `-diverse SA’s values single generalization protects AD in the PPDP process prone to explicit ID in imbalanced datasets
DBT P − ` − M DAV algorithm [81] Syntactic `-distinct SA’s values single micro-aggregation yields higher data utility prone to AD, ID, and MD in the PPDP
Lsl -diversity model [82] Syntactic `-diversity group multiple grouping & suppression greatly reduce the IL in micro data run time is significantly higher
DI-Mondrian method [83] Syntactic `-diverse single generalization significant reduction in time and IL it can lead to the SA disclosures
(`, d)-semantic diversity [84] Syntactic `-diverse with distance ≥ d single dummy records addition better privacy preservation for AD cannot work well in the MSA scenarios
0
t-closeness privacy model [60] Syntactic t-close threshold single generalization/suppression protects from both AD and MD significant degradation in T ’s utility
(n, t)-closeness model [85] Syntactic (n, t)-close threshold single generalization protects from AD, ID, and MD significant degradation in data utility
TCS algorithm [86] Syntactic t-close threshold single & multiple generalization protects from MD,ID, and AD prone to groups’ identity theft problems
M -Shuffle algorithm [87] Syntactic SA grouping single QIs shuffling excellent data utility and efficiency explicit SA disclosure in imbalanced data
MSA t-closeness algorithm [88] Syntactic PCA and projections multiple clustering privacy preservation in the MSA cases privacy sensitive pattern leakage is possible
SABRE framework [89] Syntactic SA’s redistribution single generalization better privacy preservation groups users’ privacy invasion is possible
TCMA algorithm [90] Syntactic t-close threshold single micro aggregation better privacy preservation very high computational complexity
ASQI algorithm [91] Syntactic (`, t)-thresholds single randomization highest data utility in the PPDP prone to AD and ID during published DA
TCMSA method [92] Syntactic tX -close, where o ≤ tX ≤ 1 multiple generalization better privacy protection in the MSA cases poor data utility in imbalanced datasets
Differential privacy model [18] Semantic noise addition single QIs sampling strong privacy guarantees in PPDP significant degradation in anonymous data utility
(, σ)-differential privacy [93] Semantic noise addition single & multiple clustering superior data utility for analysis privacy breaches do occur with some Pr.
Extended -DP algorithm [94] Semantic noise addition single perturbation higher data utility (i.e., accuracy) lower privacy in presence of the BK.
Improved DP algorithm [95] Semantic noise addition single & multiple perturbation better utility in interactive setting no privacy guarantee for correlated data
Concentrated DP algorithm [96] Sy. & Se. random sampling of SA single random reshuffling better privacy preservation in the PPDP low utility in the sparse datasets
k-CRDP approach [97] Semantic noise addition single maximal information coefficient better privacy protection of users suffer from the CoD and high IL
10.1109/ACCESS.2020.3045700, IEEE Access

MWEM algorithm [98] Semantic noise addition single as per query budget better user’s privacy preservation work well with only categorical attributes
DPMK anonymity [99] Se. & Sy. noise addition single generalization superior anonymous data utility very high computing complexity
IPA Method [100] Semantic noise addition single generalization, insertion, and suppression better data utility for medical researchers may yield privacy disclosures in presence of strong
BK and auxiliary information
Pareto Principle-based DP [101] Semantic noise addition single & multiple DP with Pareto principle improve accuracy of the query results works with only limited type of queries
-DP based privacy protection [102] Semantic distort and reconstruct single -DP with trajectory data shuffles protects sensitive places visits of user poor utility with raw GPS data
(,δ)-local DP [103] Semantic correlated noise addition single synthetic datasets creation higher accuracy using SVM classifier poor utility in general purpose metrics

This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see [Link]
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI

VOLUME 4, 2016
Author et al.: Preparation of Papers for IEEE TRANSACTIONS and JOURNALS
 This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI
10.1109/ACCESS.2020.3045700, IEEE Access

Author et al.: Preparation of Papers for IEEE TRANSACTIONS and JOURNALS

We compare the existing approaches with each other based pick some instances from the original data and can evalu-
on six different parameters. The abbreviation used in Table 1 ate the anonymization algorithm privacy protection level by
are: ID= identity disclosure, AD= attribute disclosure, MD= matching; (iii) privacy protection evaluation with the help
membership disclosure, IL= information loss, Sy. & Se. = of privacy-sensitive (PS) rules. In this case, the data owner
syntactic and semantic, Bk= background knowledge, CoD= can construct certain rules to evaluate privacy protection.
curse of dimensionality, Pr.= probability, SA= sensitive at- For example, how many people having age >40 suffer from
tribute, MSA= multiple sensitive attribute, LA= linkage at- this disease(i.e., cancer) . The sensitive knowledge pattern
tack, DMAR= discovering and maintaining association rules, revelation, and attribute and identity disclosure of multiple
DA= data analysis, ECs= equivalence classes, GPS= global users through PS rules have a wide range of negative con-
positioning system, and QIs= quasi identifiers. sequences on people’s life; (iv) prediction about the users
Some studies have used the combinations of more than SA through the existence of private and public profiles in
one privacy models (e.g., k-anonymity and `-diversity) to SNs. In this case, the data owner can quantify the amount of
protect the user’s privacy in data publishing. Majeed et al. protection level of an algorithm assuming that either partial
[104] extended the k-anonymity model to effectively resolve or full user’s original data is known to the attacker as some
the privacy and utility trade-off in the PPDP. The proposed users willingly publish their QIs over different SNs. The fac-
scheme performs adaptive data generalization considering tual information that can be learned through the knowledge
both the vulnerability of the QIs and the diversity of the gained from the D to invade unknown users’ privacy can be
SA to anonymize data. Jordi et al. [105] suggested that t- used to evaluate an anonymization effectiveness; (v) privacy
closeness can be extended to the DP model when t = protection evaluation in the presence of malicious users’ in a
exp(). The authors proposed a method for achieving both dataset. In this case, the data owner can classify some of the
t-closeness and DP, respectively. As a result, higher utility tuples as malicious and can calculate the similarity with other
was retained in the anonymous data compared to the noise (i.e., non-malicious) users to quantify the privacy protection
addition methods. Rasool et al. [106] used the k-anonymity level. In some cases, the sensitive queries and corresponding
concept in the clustering process to produce anonymous data private information budget is also used for the evaluation of
set for publishing. The proposed SBC algorithm significantly anonymization algorithms/models.
reduces information loss and retains better semantics of the Utility evaluation metrics: During tabular data anonymiza-
original dataset. Recently, the k-anonymity concept has been tion, the original QI’s values are modified to fulfill the
extended in combination with entropy concept to protect the privacy needs, hence, the data utility degrades. There exist
users’ groups privacy in data publishing [107]. The proposed multiple ways to quantify the anonymous data utility offered
anonymization method effectively resolves the users’ groups by an anonymization algorithm. We classify the metrics used
privacy issues stemming from the low diverse ECs, and for measuring anonymous data utility into two categories:
highly susceptible QIs present in a person-specific dataset. special purpose and general purpose metrics. The special
purpose metrics use machine learning methods to measure
E. METRICS USED FOR THE EVALUATION OF PRIVACY the anonymous data quality. The most widely used special
AND UTILITY OF RELATIONAL DATA ANONYMIZATION purpose metrics are, accuracy or error rate, F -measures,
TECHNIQUES precision, and recall. The general purpose metrics measure
Privacy evaluation metrics: There exist multiple ways to the information loss caused by modifying the original data.
quantify the privacy protection offered by an anonymization The most popular general purpose utility evaluation meth-
algorithm. The five common methods that are employed to ods are, weighted certainty penalty, generalized information
evaluate the effectiveness of any anonymization algorithm in loss (GenILoss), discernability metric, minimal distortions,
terms of privacy protection are: (i) anonymous and original average equivalence class size (CAV G ), KL-divergence,
dataset linking and calculating the probability of successful granularity, query accuracy, global loss penalty (GLP), nor-
matches based on the QI values in both these datasets. The malized mutual information (NMI), relative error (RE), and
probability value tells the amount of privacy protection an information theocratic metrics (ITM). The comprehensive
anonymization algorithm will offer during published data details about these utility metrics can be found in the recent
analysis. In this case, it is assumed that attackers may have studies [5], [9], [35], [50].
access to the excessive amount of auxiliary information from
some external sources (i.e., voter list, online repositories, e- F. PRIVACY PRESERVING DYNAMIC DATA
commerce sites etc.) to launch identity and attribute disclo- PUBLICATION
sure attacks; (ii) privacy protection evaluation in presence Privacy preserving dynamic data publication (PPDDP) al-
of the background knowledge. In this privacy evaluation lows organizations to publish a dataset multiple times.
metric, the data owner assumes that attacker may possess PPDDP enables organizations to share up-to-date data with
the true information (i.e., age and gender of a Bob) about multiple recipients statically or after some modifications
some users and he/she can explore only the particular ECs to (i.e., update, delete or insert). In contrast, privacy preserving
infer private information of relevant user/users. To evaluate static data publication (PPSDP) focused only on one time
effectiveness of algorithm in this regard, the data owner can publication of a dataset, and many approaches have been
VOLUME 4, 2016 13

This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see [Link]
 This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI
10.1109/ACCESS.2020.3045700, IEEE Access

Author et al.: Preparation of Papers for IEEE TRANSACTIONS and JOURNALS

proposed for the PPSDP in literature [12], [59], [60]. Mean- existing PPDP methods often assume worst-case scenarios
while, PPDDP opens a new era in PPDP research, and many regarding attackers, and apply heavy changes in the data that
organizations are publishing their users data dynamically. impact the shared data utility and often limit data sharing on
Kabou et al. [108] presented a comprehensive survey about a wider scale. Thus, accurate and novel adversarial modeling
the PPDDP, and summarized different studies used for the methods are needed to support PPDP in big data era. Aside
PPDDP. Shi et al. [109] presented a method for PPDDP using from the five potential challenge explained above, in some
distance and information entropy concepts. The proposed cases, an adversary can possibly link the whole published
0
method ensures that individual privacy is preserved after dataset (e.g., T ) by leveraging the auxiliary information
the data has been subjected to multiple releases. The m- [113]. Hence, devising algorithms/method which can esti-
invariance privacy model [110] was proposed to limit the risk mate the users’ privacy disclosure risk as accurate as possible
of privacy disclosure in data re-publication. The proposed during published data analytics is a vibrant area of research.
approach jointly uses the m-invariance and counterfeited
generalization concepts to solve the PPDDP problem. Anjum V. STRUCTURAL ANONYMIZATION TECHNIQUES USED
et al. [111] proposed a τ -safety privacy model for the PPDDP. FOR THE SOCIAL NETWORKS DATA ANONYMIZATION
The proposed approach performs better in the presence of Structural anonymization refers to the modification in the
external and internal updates. Zhu et al. [112] proposed a τ - structural properties of the social network (SN) data (i.e.,
safe (`, k)-diversity privacy model for sequential publication. graphs) to protect the privacy threats that emerge from SN
The proposed privacy model guarantees that each record’s data publishing. Generally, the SN analysts represent the SN
signatures/values keep consistency or have no intersection data mainly via two methods: metrics and graphs [114]. The
in all data releases. This model can be applied to the data matrices representation of the SN data allow the application
in which individual has multiple records. The proposed al- of computer tools and mathematical models to summarize
gorithm performs better compared to the m-invariance and and extract patterns. Since finding relevant patterns from the
τ -safety privacy models. Considering the widespread ap- dense graphs is extremely complex. The adjacency matrix is
plications/uses of the privacy preserved published data, the used as the variant of the graphs in social network analysis.
PPDDP has become an emerging area of research in recent For instance, a G with n users can be modeled as an adja-
years. cency matrix M of size n × n. In an adjacency matrix, the
relationship between two users i and j can be represented by
G. CHALLENGES IN THE RELATIONAL DATA the value (< 0, 1 >or < y, n >) in a cell i, j. To represent
ANONYMIZATION various forms of users’ data and to model the structural
The representation of tabular data is relatively simpler than properties of SNs, a G can have their nodes and edges labeled
the SN data. In relational data, each row/tuple represents one or unlabeled, undirected or directed, weighted or unweighted
real world entity/individual. We identify following five chal- as presented in Figure 9.
lenges that make the relational data anonymization challeng-
ing. First, selection of the user’s attributes that are regarded as
QIs. In relational data, a small subset of the users’ attributes
are chosen as QIs. However, some QIs can behave as SA (i.e.,
profession) in practice. Thus, appropriate selection of QIs
prior to data sanitization is imperative. Second, over reliance
on the custom made QI’s values generalization taxonomies.
The relational anonymization is performed with the help of
pre-defined taxonomies of the QIs. Meanwhile, these tax-
onomies do not truly reflect the privacy and utility trade-
off. Thus, devising the appropriate taxonomies with in-depth
analysis of QI’s domain values in relational anonymization
is challenging. Third, tabular data anonymization in multi-
ple SAs (MSAs) scenarios. In some cases, the tabular data
contains multiple SAs about individuals. Anonymizing the
tabular data having MSAs is harder compared to the single
SA scenarios due to the high risk of user’s private information
disclosures. Fourth, quantifying the impact of QIs on both
user’s privacy and anonymous data utility. Since each QI
affects the privacy and utility differently, and some QIs can
be highly vulnerable in terms of privacy and some QIs have
higher utility. Thus, quantifying each QI’s statistics related FIGURE 9. Overview of the social network representation using different
forms of graphs and a matrix.
to privacy and utility is very challenging in the PPDP. Fifth,
accurate estimation of the subjects’ re-identification risk. The
14 VOLUME 4, 2016

This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see [Link]
 This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI
10.1109/ACCESS.2020.3045700, IEEE Access

Author et al.: Preparation of Papers for IEEE TRANSACTIONS and JOURNALS

TABLE 2. Description about the pieces of information related to user’s privacy in SNs data (Ref. [39]).

Sr. No. Pieces of information Description about each piece of information

1 Node existence/non-existence Target individual presence/absence in a SN data (i.e., graph).
2 Node properties Some properties of a node such as degree and position/placement etc. in a graph.
3 Link relationship The link relationship (e.g., patient & HIV specialist) among nodes in a SN data.
4 Sensitive node label The sensitive label (i.e., disease information) carried by an individual in a SN data.
5 Sensitive edge label The sensitive edge label (i.e., social connection) between vertices in a SN data.
6 Graph metrics The sensitive graph properties (i.e., betweenness, centrality, closeness, and reach-ability) in a SN data.
7 Link weight The edge weight (i.e., communication cost) between nodes in a SN data.
8 Node-group affiliation The link relationship between nodes (i.e., users) and online SN groups in a SN data.

TABLE 3. Types of the background knowledge (BK) used by the adversaries to jeopardize user’s privacy in the PPGP.

Sr. No. Type of the BK Examples Privacy threats that emerge from the background knowledge
1 Node/vertex degrees Number of friends Identity disclosure and membership disclosure
2 Attributes of nodes Sex, age, occupation, disease Identity disclosure and content disclosure
3 Link relationship Communication channel, social connection, online group Content disclosure and affiliation disclosure
4 Neighborhoods Friend’s circle, close friends, mutual friends Identity disclosure and content disclosure (with some probability).
5 Neighborhood-pair properties Close friends, mutual friends, friends of friends (FoF) Identity disclosure with very high probability.
6 Embedded sub graphs Vertices, edges, clique Identity disclosure and groups identity theft.
7 Knowledge graph Sex, age, relations, followers, following Identity disclosure and content disclosure.
8 Accounts on multiple SNs Profile information, login details, display name Identity disclosure and content disclosure.
9 Graph metrics degree, centrality, closeness, sub graphs Identity disclosure, content disclosure, and groups identity theft.
10 User behaviors recommendation, interests, SN use patterns Identity disclosure and content disclosure.
11 Auxiliary information Other SNs graphs All four disclosures about an individual, and groups identity/attribute theft.

Due to the inefficacy in handling the complex SN data, and tain pieces of information as BK while anonymizing user’s
inability to correctly represent the SN with users’ attribute data. The BK types with sufficient details and examples
information, matrices are rarely used to represent the SN are explained in literature [37], [39], [41]. In Table 3, we
data. In contrast, graphs can represent the users’ attribute summarize the most recent types of the BK that are used
information properly along with social relations. Therefore, by the adversaries to jeopardize SN user’s privacy during
graphs are most widely used in SN analysis, and assist effec- published graphs analytics.
tively in proving graph-based theorems. This work uses SN
The most common technique used for SN users privacy
data modeled as a graph for further analysis and discussions.
preservation in the PPGP is anonymization. After in-depth
Users’ privacy preservation in SN data publishing is very
synthesis of the literature [114]–[116], we present the tax-
challenging compared to the relational data due to the more
onomy of the PPGP approaches along with representative
pieces of private information contained in a G. The pieces of
anonymization methods employed for SN data in Figure
information concerning user privacy in a social graph data are
10. These PPGP approaches can be broadly classified into
summarized in Table 2. The SN users need privacy protection
five categories, namely graph modification techniques, graph
for most of the pieces of their private information shown
generalization/clustering techniques, privacy aware graph
in Table 2. In contrast, the relational data mainly contains
computation techniques, differential privacy based graph
four pieces of information about the users: (i) users’ QIs,
anonymity techniques, and hybrid anonymization techniques.
(ii) users’ SA, (iii) micro-statistics (i.e., SA’s particular value
Brief description along with relevant examples about all
shared by less number of people in a dataset) about users,
five anonymity techniques used in the PPGP is given in
and (iv) macro statistics (i.e., SA’s particular value shared
subsequent paragraphs.
by large number of people in a dataset) about the users. In
addition, due to the availability of user’s profiles information Due to the widespread applications of the SNs data, many
on the SNs sites and accounts on multiple SNs, the SN users structural anonymization techniques have been proposed for
privacy can be compromised easily compared to the tabular the PPGP. These techniques modify the structure of the SN
data. graph by adding/ deleting vertices or edges to preserve the
user’s privacy. Aside from the add/delete, in some case,
The background knowledge (BK) is the fact or an informa- edges and vertices are switched or re-arranged in clusters to
tion known to the adversaries about an individual or group preserve user’s privacy. The overview of anonymous graphs
of individuals, which can be exploited to infer the SA of obtained by adding vertices and edges is shown in Figure 11.
0
an individual(s) from the G . The BK can be acquired from In Figure 11(b), two new edges have been created ({v1 , v3 }
different sources, and its degree purely depends upon the ad- and {v2 , v4 }). Similarly, in Figure 11(c), two new nodes
versaries’ capabilities and technical knowledge. In practice, ({v7 , v8 }) with four edges ({v7 , v3 }, {v7 , v2 }, {v8 , v1 } and
it is very difficult to quantify the level of the BK possessed {v8 , v2 }) have been added in the anonymous version of a G.
by the adversaries, and many existing algorithms assume cer-
VOLUME 4, 2016 15

This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see [Link]
 This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI
10.1109/ACCESS.2020.3045700, IEEE Access

Author et al.: Preparation of Papers for IEEE TRANSACTIONS and JOURNALS

FIGURE 10. Taxonomy of privacy preserving graph publishing (PPGP) approaches used for SN data.

Figure 12(i)(b) shows an example of a perturbed version

The addition/deletion of the nodes and edges can be con- of the network shown in Figure 12(i)(a) by Rand add/del
strained or random (e.g., non-constrained) depending upon operation. In this example, the two edges ({v1 , v5 } and
the scenario. {v2 , v3 }) have been removed and two new edges ({v6 , v7 }
and {v8 , v9 }) have been added to produce the anonymous
0
graph G . Meanwhile, the perturbed version of the graph
shown in Figure 12(i)(c) is obtained from the Rand switch
operation. In this example, two edges ({v1 , v2 } and {v4 , v5 })
were switched to ({v1 , v4 } and {v2 , v5 }) to produce the
0
anonymous graph G . In the random perturbation (e.g., non-
constrained), there is no hard constraints regarding the edges
addition/deletion/ switching.
In contrast, in the constrained anonymization, the
nodes/edges addition/deletion is bounded by some con-
strains (i.e., degree). Figure 12(ii)(b) shows an example of
0
the perturbed graph G obtained by applying edge mod-
ification concept on an original graph G given in Figure
12(ii)(a). The perturbed graph is k-degree anonymous, where
k = 2. The original graph G has a degree sequence
d(G) = {2, 4, 2, 1, 3, 2, 2, 2, 2}, while the modified graph
0 0
G given in Figure 12(ii)(b) has degree sequence d(G ) =
{2, 3, 2, 2, 3, 2, 2, 2, 2}. The number of vertices and edges are
same in both graphs, and the anonymous graph is 2-degree
anonymous (i.e., each vertex has at least 2-edges). The single
modification in a G by modifying edge ({v3 , v2 } to {v3 , v4 })
has made the G two anonymous. The constrains value can be
adjusted considering the protection level and graph structure.
0
Another example of the 2-degree anonymous G by adding
two edges ({v4 , v10 } and {v5 , v10 }), and one vertex (v10 )
0
is shown in Figure 12(ii)(c). The degree sequence of G
0
becomes d(G ) = {2, 4, 2, 2, 4, 2, 2, 2, 2, 2} and number
FIGURE 11. Examples of anonymizing graph by adding edges and vertices. of vertices and edges increase by one and two, respec-
tively. In the constrained perturbation, addition/deletion of
An example of the original graph G anonymization the nodes/edges follow some criteria (i.e., degree, closeness,
through both constrained and random perturbation tech- and clustering co-efficient etc.), and further addition/deletion
niques taken from study [30] is shown in Figure 12(i), (ii). of the nodes/edges stop once the defined criteria is satisfied.
16 VOLUME 4, 2016

This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see [Link]
 This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI
10.1109/ACCESS.2020.3045700, IEEE Access

Author et al.: Preparation of Papers for IEEE TRANSACTIONS and JOURNALS

FIGURE 12. Original graph anonymization by using random (e.g., non-constrained) and constrained anonymization methods.

There are six basic edge and vertex modifications tech- node represent the cluster size (e.g., number of users) and
niques for SN data anonymization [44]. The modifications intra-cluster edges. For example, in cluster c3 there are two
techniques are: (i) edge add, (ii) edge delete, (iii) edge users but there is no edge between them. Therefore, the value
add/del, (iv) simple edge switch, (v) double edge switch, and inside the triangle (a.k.a super node) is (2, 0). The weighted
(vi) node addition. Most of the existing SN data anonymiza- edges between super nodes represent the inter-cluster edges.
tion methods use one (or more) of these six modifications
techniques during graph anonymization. A detailed taxon-
omy of the graph modification techniques is given in study
[53]. The four types of graphs that are mainly used to rep-
resent the SNs users’ data are: simple graph, bipartite graph,
labelled graph, and uncertain graph.
In SN data anonymization, majority of the approaches
are driven from the concepts that were proposed for
anonymizing tabular data. For example, the k-anonymity
model and its variants such as k-degree anonymity, k-
isomorphism anonymity, k-automorphism anonymity, k-
candidate anonymity, k-neighborhood anonymity, and (k, `)-
grouping have been adapted to anonymize SN data. The gen-
eralization/clustering based approaches anonymize SN data
by partitioning it into different clusters, and generalizing the
clusters into super nodes/edges [117]. The concept of these
approaches after clustering is analogous to the EC general-
ization of the relational data. Moreover, the cluster sizes and
generalization degrees are determined in a way that maximal
0
information is retained in the clustered network (i.e., G ). The
conceptual overview of the generalization/clustering based
anonymization is presented in Figure 13.
A network/graph with seven nodes and two QIs (age,
gender) is provided as an input ( Figure 13 (a)), whole
network is partitioned into three clusters (c1 , c2 , c3 ) based on
the QI’s similarities ( Figure 13 (b)), and a corresponding
generalized network with three super nodes is obtained as an
output ( Figure 13 (c)). We used three distinct symbols (e.g.,
square, circle, and triangle) to denote the users in each cluster FIGURE 13. Original graph anonymization by employing
and super nodes, respectively. The two numbers in each super clustering/generalization based method.

VOLUME 4, 2016 17

This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see [Link]
 This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI
10.1109/ACCESS.2020.3045700, IEEE Access

Author et al.: Preparation of Papers for IEEE TRANSACTIONS and JOURNALS

On the contrary, the privacy-aware graph computation

0
and DP based approaches do not release the entire G like
previous two techniques (e.g., graph modification and graph
generalization/clustering techniques) [30]. These approaches
perform computations on the original graphs G, and yield
output of an analysis computation. Compared to the previous
two techniques, these approaches allow constrained analysis
on the SNs data that can limit the widest range of appli-
cations for knowledge extraction and data mining. The DP
concepts have been tailored with the structural properties to
anonymize graphs data, and DP is regarded as one of the
best privacy-aware graph computation techniques [30]. The
DP based approaches in SN data anonymization have been
classified into three categories, node-level DP, edge-level DP,
and node and edge level DP. These techniques compute the
useful statistics from an original graph in such a way that
individual’s privacy is preserved, and data remains useful for
the analytical purposes.
The useful analysis provided by privacy-aware graph com-
putation and DP based approaches are: graph density, edges
count, relationships degree, degree distributions, size of the
network, centralities, closeness, counts of the sub graphs, top
k-users with highest degree in a network, distance/similarity
between users, path length, clustering coefficients, commu- FIGURE 14. Overview of the graphs’ statistics determined by privacy-aware
nity discovery/extraction, hypergraphs, joint degree distri- graph computation methods.

bution, cuts, number of users with degree d, aggregation,

projections, and sparse and dense segments of the graphs,
to name a few. These valuable statistics can be utilized utility trade-off, CC= computational complexity, SNs= social
for range of applications including social network analy- networks, SA= sensitive attributes, Bk= background knowl-
sis, marketing, preference mining and analysis, collabora- edge, GP= graph publishing, GA= graph anonymization,
tive filtering, epidemiological investigation, and information EC= equi-cardinal, and IL= information loss. Just like re-
spread/contagion etc. A sample of the graphs’ statistics com- lational data, many privacy and utility evaluation metrics
puted with the help of node DP techniques [118], [119] have been proposed to access the performance of SNs data
and minimum spanning tree (MST) DP [120] approaches is anonymization mechanisms.
presented in Figure 14.
Aside from these basic statistics, applying node/edge DP A. METRICS USED FOR THE EVALUATION OF PRIVACY
approaches for publishing graph cuts and pair-wise distance AND UTILITY OF STRUCTURAL ANONYMIZATION
between nodes are handy for data-driven applications. Fur- TECHNIQUES
thermore, many `-diversity and t-closeness variants have 1) Graphs utility evaluation metrics
been proposed by the researchers to solve the content dis- The existing well-known graph utility evaluation metrics
closure problems in the PPGP. A comprehensive details are: (1) degree (Deg.), (2) effective diameter (ED), (3) joint
about these variants with definition is elaborated in studies degree (JD), (4) local clustering co-efficient (LCC), (5) path
[33], [55], [121]. Despite the success of existing PPGP length (PL), (6) closeness centrality (CC), (7) eigen vector
mechanisms, preserving privacy in dynamic SNs is still an (EV), (8) betweenness centrality (BC), (9) network con-
important research direction which has received significant straints (NC), (10) network resilience (NR), (11) infectious-
attention from the research community recently. ness (Infe.), (12) page rank (PR), (13) hub score (HS), (14)
The hybrid anonymity approaches usually employ more global clustering co-efficient (GCC) or global transitivity
than one anonymity technique to yield anonymized SN data (GT), and (15) authority score (AS). Aside from these well-
[122]. However, the complexity of the hybrid anonymity known metrics, some general purpose approaches such as
approaches is relatively higher when G contains substan- accuracy, classification, information loss (IL), ratio of top
tial number of nodes and edges. Hence, hybrid anonymity influential users (RRTI), query response, and graph spec-
techniques are used only in specific scenarios involving SN tral properties have also been used to measure anonymous
data. We summarize the recent structural anonymization ap- graph’s utility. Furthermore, there exist seven application-
proaches used for SN data (e.g., graphs) in Table 4. The specific utility evaluation methods which are, (1) role ex-
abbreviation used in Table 4 are: EM=edge modifications, traction (RX),(2) reliable email (RE), (3) minimum sized
PPGP= privacy preserving graph publishing, PUT= privacy- influential nodes set (MINS), (4) influence maximization
18 VOLUME 4, 2016

This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see [Link]
 This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI
10.1109/ACCESS.2020.3045700, IEEE Access

Author et al.: Preparation of Papers for IEEE TRANSACTIONS and JOURNALS

(IM),(5) community detection (CD), (6) source routing (SR),

and (7) sybil detection (SD). We refer interested reader to
the previous work [123] for more detailed definitions and
descriptions of the above metrics.

2) Graphs privacy evaluation metrics

The most commonly used privacy metrics in evaluating the
performance of graph anonymization algorithms are, (1) the
number of re-identified nodes, (2) degree of uncertainty, (3)
adversary’s success rate, (4) query’s error, (5) information
gain, (6) amount of leaked information, (7) information sur-
prisal, (8) privacy score, (9) association rule hiding (ARH),
(10) distribution leakage, (11) prior information belief and
posterior information belief, (12) entropy leakage, (13) prob-
abilistic anonymity, (14) downgrading classifier effective-
ness, (15) membership inference analysis, and (16) accurate
predictions. Wagner et al. [124] summarized eighty privacy
evaluation metrics used by different PPDP algorithms. The
authors categorized the privacy metrics based on four com-
mon characteristics which are, (i) adversary models, (ii) data
sources (i.e., auxiliary information), (iii) input for compu-
tation of metrics, and (iv) output measures. The selection
of the metric depends on the data type, objectives of data
publishing, and target application/users. However, in most
cases, a single metric cannot capture the entire concept of
privacy, therefore, two or more metrics are jointly used to
measure the level of privacy offered by an anonymization
algorithm/model. Recently, Zhao et al. [125] analyzed and
discussed twenty-six different metrics used for privacy eval-
uation in anonymized graph. The authors suggested that no
single metric is effective to evaluate privacy protection in
anonymous graphs. Therefore, the authors suggest that the
strengths of multiple privacy evaluation metrics can be com-
bined to improve the overall measurement of user’s privacy
0
in a G . This work employs multi-criteria decision analysis
0
to the privacy measurement in a G , and it opens up a new
research direction that may lead to significant improvements
in future for privacy measurement.

VOLUME 4, 2016 19

This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see [Link]
 20
TABLE 4. Detailed comparison of recent structural anonymization approaches used for the social networks data (i.e., graphs data) anonymization.

Method [Ref.] Assertion (e.g., problem solved) Anonymization by Merits Demerits

KDVEM:k-degree anonymity preserve identity disclosure modifying edges and vertices less changes in the graph’s structure poor utility in large SN graphs
[126]
k-degree sequence anonymity preserve identity disclosure modifying edges better SN data utility in the PPGP complexity rapidly increases with the k
[127]
k-anonymity on graphs [128] preserve identity disclosure adding dummy vertices and EM better utility on three graph metrics works well on small graphs only
structural integrity [129] preserve identity disclosure edges addition and deletion improved graph’s utility for analysis very high computational cost
randomization [130] preserve link disclosure edge shifting resolves privacy and utility trade-off in PPGP identity disclosure is possible due to the BK
rough set based approach [115] protects sensitive relationship disclosure edge shuffling improved graph utility for analytics vertex re-identification possible in presence of BK
randomized perturbations [131] preserve identity disclosure modifying edges and vertices better graph data utility for analytics prone to the content disclosure threats/problems
(k, `)-anonymity [132] preserve identity and content disclosures edge addition produces more useful graphs high computational cost on the large graphs
SN immunization (SNI) [133] preserve content disclosure guarding nodes solves multiple SAs problem in the PPGP lower utility in terms of the IL
EC clustering [134] preserve identity, link, and content disclosures vertex shuffling better privacy for all three disclosures lower utility on the complex graphs
PM index [135] preserve identity disclosure perturb links better users’ privacy protection lower utility and very high computational complexity
(k, τG,` )-adjacency [136] preserve identity disclosure edge set perturbations less graph edits in the GA poor utility on the dense graphs
0
mathematical modeling [137] preserve identity disclosure edge addition better privacy preservation during G analysis less utility on the sparse graphs
k-degree anonymity [138] preserves identity and link disclosures edge additions scalable to the large SN graphs high IL on sparse and complex graphs
active learning method [139] preserves link predictability deleting edges protects from the inference attacks may deletes highly useful links/edges
edge entropy [140] preserve identity disclosure edge modification better privacy of only some nodes unable to resolve PUT in the PPGP
safely permuting condition users, groups and edges’ privacy protection nodes masking suitable for dynamic GP high complexity and low utility in terms of analysis
[121]
Anatomy based clustering preserves identity, link and attribute threats clustering better utility of the SN graphs high computing cost and more changes in G
[141]
statistical analysis [142] preserves identity disclosure edge removal better privacy in the PPGP higher IL due to more edits in G
Bayes rule (BR) [143] preserves identity disclosure edge addition better PPGP method in practice does not provide privacy analysis on the large graphs
clustering perturbation [144] preserves vertices properties modifying edges and exchanging at- better privacy preservation in the PPGP lower utility in terms of the IL
tributes randomly
k-degree-l-diversity [145] preserves identity and content disclosures adding noise nodes superior privacy protection in the GP lower data utility and high CC
k-subgraph [146] preserves identity disclosure move edges to achieve k-degree defense capability against malicious attacks limited testing was carried out
k-degree anonymity [147] preserves identity disclosure adding noise nodes slight modification in the original graph lower utility due to more noise addition
partial k-anonymity [148] preserves identity disclosure adding and deleting edges better utilities in the PPGP’s analytics privacy breaches occur in presence of the BK
wP IN Q method [149] preserves identity disclosure adding new nodes better data utility during published graph analysis higher modifications in the G’s structure
CDGA method [150] preserve identity disclosure remove edges slight changes in the original graph prone to link disclosure threats
10.1109/ACCESS.2020.3045700, IEEE Access

DP-FT method [151] preserve identity and link disclosures masking vertices maintains good utility during the GA prone to content disclosure threats
HDP + AU L method [152] preserve link disclosure edges modification maintains good privacy in the PPGP less utility due to noise addition
0
Differential privacy [153] preserve link disclosure edges modification less changes in the original graph errors rate is still relatively high in G
EN − DP method [154] preserve identity disclosure ordered edge insertion effective in terms of less changes in the G more utility loss on the large G
dK − 1, 2, 3 [155] preserve identity and link disclosures nodes and edges perturbation more utility in terms of query response more changes in the graph structure
subgraph-DP [156] preserve groups identity disclosure edges addition slight changes in the graph no guarantee for single user’s privacy
HIGA method [157] preserved identity disclosure edge addition and deletion better utility in terms of query’s answer accuracy prone to content and link breaches
graph anonymity [158] preserved link disclosure edges modification protects from the inference attacks high utility loss due to more changes in G
k-decomposition [159] preserved identity disclosure graph modifications better PUT resolution in the GP poor scalability on large graphs
random walk [160] preserved link disclosure degree and link perturbations hides both hub nodes and social relationships in SNs high modifications in the G’s structure
(k, `)-anonymity [161] preserved link and identity disclosures edge additions protection from the active attacks cannot thwart the sybil retrieval
Differential Privacy [162] preserved link and content disclosures node sampling better user’s privacy protection very high computing cost
data-manipulating methods preserve content disclosure indistinguishable links lowers prediction accuracy for the SA utility can be lower on large graphs
[163]
heuristic PBCP method [164] preserved content disclosure clustering better privacy protection in the GP prone to the link disclosure threats
KDDLD − U L [165] preserved content and identity disclosures nodes addition better utility and low computing cost prone to the link disclosure threats

This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see [Link]
(k, `)-grouping [166] preserve affiliation link disclosure generalizes node’s attributes better privacy protection in the PPGP more changes in the G’s structure
PBCN approach [167] protects from graph structure and degree attacks clustering and noise addition resolve “trade-off” between data utility and privacy more parameters and high computing complexity
DPCD and NAR algorithm protects user’s private social relationships and DP-based community detection and privacy preservation of both social relationships and at- may lead to privacy breaches in dense structures G
[168] attributes NAR algorithm tributes
SSN algorithm [169] protects the privacy of structural role variational Bayes-weighted network significant improvements in anonymous graph accuracy limited experiments were performed for validation
DP (VB-WNDP)
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI

VOLUME 4, 2016
Author et al.: Preparation of Papers for IEEE TRANSACTIONS and JOURNALS
 This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI
10.1109/ACCESS.2020.3045700, IEEE Access

Author et al.: Preparation of Papers for IEEE TRANSACTIONS and JOURNALS

B. DE-ANONYMIZATION METHODS EMPLOYED BY THE

ADVERSARIES TO JEOPARDIZE USERS PRIVACY IN SN
PUBLISHED DATA
Due to the phenomenal growth in SNs adoption around the
globe, the SN data has become more reliable for conducting
research and achieving multiple business/scientific objec-
tives. The data-miners and analysts can extract the enormous
0
amount of information embedded in the published G . Aside
from collecting the relevant information regarding some
custom rules or desired communities from the published
graph, the data-miners try to reveal true identities/private-
information of the users for fulfilling multiple hidden ob-
jectives such as personalized service recommendation, user’s
profiling, and preference based digital contents selling. Inter-
estingly, in some cases, the embedded knowledge extraction
enables firms to be competitive in the market for long-run.
Due to increase in information surges, availability of the var-
ious SNs, maturity of the machine learning and data mining
tools, advancement in computing technologies, and attacker
capabilities have made the personal information retrieval
much easier. Due to the public access of the SNs and lack
of user’s awareness about the online privacy, the protection
of privacy on the SN sites is very challenging. Therefore,
it has become an active area of research in recent years.
Adversaries are not only able to get multiple users informa-
tion but also they can re-identify people uniquely with the
help of multiple auxiliary sources. There exist several de-
anonymization approaches in literature that were employed
on the published graphs to infer the true identity or SA of
the SN users. For instance, Azizy et al. [170] summarized
and classified various de-anonymization approaches used by
the adversaries. We summarize the recent de-anonymization
approaches with examples in Figure 15.
Aside from the de-anonymization approaches explained
above, Beigi et al. [171] summarized various seed-based and
seed-free de-anonymization methods employed by the adver-
saries for privacy breaches in published SN data. Authors
FIGURE 15. Description about de-anonymization approaches used by the
provided a detailed overview of latest SN data anonymization malevolent adversaries for privacy breaches.
and de-anonymization approaches, and theoretical analysis
about the graph’s de-anonymization. In addition, various
user’s attributes inference methods have been reported by
the authors with examples. Apart from the de-anonymization The privacy items and corresponding de-anonymization
approaches explained in Figure 15 and previous studies, we methods summarized in Table 5 pose serious threats to the
summarize the key items that enable unique identifications SN user’s privacy in the PPGP. Apart from the well-known
of an individual/groups or SA disclosures from the privacy methods summarized above, the user’s privacy can also
preserved graph data publishing in Table 5. be breached through the information acquisition about the
These items are usually exploited by the adversaries changing interest of a user overtime and predictions about the
to jeopardize user’s privacy in SN published data to in- user’s private information through side channels of various
fer/predict true identities of users or their SAs. Each item types (i.e., interests). Recently, due to availability of the
assists in compromising an individual or community privacy excessive amount of auxiliary information and advanced data
when exploited by the adversaries. Various approaches based mining tools, the scale and the scope of privacy breaches is
on these items/features have been proposed to compromise expanding from an individual identification or SA disclosure
people’s privacy by leveraging the single or multiple SNs’ to groups identity theft for achieving multiple scientific and
data (a.k.a across SNs). Drawing on the reviewed graph de- business objectives, and identifying communities in SNs hav-
anonymization techniques, majority of the techniques enable ing common characteristics or common interests for accurate
adversaries to compromise users’ privacy successfully. recommendations.
VOLUME 4, 2016 21

This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see [Link]
 This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI
10.1109/ACCESS.2020.3045700, IEEE Access

Author et al.: Preparation of Papers for IEEE TRANSACTIONS and JOURNALS

TABLE 5. Description about the key items that are exploited by the adversaries to breach user’s privacy.

Sr. No. Items Methods employed by the adversaries to breach user’s privacy (a.k.a de-anonymization) Representative Methods
1. profile attributes attributes coupling, computing attribute’s similarities between published and auxiliary graphs, relevance analysis, Yin et al. [172], Li et al. [173], Mao et al.
quantifying the significance of attributes to invade user’s privacy. [174], Zhang et al. [175], [176]
2. user-generated contents in measuring similarities of contents in terms of space, time and content dimensions, interest mapping, word embedding Yongjun et al. [177], Nie et al. [178], Sha et
SN technologies on users messages. al. [179]
3. accounts on multiple so- pairwise identical factor graph models, identity search and matching by exploiting user-generated posts and number Wang et al. [180], Ahmad et al. [181]
cial networks of friends.
4. online groups joined by a exploiting the group membership information of a user that he/she subscribe/join for information seeking or sharing Wondracek et al. [182]
user on SNs and is available on the SN sites.
5. communities a user is part partitioning the whole networks/graphs into ‘communities’ and performs a mapping, exploiting the multi-hop Nilizadeh et al. [183], Lee et al. [184]
of in the SNs neighborhood information with classifiers to breach privacy.
6. friends, neighbors’ infor- structure-based weighted neighborhood matching (SWNM), information shared by users’ SN friends, friendship Fang et al. [185], Labitzke et al. [186],
mation learning-based identification (FBI). Youyang et al. [187]
7. spatial and temporal infor- fusing temporal and spatial data with other related information such as check-in/posts data to infer private Gao et al. [188]
mation of the SN use information of users.
8. user’s activities on the SNs Combining multiple personal activities of a user such as posting content on SNs, commenting on SN sites, liking Yoshiura et al. [189]
sites posts, and using mobile services.
9. display name of a user Exploiting multiple characteristics of display names such as length similarity, letter distribution similarity and Li et al. [190]
across SNs character similarity.
10. user’s structural and con- modeling the topics of user’s interests from contents, capturing the interest-based and friend-based user co- Wang et al. [191]
0
tent information occurrence in a G to compromise user’s privacy.
11. tagging behavior of a user extracting relevant features from the inconsistent tagging behaviors of a user and combining them with the profile Zhao et al. [192]
on SNs sites attributes.
12. rating given by a user to a extracting relevant features about the movies’ rating, and gender estimation using traditional supervised classification Weinsberg et al. [193], Kosinski et al. [194]
particular movie methods.
13. music choices extraction of user’s interests, semantic similarity computation and topic modeling based users’ attribute prediction. Chaabane et al. [195]
14. social links (i.e., friends) construction of the social behavior attribute network (SBA), integration of the related information in a unified Gong et al. [196], [197]
and user behavior informa- framework, and inferring the target user’s profile information via vote distribution attack (VIAL) model.
tion
15. purchasing behavior structured neural embedding (SNE) model to learn the representations from users’ purchase data automatically to Wang et al. [198]
predict multiple demographic attributes. Five attributes (e.g., marital status, gender, income, education level, and
age) of users were accurately predicted.
16. networks of social modeling SN data as a social-attribute network (SAN) and exploiting the structural characteristics of the SAN, and Jiang et al. [199], Thangam et al. [200], Song
attributes computing attributes and nodes similarities to infer/predict the private links and user’s attributes. et al. [201]
17. capturing user’s structural pattern learning, multi view modeling of both the target network and the auxiliary network, and employing Xian et al. [202]
activities/interactions target network reconstruction for inferring anonymized links.
18. Exploiting vulnerable finding and targeting the vulnerable friends who have applied insufficient privacy settings to infer their private Gundecha et al. [203]
friend’s information information, and entire network of friends subsequently.
19. Picture’s metadata mapping picture’s meta-data to a low-dimensional vector space, and inferring user’s gender subsequently. Pijani et al. [204]
20. utilizing both graph struc- reduce the size of candidate set by analyzing graph structure, and exploits user’s profile information to identify the Li et al. [205]
ture and user profile info. correct mapping of users with a very high confidence.

Furthermore, when a group of SN users form an online summarize the recent structural anonymization approaches
community, the SN service providers have access to more used in application-specific scenarios of SN data publish-
information including political viewpoints, preferences, rela- ing. These scenarios include, anonymization approaches for
tionship status or financial status because a user often readily friends recommendation, community clustering/detection,
shares more about him or herself in an online community. collaborative filtering, topic modelling, and SN’s users be-
Accordingly, this goldmine of data when shared with the havior analysis etc. Aside from the structural modifications
data-miners can lead to privacy breaches. In addition, so- in graphs, the anonymization approaches used in application-
cial connection information prediction about a user with specific scenarios also consider the features of the applica-
advanced data mining tools, and identifying an individual tions for which the data is being anonymized. For exam-
and users groups by contents analysis and activities has ple, Xu et al. [29] proposed a framework for discovering
become serious challenge for SN service providers [206]. the privacy-preserved communities in the SNs. The pro-
Hence, SNs users data sharing can endanger user’s privacy in posed framework enables the formation/detection of different
unexpected ways, and researchers are devising many domain communities without revealing sensitive link information.
and attacks specific, and general PPGP methods to combat In this work, we summarize the state-of-the art structural
with this uprising social problem (e.g., safeguarding SN users anonymization approaches used in application-specific sce-
privacy). narios of the SN in Table 6. The anonymization approaches
summarized in Table 6 consider the features of the related ap-
C. STRUCTURAL ANONYMIZATION APPROACHES plication during anonymization process. Furthermore, some
USED FOR APPLICATION-SPECIFIC SCENARIOS IN SN approaches have been used for multiple/heterogeneous appli-
DATA PUBLISHING cations due to overlapped properties/characteristics between
In Table 4, we summarized the generic structural anonymiza- them.
tion approaches used in the PPGP. In this subsection, we Recently, due to the phenomenal growth in opportunities
22 VOLUME 4, 2016

This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see [Link]
 This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI
10.1109/ACCESS.2020.3045700, IEEE Access

Author et al.: Preparation of Papers for IEEE TRANSACTIONS and JOURNALS

TABLE 6. Description about the anonymization approaches used in SN application-specific scenarios.

References Proposed solutions Main methods/concepts employed in the anonymization Practical application scenario(s)
Xu et al. [29] PPGP Framework It utilizes both social connections and users’ published contents during anonymization Privacy preserved communities detection/discovery
Guo et al. [207] Privacy preserving scheme It utilizes SN users’ social attributes and trust relationship during anonymization Friend recommendation
Kukkala et al. [208] Multiparty computation (MPC) It focuses on identifying the influential spreaders in the SN by securely performing k-Shell decomposition, Information diffusion
protocols PageRank and VoteRank algorithms.
Dong et al. [209] Matchmaking system It encrypts users’ identities, locations, as well as profiles to preserve the user’s privacy in SNs Finding potential friends/romantic partner
Zhang et al. [210] Utility-based popularity It combines k-anonymous popularity-based following (KPF) protocol and fully utility-based interaction targeted advertisements, opinion leader selection, information
anonymization scheme (FUI) protocols to protect users privacy. spreader
Georgiou et al. [211] Algorithmic methodology It alters an existing/determined community-aware trending topic structure so that it can preserve the privacy Trending topic detection in SNs.
of the involved users while still reporting/modeling topics with a satisfactory level of utility
Chinnaiah et al. [212] Sanitization framework It automatically preserves the user’s privacy by detecting sensitive topic and minimizing the risk of sensitive Sensitive topic diffusion
information disclosure
Jiu-Ru et al. [213] Novel framework It uses k-automorphism model to protect the structural privacy and a cost-model based label generalization Subgraph pattern matching
method to protect label privacy.
Casas-Roma et al. [214] PPDP framework It uses a generic information loss measures (GIL), such as average distance or diameter, to evaluate to what Graph mining tasks
0
extent the analysis of G differs from the G to effectively preserve privacy.
Dongsheng et al. [215] Privacy-preserving recommender It organizes users into groups with diverse interests and users interact with the server via interest-specific Privacy-preserving content recommendation
system pseudo users.
Mosallanezhad et al. [216] Text annonymizer approach It extracts a latent representation of the original data/text and use deep reinforcement learning for privacy User behavioral modeling tasks
and utility problem solving.
Tianchong et al. [217] Anonymization algorithm It adds and deletes enough edges to satisfy the privacy demand and use novel bottom-(`, k) sketching to Analyzing the information transmission speed and rumor
preserve user’s privacy. spreading models
Yiwei et al. [218] Residual entropy minimization al- It quantifies the amount of information revealed by a community structure and then solve this problem by Community structure deception
gorithm residual entropy minimization (REM) algorithm to obfuscate a given community structure in a SN data.
Ramezanian et al. [219] AI-based privacy preserving system It marks all subscribers as normal at the start, detect the bully message using artificial intelligence (AI) Cyberbullying prevention
techniques, and protect victims automatically.
Kavianpour et al. [220] Privacy-preserving model It provides a safe platform with high accuracy to detect malicious social interactions to enhance users’ Controlling undesirable users’ data diffusion to unauthorized
privacy in interactions with third-parties applications. It alleviates the possibility of information leakage third-parties
and user’s re-identification problems.
Rathore et al. [221] Access control framework It uses the relation-based access control (ReBAC) policy model based on the predicate calculus for Restricting user’s private data not to move outside of the SN
AppMonitor regulating access of the users data with third-parties. platform
Boshrooyeh et al. [222] Privado mechanism It protects user privacy against active malicious adversaries on the SN sites using two non-colluding servers Users group-based advertising on SNs sites
and honest but curious (HbC) adversarial model.
Huang et al. [223] platform-centric two-layer three- It protects user’s privacy by analyzing the interactions among the three parties (user, platform, and Context-aware services on SNs sites, such as Facebook
party game model adversary) by using a platform-centric two-layer three party game model.
Guo et al. [224] attribute-based reputation value es- It computes the reputation value of the users’ attributes while preserving the privacy of the verifiability of Content-based user’s reputation estimation in SNs
timation system the attributes and authenticity of the reputation value in SNs.
Yang et al. [225] DP Input and Manner (DPI, DPM) It calculates the predicted scores and adopts two methods (DPI, DPM) of adding Laplace noise to hide Collaborative filtering in recommender systems for social ser-
methods individual ratings, and provide valuable prediction results to information consumers. vices (i.e., using SN data)
Aljably et al. [226] privacy-preserving model based on It protects user privacy in SNs by employing Laplace’s probability distribution function (PDF) to generate Anomaly detection in online social networks with high detec-
local DP (LDP) random noise. Tt protects both profiles and activities of the users. tion accuracy
Li et al. [227] PPGP protocols based on homo- It prevents users information leakage during the graphs computing process (a.k.a privacy-aware graph social network analysis (e.g., graph operations) in multi-party
morphic encryption computation) using homomorphic encryption technique. computation process/setting

offered by SNs data, researches have turned their attention to the users who are no longer in the same environment/place as
devise new and realistic anonymization methods leveraging the target user may no longer be reliable/true and have lost
advanced artificial intelligence (AI) techniques. Li et al. its value. The authors combined behavioral characteristics
[228] designed a deep learning (DL) model that combines and structural similarity to accurately filter the user groups
multiple factors such as attribute information, graph struc- who hold the current private information of a target user
ture, and behaviour characteristics while avoiding tedious for measuring a user’s privacy status. Ruggero et al. [232]
calculation procedures to measure the privacy in SNs. The suggested that user’s privacy in SNs can be influenced by
proposed model considers the deep relationship between all many external factors (e.g., the position of the user within
three factors (user attributes information, graph structure, and the social graph, the relative risk of the network). To solve
behaviour characteristics) to accurately obtain the privacy this problem, the authors devised a network-aware privacy
score. score metric that accurately measure the user’s privacy risk
Alemany et al. [229] devised two metrics (Audience and according to the characteristics of the network (i.e., G).
Reachability) for assessment of privacy in information shar- A semi-supervised framework based on structural em-
ing scenario in the SNs. The authors performed rigorous sim- bedding for account correlation was proposed by Zhou et
ulations in different SN topologies and considering different al. [233]. It learns the latent and structural semantics for
layers, and concluded that network topology in SNs has a accounts correlation between networks. It correlates accounts
direct effect on the outreach of the information. Pensa et al. with high accuracy by leveraging the semantic information
[230] described a knowledge-driven approach for enhancing among accounts through random walks approach. Further-
privacy awareness in SNs. The proposed approach has ability more, the user’s identity disclosure/matches problems with
to measure the privacy risk of the users and inform them limited profile items have also been reported in the litera-
whenever their privacy is breached or at risk. Also, it helps ture [234], [235]. In recent years, federated learning (FL)
the exposed users to customize their privacy level semi- based privacy preserving approaches have been proposed
automatically by limiting the number of manual operations. for anonymous data publishing with legitimate third-parties
Li et al. [231] suggested that private information in the SNs [236]–[240]. Furthermore, many anonymization approaches
sites is time-sensitive, which means that information held by have been proposed to preserve the users’ privacy in sequen-
VOLUME 4, 2016 23

This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see [Link]
 This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI
10.1109/ACCESS.2020.3045700, IEEE Access

Author et al.: Preparation of Papers for IEEE TRANSACTIONS and JOURNALS

tial publication of the SNs data [241]–[243]. digital traces, logs, documents (e.g., medical prescriptions,
disaster/disease control agencies data), images, videos, text
D. CHALLENGES IN SOCIAL NETWORK DATA documents (e.g., reviews, blogs, and opinions), and time
ANONYMIZATION series data can reveal private information in digital landscape.
SN data is usually represented as a graph, and structural Hence, enterprises and organizations are constantly exploring
anonymization approach is applied to sanitize it before re- new innovative strategies and methods to remain competitive
leasing with data-miners. Anonymizing SN data is much in their market while ensuring users’ privacy [245]–[249].
more challenging compared to tabular data due to complex Nevertheless, data policies including privacy, intellectual
structure and variety of information embedded in graphs property, security, and liability issues, should be addressed
about the entities (i.e., users). The three well-known chal- in all phases (e.g., collecting, pre-processing, anonymizing,
lenges related to SN data anonymization are, (i) modeling sharing, and analytics) of person-specific data handling in
background knowledge (BK) of the adversaries (in SNs, the order to exploit big data value. Decentralized anonymization
appropriate modeling of the adversaries’ BK is harder com- methods are handy solutions to truly benefit from the data
pared to the tabular data because adversaries can have access publishing without significantly impacting user’s privacy
to the multiple pieces of information about an individual, and [250], [251]. Nowadays, the AI techniques have become
0
he/she can re-identify target individual from the G by lever- significantly mature to assist in data-driven decision making,
aging the BK.), (ii) devising a new structural anonymization users’ privacy protection has become imperative for most
method (devising a new anonymization method for SN data organizations’ success [252]. Considering the applications
is very hard compared to the tabular data due to the structural and unprecedented opportunities of data sharing, the privacy
dependence of entities on each other. In SN, a slight modi- and utility trade-off resolution in PPDP remains challenging.
fication in the graph structure can affect the whole network.
Hence, the adhoc solutions based on "divide and conquer" In future computing paradigm, four mainstream technolo-
approach cannot be directly applied on the SN data), and gies will become the centre of the information technology
(iii) quantifying the utility of the anonymous graph (in SN (IT) world, big data, cloud computing, social networks, and
data, measuring the usefulness offered by an anonymous internet of things (IoT). These technologies have ability to
0
graph is not straightforward. The differences in G and G process any kind of data with advanced analytics tools to
properties are difficult to quantify. In addition, by adding extract insights from collected data. The main drivers of these
new edges and vertices to increase privacy protection can technologies are expanded internet connectivity, low cost
often lead to excessive information loss in the PPGP.). Aside sensors, higher mobile adoption, and large IoT investments.
from the three key challenges explained above, the structural In Figure 16, we present the future computing paradigm’s
anonymization of massively large scale graphs involving technologies, data sources, and analytics solutions that are in
many entities data is very challenging. Furthermore, in SN, use to serve the mankind in better way compared to the recent
amount and variety of data collected about entities increase past.
exponentially with the passage of time. Thus, devising new Despite the benefits offered by these latest technologies,
structural anonymization approaches to solve these problems there exist many barriers such as technological fragmenta-
from both practical and theoretical perspectives have become tion, security concerns, implementation problems, and pri-
imperative while benefiting from the SNs users data. vacy concerns. Such potential barriers have been the bot-
tleneck for the wide applications and development of these
VI. SUMMARY AND DISCUSSION ABOUT THE PRIVACY technologies and, thus, have attracted widespread concern.
ISSUES IN FUTURE COMPUTING PARADIGM Among others, privacy concerns significantly hamper the
In this article, we have covered most of the concepts related development and applications of these technologies, and
to the anonymization approaches used for data owned by this field has attracted significant attention from the re-
both physical organizations (e.g., hospitals, banks, and insur- search community in recent years. Furthermore, many latest
ance companies etc.) and virtual platforms (e.g., Facebook, methodologies such as homomorphic encryption, federated
Twitter, and Link-din etc.). Specifically, we described the learning, deep learning, and block chain have also been
anonymization methods employed for two types of input used for privacy protection in future computing paradigm
data, tables and graphs. We emphasized more on the SN (year 2020 and beyond) [253]–[260]. Butpheng et al. [261]
data anonymization considering the exponential adoption presented various research perspectives related to privacy and
of the SNs around the globe by adults, and unprecedented security within IoT-cloud-based e-Health systems. Authors
opportunities these platforms offer in terms of business in- provided various benefits of IoT and cloud based e-Health
telligence. Furthermore, the data-driven technologies and big systems, and analyzed security and privacy solutions in the
data analytics are playing a vital role in extracting embedded study.
knowledge from unstructured data to improve SQ [244]. We summarize the various privacy issues related to the
Apart from these two types of data (e.g., tables and future computing paradigm after in-depth synthesis of the
graphs), a wide range of data types such as matrix (e.g., tra- previous studies in Figure 17. We refer interested reader to
jectories information, market basket data, and ratings data), previous works [262]–[271] for more detailed descriptions
24 VOLUME 4, 2016

This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see [Link]
 This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI
10.1109/ACCESS.2020.3045700, IEEE Access

Author et al.: Preparation of Papers for IEEE TRANSACTIONS and JOURNALS

FIGURE 16. Detailed overview of the future computing paradigm and related concepts.

and definitions of the privacy issues related to the future privacy preserving machine learning (PPML) concept has
computing paradigm. Therefore, future research must be been employed to extract the knowledge from distributed
done to find new ways to make anonymization solutions databases while ensuring data privacy [276], [277]. Due
more resilience towards these issues such as quantifying the to the PPML, traditional machine learning algorithms can
risk and benefits of data publishing, deciding the appropriate be adapted to secure users’ data stored in multiple digital
mechanism for privacy preservation considering the adver- environments.
saries’ capabilities (e.g., worst case scenarios), verifying the Recently, the privacy-aware data cleaning techniques have
effectiveness of privacy enhancing technologies through real- significantly reduced the data preparation cost of data analy-
world applications or increasing users’ awareness about the sis pipeline [278], [279]. These techniques allow the clients
privacy leakage through hidden routes. to buy clean, and curated data from heterogeneous service
Moreover, achieving effective privacy protection should provider to perform analytics without compromising user’s
focus more on exploiting intrinsic characteristics of users’ privacy. Furthermore, development of privacy information
data or application features for which data is being management system (PIMS) in accordance with international
anonymized by the simulation of diverse privacy approaches standard (e.g., ISO/IEC 27701) is imperative to safeguard
[272]–[274]. Furthermore, privacy enhancing technologies the privacy of individuals or small groups in the popula-
(PETs) for better privacy preservation in personalized ser- tion [280]. According to such system, if an anonymization
vices by satisfying both economical and ethical purposes mechanism cannot safeguard user’s privacy or anonymized
have become more emergent than ever [275]. In recent years, data can be used to identify individuals uniquely or small
VOLUME 4, 2016 25

This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see [Link]
 This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI
10.1109/ACCESS.2020.3045700, IEEE Access

Author et al.: Preparation of Papers for IEEE TRANSACTIONS and JOURNALS

FIGURE 17. Comprehensive overview of the privacy issues in the future computing paradigm (Year 2020 and beyond).

population groups, data cannot be released without legal • Excessive information loss caused by over-generalization
advice or additional technical measures. of the QIs: In tabular data anonymization, most of the
existing anonymization approaches anonymize each QI
present in a dataset that can lead to excessive infor-
VII. PROMISING OPEN RESEARCH DIRECTIONS mation loss. As some QIs are not vulnerable in terms
Some promising open research directions/problems that need of user’s privacy, and their unnecessary generalization
further research and developments from both academia and significantly impact data utility. Thus, quantifying each
industry are outlined below. QI impact on privacy and utility, and controlling un-
necessary generalization to the extent possible while
• Users groups’ privacy issues: In tabular data anonymizing user’s data requires further research and
anonymization, majority of the existing approaches developments from the research community.
focus solely on an individual’s privacy preservation. • Imbalanced datasets anonymization: In some cases,
Thus, they are less resilient towards the users groups’ the relational dataset can be highly imbalanced (i.e.,
privacy preservation. For instance, k-anonymity model the SA’s values distribution is not uniform), and its
creates equivalence classes with k-users in each class. anonymization is very challenging. In such datasets,
On the one hand, it protects individual privacy by hiding enforcing hard constraints such as making each class `-
each user in other k-users’ crowd. On the other hand, diverse or t-close is not possible in practice. Hence, it re-
it explicitly discloses private information about users quires development of new approaches for anonymizing
groups. Hence, devising new PPDP methods for users imbalanced datasets to effectively protect users’ privacy
groups’ privacy protection would be promising.
26 VOLUME 4, 2016

This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see [Link]
 This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI
10.1109/ACCESS.2020.3045700, IEEE Access

Author et al.: Preparation of Papers for IEEE TRANSACTIONS and JOURNALS

without degrading data usefulness. users and community privacy when published data is
• Effective resolution of privacy and utility trade-off in analyzed with advanced data mining and SNA tools.
the PPDP: In data anonymization, there exist a strong Hence, devising new solutions that are resilient towards
trade-off between privacy and utility. Tailoring the community discovery and community-based node/user
anonymization with privacy objectives can adversely mapping in SN data publishing has become more press-
affect the anonymous data utility, and vice-versa. This ing than ever.
longstanding challenge in the field of PPDP seeking • Exploiting global and local features of SN data to
novel solutions to support privacy preserving big data safeguard against network reconciliation problems: Re-
analytics. cently, across SNs users identification by leveraging
• Personalized privacy preservation in SNs: In SNs, each multiple methods such as multiple SNs graphs matching
user has different requirements and concerns about (i.e., network reconciliation), display names mapping,
his/her information privacy, which is called personalized contents and activities analysis, accounts on the hetero-
privacy (PP). For example, in social graph some users geneous SNs, and their combinations has become an
may want to hide only sensitive relationship (i.e., lover) activate area of research. Accordingly, the privacy ap-
information, while some users may want to hide all proaches need significant up-gradation to protect user’s
social connections (i.e., all friends) information. There- privacy in network reconciliation problems. In this re-
fore, the PP involves high level of subjectiveness, and gard, the approaches which perform data anonymization
it is very difficult to implement. Hence, innovative solu- by exploiting local (i.e., common mapped neighbours,
tions that can incorporate the SN users’ PP requirements number of friends, and mutual friends etc.) and global
in SN data anonymization are required. (i.e., betweenness, centralities, ties strength, and multi-
• Accurate modeling of the adversaries’ background hop neighbour’s information etc. ) features of social
knowledge: Adversaries poses more side channel in- graph will be an interesting research area in the near
formation as background knowledge (BK) about SNs future for PPGP.
users compared to the tabular data. This BK continues • Metrics suites rather than single metric for quantifying
to grow due to the access to other publicly available the level of privacy in anonymous graphs: Generally,
SNs, and richness of information embedded in the SNs. one type of metric is employed for evaluating the level
0
Recently, text mining and natural language processing of privacy/utility in a G offered by anonymization so-
(NLP) techniques utilize the contents of SN users to lutions. Moreover, in real world cases, the privacy quan-
match their identities. Thus, accurate modeling of the tified by one metric may not be monotonic (e.g., show
Bk while anonymizing SN data is very challenging, lower privacy results for stronger adversaries) or reliable
and further research on how to model the BK during from multiple viewpoints. Hence, combining multiple
anonymization process is required to effectively protect privacy metrics that can more accurately measure the
user’s privacy in big data era. level of privacy and can mitigate the weaknesses of
• Generic solutions for the social graph anonymization: individual metrics is a promising research direction in
Generally, the SN data is modeled with the help of near future considering the widespread interest in SNs
graphs (a.k.a. sociograms). These graphs can be of data publishing with legitimate information consumers.
different types such as simple, directed, undirected, • Devising privacy-friendly mechanisms for exceptional
weighted, and labeled directed. The anonymization situations: During 2020, the whole world is facing an
mechanism proposed for one type of the graph cannot be unanticipated and extraordinary challenge from an un-
directly applied to the other. For instance, the k-degree known enemy, called corona virus disease-19 (COVID-
anonymity concept cannot be applied to directed graphs 19) [281], [282]. The COVID-19 pandemic has affected
straightforwardly as it requires the detailed analysis of every profession around the globe, and governments are
in-and-out degree sequences. Hence, devising generic heavily relying on the non-pharmaceutical interventions
anonymization methods that can work with multiple (e.g., strict lock-downs, cities and facilities closures, so-
graph’s types will be an interesting research area in the cial distancing, geo-location based users’ mobility anal-
future. ysis, proximity detection, and digital contact/suspect
• Controlling large scale user identification issues by tracing etc.) to curb the spread of COVID-19 [283].
evading data mining and SN analysis (SNA) tools: In In addition, for epidemiological investigations, some
SNs, users establish relationships with like-minded peo- governments employed extensive measures (e.g., credit
ple or people having similar interests. This results into card data, mobile phone signals, Bluetooth and GPS
formation of the online communities. A growing body data, and CCTV data) to find the COVID-19’s suspects
of research has been devoted to community discovery and hotspots [284]–[286]. Due to the adoption of the
in the SNs. On the one hand, community discovery digital methods, a huge amount of personal data has
is beneficial for multiple purposes such as information entered into the cyberspace, and privacy violations have
spread and control. Moreover, community discovery in been constantly reporting around the globe. For exam-
privacy preserved SN published data can jeopardize ple, in Italy from January to April 2020, the privacy
VOLUME 4, 2016 27

This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see [Link]
 This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI
10.1109/ACCESS.2020.3045700, IEEE Access

Author et al.: Preparation of Papers for IEEE TRANSACTIONS and JOURNALS

violations in healthcare sector related to companies VIII. CONCLUSION

and individuals have doubled [287]. Furthermore, the In this paper, we have presented the latest researches that
privacy violations in post COVID-19’s era are expected have been proposed to release useful information while pre-
to increase as many companies have collected the multi- serving user’s privacy from malevolent adversaries, namely
fact data about the people lifestyles [288]–[290]. Con- privacy preserving data publishing (PPDP). In recent years,
sidering the necessity of users’ privacy preservation, the there is an increasing focus on the rapid development of
ethical aspects during and after COVID-19’s era must be more practical anonymization solutions due to the significant
carefully observed and addressed [291]–[297]. Hence, rise in the privacy breaches across the globe, and this area
privacy-friendly solutions are required for exceptional is attracting researchers’ interests drastically. Owing to the
situations such as COVID-19 pandemic to safeguard rapid technological developments in communication science
patients’ privacy and other pandemics’ related aspects and technology, tremendous amount of users’ data can now
(e.g., privacy preserving symptoms tracking and report- be easily obtained in diverse formats, ranging from relational
ing, collecting only relevant information from the users tables to complex social graphs. Although this increasing
to protect privacy, encrypting sensitive information, amount of data offers unprecedented opportunities for an-
GDPR-compliant and privacy-aware contact tracing, alytics, but it increases the chance of individuals’ privacy
and decentralized solutions for computing the probabil- breaches. In addition, most of the traditional anonymization
ity of exposure). Further, PPDP mechanism involving algorithms that were proposed for the tabular data can rarely
COVID-19’s patients data to safeguard discrimination perform well on a social network (SN) (e.g., graphs) data
and hates towards certain religions, countries, sects, without modifications. Hence, it is of paramount importance
caste, and sexual minorities during published data an- to provide good perspectives of the information privacy
alytics is deemed necessary. Hence, analyzing/solving area involving both tabular and SN data along with recent
the potential privacy risks and vulnerabilities in contact anonymization researches. In this work, we have provided
tracing apps developed by many countries to fight with detailed and systemic coverage of the relational anonymiza-
the pandemic is a vibrant area of research. tion techniques used for the tabular data before presenting
• Adoption of industry 4.0 techniques for the PPDP: recent structural anonymization approaches used for SNs
In recent years, many innovative techniques such as data anonymization. We have summarized and compared
few-shot learning, federated learning, transfer learning, substantial number of anonymization approaches used for
deep learning, and block-chain have revolutionized the the information privacy protection involving both SNs and
human life in many aspects. These techniques have tabular data. Furthermore, we provide deeper insights on the
been extensively used in many areas such as health- privacy problems in future computing paradigm that will
care, social engineering, data analytics, predictions and be helpful in devising more secure anonymization meth-
forecasting, knowledge extraction, and image recogni- ods, and we discuss numerous promising open research
tion/analysis etc. Due to the availability of huge amount directions/problems that need further research and devel-
of labeled data, and ability to work in a decentralized opments. In this survey, we specifically focus on the SN
fashion, these techniques can be utilized for users’ pri- data anonymization and de-anonymization techniques con-
vacy preservation with enhanced usefulness. The het- sidering the widespread applications/use of the SNs data. In
erogeneous federated transfer learning (HFTL) frame- addition, SNs data contains a treasure of information that
work [298], privacy-preserving deep learning (PPDL) need to be protected from the malevolent adversaries. Thus,
technique [299], deep transfer learning (DTL) method it indicates the ever increasing interests of researchers in the
[300], adaptive privacy preserving federated learning area of SN’s data anonymization. Nevertheless, user’s data
(APPFL) method [301], block-chain-enable privacy pre- anonymization is still irrefutably complex, and it requires
serving (BCEPP) architectures [302], [303], secure significant improvements in existing approaches as well as
collaborative few-shot learning (SCFSL) framework devising new practical approaches with regard to better utility
[304], searchable encryption (SE) methods leveraging and privacy preservation. In future work, we are planning
ciphertext-policy attribute-based encryption (CP-ABE) to devise new anonymization methods for SN data, and we
[305], [306], data resource protection solution lever- intend to explore privacy problems in industry 4.0 technolo-
aging smart contracts [307], improving cyber security gies.
solutions utilizing AI’s potential [308], and computa-
tional intelligence based methods for information se- CONFLICT OF INTEREST
curity [309], to name a few have already been used in The authors declare that they have no conflict of interest.
practical applications related to the PPDP. Hence, de-
vising robust and lightweight techniques which involve
REFERENCES
less parameters and can co-work with the traditional
anonymization approaches to scale up privacy preser- [1] K. Adhikari and R. K. Panda, “Users’ information privacy concerns
and privacy protection behaviors in social networks,” Journal of Global
vation with enhanced data utility is a promising area of Marketing, vol. 31, no. 2, pp. 96–110, 2018.
research for the future. [2] J. Wieringa, P. Kannan, X. Ma, T. Reutterer, H. Risselada, and B. Skiera,

28 VOLUME 4, 2016

This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see [Link]
 This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI
10.1109/ACCESS.2020.3045700, IEEE Access

Author et al.: Preparation of Papers for IEEE TRANSACTIONS and JOURNALS

“Data analytics in a privacy-concerned world,” Journal of Business [26] Y. Hao, H. Cao, C. Hu, K. Bhattarai, and S. Misra, “K-anonymity for
Research, 2019. social networks containing rich structural and textual information,” Social
[3] T. Li and N. Li, “On the tradeoff between privacy and utility in data Network Analysis and Mining, vol. 4, no. 1, p. 223, 2014.
publishing,” in Proceedings of the 15th ACM SIGKDD international [27] L. Backstrom, C. Dwork, and J. Kleinberg, “Wherefore art thou r3579x?
conference on Knowledge discovery and data mining, 2009, pp. 517–526. anonymized social networks, hidden patterns, and structural steganogra-
[4] L. Sankar, S. R. Rajagopalan, and H. V. Poor, “Utility-privacy tradeoffs phy,” in Proceedings of the 16th international conference on World Wide
in databases: An information-theoretic approach,” IEEE Transactions on Web, 2007, pp. 181–190.
Information Forensics and Security, vol. 8, no. 6, pp. 838–852, 2013. [28] J. Casas-Roma, J. Salas, F. D. Malliaros, and M. Vazirgiannis, “k-degree
[5] B. C. Fung, K. Wang, A. W.-C. Fu, and S. Y. Philip, Introduction to anonymity on directed networks,” Knowledge and Information Systems,
privacy-preserving data publishing: Concepts and techniques. CRC vol. 61, no. 3, pp. 1743–1768, 2019.
Press, 2010. [29] X. Zheng, Z. Cai, G. Luo, L. Tian, and X. Bai, “Privacy-preserved
[6] R. K. Langari, S. Sardar, S. A. A. Mousavi, and R. Radfar, “Combined community discovery in online social networks,” Future Generation
fuzzy clustering and firefly algorithm for privacy preserving in social Computer Systems, vol. 93, pp. 1002–1009, 2019.
networks,” Expert Systems with Applications, vol. 141, p. 112968, 2020. [30] J. Casas-Roma, J. Herrera-Joancomartí, and V. Torra, “A survey of graph-
[7] X. Zhao, D. Pi, and J. Chen, “Novel trajectory privacy-preserving method modification techniques for privacy-preserving on networks,” Artificial
based on clustering using differential privacy,” Expert Systems with Intelligence Review, vol. 47, no. 3, pp. 341–366, 2017.
Applications, vol. 149, p. 113241, 2020. [31] B. C. Fung, K. Wang, R. Chen, and P. S. Yu, “Privacy-preserving data
[8] J. Casas-Roma, “An evaluation of edge modification techniques for publishing: A survey of recent developments,” ACM Computing Surveys
privacy-preserving on graphs,” in International Conference on Modeling (Csur), vol. 42, no. 4, pp. 1–53, 2010.
Decisions for Artificial Intelligence. Springer, 2015, pp. 180–191. [32] K. Rajendran, M. Jayabalan, and M. E. Rana, “A study on k-anonymity,
[9] M. Rahimi, M. Bateni, and H. Mohammadinejad, “Extended k- l-diversity, and t-closeness techniques,” IJCSNS, vol. 17, no. 12, p. 172,
anonymity model for privacy preserving on micro data,” IJ Comput Netw 2017.
Inf Secur, pp. 42–51, 2015. [33] A. Gkoulalas-Divanis, G. Loukides, and J. Sun, “Publishing data from
[10] A. Anjum, K.-K. R. Choo, A. Khan, A. Haroon, S. Khan, S. U. Khan, electronic health records while preserving privacy: A survey of algo-
N. Ahmad, B. Raza et al., “An efficient privacy mechanism for electronic rithms,” Journal of biomedical informatics, vol. 50, pp. 4–19, 2014.
health records,” computers & security, vol. 72, pp. 196–211, 2018. [34] H.-Y. Tran and J. Hu, “Privacy-preserving big data analytics a compre-
[11] N. Mohammed, R. Chen, B. C. Fung, and P. S. Yu, “Differentially private hensive survey,” Journal of Parallel and Distributed Computing, vol. 134,
data release for data mining,” in Proceedings of the 17th ACM SIGKDD pp. 207–218, 2019.
international conference on Knowledge discovery and data mining, 2011, [35] A. Sharma, G. Singh, and S. Rehman, “A review of big data challenges
pp. 493–501. and preserving privacy in big data,” in Advances in Data and Information
[12] L. Sweeney, “k-anonymity: A model for protecting privacy,” Interna- Sciences. Springer, 2020, pp. 57–65.
tional Journal of Uncertainty, Fuzziness and Knowledge-Based Systems, [36] M. Binjubeir, A. A. Ahmed, M. A. B. Ismail, A. S. Sadiq, and M. K.
vol. 10, no. 05, pp. 557–570, 2002. Khan, “Comprehensive survey on big data privacy protection,” IEEE
[13] A. Friedman, R. Wolff, and A. Schuster, “Providing k-anonymity in data Access, vol. 8, pp. 20 067–20 079, 2019.
mining,” The VLDB Journal, vol. 17, no. 4, pp. 789–804, 2008. [37] Y. Mengmeng, Z. Tianqing, Z. Wanlei, and X. Yang, “Attacks and coun-
[14] B. C. Fung, K. Wang, and S. Y. Philip, “Anonymizing classification termeasures in social network data publishing,” ZTE Communications,
data for privacy preservation,” IEEE transactions on knowledge and data vol. 14, no. S0, pp. 2–9, 2019.
engineering, vol. 19, no. 5, pp. 711–725, 2007. [38] M. Siddula, L. Li, and Y. Li, “An empirical study on the privacy preserva-
[15] S. Kisilevich, L. Rokach, Y. Elovici, and B. Shapira, “Efficient multidi- tion of online social networks,” IEEE Access, vol. 6, pp. 19 912–19 922,
mensional suppression for k-anonymity,” IEEE Transactions on Knowl- 2018.
edge and Data Engineering, vol. 22, no. 3, pp. 334–347, 2009. [39] B. Zhou, J. Pei, and W. Luk, “A brief survey on anonymization techniques
[16] J. Li, J. Liu, M. Baig, and R. C.-W. Wong, “Information based data for privacy preserving publishing of social network data,” ACM Sigkdd
anonymization for classification utility,” Data & Knowledge Engineering, Explorations Newsletter, vol. 10, no. 2, pp. 12–22, 2008.
vol. 70, no. 12, pp. 1030–1045, 2011. [40] E. Zheleva and L. Getoor, “Privacy in social networks: A survey,” in
[17] P. Geetha, C. Naikodi, and S. L. N. Setty, “Design of big data privacy Social network data analytics. Springer, 2011, pp. 277–306.
framework—a balancing act,” in Advances in Data Sciences, Security and [41] J. Abawajy and M. I. H. Ninggal, “Tutut herawan privacy preserving
Applications. Springer, 2020, pp. 253–265. social network data publication,” IEEE Transaction, vol. 27, 2016.
[18] C. Dwork, “Differential privacy: A survey of results,” in Interna- [42] L. Xing, K. Deng, H. Wu, P. Xie, H. V. Zhao, and F. Gao, “A survey
tional conference on theory and applications of models of computation. of across social networks user identification,” IEEE Access, vol. 7, pp.
Springer, 2008, pp. 1–19. 137 472–137 488, 2019.
[19] A. Friedman and A. Schuster, “Data mining with differential privacy,” [43] A. Esfandyari, M. Zignani, S. Gaito, and G. P. Rossi, “User identification
in Proceedings of the 16th ACM SIGKDD international conference on across online social networks in practice: Pitfalls and solutions,” Journal
Knowledge discovery and data mining, 2010, pp. 493–502. of Information Science, vol. 44, no. 3, pp. 377–391, 2018.
[20] J. Soria-Comas, J. Domingo-Ferrer, D. Sánchez, and D. Megías, “Individ- [44] J. Casas-Roma, “An evaluation of vertex and edge modification tech-
ual differential privacy: A utility-preserving formulation of differential niques for privacy-preserving on graphs,” Journal of Ambient Intelligence
privacy guarantees,” IEEE Transactions on Information Forensics and and Humanized Computing, pp. 1–17, 2019.
Security, vol. 12, no. 6, pp. 1418–1429, 2017. [45] S. Badsha, X. Yi, and I. Khalil, “A practical privacy-preserving recom-
[21] R. Sarathy and K. Muralidhar, “Evaluating laplace noise addition to mender system,” Data Science and Engineering, vol. 1, no. 3, pp. 161–
satisfy differential privacy for numeric data.” Trans. Data Priv., vol. 4, 177, 2016.
no. 1, pp. 1–17, 2011. [46] R. Mendes and J. P. Vilela, “Privacy-preserving data mining: methods,
[22] J. Hua, A. Tang, Y. Fang, Z. Shen, and S. Zhong, “Privacy-preserving metrics, and applications,” IEEE Access, vol. 5, pp. 10 562–10 582, 2017.
utility verification of the data published by non-interactive differentially [47] M. Jayabalan and M. E. Rana, “Anonymizing healthcare records: A study
private mechanisms,” IEEE Transactions on Information Forensics and of privacy preserving data publishing techniques,” Advanced Science
Security, vol. 11, no. 10, pp. 2298–2311, 2016. Letters, vol. 24, no. 3, pp. 1694–1697, 2018.
[23] U. Kumaran et al., “A secure and privacy-preserving approach to protect [48] A. Vedangi and V. Anandam, “Data slicing technique to privacy preserv-
user data across cloud based online social networks,” International Jour- ing and data publishing,” Cancer, vol. 4790, no. 4790, p. 4790, 2013.
nal of Grid and High Performance Computing (IJGHPC), vol. 12, no. 2, [49] M. E. Nergiz, M. Atzori, and C. Clifton, “Hiding the presence of individ-
pp. 1–24, 2020. uals from shared databases,” in Proceedings of the 2007 ACM SIGMOD
[24] X. Li, J. Yang, Z. Sun, and J. Zhang, “Differential privacy for edge international conference on Management of data, 2007, pp. 665–676.
weights in social networks,” Security and Communication Networks, vol. [50] L. Xu, C. Jiang, J. Wang, J. Yuan, and Y. Ren, “Information security in
2017, 2017. big data: privacy and data mining,” Ieee Access, vol. 2, pp. 1149–1176,
[25] N. Yazdanjue, M. Fathian, and B. Amiri, “Evolutionary algorithms for 2014.
k-anonymity in social networks based on clustering approach,” The [51] R. Khan, X. Tao, A. Anjum, H. Sajjad, A. Khan, F. Amiri et al.,
Computer Journal, vol. 63, no. 7, pp. 1039–1062, 2020. “Privacy preserving for multiple sensitive attributes against fingerprint

VOLUME 4, 2016 29

This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see [Link]
 This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI
10.1109/ACCESS.2020.3045700, IEEE Access

Author et al.: Preparation of Papers for IEEE TRANSACTIONS and JOURNALS

correlation attack satisfying c-diversity,” Wireless Communications and [75] H. Zhu, S. Tian, and K. Lü, “Privacy-preserving data publication with
Mobile Computing, vol. 2020, 2020. features of independent `-diversity,” The Computer Journal, vol. 58,
[52] C. Watanabe, T. Amagasa, and L. Liu, “Privacy risks and countermea- no. 4, pp. 549–571, 2015.
sures in publishing and mining social network data,” in 7th International [76] E. Elabd, H. Abdulkader, and A. Mubark, “L–diversity-based semantic
Conference on Collaborative Computing: Networking, Applications and anonymaztion for data publishing,” IJ Information Technology and Com-
Worksharing (CollaborateCom). IEEE, 2011, pp. 55–66. puter Science (IJITCS), vol. 10, pp. 1–7, 2015.
[53] M. Kiabod, M. N. Dehkordi, and B. Barekatain, “Tsram: A time-saving [77] L. Zhang, L. Wang, S. Jajodia, and A. Brodsky, “L-cover: Preserving
k-degree anonymization method in social network,” Expert Systems with diversity by anonymity,” in Workshop on Secure Data Management.
Applications, vol. 125, pp. 378–396, 2019. Springer, 2009, pp. 158–171.
[54] V. V. H. Pham, S. Yu, K. Sood, and L. Cui, “Privacy issues in social [78] H. Tian and W. Zhang, “Extending `-diversity to generalize sensitive
networks and analysis: a comprehensive survey,” IET networks, vol. 7, data,” Data & Knowledge Engineering, vol. 70, no. 1, pp. 101–126, 2011.
no. 2, pp. 74–84, 2017. [79] B. Tripathy, A. Maity, B. Ranajit, and D. Chowdhuri, “A fast p-sensitive
[55] A. Maurya and M. Singh, “A survey on social networks: Issues and l-diversity anonymisation algorithm,” in 2011 IEEE Recent Advances in
attacks,” in Recent Advances in Mathematics, Statistics and Computer Intelligent Computational Systems. IEEE, 2011, pp. 741–744.
Science. World Scientific, 2016, pp. 634–642.
[80] S. Chakraborty and B. Tripathy, “Privacy preservation in relational data
[56] F. Li, H. Li, B. Niu, and J. Chen, “Privacy computing: Concept, com-
through l-diversity and recursive (c, l) diversity anonymisation,” Interna-
puting framework, and future development trends,” Engineering, vol. 5,
tional Journal of Mathematical Modelling and Numerical Optimisation,
no. 6, pp. 1179–1192, 2019.
vol. 7, no. 3-4, pp. 338–362, 2016.
[57] A. Zigomitros, F. Casino, A. Solanas, and C. Patsakis, “A survey on
[81] X. Wu, Y. Wei, T. Jiang, Y. Wang, and S. Jiang, “A micro-aggregation
privacy properties for data publishing of relational data,” IEEE Access,
algorithm based on density partition method for anonymizing biomedical
vol. 8, pp. 51 071–51 099, 2020.
data,” Current Bioinformatics, vol. 14, no. 7, pp. 667–675, 2019.
[58] S. M. Shah and R. A. Khan, “Secondary use of electronic health record:
Opportunities and challenges,” arXiv preprint arXiv:2001.09479, 2020. [82] Y. Xiao and H. Li, “Privacy preserving data publishing for multiple
[59] A. Machanavajjhala, D. Kifer, J. Gehrke, and M. Venkitasubramaniam, sensitive attributes based on security level,” Information, vol. 11, no. 3,
“l-diversity: Privacy beyond k-anonymity,” ACM Transactions on Knowl- p. 166, 2020.
edge Discovery from Data (TKDD), vol. 1, no. 1, pp. 3–es, 2007. [83] F. Ashkouti, A. Sheikhahmadi et al., “Di-mondrian: Distributed improved
[60] N. Li, T. Li, and S. Venkatasubramanian, “t-closeness: Privacy beyond k- mondrian for satisfaction of the l-diversity privacy model using apache
anonymity and l-diversity,” in 2007 IEEE 23rd International Conference spark,” Information Sciences, vol. 546, pp. 1–24, 2021.
on Data Engineering. IEEE, 2007, pp. 106–115. [84] K. Oishi, Y. Sei, Y. Tahara, and A. Ohsuga, “Semantic diversity: Privacy
[61] J. S. Davis and O. Osoba, “Improving privacy preservation policy in the considering distance between values of sensitive attribute,” Computers &
modern information age,” Health and Technology, vol. 9, no. 1, pp. 65– Security, p. 101823, 2020.
75, 2019. [85] N. Li, T. Li, and S. Venkatasubramanian, “Closeness: A new privacy
[62] X. Ding, W. Yang, K.-K. R. Choo, X. Wang, and H. Jin, “Privacy measure for data publishing,” IEEE Transactions on Knowledge and Data
preserving similarity joins using mapreduce,” Information Sciences, vol. Engineering, vol. 22, no. 7, pp. 943–956, 2009.
493, pp. 20–33, 2019. [86] M. Wang, Z. Jiang, Y. Zhang, and H. Yang, “T-closeness slicing: A
[63] T. M. Truta and B. Vinay, “Privacy protection: p-sensitive k-anonymity new privacy-preserving approach for transactional data publishing,” IN-
property,” in 22nd International Conference on Data Engineering Work- FORMS Journal on Computing, vol. 30, no. 3, pp. 438–453, 2018.
shops (ICDEW’06). IEEE, 2006, pp. 94–94. [87] Y. Qu, J. Xu, and S. Yu, “Privacy preserving in big data sets through
[64] X. Sun, L. Sun, and H. Wang, “Extended k-anonymity models against multiple shuffle,” in Proceedings of the Australasian Computer Science
sensitive attribute disclosure,” Computer Communications, vol. 34, no. 4, Week Multiconference, 2017, pp. 1–8.
pp. 526–535, 2011. [88] R. Wang, Y. Zhu, T.-S. Chen, and C.-C. Chang, “Privacy-preserving algo-
[65] R. C.-W. Wong, J. Li, A. W.-C. Fu, and K. Wang, “(α, k)-anonymity: rithms for multiple sensitive attributes satisfying t-closeness,” Journal of
an enhanced k-anonymity model for privacy preserving data publishing,” Computer Science and Technology, vol. 33, no. 6, pp. 1231–1242, 2018.
in Proceedings of the 12th ACM SIGKDD international conference on [89] J. Cao, P. Karras, P. Kalnis, and K.-L. Tan, “Sabre: a sensitive attribute
Knowledge discovery and data mining, 2006, pp. 754–759. bucketization and redistribution framework for t-closeness,” The VLDB
[66] H. Jian-min, Y. Hui-qun, Y. Juan, and C. Ting-ting, “A complete (alpha, Journal, vol. 20, no. 1, pp. 59–81, 2011.
k)-anonymity model for sensitive values individuation preservation,” in [90] J. Soria-Comas, J. Domingo-Ferrer, D. Sanchez, and S. Martinez, “t-
2008 International Symposium on Electronic Commerce and Security. closeness through microaggregation: Strict privacy with enhanced utility
IEEE, 2008, pp. 318–323. preservation,” IEEE Transactions on Knowledge and Data Engineering,
[67] T. K. Dang, J. Kung, and H. V. Phuong, “Protecting privacy while discov- vol. 27, no. 11, pp. 3098–3110, 2015.
ering and maintaining association rules,” in 2011 4th IFIP International [91] Y. Sei, H. Okumura, T. Takenouchi, and A. Ohsuga, “Anonymization of
Conference on New Technologies, Mobility and Security. IEEE, 2011, sensitive quasi-identifiers for l-diversity and t-closeness,” IEEE transac-
pp. 1–5. tions on dependable and secure computing, 2017.
[68] N. Maheshwarkar, K. Pathak, and N. S. Choudhari, “K-anonymity model
[92] E. Weber, “A method for t-close anonymization in the presence of
for multiple sensitive attributes,” International Journal of Computer
multiple numerical sensitive attributes,” Ph.D. dissertation, Wichita State
Applications (IJCA), vol. 1, no. 1, pp. 51–56, 2012.
University, 2020.
[69] M. Nithya and T. Sheela, “Predictive delimiter for multiple sensitive
[93] K. Nissim, S. Raskhodnikova, and A. Smith, “Smooth sensitivity and
attribute publishing,” Cluster Computing, vol. 22, no. 5, pp. 12 297–
sampling in private data analysis,” in Proceedings of the thirty-ninth
12 304, 2019.
annual ACM symposium on Theory of computing, 2007, pp. 75–84.
[70] E. K. Budiardjo, W. C. Wibowo, H. T. Achsan et al., “An approach
for distributing sensitive values in k-anonymity,” in 2019 International [94] A. Korolova, K. Kenthapadi, N. Mishra, and A. Ntoulas, “Releasing
Workshop on Big Data and Information Security (IWBIS). IEEE, 2019, search queries and clicks privately,” in Proceedings of the 18th interna-
pp. 109–114. tional conference on World wide web, 2009, pp. 171–180.
[71] E. K. Budiardjo, W. C. Wibowo et al., “Privacy preserving data pub- [95] D. Kifer and A. Machanavajjhala, “No free lunch in data privacy,” in
lishing with multiple sensitive attributes based on overlapped slicing,” Proceedings of the 2011 ACM SIGMOD International Conference on
Information, vol. 10, no. 12, p. 362, 2019. Management of data, 2011, pp. 193–204.
[72] L. Zhang, J. Xuan, R. Si, and R. Wang, “An improved algorithm of [96] L. Yu, L. Liu, C. Pu, M. E. Gursoy, and S. Truex, “Differentially
individuation k-anonymity for multiple sensitive attributes,” Wireless private model publishing for deep learning,” in 2019 IEEE Symposium
Personal Communications, vol. 95, no. 3, pp. 2003–2020, 2017. on Security and Privacy (SP). IEEE, 2019, pp. 332–349.
[73] C. Liu, S. Chen, S. Zhou, J. Guan, and Y. Ma, “A novel privacy preserving [97] D. Lv and S. Zhu, “Achieving correlated differential privacy of big data
method for data publication,” Information Sciences, vol. 501, pp. 421– publication,” Computers & Security, vol. 82, pp. 184–195, 2019.
435, 2019. [98] M. Hardt, K. Ligett, and F. McSherry, “A simple and practical algorithm
[74] Y.-C. Tsai, S.-L. Wang, I.-H. Ting, and T.-P. Hong, “Flexible sensitive for differentially private data release,” in Advances in Neural Information
k-anonymization on transactions,” World Wide Web, pp. 1–16, 2020. Processing Systems, 2012, pp. 2339–2347.

30 VOLUME 4, 2016

This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see [Link]
 This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI
10.1109/ACCESS.2020.3045700, IEEE Access

Author et al.: Preparation of Papers for IEEE TRANSACTIONS and JOURNALS

[99] J. Soria-Comas, J. Domingo-Ferrer, D. Sánchez, and S. Martínez, “En- [121] S. Bourahla, M. Laurent, and Y. Challal, “Privacy preservation for so-
hancing data utility in differential privacy via microaggregation-based k- cial networks sequential publishing,” Computer Networks, vol. 170, p.
anonymity,” The VLDB Journal, vol. 23, no. 5, pp. 771–794, 2014. 107106, 2020.
[100] H. Lee and Y. D. Chung, “Differentially private release of medical [122] K. Deng, L. Xing, L. Zheng, H. Wu, P. Xie, and F. Gao, “A user iden-
microdata: an efficient and practical approach for preserving informa- tification algorithm based on user behavior analysis in social networks,”
tive attribute values,” BMC Medical Informatics and Decision Making, IEEE Access, vol. 7, pp. 47 114–47 123, 2019.
vol. 20, no. 1, pp. 1–15, 2020. [123] S. Ji, P. Mittal, and R. Beyah, “Graph data anonymization, de-
[101] H. B. Kartal, X. Liu, and X.-B. Li, “Differential privacy for the vast ma- anonymization attacks, and de-anonymizability quantification: A survey,”
jority,” ACM Transactions on Management Information Systems (TMIS), IEEE Communications Surveys & Tutorials, vol. 19, no. 2, pp. 1305–
vol. 10, no. 2, pp. 1–15, 2019. 1326, 2016.
[102] N. Wang and M. S. Kankanhalli, “Protecting sensitive place visits in [124] I. Wagner and D. Eckhoff, “Technical privacy metrics: a systematic
privacy-preserving trajectory publishing,” Computers & Security, vol. 97, survey,” ACM Computing Surveys (CSUR), vol. 51, no. 3, pp. 1–38, 2018.
p. 101949, 2020. [125] Y. Zhao and I. Wagner, “Using metrics suites to improve the measurement
[103] F. Farokhi, “Privacy-preserving public release of datasets for support of privacy in graphs,” IEEE Transactions on Dependable and Secure
vector machine classification,” IEEE Transactions on Big Data, 2020. Computing, 2020.
[104] A. Majeed, F. Ullah, and S. Lee, “Vulnerability-and diversity-aware [126] T. Ma, Y. Zhang, J. Cao, J. Shen, M. Tang, Y. Tian, A. Al-Dhelaan, and
anonymization of personally identifiable information for improving user M. Al-Rodhaan, “KDVEM: a k-degree anonymity with vertex and edge
privacy and utility of publishing data,” Sensors, vol. 17, no. 5, p. 1059, modification algorithm,” Computing, vol. 97, no. 12, pp. 1165–1184,
2017. 2015.
[105] J. Soria-Comas and J. Domingo-Ferrert, “Differential privacy via t- [127] J. Casas-Roma, J. Herrera-Joancomartí, and V. Torra, “k-degree
closeness in data publishing,” in 2013 Eleventh Annual Conference on anonymity and edge selection: improving data utility in large networks,”
Privacy, Security and Trust. IEEE, 2013, pp. 27–35. Knowledge and Information Systems, vol. 50, no. 2, pp. 447–474, 2017.
[106] M. R. S. Aghdam and N. Sonehara, “Achieving high data utility k- [128] Y. Wang and B. Zheng, “Preserving privacy in social networks against
anonymization using similarity-based clustering model,” IEICE TRANS- connection fingerprint attacks,” in 2015 IEEE 31st International Confer-
ACTIONS on Information and Systems, vol. 99, no. 8, pp. 2069–2078, ence on Data Engineering. IEEE, 2015, pp. 54–65.
2016. [129] M. I. H. Ninggal and J. H. Abawajy, “Utility-aware social network graph
[107] A. Majeed and S. Lee, “Attribute susceptibility and entropy based data anonymization,” Journal of Network and Computer Applications, vol. 56,
anonymization to improve users community privacy and utility in pub- pp. 137–148, 2015.
lishing data,” Applied Intelligence, pp. 1–20, 2020. [130] A. M. Fard and K. Wang, “Neighborhood randomization for link privacy
in social network analysis,” World Wide Web, vol. 18, no. 1, pp. 9–32,
[108] S. Kabou, S. mohamed Benslimane, and M. Mosteghanemi, “A survey
2015.
on privacy preserving dynamic data publishing,” International Journal
of Organizational and Collective Intelligence (IJOCI), vol. 8, no. 4, pp. [131] P. Liu, L.-e. Wang, and X. Li, “Randomized perturbation for privacy-
1–20, 2018. preserving social network data publishing,” in 2017 IEEE International
Conference on Big Knowledge (ICBK). IEEE, 2017, pp. 208–213.
[109] Y. Shi, Z. Zhang, H.-C. Chao, and B. Shen, “Data privacy protection
[132] S. Hamideh Erfani and R. Mortazavi, “A novel graph-modification
based on micro aggregation with dynamic sensitive attribute updating,”
technique for user privacy-preserving on social networks,” Journal of
Sensors, vol. 18, no. 7, p. 2307, 2018.
Telecommunications and Information Technology, 2019.
[110] X. Xiao and Y. Tao, “M-invariance: towards privacy preserving re-
[133] A. Karimi Rizi, M. Naderi Dehkordi et al., “Sni: Supervised anonymiza-
publication of dynamic datasets,” in Proceedings of the 2007 ACM
tion technique to publish social networks having multiple sensitive la-
SIGMOD international conference on Management of data, 2007, pp.
bels,” Security and Communication Networks, vol. 2019, 2019.
689–700.
[134] M. Siddula, Y. Li, X. Cheng, Z. Tian, and Z. Cai, “Anonymization
[111] A. Anjum, G. Raschia, M. Gelgon, A. Khan, N. Ahmad, M. Ahmed,
in online social networks based on enhanced equi-cardinal clustering,”
S. Suhail, M. M. Alam et al., “τ -safety: A privacy model for sequential
IEEE Transactions on Computational Social Systems, vol. 6, no. 4, pp.
publication with arbitrary updates,” computers & security, vol. 66, pp.
809–820, 2019.
20–39, 2017.
[135] W. Shi, J. Hu, J. Yan, Z. Wu, and L. Lu, “A privacy measurement method
[112] H. Zhu, H.-B. Liang, L. Zhao, D.-Y. Peng, and L. Xiong, “τ -safe (l, k)- using network structure entropy,” in 2017 International Conference on
diversity privacy model for sequential publication with high utility,” IEEE Networking and Network Applications (NaNA). IEEE, 2017, pp. 147–
Access, vol. 7, pp. 687–701, 2018. 151.
[113] M. E. Nergiz and C. Clifton, “δ -presence without complete world knowl- [136] S. Mauw, Y. Ramírez-Cruz, and R. Trujillo-Rasua, “Conditional adja-
edge,” IEEE Transactions on Knowledge and Data Engineering, vol. 22, cency anonymity in social graphs under active attacks,” Knowledge and
no. 6, pp. 868–883, 2009. Information Systems, vol. 61, no. 1, pp. 485–511, 2019.
[114] B. Ouafae, R. Mariam, L. Oumaima, and L. Abdelouahid, “Data [137] R. Mortazavi and S. H. Erfani, “An effective method for utility preserving
anonymization in social networks state of the art, exposure of short- social network graph anonymization based on mathematical modeling,”
comings and discussion of new innovations,” in 2020 1st International International Journal of Engineering, vol. 31, no. 10, pp. 1624–1632,
Conference on Innovative Research in Applied Science, Engineering and 2018.
Technology (IRASET). IEEE, 2020, pp. 1–10. [138] J. Casas-Roma, J. Salas, F. D. Malliaros, and M. Vazirgiannis, “k-degree
[115] S. Kumar and P. Kumar, “Upper approximation based privacy preserving anonymity on directed networks,” Knowledge and Information Systems,
in online social networks,” Expert Systems with Applications, vol. 88, pp. vol. 61, no. 3, pp. 1743–1768, 2019.
276–289, 2017. [139] T. Wu, G. Ming, X. Xian, W. Wang, S. Qiao, and G. Xu, “Structural
[116] J. Vadisala and V. K. Vatsavayi, “Challenges in social network data predictability optimization against inference attacks in data publishing,”
privacy,” International Journal of Computational Intelligence Research, IEEE Access, vol. 7, pp. 92 119–92 136, 2019.
vol. 13, no. 5, pp. 965–979, 2017. [140] J. Yan, L. Zhang, Y. Tian, G. Wen, and J. Hu, “An uncertain graph
[117] T. Tassa and D. J. Cohen, “Anonymization of centralized and distributed approach for preserving privacy in social networks based on important
social networks by sequential clustering,” IEEE Transactions on Knowl- nodes,” in 2018 International Conference on Networking and Network
edge and data Engineering, vol. 25, no. 2, pp. 311–324, 2011. Applications (NaNA). IEEE, 2018, pp. 107–111.
[118] X. Ding, X. Zhang, Z. Bao, and H. Jin, “Privacy-preserving triangle [141] D. Mohapatra and M. R. Patra, “Anonymization of attributed social graph
counting in large graphs,” in Proceedings of the 27th ACM International using anatomy based clustering,” Multimedia Tools and Applications,
Conference on Information and Knowledge Management, 2018, pp. vol. 78, no. 18, pp. 25 455–25 486, 2019.
1283–1292. [142] K. Stokes, “Cover-up: a probabilistic privacy-preserving graph database
[119] A. J. O’Malley and J.-P. Onnela, Introduction to Social Network Analysis. model,” Journal of Ambient Intelligence and Humanized Computing, pp.
New York, NY: Springer US, 2019, pp. 617–660. 1–8, 2019.
[120] R. Pinot, “Minimum spanning tree release under differential privacy [143] G. Wen, H. Liu, J. Yan, and Z. Wu, “A privacy analysis method to
constraints,” arXiv preprint arXiv:1801.06423, 2018. anonymous graph based on bayes rule in social networks,” in 2018 14th

VOLUME 4, 2016 31

This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see [Link]
 This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI
10.1109/ACCESS.2020.3045700, IEEE Access

Author et al.: Preparation of Papers for IEEE TRANSACTIONS and JOURNALS

International Conference on Computational Intelligence and Security [166] G. Cormode, D. Srivastava, T. Yu, and Q. Zhang, “Anonymizing bipartite
(CIS). IEEE, 2018, pp. 469–472. graph data using safe groupings,” Proceedings of the VLDB Endowment,
[144] F. Yu, M. Chen, B. Yu, W. Li, L. Ma, and H. Gao, “Privacy preservation vol. 1, no. 1, pp. 833–844, 2008.
based on clustering perturbation algorithm for social network,” Multime- [167] H. Huang, D. J. Zhang, F. Xiao, K. Wang, J. Gu, and R. Wang, “Privacy-
dia Tools and Applications, vol. 77, no. 9, pp. 11 241–11 258, 2018. preserving approach pbcn in social network with differential privacy,”
[145] M. Yuan, L. Chen, S. Y. Philip, and T. Yu, “Protecting sensitive labels in IEEE Transactions on Network and Service Management, 2020.
social network data anonymization,” IEEE Transactions on Knowledge [168] T. Ji, C. Luo, Y. Guo, Q. Wang, L. Yu, and P. Li, “Community detection
and Data Engineering, vol. 25, no. 3, pp. 633–647, 2011. in online social networks: a differentially private and parsimonious
[146] J. Yuan, Y. Ou, and G. Gu, “An improved privacy protection method approach,” IEEE transactions on computational social systems, vol. 7,
based on k-degree anonymity in social network,” in 2019 IEEE Interna- no. 1, pp. 151–163, 2020.
tional Conference on Artificial Intelligence and Computer Applications [169] Y. Wang, J. Yang, and J. Zhang, “Differential privacy for weighted
(ICAICA). IEEE, 2019, pp. 416–420. network based on probability model,” IEEE Access, vol. 8, pp. 80 792–
[147] S. Hamzehzadeh and S. M. Mazinani, “Annm: A new method for adding 80 800, 2020.
noise nodes which are used recently in anonymization methods in social [170] D. Al-Azizy, D. Millard, I. Symeonidis, K. O’Hara, and N. Shadbolt,
networks,” Wireless Personal Communications, vol. 107, no. 4, pp. 1995– “A literature survey and classifications on data deanonymisation,” in
2017, 2019. International Conference on Risks and Security of Internet and Systems.
[148] P. Liu, Y. Bai, L. Wang, and X. Li, “Partial k-anonymity for privacy- Springer, 2015, pp. 36–51.
preserving social network data publishing,” International Journal of [171] G. Beigi and H. Liu, “A survey on privacy in social media: Identification,
Software Engineering and Knowledge Engineering, vol. 27, no. 01, pp. mitigation, and applications,” ACM Transactions on Data Science, vol. 1,
71–90, 2017. no. 1, pp. 1–38, 2020.
[149] X. Li, J. Yang, Z. Sun, and J. Zhang, “Publishing social graphs with [172] D. Yin, Y. Shen, and C. Liu, “Attribute couplet attacks and privacy
differential privacy guarantees based on wpinq,” Chinese Journal of preservation in social networks,” IEEE Access, vol. 5, pp. 25 295–25 305,
Electronics, vol. 28, no. 2, pp. 273–279, 2019. 2017.
[150] A.-T. Hoang, B. Carminati, and E. Ferrari, “Cluster-based anonymization [173] Y. Li, Z. Su, J. Yang, and C. Gao, “Exploiting similarities of user friend-
of directed graphs,” in 2019 IEEE 5th International Conference on ship networks across social networks for user identification,” Information
Collaboration and Internet Computing (CIC). IEEE, 2019, pp. 91–100. Sciences, vol. 506, pp. 78–98, 2020.
[151] H. Zhu, X. Zuo, and M. Xie, “Dp-ft: A differential privacy graph gen- [174] J. Mao, W. Tian, Y. Yang, and J. Liu, “An efficient social attribute
eration with field theory for social network data release,” IEEE Access, inference scheme based on social links and attribute relevance,” IEEE
vol. 7, pp. 164 304–164 319, 2019. Access, vol. 7, pp. 153 074–153 085, 2019.
[152] C. Kong, H. Li, H. Zhu, Y. Xiu, J. Liu, and T. Liu, “Anonymized user
[175] C. Zhang, H. Jiang, Y. Wang, Q. Hu, J. Yu, and X. Cheng, “User identity
linkage under differential privacy,” in International Conference on Soft
de-anonymization based on attributes,” in International Conference on
Computing in Data Science. Springer, 2019, pp. 309–324.
Wireless Algorithms, Systems, and Applications. Springer, 2019, pp.
[153] D. Wang and S. Long, “Boosting the accuracy of differentially private in 458–469.
weighted social networks,” Multimedia Tools and Applications, vol. 78,
[176] C. Zhang, S. Wu, H. Jiang, Y. Wang, J. Yu, and X. Cheng, “Attribute-
no. 24, pp. 34 801–34 817, 2019.
enhanced de-anonymization of online social networks,” in International
[154] K. R. Macwan and S. J. Patel, “Node differential privacy in social graph
Conference on Computational Data and Social Networks. Springer,
degree publishing,” Procedia computer science, vol. 143, pp. 786–793,
2019, pp. 256–267.
2018.
[177] Y. Li, Z. Zhang, Y. Peng, H. Yin, and Q. Xu, “Matching user accounts
[155] T. Gao and F. Li, “Sharing social networks using a novel differentially
based on user generated content across social networks,” Future Genera-
private graph model,” in 2019 16th IEEE Annual Consumer Communica-
tion Computer Systems, vol. 83, pp. 104–115, 2018.
tions & Networking Conference (CCNC). IEEE, 2019, pp. 1–4.
[178] Y. Nie, Y. Jia, S. Li, X. Zhu, A. Li, and B. Zhou, “Identifying users across
[156] B. P. Nguyen, H. Ngo, J. Kim, and J. Kim, “Publishing graph data with
social networks based on dynamic core interests,” Neurocomputing, vol.
subgraph differential privacy,” in International Workshop on Information
210, pp. 107–115, 2016.
Security Applications. Springer, 2015, pp. 134–145.
[157] Q. Liu, G. Wang, F. Li, S. Yang, and J. Wu, “Preserving privacy with [179] Y. Sha, Q. Liang, and K. Zheng, “Matching user accounts across social
probabilistic indistinguishability in weighted social networks,” IEEE networks based on users message,” Procedia Computer Science, vol. 80,
Transactions on Parallel and Distributed Systems, vol. 28, no. 5, pp. pp. 2423–2427, 2016.
1417–1429, 2016. [180] L. Wang, K. Hu, Y. Zhang, and S. Cao, “Factor graph model based
[158] A. Srivastava and G. Geethakumari, “Privacy preserving solution to user profile matching across social networks,” IEEE Access, vol. 7, pp.
prevent classification inference attacks in online social networks,” Inter- 152 429–152 442, 2019.
national Journal of Data Science, vol. 4, no. 1, pp. 31–44, 2019. [181] W. Ahmad and R. Ali, “Social account matching in online social media
[159] X. Ding, C. Wang, K.-K. R. Choo, and H. Jin, “A novel privacy preserving using cross-linked posts,” Procedia Computer Science, vol. 152, pp. 222–
framework for large scale graph data publishing,” IEEE transactions on 229, 2019.
knowledge and data engineering, 2019. [182] G. Wondracek, T. Holz, E. Kirda, and C. Kruegel, “A practical attack to
[160] Y. Guo, Z. Liu, Y. Zeng, R. Wang, and J. Ma, “Preserving privacy for de-anonymize social network users,” in 2010 ieee symposium on security
hubs and links in social networks,” in 2018 International Conference on and privacy. IEEE, 2010, pp. 223–238.
Networking and Network Applications (NaNA). IEEE, 2018, pp. 263– [183] S. Nilizadeh, A. Kapadia, and Y.-Y. Ahn, “Community-enhanced de-
269. anonymization of online social networks,” in Proceedings of the 2014
[161] S. Mauw, Y. Ramírez-Cruz, and R. Trujillo-Rasua, “Anonymising social acm sigsac conference on computer and communications security, 2014,
graphs in the presence of active attackers.” Trans. Data Priv., vol. 11, pp. 537–548.
no. 2, pp. 169–198, 2018. [184] W.-H. Lee, C. Liu, S. Ji, P. Mittal, and R. B. Lee, “Blind de-
[162] X. Yin, S. Zhang, and H. Xu, “Node attributed query access algorithm anonymization attacks using social networks,” in Proceedings of the 2017
based on improved personalized differential privacy protection in so- on Workshop on Privacy in the Electronic Society, 2017, pp. 1–4.
cial network,” International Journal of Wireless Information Networks, [185] J. Fang, A. Li, Q. Jiang, S. Li, and W. Han, “A structure-based de-
vol. 26, no. 3, pp. 165–173, 2019. anonymization attack on graph data using weighted neighbor match,”
[163] Z. Cai, Z. He, X. Guan, and Y. Li, “Collective data-sanitization for in 2019 IEEE Fourth International Conference on Data Science in
preventing sensitive information inference attacks in social networks,” Cyberspace (DSC). IEEE, 2019, pp. 480–486.
IEEE Transactions on Dependable and Secure Computing, vol. 15, no. 4, [186] S. Labitzke, F. Werling, J. Mittag, and H. Hartenstein, “Do online social
pp. 577–590, 2016. network friends still threaten my privacy?” in Proceedings of the third
[164] X. Zheng, G. Luo, and Z. Cai, “A fair mechanism for private data ACM conference on Data and application security and privacy, 2013,
publication in online social networks,” IEEE Transactions on Network pp. 13–24.
Science and Engineering, 2018. [187] Y. Qu, S. Yu, W. Zhou, and J. Niu, “Fbi: Friendship learning-based
[165] Y. Xie and M. Zheng, “A differentiated anonymity algorithm for social user identification in multiple social networks,” in 2018 IEEE Global
network privacy preservation,” Algorithms, vol. 9, no. 4, p. 85, 2016. Communications Conference (GLOBECOM). IEEE, 2018, pp. 1–6.

32 VOLUME 4, 2016

This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see [Link]
 This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI
10.1109/ACCESS.2020.3045700, IEEE Access

Author et al.: Preparation of Papers for IEEE TRANSACTIONS and JOURNALS

[188] X. Gao, W. Ji, Y. Li, Y. Deng, and W. Dong, “User identification with [210] S. Zhang, Q. Liu, and Y. Lin, “Anonymizing popularity in online social
spatio-temporal awareness across social networks,” in Proceedings of networks with full utility,” Future Generation Computer Systems, vol. 72,
the 27th ACM International Conference on Information and Knowledge pp. 227–238, 2017.
Management, 2018, pp. 1831–1834. [211] T. Georgiou, A. El Abbadi, and X. Yan, “Privacy-preserving community-
[189] H. Yoshiura, “Re-identifying people from anonymous histories of their aware trending topic detection in online social media,” in IFIP Annual
activities,” in 2019 IEEE 10th International Conference on Awareness Conference on Data and Applications Security and Privacy. Springer,
Science and Technology (iCAST). IEEE, 2019, pp. 1–5. 2017, pp. 205–224.
[190] Y. Li, Y. Peng, Z. Zhang, M. Wu, Q. Xu, and H. Yin, “A deep dive into [212] C. Valliyammai and A. Bhuvaneswari, “Semantics-based sensitive topic
user display names across social networks,” Information Sciences, vol. diffusion detection framework towards privacy aware online social net-
447, pp. 186–204, 2018. works,” Cluster Computing, vol. 22, no. 1, pp. 407–422, 2019.
[191] Y. Wang, C. Feng, L. Chen, H. Yin, C. Guo, and Y. Chu, “User identity [213] J.-R. Gao, W. Chen, J.-J. Xu, A. Liu, Z.-X. Li, H. Yin, and L. Zhao,
linkage across social networks via linked heterogeneous network embed- “An efficient framework for multiple subgraph pattern matching models,”
ding,” World Wide Web, vol. 22, no. 6, pp. 2611–2632, 2019. Journal of Computer Science and Technology, vol. 34, no. 6, pp. 1185–
[192] D. Zhao, N. Zheng, M. Xu, X. Yang, and J. Xu, “An improved user 1202, 2019.
identification method across social networks via tagging behaviors,” [214] J. Casas-Roma, “Duef-ga: data utility and privacy evaluation framework
in 2018 IEEE 30th International Conference on Tools with Artificial for graph anonymization,” International Journal of Information Security,
Intelligence (ICTAI). IEEE, 2018, pp. 616–622. vol. 19, no. 4, pp. 465–478, 2020.
[193] U. Weinsberg, S. Bhagat, S. Ioannidis, and N. Taft, “Blurme: Inferring [215] D. Li, Q. Lv, L. Shang, and N. Gu, “Efficient privacy-preserving content
and obfuscating user gender based on ratings,” in Proceedings of the sixth recommendation for online social communities,” Neurocomputing, vol.
ACM conference on Recommender systems, 2012, pp. 195–202. 219, pp. 440–454, 2017.
[194] M. Kosinski, D. Stillwell, and T. Graepel, “Private traits and attributes are [216] A. Mosallanezhad, G. Beigi, and H. Liu, “Deep reinforcement learning-
predictable from digital records of human behavior,” Proceedings of the based text anonymization against private-attribute inference,” in Proceed-
national academy of sciences, vol. 110, no. 15, pp. 5802–5805, 2013. ings of the 2019 Conference on Empirical Methods in Natural Language
[195] A. Chaabane, G. Acs, M. A. Kaafar et al., “You are what you like! Processing and the 9th International Joint Conference on Natural Lan-
information leakage through users’ interests,” in Proceedings of the 19th guage Processing (EMNLP-IJCNLP), 2019, pp. 2360–2369.
Annual Network & Distributed System Security Symposium (NDSS). [217] T. Gao and F. Li, “Privacy-preserving sketching for online social network
Citeseer, 2012. data publication,” in 2019 16th Annual IEEE International Conference
[196] N. Z. Gong and B. Liu, “Attribute inference attacks in online social on Sensing, Communication, and Networking (SECON). IEEE, 2019,
networks,” ACM Transactions on Privacy and Security (TOPS), vol. 21, pp. 1–9.
no. 1, pp. 1–30, 2018. [218] Y. Liu, J. Liu, Z. Zhang, L. Zhu, and A. Li, “Rem: From structural entropy
[197] H. Zhao, J. Chi, Y. Tian, and G. J. Gordon, “Adversarial privacy preserva- to community structure deception,” in Advances in Neural Information
tion under attribute inference attack,” arXiv preprint arXiv:1906.07902, Processing Systems, 2019, pp. 12 938–12 948.
2019.
[219] S. Ramezanian and V. Niemi, “Privacy preserving cyberbullying preven-
[198] P. Wang, J. Guo, Y. Lan, J. Xu, and X. Cheng, “Your cart tells you:
tion with ai methods in 5g networks,” in 2019 25th Conference of Open
Inferring demographic attributes from purchase data,” in Proceedings of
Innovations Association (FRUCT). IEEE, 2019, pp. 265–271.
the ninth ACM international conference on web search and data mining,
[220] S. Kavianpour, A. Tamimi, and B. Shanmugam, “A privacy-preserving
2016, pp. 173–182.
model to control social interaction behaviors in social network sites,”
[199] H. Jiang, J. Yu, C. Hu, C. Zhang, and X. Cheng, “Sa framework based
Journal of Information Security and Applications, vol. 49, p. 102402,
de-anonymization of social networks,” Procedia Computer Science, vol.
2019.
129, pp. 358–363, 2018.
[221] N. C. Rathore and S. Tripathy, “Appmonitor: restricting information
[200] J. G. Thangam and A. Sankar, “Emphasizing on space complexity in
leakage to third-party applications,” Social Network Analysis and Mining,
enterprise social networks for the investigation of link prediction using
vol. 10, no. 1, pp. 1–20, 2020.
hybrid approach,” in Business Intelligence for Enterprise Internet of
Things. Springer, 2020, pp. 253–270. [222] S. T. Boshrooyeh, A. Küpçü, and Ö. Özkasap, “Privado: Privacy-
[201] G. Song, Y. Zhou, H. Liu, G. Wen et al., “A privacy inference model based preserving group-based advertising using multiple independent social
on attribute graph,” in 2018 International Conference on Networking and network providers,” ACM Transactions on Privacy and Security (TOPS),
Network Applications (NaNA). IEEE, 2018, pp. 97–101. vol. 23, no. 3, pp. 1–36, 2020.
[202] X. Xian, T. Wu, S. Qiao, W. Wang, Y. Liu, and N. Han, “Multi-view low- [223] Y. Huang, Z. Cai, and A. G. Bourgeois, “Privacy protection for context-
rank coding-based network data de-anonymization,” IEEE Access, vol. 8, aware services: A two-layer three-party game model,” in Interna-
pp. 94 575–94 593, 2020. tional Conference on Wireless Algorithms, Systems, and Applications.
[203] P. Gundecha, G. Barbier, and H. Liu, “Exploiting vulnerability to secure Springer, 2019, pp. 124–136.
user privacy on a social networking site,” in Proceedings of the 17th [224] L. Guo, C. Zhang, Y. Fang, and P. Lin, “A privacy-preserving attribute-
ACM SIGKDD international conference on Knowledge discovery and based reputation system in online social networks,” Journal of Computer
data mining, 2011, pp. 511–519. Science and Technology, vol. 30, no. 3, pp. 578–597, 2015.
[204] B. A. Pijani, A. Imine, and M. Rusinowitch, “Inferring attributes with pic- [225] J. Yang, X. Li, Z. Sun, and J. Zhang, “A differential privacy framework
ture metadata embeddings,” ACM SIGAPP Applied Computing Review, for collaborative filtering,” Mathematical Problems in Engineering, vol.
vol. 20, no. 2, pp. 36–45, 2020. 2019, 2019.
[205] H. Li, Q. Chen, H. Zhu, D. Ma, H. Wen, and X. S. Shen, “Privacy [226] R. Aljably, Y. Tian, M. Al-Rodhaan, and A. Al-Dhelaan, “Anomaly
leakage via de-anonymization and aggregation in heterogeneous social detection over differential preserved privacy in online social networks,”
networks,” IEEE Transactions on Dependable and Secure Computing, Plos one, vol. 14, no. 4, p. e0215856, 2019.
2017. [227] P. Li, F. Zhou, Z. Xu, Y. Li, and J. Xu, “Privacy-preserving graph
[206] K. Deng, L. Xing, L. Zheng, H. Wu, P. Xie, and F. Gao, “A user iden- operations for social network analysis,” in International Symposium on
tification algorithm based on user behavior analysis in social networks,” Security and Privacy in Social Networks and Big Data. Springer, 2020,
IEEE Access, vol. 7, pp. 47 114–47 123, 2019. pp. 303–317.
[207] L. Guo, C. Zhang, and Y. Fang, “A trust-based privacy-preserving friend [228] X. Li, Y. Xin, C. Zhao, Y. Yang, and Y. Chen, “Graph convolutional net-
recommendation scheme for online social networks,” ieee transactions works for privacy metrics in online social networks,” Applied Sciences,
on dependable and secure computing, vol. 12, no. 4, pp. 413–427, 2014. vol. 10, no. 4, p. 1327, 2020.
[208] V. B. Kukkala and S. Iyengar, “Identifying influential spreaders in a social [229] J. Alemany, E. Del Val, J. M. Alberola, and A. Garćia-Fornes, “Metrics
network (while preserving privacy),” Proceedings on Privacy Enhancing for privacy assessment when sharing information in online social net-
Technologies, vol. 2020, no. 2, pp. 537–557, 2020. works,” IEEE Access, vol. 7, pp. 143 631–143 645, 2019.
[209] Q. Dong and D. Huang, “Privacy-preserving matchmaking in geosocial [230] R. G. Pensa, “Enhancing privacy awareness in online social networks:
networks with untrusted servers,” in 2017 IEEE 37th International Con- A knowledge-driven approach,” in 2018 International Workshop on
ference on Distributed Computing Systems (ICDCS). IEEE, 2017, pp. Knowledge-Driven Analytics Impacting Human Quality of Life (KDAH
2591–2592. 2018), vol. 2482. CEUR-WS, 2019, pp. 1–2.

VOLUME 4, 2016 33

This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see [Link]
 This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI
10.1109/ACCESS.2020.3045700, IEEE Access

Author et al.: Preparation of Papers for IEEE TRANSACTIONS and JOURNALS

[231] X. Li, Y. Xin, C. Zhao, Y. Yang, S. Luo, and Y. Chen, “Using user [253] P. Zhao, H. Huang, X. Zhao, and D. Huang, “P3 : Privacy-preserving
behavior to measure privacy on online social networks,” IEEE Access, scheme against poisoning attacks in mobile-edge computing,” IEEE
vol. 8, pp. 108 387–108 401, 2020. Transactions on Computational Social Systems, 2020.
[232] R. G. Pensa, G. Di Blasi, and L. Bioglio, “Network-aware privacy [254] Y. Zhao, J. Zhao, L. Jiang, R. Tan, D. Niyato, Z. Li, L. Lyu, and Y. Liu,
risk estimation in online social networks,” Social Network Analysis and “Privacy-preserving blockchain-based federated learning for iot devices,”
Mining, vol. 9, no. 1, p. 15, 2019. IEEE Internet of Things Journal, 2020.
[233] F. Zhou, K. Zhang, S. Xie, and X. Luo, “Learning to correlate ac- [255] S. Madan and P. Goswami, “A privacy preservation model for big data in
counts across online social networks: An embedding-based approach,” map-reduced framework based on k-anonymisation and swarm-based al-
INFORMS Journal on Computing, 2020. gorithms,” International Journal of Intelligent Engineering Informatics,
[234] I. Nurgaliev, Q. Qu, S. M. H. Bamakan, and M. Muzammal, “Matching vol. 8, no. 1, pp. 38–53, 2020.
user identities across social networks with limited profile data,” Frontiers [256] R. Jain, N. Jain, and A. Nayyar, “Security and privacy in social networks:
of Computer Science, vol. 14, pp. 1–14, 2020. Data and structural anonymity,” in Handbook of Computer Networks and
[235] X. Han, H. Huang, and L. Wang, “F-pad: Private attribute disclosure risk Cyber Security. Springer, 2020, pp. 265–293.
estimation in online social networks,” IEEE Transactions on Dependable [257] C. Fang, Y. Guo, N. Wang, and A. Ju, “Highly efficient federated learning
and Secure Computing, vol. 16, no. 6, pp. 1054–1069, 2019. with strong privacy preservation in cloud computing,” Computers &
[236] G. Xu, H. Li, Y. Zhang, S. Xu, J. Ning, and R. Deng, “Privacy-preserving Security, p. 101889, 2020.
federated deep learning with irregular users,” IEEE Transactions on [258] S. D. Khambalkar, S. D. Kamble, N. V. Thakur, N. U. Sambhe, and
Dependable and Secure Computing, 2020. N. S. Mangrulkar, “An overview on privacy preservation and public
[237] R. Hu, Y. Guo, H. Li, Q. Pei, and Y. Gong, “Personalized federated auditing on outsourced cloud data,” in Smart Trends in Computing and
learning with differential privacy,” IEEE Internet of Things Journal, Communications. Springer, 2020, pp. 463–470.
2020. [259] J. Li, X. Kuang, S. Lin, X. Ma, and Y. Tang, “Privacy preservation
[238] X. Liu, H. Li, G. Xu, R. Lu, and M. He, “Adaptive privacy-preserving for machine learning training and classification based on homomorphic
federated learning,” PEER-TO-PEER NETWORKING AND APPLICA- encryption schemes,” Information Sciences, 2020.
TIONS, 2020. [260] Y.-L. Gao, X.-B. Chen, G. Xu, W. Liu, M.-X. Dong, and X. Liu, “A new
[239] A. Triastcyn and B. Faltings, “Federated generative privacy,” IEEE Intel- blockchain-based personal privacy protection scheme,” Multimedia Tools
ligent Systems, 2020. and Applications, pp. 1–14, 2020.
[261] C. Butpheng, K.-H. Yeh, and H. Xiong, “Security and privacy in
[240] O. Choudhury, A. Gkoulalas-Divanis, T. Salonidis, I. Sylla, Y. Park,
iot-cloud-based e-health systems—a comprehensive review,” Symmetry,
G. Hsu, and A. Das, “Anonymizing data for privacy-preserving federated
vol. 12, no. 7, p. 1191, 2020.
learning,” arXiv preprint arXiv:2002.09096, 2020.
[262] N. Kaaniche and M. Laurent, “Data security and privacy preservation
[241] X. Hu, L.-e. Wang, J. Tang, C. Lei, P. Liu, and X. Li, “Anonymizing
in cloud storage environments based on cryptographic mechanisms,”
approach to resist label-neighborhood attacks in dynamic releases of
Computer Communications, vol. 111, pp. 120–141, 2017.
social networks,” in 2017 IEEE 19th International Conference on e-
[263] E. Damiani, C. A. Ardagna, F. Zavatarelli, E. Rekleitis, and L. Marinos,
Health Networking, Applications and Services (Healthcom). IEEE,
“Big data threat landscape and good practice guide,” European Union
2017, pp. 1–6.
Agency For Network And Information Security, 2016.
[242] R. Yue, Y. Li, T. Wang, and Y. Jin, “An efficient adaptive graph
[264] R. Jain, N. Jain, and A. Nayyar, “Security and privacy in social networks:
anonymization framework for incremental data publication,” in 2018 5th
Data and structural anonymity,” in Handbook of Computer Networks and
International Conference on Behavioral, Economic, and Socio-Cultural
Cyber Security. Springer, 2020, pp. 265–293.
Computing (BESC). IEEE, 2018, pp. 103–108.
[265] A. Ghorbel, M. Ghorbel, and M. Jmaiel, “Privacy in cloud computing
[243] C.-H. Tai, P.-J. Tseng, S. Y. Philip, and M.-S. Chen, “Identity protec- environments: a survey and research challenges,” The Journal of Super-
tion in sequential releases of dynamic networks,” IEEE transactions on computing, vol. 73, no. 6, pp. 2763–2800, 2017.
Knowledge and Data Engineering, vol. 26, no. 3, pp. 635–651, 2013.
[266] H. F. Atlam and G. B. Wills, “Iot security, privacy, safety and ethics,” in
[244] W. M. Yafooz, Z. B. A. Bakar, S. A. Fahad, and A. M. Mithon, “Business Digital Twin Technologies and Smart Cities. Springer, 2020, pp. 123–
intelligence through big data analytics, data mining and machine learn- 149.
ing,” in Data Management, Analytics and Innovation. Springer, 2020, [267] J. Tang, Y. Cui, Q. Li, K. Ren, J. Liu, and R. Buyya, “Ensuring secu-
pp. 217–230. rity and privacy preservation for cloud data services,” ACM Computing
[245] J. Liu, X. Li, L. Ye, H. Zhang, X. Du, and M. Guizani, “Bpds: A Surveys (CSUR), vol. 49, no. 1, pp. 1–39, 2016.
blockchain based privacy-preserving data sharing for electronic medical [268] M. Sumathi and S. Sangeetha, “A group-key-based sensitive attribute pro-
records,” in 2018 IEEE Global Communications Conference (GLOBE- tection in cloud storage using modified random fibonacci cryptography,”
COM). IEEE, 2018, pp. 1–6. Complex & Intelligent Systems, pp. 1–15, 2020.
[246] Y. Khazbak, J. Qiu, T. Tan, and G. Cao, “Targetfinder: A privacy preserv- [269] P. J. Sun, “The optimal privacy strategy of cloud service based on
ing system for locating targets through iot cameras,” ACM Transactions evolutionary game,” Cluster Computing, pp. 1–19, 2020.
on Internet of Things, vol. 1, no. 3, pp. 1–23, 2020. [270] ——, “Security and privacy protection in cloud computing: Discussions
[247] M. Shen, G. Cheng, L. Zhu, X. Du, and J. Hu, “Content-based multi- and challenges,” Journal of Network and Computer Applications, p.
source encrypted image retrieval in clouds with privacy preservation,” 102642, 2020.
Future Generation Computer Systems, vol. 109, pp. 621–632, 2020. [271] U. Khadam, M. M. Iqbal, M. Alruily, M. A. Al Ghamdi, M. Ramzan, and
[248] R. Wei, H. Shen, and H. Tian, “An improved (k, p, l)-anonymity method S. H. Almotiri, “Text data security and privacy in the internet of things:
for privacy preserving collaborative filtering,” in GLOBECOM 2017- Threats, challenges, and future directions,” Wireless Communications
2017 IEEE Global Communications Conference. IEEE, 2017, pp. 1–6. and Mobile Computing, vol. 2020, 2020.
[249] A. Bhatia and S. Shaikh, “Proceedings for the first international workshop [272] P. C. M. Arachchige, P. Bertok, I. Khalil, D. Liu, and S. Camtepe, “Ppaas:
on social threats in online conversations: Understanding and manage- Privacy preservation as a service,” arXiv preprint arXiv:2007.02013,
ment,” in Proceedings for the First International Workshop on So- 2020.
cial Threats in Online Conversations: Understanding and Management, [273] A. Ye, Q. Zhang, Y. Diao, J. Zhang, H. Deng, and B. Cheng, “A semantic-
2020. based approach for privacy-preserving in trajectory publishing,” IEEE
[250] R. Talat, M. S. Obaidat, M. Muzammal, A. H. Sodhro, Z. Luo, and Access, vol. 8, pp. 184 965–184 975, 2020.
S. Pirbhulal, “A decentralised approach to privacy preserving trajectory [274] C.-Y. Lin, “Suppression techniques for privacy-preserving trajectory data
mining,” Future Generation Computer Systems, vol. 102, pp. 382–392, publishing,” Knowledge-Based Systems, vol. 206, p. 106354, 2020.
2020. [275] N. Kaaniche, M. Laurent, and S. Belguith, “Privacy enhancing tech-
[251] H. Wang, X. A. Wang, S. Xiao, and J. Liu, “Decentralized data out- nologies for solving the privacy-personalization paradox: Taxonomy and
sourcing auditing protocol based on blockchain,” Journal of Ambient survey,” Journal of Network and Computer Applications, p. 102807,
Intelligence and Humanized Computing, pp. 1–12, 2020. 2020.
[252] M. A. P. Chamikara, P. Bertók, D. Liu, S. Camtepe, and I. Khalil, [276] D. Hurtado Ramírez and J. Auñón, “Privacy preserving k-means clus-
“Efficient privacy preservation of big data for accurate data mining,” tering: A secure multi-party computation approach,” arXiv e-prints, pp.
Information Sciences, vol. 527, pp. 420–443, 2020. arXiv–2009, 2020.

34 VOLUME 4, 2016

This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see [Link]
 This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI
10.1109/ACCESS.2020.3045700, IEEE Access

Author et al.: Preparation of Papers for IEEE TRANSACTIONS and JOURNALS

[277] N. Lisin and S. Zapechnikov, “Methods and approaches for privacy- privacy preserving federated learning in healthcare,” arXiv preprint
preserving machine learning,” in Advanced Technologies in Robotics and arXiv:2009.08294, 2020.
Intelligent Systems. Springer, 2020, pp. 141–148. [302] K. M. Hossein, M. E. Esmaeili, T. Dargahi et al., “Blockchain-based
[278] Y. Huang, M. Milani, and F. Chiang, “Pacas: privacy-aware, data privacy-preserving healthcare architecture,” in 2019 IEEE Canadian
cleaning-as-a-service,” in 2018 IEEE International Conference on Big Conference of Electrical and Computer Engineering (CCECE). IEEE,
Data (Big Data). IEEE, 2018, pp. 1023–1030. 2019, pp. 1–4.
[279] ——, “Privacy-aware data cleaning-as-a-service,” Information Systems, [303] R. Talat, M. S. Obaidat, M. Muzammal, A. H. Sodhro, Z. Luo, and
vol. 94, p. 101608, 2020. S. Pirbhulal, “A decentralised approach to privacy preserving trajectory
[280] H. Y. Youm, “An overview of de-identification techniques and their mining,” Future Generation Computer Systems, vol. 102, pp. 382–392,
standardization directions,” IEICE TRANSACTIONS on Information and 2020.
Systems, vol. 103, no. 7, pp. 1448–1461, 2020. [304] Y. Xie, H. Wang, B. Yu, and C. Zhang, “Secure collaborative few-shot
[281] J. Hiscott, M. Alexandridi, M. Muscolini, E. Tassone, E. Palermo, learning,” Knowledge-Based Systems, vol. 203, p. 106157, 2020.
M. Soultsioti, and A. Zevini, “The global impact of the coronavirus [305] Y. Zhou, S. Zheng, and L. Wang, “Privacy-preserving and efficient
pandemic,” Cytokine & Growth Factor Reviews, 2020. public key encryption with keyword search based on cp-abe in cloud,”
[282] I. Y. Iourov, M. A. Zelenova, and S. G. Vorsanova, “Covid-19: a crash Cryptography, vol. 4, no. 4, p. 28, 2020.
test for biomedical publishing?” medRxiv, 2020. [306] X. Ma, C. Wang, and L. Wang, “The data sharing scheme based on
[283] M. Shen, Y. Wei, and T. Li, “Bluetooth-based covid-19 proximity tracing blockchain,” in Proceedings of the 2nd ACM International Symposium
proposals: An overview,” arXiv preprint arXiv:2008.12469, 2020. on Blockchain and Secure Critical Infrastructure. Association for
[284] N.-Y. Ahn, J. E. Park, D. H. Lee, and P. C. Hong, “Balancing personal Computing Machinery, 2020, p. 96–105.
privacy and public safety in covid-19: Case of korea and france,” arXiv [307] W. Xiong and L. Xiong, “Data resource protection based on smart
preprint arXiv:2004.14495, 2020. contract,” Computers & Security, vol. 98, p. 102004, 2020.
[285] J. Budd, B. S. Miller, E. M. Manning, V. Lampos, M. Zhuang, M. Edel- [308] S. Zeadally, E. Adi, Z. Baig, and I. A. Khan, “Harnessing artificial
stein, G. Rees, V. C. Emery, M. M. Stevens, N. Keegan et al., “Digital intelligence capabilities to improve cybersecurity,” IEEE Access, vol. 8,
technologies in the public-health response to covid-19,” Nature medicine, pp. 23 817–23 837, 2020.
pp. 1–10, 2020. [309] R. Wang and W. Ji, “Computational intelligence for information security:
[286] M. Nanni, G. Andrienko, C. Boldrini, F. Bonchi, C. Cattuto, A survey,” IEEE Transactions on Emerging Topics in Computational
F. Chiaromonte, G. Comandé, M. Conti, M. Coté, F. Dignum et al., “Give Intelligence, vol. 4, no. 5, pp. 616–629, 2020.
more data, awareness and control to individual citizens, and they will help
covid-19 containment,” arXiv preprint arXiv:2004.05222, 2020.
[287] A. Sardi, A. Rizzi, E. Sorano, and A. Guerrieri, “Cyber risk in health
facilities: A systematic literature review,” Sustainability, vol. 12, no. 17,
p. 7002, 2020.
[288] A. Apostolos and K. Apostolos, “Tracking applications: A factor of ABDUL MAJEED did his [Link]. (2013) in In-
mithridatism of personal data and privacy in the post-covid-19 era,” formation technology from University Institute of
Disaster Medicine and Public Health Preparedness, pp. 1–1, 2020.
Information Technology (UIIT), PMAS-UAAR,
[289] M. Moeini, M. Möhlmann, and J. Hummel, “Understanding knotted ten-
Rawalpindi, Pakistan and his MS (2016) in Infor-
sions in purveying pandemic public monitoring technologies,” Available
at SSRN 3671458, 2020. mation Security from COMSATS University, Is-
[290] A. Zwitter and O. J. Gstrein, “Big data, privacy and covid-19–learning lamabad, Pakistan. He worked as Security Analyst
from humanitarian expertise in data protection,” 2020. at Trillium Information Security Systems (TISS),
[291] A. B. Dar, A. H. Lone, S. Zahoor, A. A. Khan, and R. Naaz, “Applica- Rawalpindi, Pakistan from 2015 to 2016. He is
bility of mobile contact tracing in fighting pandemic (covid-19): Issues, currently pursuing his Ph.D. degree from Korea
challenges and solutions,” Computer Science Review, p. 100307, 2020. Aerospace University, Goyang, South Korea. His
[292] A. V. Lucca, R. Luchtenberg, L. G. de Paula Conceicao, L. A. Silva, R. G. research interests include privacy preserving data publishing (PPDP), infor-
Ovejero, M. Navarro-Cáceres, and V. R. Q. Leithardt, “System for control mation security, robotics, data mining, social network analysis and mining,
and management of data privacy of patients with covid-19,” 2020. and machine learning.
[293] Z. Allam, “Actualizing big data through revised data protocols to render
more accurate infectious disease monitoring and modeling,” Surveying
the Covid-19 Pandemic and its Implications, p. 71, 2020.
[294] V. Shubina, S. Holcer, M. Gould, and E. S. Lohan, “Survey of decentral-
ized solutions with mobile devices for user location tracking, proximity
detection, and contact tracing in the covid-19 era,” Data, vol. 5, no. 4, SUNGCHANG LEE received the B.S. degree
p. 87, 2020. from Kyungpook National University, in 1983, the
[295] K. Matsui, K. Yamamoto, and Y. Inoue, “Professional commitment to eth-
M.S. degree in electrical engineering from the Ko-
ical discussions needed from epidemiologists in the covid-19 pandemic,”
rea Advanced Institute of Science and Technology
Journal of Epidemiology, vol. 30, no. 9, pp. 375–376, 2020.
[296] J. Zhang and M. Wu, “Blockchain use in iot for privacy-preserving anti- (KAIST), in 1985, and the Ph.D. degree in elec-
pandemic home quarantine,” Electronics, vol. 9, no. 10, p. 1746, 2020. trical engineering from Texas A&M University, in
[297] A. Verri Lucca, L. Augusto Silva, R. Luchtenberg, L. Garcez, X. Mao, 1991. From 1985 to 1987, he was with KAIST, as a
R. García Ovejero, I. Miguel Pires, J. Luis Victória Barbosa, and V. Reis Researcher, where he worked on Image Processing
Quietinho Leithardt, “A case study on the development of a data privacy and Pattern Recognition Projects. From 1992 to
management solution based on patient information,” Sensors, vol. 20, 1993, he was a Senior Researcher with the Elec-
no. 21, p. 6030, 2020. tronics and Telecommunications Research Institute (ETRI), South Korea.
[298] D. Gao, Y. Liu, A. Huang, C. Ju, H. Yu, and Q. Yang, “Privacy-preserving From 2004 to 2009, he was the Director of Government Project on Intelligent
heterogeneous federated transfer learning,” in 2019 IEEE International Smart Home Security & Automation Service Technology. In 2009, he was
Conference on Big Data (Big Data). IEEE, 2019, pp. 2552–2559. the Vice President of the Institute of Electronics and Information Engineers
[299] H. C. Tanuwidjaja, R. Choi, and K. Kim, “A survey on deep learning tech- (IEIE), South Korea, and also the Director of the Telecommunications Soci-
niques for privacy-preserving,” in International Conference on Machine ety, South Korea. Since 1993, he has been a Faculty with Korea Aerospace
Learning for Cyber Security. Springer, 2019, pp. 29–46. University, Goyang, South Korea, where he is currently a Professor with the
[300] C. Chen, B. Wu, M. Qiu, L. Wang, and J. Zhou, “A comprehensive School of Electronics, Telecommunication & Computer Engineering.
analysis of information leakage in deep transfer learning,” arXiv preprint
arXiv:2009.01989, 2020.
[301] M. Grama, M. Musat, L. Muñoz-González, J. Passerat-Palmbach,
D. Rueckert, and A. Alansary, “Robust aggregation for adaptive

VOLUME 4, 2016 35

This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see [Link]