Geo-Ellipse-Indistinguishability: Community-Aware Location Privacy Protection for Directional Distribution

Abstract

Directional distribution analysis has long served as a fundamental functionality in abstracting dispersion and orientation of spatial datasets. Spatial datasets that describe sensitive information of individuals such as health status and home addresses must be used and shared cautiously to protect individuals&#x0027; privacy. There is an inherent tension between the need of accurate directional distribution result and the requirement of individuals&#x0027; location privacy. Plenty of excellent location privacy protection approaches such as geo-indistinguishability can provide strong protection for locations but considerably at the expense of statistical quality of subsequent directional distribution analysis. In this paper, to protect individual location data for directional distribution, we define the geographic feature of community with covariance matrix and then propose a <i>geo-ellipse-indistinguishability</i> privacy notion incorporating this covariance matrix. As an instantiation of metric differential privacy, <i>geo-ellipse-indistinguishability</i> guarantees pairwise inputs cannot be distinguishable with the level proportional to privacy budget and Mahalanobis distance between them, given a randomized output. We also present elliptical privacy mechanisms to achieve this privacy definition on the basis of gamma distribution and multivariate normal distribution. We finally evaluate the empirical utility of the proposed mechanism in New York home addresses database. Our experiments demonstrate that under the same privacy level, our proposed elliptical approach can achieve significantly higher directional distribution utility than circular noise function based method.