Collaborative and privacy-aware sensing for Gon calves, Rui Jos - - PowerPoint PPT Presentation

Collaborative and privacy-aware sensing for

• bserving urban

movement patterns Nelson Gon¸ calves, Rui Jos´ e, Carlos Baquero Universidade do Minho and INESC TEC, PT

Collaborative and privacy-aware sensing for

• bserving urban movement patterns

Nelson Gon¸ calves, Rui Jos´ e, Carlos Baquero Universidade do Minho and INESC TEC, PT Esorics DPM, September 2013

Collaborative and privacy-aware sensing for

• bserving urban

movement patterns Nelson Gon¸ calves, Rui Jos´ e, Carlos Baquero Universidade do Minho and INESC TEC, PT

Urban Movement Patterns

Macro-level detection of aggregated urban movement can assist infrastructure management. In a tourism office: “Are the individuals in this art gallery likely to have visited a given art museum first?” In a shopping mall: “Which shops are visited most likely after the movie theater? and before the theater?”

Collaborative and privacy-aware sensing for

• bserving urban

movement patterns Nelson Gon¸ calves, Rui Jos´ e, Carlos Baquero Universidade do Minho and INESC TEC, PT

Individual Movement Patterns

Individuals often carry devices than can be detected Local detections can be shared and allow movement tracking 02:27:e4:f2:cd:0a W.Foyer 11:Sep:2013:19:12:33 MAC pseudonyms can be correlated to individuals

Collaborative and privacy-aware sensing for

• bserving urban

movement patterns Nelson Gon¸ calves, Rui Jos´ e, Carlos Baquero Universidade do Minho and INESC TEC, PT

Research Questions

1 Can we design a mechanism that preserves privacy while

allowing limited accuracy tracking of movement patterns?

2 Can higher accuracy collective movement result from lower

accuracy individual tracking?

Collaborative and privacy-aware sensing for

• bserving urban

movement patterns Nelson Gon¸ calves, Rui Jos´ e, Carlos Baquero Universidade do Minho and INESC TEC, PT

Precedence Filters

Our approach, Precedence Filters, builds heavily on: Bloom Filters (for probabilistic set membership) and on, Vector Clocks (for distributed causality tracking). The goal is to present a probabilist trace of past user locations, when at a given location. @ Subway Bank → Market → Subway And collectively collect common routes.

Collaborative and privacy-aware sensing for

• bserving urban

movement patterns Nelson Gon¸ calves, Rui Jos´ e, Carlos Baquero Universidade do Minho and INESC TEC, PT

Tools: Bloom Filters

Bloom filter for set {x, y, z} with 3 hash functions.

1 0 0 1 0 0 1 0 1 0 1 0 0 1 1 0 0 1 0 1 0 {x,y,z} w hash_fun2 hash_fun3 hash_fun1

Querying for element w yields a false positive. Larger filters depict larger precision for the same stored set size.

Collaborative and privacy-aware sensing for

• bserving urban

movement patterns Nelson Gon¸ calves, Rui Jos´ e, Carlos Baquero Universidade do Minho and INESC TEC, PT

Tools: Vector Clocks

Captures causality (happens before) relations without wall clocks

P1 P2 P3 [2,2,0] [2,2,3] [0,0,1] [2,2,2] [2,1,0] [2,3,3] [1,0,0] [2,0,0] [3,0,0] [4,3,3]

[2, 2, 0] → [2, 2, 3] → [4, 3, 4]

Collaborative and privacy-aware sensing for

• bserving urban

movement patterns Nelson Gon¸ calves, Rui Jos´ e, Carlos Baquero Universidade do Minho and INESC TEC, PT

System Model and Design

Network of local sensing devices (e.g. WiFi Hotspots) MAC/Pseudonyms cannot leave the local sensing device Tracking can exhibit false routes (plausible deniability) No network communication failures Network communication is faster than user movement A node holds a filter and caches cells from other filters

Collaborative and privacy-aware sensing for

• bserving urban

movement patterns Nelson Gon¸ calves, Rui Jos´ e, Carlos Baquero Universidade do Minho and INESC TEC, PT

Precedence Filters: Algorithm

All filters have cells at 0 and they can take natural numbers A MAC address a is sensed in scanner node X Using hashes X calculates to which cells item a is mapped Each other node sends to X the value on those cells Node X updates the caches of node’s filters on those cells In X filter, on those cells, it stores the maximum known value, plus one. This creates a fingerprint for a that is after all other sightings. From this information a node can construct its probabilistic view of the sequence of visits of a sensed device.

Collaborative and privacy-aware sensing for

• bserving urban

movement patterns Nelson Gon¸ calves, Rui Jos´ e, Carlos Baquero Universidade do Minho and INESC TEC, PT

Mobility Traces

Trace with recurrent visits Subway → Market → Bookshop → Bank → Market → Subway Precedence filters only capture the last of recurring visits Trace with more recent visits Bookshop → Bank → Market → Subway

Collaborative and privacy-aware sensing for

• bserving urban

movement patterns Nelson Gon¸ calves, Rui Jos´ e, Carlos Baquero Universidade do Minho and INESC TEC, PT

Metrics and Data Sets

A data set of Bluetooth sightings by static nodes was used from Leguay at all, from 2006, where 18 static nodes tracked 9244 distinct

• users. This trace was replayed and complemented by a derived

synthetic trace that expands the trace length and number of users. Precedence Filters false positives create fictitious transitions. For evaluation we observe the relative proportion of these transitions. A value of 0.5 means that 50% of transitions are false.

Collaborative and privacy-aware sensing for

• bserving urban

movement patterns Nelson Gon¸ calves, Rui Jos´ e, Carlos Baquero Universidade do Minho and INESC TEC, PT

Data Set: Location visits

38 39 40 42 52 37 53 44 43 46 48 50 45 49 47 41 54 51 Scanner name 500 1000 1500 2000 2500 3000 Number of sightings

Total and Distinct number of sightings for each fixed scanner Total devices Distinct devices

P1 P2 P3 P4 P5 P6 P7 P8 P9 P10 P11 P12 P13 P14 P15 P16 P17 P18 Scanner name 500 1000 1500 2000 2500 3000 Number of sightings

Total and Distinct number of sightings for each fixed scanner Total sightings Distinct sightings

Distribution of detections in locations on real and synthetic traces

Collaborative and privacy-aware sensing for

• bserving urban

movement patterns Nelson Gon¸ calves, Rui Jos´ e, Carlos Baquero Universidade do Minho and INESC TEC, PT

Inaccuracy vs False Positive Probability

0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1.0 CBFs' False Positive Probability 0.0 0.2 0.4 0.6 0.8 1.0 Inaccuracy 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1.0 CBFs' False Positive Probability 0.0 0.2 0.4 0.6 0.8 1.0 Inaccuracy Individual Global

Real and synthetic traces for the same trace length and users Global measures quality of aggregated transition prevalence

Collaborative and privacy-aware sensing for

• bserving urban

movement patterns Nelson Gon¸ calves, Rui Jos´ e, Carlos Baquero Universidade do Minho and INESC TEC, PT

Extended synthetic trace

Effects of increased trace size (100) and tracked users (100000)

0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1.0 CBFs' False Positive Probability 0.0 0.2 0.4 0.6 0.8 1.0 Inaccuracy

For longer runs higher quality aggregated data can be extracted from low quality (higher privacy) individual movement tracking.

Collaborative and privacy-aware sensing for

• bserving urban

movement patterns Nelson Gon¸ calves, Rui Jos´ e, Carlos Baquero Universidade do Minho and INESC TEC, PT

Take home message

New technique, Precedence Filters, joins Bloom Filters and VCs Controlling filter size WRT number of devices, dictates accuracy False positives translate to fictitious visits to locations Proportion of fictitious visits supports plausible deniability 50% user inaccuracy can support aggregated 10% inaccuracy

Collaborative and privacy-aware sensing for

• bserving urban

movement patterns Nelson Gon¸ calves, Rui Jos´ e, Carlos Baquero Universidade do Minho and INESC TEC, PT

Photos

Attribution under Creative Commons. http://www.flickr.com/photos/skyjuice/ http://www.flickr.com/photos/unknowndomain/ http://www.flickr.com/photos/library of congress/