A Framework for Computing the Privacy Scores of Users in Online Social Networks

Transcription

1 A Framework for Computing the Privacy Scores of Users in Online Social Networks Kun Liu Yahoo! Labs (previously IBM Research) September 11, 2009

2 The Team IBM Almaden Research Center IBM Silicon Valley Lab Tyrone Grandison Sherry Guo Kun Liu Dwayne Richardson Michael (Max) Maximilien Tony Sun Evimaria Terzi 2 References:

3

4 Wait a minute, how come the talk is related Credit Score? 4 References:

5 From humble beginnings in 1956, Fair Isaac Corp.'s credit score has come to loom over consumer finance like no other statistical measure ever has. 5 References:

6 So, how about a Privacy Score that indicates the privacy risk of online social-networking users? 6 References:

7 Do you want to design a privacy score and other advanced privacy and risk management mechanisms so that 50 years (or much less) later, people will appreciate your effort? 7 References:

8 Roadmap Motivation and Goal Privacy Score and Its Applications Privacy Score and Facebook/OpenSocial Proof of Concept: The Privacy-Aware Market Place Conclusions 8 References:

9 Motivation Millions of users share details of their personal lives with vast networks of friends, and often, strangers Disclosure of personal info expose the users to identity theft, digital stalking, etc. Courtesy to: Courtesy to: 9 References:

10 Motivation (Cont.) All my friends have shared their hometown and phone number, maybe I should also do this? My God! What information I have shared all these years and who can view these information? How to prevent my ex from seeing my status updates? How to hide my friend list in the search results? I enjoyed sharing my daily activities with the World! But any adverse effects? How to prevent the applications my friends installed from accessing my information? 10 References:

11 Goal Our goal is to develop a mechanism that is able to Measure/monitor the privacy risk of social-networking users Boost public awareness of privacy Help users to easily manage their information sharing Our goal is NOT to prevent people from sharing information How to achieve this goal? Privacy-score calculation Comprehensive information-sharing report Privacy-settings recommendation and more 11 References:

12 Life Cycle of Privacy Score Privacy Settings Privacy Score Calculation privacy score of the user Utilize Privacy Scores Privacy Risk Monitoring Comprehensive Privacy Report Privacy Settings Recommendation 12 References:

13 Roadmap Motivation and Goal Privacy Score and Its Applications Privacy Score and Facebook/OpenSocial Proof of Concept: The Privacy-Aware Market Place Conclusions 13 References:

14 Basic Premises of Privacy Score Sensitivity: The more sensitive the information revealed by a user, the higher his privacy risk. mother s maiden name is more sensitive than mobile-phone number mother s maiden name is more sensitive than mobile-phone number Visibility: The wider the information about a user spreads, the higher his privacy risk. home address known by everyone poses higher risks than by friends only home address known by everyone poses higher risks than by friends only 14 References:

15 The Framework name, or gender, birthday, address, phone number, degree, job, etc. Privacy Score of User j due to Profile Item i PR( i, j)= β V ( i, j). i sensitivity of profile item i visibility of profile item i 15 References:

16 The Framework name, or gender, birthday, address, phone number, degree, job, etc. Privacy Score of User j due to Profile Item i PR( i, j)= β V ( i, j). i sensitivity of profile item i visibility of profile item i Overall Privacy Score of User j = = i i i PR( j) PR( i, j) β V ( i, j). 16 References:

17 The Naïve Approach Profile Item_1 (birthday) User_1 User_j User_N R(1, 1) R(1, 2) R(1, N) Profile Item_i (cell phone #) R(i, j) Profile Item_n R(n, 1) share, R(i, j) = 1 not share, R(i, j) = 0 R(n, N) 17 References:

18 The Naïve Approach Profile Item_1 (birthday) User_1 User_j User_N R(1, 1) R(1, 2) R(1, N) Profile Item_i (cell phone #) R(i, j) R R( i, j) i = j Profile Item_n Sensitivity: R(n, 1) share, R(i, j) = 1 not share, R(i, j) = 0 N Ri βi = N R(n, N) 18 References:

19 The Naïve Approach Profile Item_1 (birthday) User_1 User_j User_N R(1, 1) R(1, 2) R(1, N) Profile Item_i (cell phone #) R(i, j) R R( i, j) i = j Profile Item_n Sensitivity: Visibility: R(n, 1) β = i share, R(i, j) = 1 not share, R(i, j) = 0 N Ri N = j R R( i, j) V ( i, j) = Pr{ R( i, j) = 1} 1+ Pr{ R( i, j) = 0} 0 i R(n, N) 19 References:

20 The Naïve Approach Profile Item_1 (birthday) User_1 User_j User_N R(1, 1) R(1, 2) R(1, N) Profile Item_i (cell phone #) R(i, j) R R( i, j) i = j Profile Item_n Sensitivity: Visibility: R(n, 1) β = i share, R(i, j) = 1 not share, R(i, j) = 0 N Ri N = j R R( i, j) V ( i, j) = Pr{ R( i, j) = 1} 1+ Pr{ R( i, j) = 0} 0 i R(n, N) j Ri R Pr{ R( i, j) = 1} = N n 20 References:

21 Item Response Theory (IRT) IRT (Lawley,1943 and Lord,1952) has its origin in psychometrics. It is used to analyze data from questionnaires and tests. It is the foundation of Computerized Adaptive Test like GRE, GMAT Probability of Correct Response Item Characteristic Curve (ICC) Ability 21 References:

22 Item Characteristic Curve (ICC) 1 Student j s ability Pr{ R( i, j) = 1} = 1+ i j i ( ) e α θ β Question i s discrimination Question i s difficulty Probability of Correct Response Question 1 Question 2 22 References:

23 The Item Response Theory (IRT) Approach Profile Item_1 (birthday) User_1 User_j User_N R(1, 1) R(1, 2) R(1, N) Profile Item_i (cell phone #) R(i, j) Profile Item_n R(n, 1) share, R(i, j) = 1 not share, R(i, j) = 0 R(n, N) Profile item s discrimination Pij 1 = Pr{ R( i, j) = 1} = 1+ i j i Profile item i s true visibility ( ) e α θ β User s attitude, e.g., conservative or extrovert Profile item s sensitivity 23 References:

24 Calculating Privacy Score using IRT Overall Privacy Score of User j PR( j) = βi V ( i, j). i Sensitivity: β i Visibility: V( i, j) = Pr{ R( i, j) = 1} Pij 1 = Pr{ R( i, j) = 1} = 1+ i j i ( ) e α θ β byproducts: profile item s discrimination and user s attitude All parameters can be estimated using Maximum Likelihood Estimation and Expectation-Maximization. 24 References:

25 Advantages of the IRT Model The mathematical model fits the observed data well The quantities IRT computes (i.e., sensitivity, attitude and visibility) have intuitive interpretations Computation is parallelizable using e.g. MapReduce Privacy scores calculated within different social networks are comparable 25 References:

26 Interesting Results from User Study Survey We collected the information-sharing preferences of 153 users on 49 profile items such as name, gender, birthday, political views, address, phone number, degree, job, etc. Sensitivity of The Profile Items Computed by IRT Model Statistics 49 profile items 153 users from 18 countries/regions 53.3% are male and 46.7% are female 75.4% are in the age of 23 to % hold a college degree or higher 76.0% spend 4+ hours online per day Average Privacy Scores Grouped by Geographical Regions 26 References:

27 Utilize Privacy Scores Privacy Risk Monitoring Privacy (Information Sharing) Report Score: 100 ~ 150 Score: 100 ~ 150 Privacy Settings Recommendation Score: 100 ~ 150 Score: 100 ~ 150 Score: 100 ~ References:

28 Roadmap Motivation and Goal Privacy Score and Its Applications Privacy Score and Facebook/OpenSocial Proof of Concept: The Privacy-Aware Market Place Conclusions 28 References:

29 Privacy Score and Facebook/OpenSocial Provide native native implementation of of Privacy Score Scorecomputation. Enable Enable application developers to to implement their their own own Privacy Scores. Enable Enable application developers to to build build Information Sharing Report Reportmodules and and Privacy Settings Recommendation modules. 29 References:

30 Roadmap Motivation and Goal Privacy Score and Its Applications Privacy Score and Facebook/OpenSocial Proof of Concept: The Privacy-Aware Market Place Conclusions 30 References:

31 Privacy-aware Marketplace (PaMP) 31 References:

32 Conclusions In this talk, we have discussed the importance of privacy score and privacy management two ways to compute privacy score using privacy settings Our goal is to develop a mechanism and a platform that will Measure/monitor the privacy risk of social-networking users Boost public awareness of privacy Help users to easily manage their information sharing We believe that simple and effective privacy management makes one feels safe and comfortable about sharing information online, which will eventually facilitate the information sharing and integration. 32 References:

33 Thank you and Questions? 33 References: