In event processing systems, detected event patterns can revealprivacy-sensitive information. In this paper, we proposeand discuss how to integrate pattern-level privacy protection in event-based systems. Compared to state-of-the-art approaches, we aim to enforce privacy independent of the particularities of specific operators. We accomplish this by supporting the flexible integration of multiple obfuscation techniques and studying deployment strategies for privacy-enforcing mechanisms. Moreover, we share ideas on how to model the adversary’s knowledge to better select appropriate obfuscation techniques for the discussed deployment strategies. Initial results indicate that flexibly choosing obfuscation techniques and deployment strategies is essential to conceal privacy-sensitive event patterns accurately

Degeler, Viktoriya

Koldehofe, Boris

Lotfian Delouee, Majid

English

ARTS repository - University of Groningen

   University of GroningenTowards Pattern-Level Privacy Protection in Distributed Complex Event ProcessingLotfian Delouee, Majid; Koldehofe, Boris; Degeler, ViktoriyaPublished in:Proceedings of the 17th ACM International Conference on Distributed and Event-based SystemsDOI:10.1145/3583678.3603278IMPORTANT NOTE: You are advised to consult the publisher's version (publisher's PDF) if you wish to cite fromit. Please check the document version below.Document VersionPublisher's PDF, also known as Version of recordPublication date:2023Link to publication in University of Groningen/UMCG research databaseCitation for published version (APA):Lotfian Delouee, M., Koldehofe, B., & Degeler, V. (2023). Towards Pattern-Level Privacy Protection inDistributed Complex Event Processing. In Proceedings of the 17th ACM International Conference onDistributed and Event-based Systems: DEBS '23 (pp. 185-186). ACM Press.https://doi.org/10.1145/3583678.3603278CopyrightOther than for strictly personal use, it is not permitted to download or to forward/distribute the text or part of it without the consent of theauthor(s) and/or copyright holder(s), unless the work is under an open content license (like Creative Commons).The publication may also be distributed here under the terms of Article 25fa of the Dutch Copyright Act, indicated by the “Taverne” license.More information can be found on the University of Groningen website: https://www.rug.nl/library/open-access/self-archiving-pure/taverne-amendment.Take-down policyIf you believe that this document breaches copyright please contact us providing details, and we will remove access to the work immediatelyand investigate your claim.Downloaded from the University of Groningen/UMCG research database (Pure): http://www.rug.nl/research/portal. For technical reasons thenumber of authors shown on this cover page is limited to 10 maximum.Download date: 31-10-2023Poster: Towards Pattern-Level Privacy Protection inDistributed Complex Event ProcessingMajid Lotfian DeloueeUniversity of GroningenBoris KoldehofeTechnische Universität IlmenauViktoriya DegelerUniversity of AmsterdamABSTRACTIn event processing systems, detected event patterns can re-veal privacy-sensitive information. In this paper, we proposeand discuss how to integrate pattern-level privacy protection inevent-based systems. Compared to state-of-the-art approaches,we aim to enforce privacy independent of the particularities ofspecific operators. We accomplish this by supporting the flexi-ble integration of multiple obfuscation techniques and studyingdeployment strategies for privacy-enforcing mechanisms. Inaddition, we share ideas on how to model the adversary’s knowl-edge to select appropriate obfuscation techniques for the dis-cussed deployment strategies. Initial results indicate that flexiblychoosing obfuscation techniques and deployment strategies isessential to conceal privacy-sensitive event patterns accurately.CCS CONCEPTS• Computer systems organization → Real-time systems.KEYWORDSPrivacy, Complex Event Processing, Pattern.ACM Reference Format:Majid Lotfian Delouee, Boris Koldehofe, and Viktoriya Degeler. 2023.Poster: Towards Pattern-Level Privacy Protection in Distributed Com-plex Event Processing. In The 17th ACM International Conference on Dis-tributed and Event-based Systems (DEBS ’23), June 27–30, 2023, Neuchatel,Switzerland. ACM, New York, NY, USA, 2 pages. https://doi.org/10.1145/3583678.36032781 INTRODUCTIONWhy Pattern-Level Privacy Protection is critical? Distributed Com-plex Event Processing (DCEP) is a state-of-the-art paradigm toprocess streams of simple events (e.g., IoT data) and producevaluable information, so-called complex events, in real time [2].For instance, a road congestion can be inferred by simple events:𝐴𝑣𝑒𝑟𝑎𝑔𝑒_𝑉𝑒ℎ𝑖𝑐𝑙𝑒𝑠_𝑆𝑝𝑒𝑒𝑑 < 20 𝑘𝑚/ℎ and 𝑉𝑒ℎ𝑖𝑐𝑙𝑒𝑠_𝐷𝑒𝑛𝑠𝑖𝑡𝑦 >𝑁𝑜𝑟𝑚𝑎𝑙_𝐷𝑒𝑛𝑠𝑖𝑡𝑦. Although the output of such systems deliversuseful information to various applications[1], detected complexevents might be privacy-sensitive. Besides, most Privacy Pro-tection Mechanisms (PPM) (e.g., access control) provide privacyprotection at the level of single events (i.e., by protecting eventattributes). In contrast, privacy demands often can be repre-sented using a combination of events through event patterns.It means the capabilities of conventional PPMs should be ex-tended from event-level to pattern-level. For example, the bloodpressure and heart rate data can reveal a disease when they areinvolved in an aggregated analysis, while they are not so helpfulseparately. Besides, concealing such a privacy-sensitive eventPermission to make digital or hard copies of part or all of this work for personalor classroom use is granted without fee provided that copies are not made ordistributed for profit or commercial advantage and that copies bear this notice andthe full citation on the first page. Copyrights for third-party components of thiswork must be honored. For all other uses, contact the owner/author(s).DEBS ’23, June 27–30, 2023, Neuchatel, Switzerland© 2023 Copyright held by the owner/author(s).ACM ISBN 979-8-4007-0122-1/23/06. . . $15.00https://doi.org/10.1145/3583678.3603278pattern (i.e., private pattern (PrP) ) can impact the detection ofnon-sensitive event patterns (i.e., public pattern (PuP)). Hence,a pattern-level PPM is required to provide a trade-off betweenprivacy and utility.Existing Solutions and Their Pitfalls. Although the state-of-the-art approaches propose pattern-based access strategies [3, 4],they are limited to dealing only with sequence types of patterns.Besides, they depend highly on the input streams to apply ob-fuscation techniques (OT), thereby failing to obfuscate varioustypes of PrPs for dynamic input event streams. In addition, pre-vious works stated that the CEP middleware is not trustable.This assumption reduces the detection of all matches for PuPssince they merge the input streams before the CEP middleware.However, suppose PrPs are concealed in the sink node withinthe CEP middleware for specific queries. In that case, it willnot negatively impact the results of the other queries. Besides,the potential knowledge an adversary might have needed to bebetter studied and involved in the obfuscation procedure.In this paper, we present a pattern-level PPM to fulfill dataowners’ privacy requirements while considering adversaries’ po-tential background knowledge. The ending goal of this approachis to provide a system that obtains privacy requirements (i.e.,PrPs) and situations of interest (i.e., PuPs) in the form of eventpatterns as input, and decide about obfuscation technique byproviding a trade-off between concealing PrPs when deliveringthe results to the queries. Moreover, we model the adversary’spotential background knowledge based on event dependenciesand possible statistical information gathered from the availableevent streams. While we initially focused on sequence types ofpatterns and limited this paper to the two most common obfus-cation techniques (i.e., drop and reorder), we believe the finalproposed mechanism can eventually cover more pattern typesand obfuscation techniques to decrease the adversary’s abilityto distinguish between the original and modified streams. Inthe following, we first elaborate on our approach, present thepreliminary experiment results, and conclude the paper.2 OUR APPROACHThis paper aims to minimize the impacts of concealing PrPs ondetecting PuPs, even in the presence of knowledgeable adver-saries. In Figure 1 (left), the initial system design of the pattern-level privacy preservation system is exhibited. Here, we do notprovide our own pattern generation for PrPs but build on ex-isting concepts for the flexible transformation of privacy re-quirements to PrPs[5]. However, finding the best obfuscationtechnique which maximizes the utility and at the same time doesnot reveal the concealing of the PrPs to adversaries is non-trivial.The first challenge in this research is the utility metric bywhich the performance of each OTmodel on a specific PrP can beassessed. One significant criterion to compare the performanceof models is their ability to keep detecting PuPs while decreasingthe number of PrPs revealed. Moreover, the false detection ofPuPs should be considered a negative factor since it reduces185DEBS ’23, June 27–30, 2023, Neuchatel, Switzerland Majid Lotfian Delouee, Boris Koldehofe, and Viktoriya Degeler    CEP Middleware   Operators Network          Producers P1 P2 Pp . . .          Consumers C1 C2 Cc . . . DOi Query Privacy Requirements      Controller Public/Private Patterns Pattern Generator Query Optimizer Obfuscation Technique Utility Analyzer OT Deployment OT  Adaptation      Local DO-Specific Global    CEP Middleware   Operators Network C1 C2 P1 P2 DOi Union streams related to each DO    CEP Middleware    C1 C2 P1 P2 DOi    CEP Middleware     C1 C2 Pn P1 . . . Union all  streams   30405060708090100Private 1 Private 2 Private 3 Private 4 Private 5Utility (in %)No Privacy Drop (e1) Drop (e2) Drop (e3) Reorder (e1,e2) Reorder (e1,e3) Reorder (e2,e3)303540455055606570Drop - Pub1 Drop - Pub2 Drop - PubSet Reorder - Pub1 Reorder - Pub2 Reorder - PubSetUtility (in %)Local Global DO-SpecificFigure 1: (left) System Design, (middle) Obfuscation Technique’s Deployment Strategies, (right) The Initial Resultsthe OT model’s detection accuracy. Besides, modeling the adver-saries’ knowledge is another part of the mentioned utility metricthat ensures the obfuscation’s performance against the potentialstatistical knowledge an adversary might gain from the previ-ous queries or other sources. To this end, event dependenciesshould be defined beforehand to be considered in the processof OT model selection. Such dependencies can be presented asCausal dependencies (i.e., the occurrence of event 𝑒2 dependson the event 𝑒1), Periodic events (e.g., event 𝑒1 happens every 2hours), or Infeasible events (e.g., event "at the office" cannot occur5 minutes after event "at home" when the fastest route betweenhome and office is 30 minutes). It is worth noticing that, in somecases, concealing a PrP might cause one or more other PrPs to berevealed or obfuscated. Therefore, a potential solution requiresconsidering the impacts of an OT model on the rest of the PrPs.As a second challenge, where an OT model is deployed bringseven more complications. As illustrated in Figure 1 (middle),the decision metric is whether or not the CEP middleware isassumed to be trustable. In the case of no trust, two strategiescan be deployed to apply OT models. In the first strategy, thesystem union all the input event streams before entering theCEP middleware, the so-called Global strategy. Here, concealinga PrP makes the system more prone to further false detection(i.e., False Positive (FP)) or no detection (i.e., False Negative(FN)) of PuPs. The second strategy, so-called DO-Specific, unionsstreams associated with a specific data owner and then, appliesOT models on the combined stream. Here, any producer mustbe assigned only to one data owner, e.g., a camera that generatesstreams related to multiple targets cannot be involved. On theother hand, in a trustable CEP middleware, each PrP can beobfuscated in the sink node exactly before delivering the resultsto consumers. Such a strategy is called Local deployment, wherethe probability of influencing the detection of other PuPs be-comes lower, leading to higher utility values. Notice that sincethe system chooses various OT models for different queries, anOmnipresent Adversary can realize the pattern obfuscation (e.g.,a dropped event for a query might be delivered in the results ofanother query). However, the first two strategies can overcomesuch a threat since they provide the same stream to consumersrelated to a specific data owner.3 PRELIMINARY EXPERIMENTSOur Main evaluation goals are to figure out 1) makes the choiceof obfuscation technique impacts the utility of event processing,and 2) how does the deployment of the obfuscation operators in-fluence the utility and dealing with the adversary’s knowledge.Simulation Setup: We evaluated our ideas by analyzing a syn-thetic dataset and for event detection, we build on FlinkCEP , alibrary implemented on top of Apache Flink. PrPs in our simu-lation are three-events sequence patterns (i.e., 𝑒1 → 𝑒2 → 𝑒3),and PuP is formed by a sequence of two events. We comparethe OT models using a utility function calculated as a weightedsum of truly detected PuPs (𝑇𝑃𝑝𝑢𝑏 ), false detected PuPs (𝐹𝑃𝑝𝑢𝑏 ),truly obfuscated PrPs (𝑇𝑂𝑝𝑟𝑖𝑣 ), and false revealed PrPs (𝐹𝑅𝑝𝑟𝑖𝑣 ).Note that 𝐹𝑃𝑝𝑢𝑏 and 𝐹𝑅𝑝𝑟𝑖𝑣 have negative impacts on the utilityfunction, and misdetection of PuPs is already counted in 𝑇𝑃𝑝𝑢𝑏 .Moreover, we assume the weights for detected PrPs (i.e., TO andFR) equal the expected matches of PuPs divided by the expectedmatches of PrPs in each window. This way, we made the obfus-cation of each PrP so crucial and dynamic, compared to staticweights in [3] only based on the number of PuPs.Initial results: Figure 1 (right) shows that applying variousmodels of obfuscation techniques on a specific PrP producesunequal utility values. This means selecting the OT model withthe highest value for each PrP to improve obfuscation perfor-mance matters. Besides, this figure indicates no OT model fits allPrPs. Although dropping events performs better for most PrPs,reordering sometimes shows its value. The main vulnerability ofdrop-based OT models is the possibility of misdetection in PuPs(i.e., FNs), whereas reordering-based models tend to wronglydetect extra matches in both types (i.e., 𝐹𝑃𝑝𝑢𝑏 and 𝐹𝑅𝑝𝑟𝑖𝑣 ). Re-garding deployment, Local and DO-Specific strategies performsimilarly, whereas Both defeat the Global strategy. This provesour primary assumption about the tendency of Global strategyto produce more FPs and FNs for PuPs. Notice that despite Lo-cal deployment, the DO-Specific strategy is able to withstandthe Omnipresent threat model, which is in harmony with con-sidering the adversary’s background knowledge. In conclusion,involving more PrPs and PuPs with different levels of dependen-cies will open up more dimensions of this topic. Also, definingparameters to explain the relationship between PrPs and PuPswould lead to autonomous obfuscation technique adaptation,making obfuscation decisions independent of the event streams.REFERENCES[1] M. Lotfian Delouee, B. Koldehofe, and V. Degeler. 2022. Towards AdaptiveQuality-Aware Complex Event Processing in the Internet of Things. In Pro-ceedings of the MSN. IEEE, pp.571–575.[2] M. Lotfian Delouee, B. Koldehofe, and V. Degeler. 2023. AQuA-CEP: Adap-tive Quality-Aware Complex Event Processing in the Internet of Things. InProceedings of the DEBS. ACM press, 12 pages. In Press.[3] S.M. Palanisamy. 2020. Towards Multiple Pattern Type Privacy Protection inComplex Event Processing Through Event Obfuscation Strategies. In Proceed-ings of the ESORICS. pp.178–194.[4] S.M. Palanisamy, F. Dürr, M.A. Tariq, and K. Rothermel. 2018. PreservingPrivacy and Quality of Service in Complex Event Processing through EventReordering. In Proceedings of the DEBS. pp.40–51.[5] C. Stach and F. Steimle. 2019. Recommender-based privacy requirementselicitation-EPICUREAN: an approach to simplify privacy settings in IoT appli-cations with respect to the GDPR. In Proceedings of the SAC. pp.1500–1507.186

Towards Pattern-Level Privacy Protection in Distributed Complex Event Processing

In event processing systems, detected event patterns can reveal privacy-sensitive information. In this paper, we propose and discuss how to integrate pattern-level privacy protection in event-based systems. Compared to state-of-the-art approaches, we aim to enforce privacy independent of the particularities of specific operators. We accomplish this by supporting the flexible integration of multiple obfuscation techniques and studying deployment strategies for privacy-enforcing mechanisms. In addition, we share ideas on how to model the adversary's knowledge to select appropriate obfuscation techniques for the discussed deployment strategies. Initial results indicate that flexibly choosing obfuscation techniques and deployment strategies is essential to conceal privacy-sensitive event patterns accurately.</p

Lotfian Delouee, M.

Koldehofe, B.

Degeler, V.

UvA-DARE

Poster: Towards Pattern-Level Privacy Protection in Distributed Complex Event Processing

   University of GroningenTowards Pattern-Level Privacy Protection in Distributed Complex Event ProcessingLotfian Delouee, Majid; Koldehofe, Boris; Degeler, ViktoriyaPublished in:Proceedings of the 17th ACM International Conference on Distributed and Event-based SystemsDOI:10.1145/3583678.3603278IMPORTANT NOTE: You are advised to consult the publisher's version (publisher's PDF) if you wish to cite fromit. Please check the document version below.Document VersionPublisher's PDF, also known as Version of recordPublication date:2023Link to publication in University of Groningen/UMCG research databaseCitation for published version (APA):Lotfian Delouee, M., Koldehofe, B., & Degeler, V. (2023). Towards Pattern-Level Privacy Protection inDistributed Complex Event Processing. In Proceedings of the 17th ACM International Conference onDistributed and Event-based Systems: DEBS '23 (pp. 185-186). ACM Press.https://doi.org/10.1145/3583678.3603278CopyrightOther than for strictly personal use, it is not permitted to download or to forward/distribute the text or part of it without the consent of theauthor(s) and/or copyright holder(s), unless the work is under an open content license (like Creative Commons).The publication may also be distributed here under the terms of Article 25fa of the Dutch Copyright Act, indicated by the “Taverne” license.More information can be found on the University of Groningen website: https://www.rug.nl/library/open-access/self-archiving-pure/taverne-amendment.Take-down policyIf you believe that this document breaches copyright please contact us providing details, and we will remove access to the work immediatelyand investigate your claim.Downloaded from the University of Groningen/UMCG research database (Pure): http://www.rug.nl/research/portal. For technical reasons thenumber of authors shown on this cover page is limited to 10 maximum.Download date: 01-11-2023Poster: Towards Pattern-Level Privacy Protection inDistributed Complex Event ProcessingMajid Lotfian DeloueeUniversity of GroningenBoris KoldehofeTechnische Universität IlmenauViktoriya DegelerUniversity of AmsterdamABSTRACTIn event processing systems, detected event patterns can re-veal privacy-sensitive information. In this paper, we proposeand discuss how to integrate pattern-level privacy protection inevent-based systems. Compared to state-of-the-art approaches,we aim to enforce privacy independent of the particularities ofspecific operators. We accomplish this by supporting the flexi-ble integration of multiple obfuscation techniques and studyingdeployment strategies for privacy-enforcing mechanisms. Inaddition, we share ideas on how to model the adversary’s knowl-edge to select appropriate obfuscation techniques for the dis-cussed deployment strategies. Initial results indicate that flexiblychoosing obfuscation techniques and deployment strategies isessential to conceal privacy-sensitive event patterns accurately.CCS CONCEPTS• Computer systems organization → Real-time systems.KEYWORDSPrivacy, Complex Event Processing, Pattern.ACM Reference Format:Majid Lotfian Delouee, Boris Koldehofe, and Viktoriya Degeler. 2023.Poster: Towards Pattern-Level Privacy Protection in Distributed Com-plex Event Processing. In The 17th ACM International Conference on Dis-tributed and Event-based Systems (DEBS ’23), June 27–30, 2023, Neuchatel,Switzerland. ACM, New York, NY, USA, 2 pages. https://doi.org/10.1145/3583678.36032781 INTRODUCTIONWhy Pattern-Level Privacy Protection is critical? Distributed Com-plex Event Processing (DCEP) is a state-of-the-art paradigm toprocess streams of simple events (e.g., IoT data) and producevaluable information, so-called complex events, in real time [2].For instance, a road congestion can be inferred by simple events:𝐴𝑣𝑒𝑟𝑎𝑔𝑒_𝑉𝑒ℎ𝑖𝑐𝑙𝑒𝑠_𝑆𝑝𝑒𝑒𝑑 < 20 𝑘𝑚/ℎ and 𝑉𝑒ℎ𝑖𝑐𝑙𝑒𝑠_𝐷𝑒𝑛𝑠𝑖𝑡𝑦 >𝑁𝑜𝑟𝑚𝑎𝑙_𝐷𝑒𝑛𝑠𝑖𝑡𝑦. Although the output of such systems deliversuseful information to various applications[1], detected complexevents might be privacy-sensitive. Besides, most Privacy Pro-tection Mechanisms (PPM) (e.g., access control) provide privacyprotection at the level of single events (i.e., by protecting eventattributes). In contrast, privacy demands often can be repre-sented using a combination of events through event patterns.It means the capabilities of conventional PPMs should be ex-tended from event-level to pattern-level. For example, the bloodpressure and heart rate data can reveal a disease when they areinvolved in an aggregated analysis, while they are not so helpfulseparately. Besides, concealing such a privacy-sensitive eventPermission to make digital or hard copies of part or all of this work for personalor classroom use is granted without fee provided that copies are not made ordistributed for profit or commercial advantage and that copies bear this notice andthe full citation on the first page. Copyrights for third-party components of thiswork must be honored. For all other uses, contact the owner/author(s).DEBS ’23, June 27–30, 2023, Neuchatel, Switzerland© 2023 Copyright held by the owner/author(s).ACM ISBN 979-8-4007-0122-1/23/06. . . $15.00https://doi.org/10.1145/3583678.3603278pattern (i.e., private pattern (PrP) ) can impact the detection ofnon-sensitive event patterns (i.e., public pattern (PuP)). Hence,a pattern-level PPM is required to provide a trade-off betweenprivacy and utility.Existing Solutions and Their Pitfalls. Although the state-of-the-art approaches propose pattern-based access strategies [3, 4],they are limited to dealing only with sequence types of patterns.Besides, they depend highly on the input streams to apply ob-fuscation techniques (OT), thereby failing to obfuscate varioustypes of PrPs for dynamic input event streams. In addition, pre-vious works stated that the CEP middleware is not trustable.This assumption reduces the detection of all matches for PuPssince they merge the input streams before the CEP middleware.However, suppose PrPs are concealed in the sink node withinthe CEP middleware for specific queries. In that case, it willnot negatively impact the results of the other queries. Besides,the potential knowledge an adversary might have needed to bebetter studied and involved in the obfuscation procedure.In this paper, we present a pattern-level PPM to fulfill dataowners’ privacy requirements while considering adversaries’ po-tential background knowledge. The ending goal of this approachis to provide a system that obtains privacy requirements (i.e.,PrPs) and situations of interest (i.e., PuPs) in the form of eventpatterns as input, and decide about obfuscation technique byproviding a trade-off between concealing PrPs when deliveringthe results to the queries. Moreover, we model the adversary’spotential background knowledge based on event dependenciesand possible statistical information gathered from the availableevent streams. While we initially focused on sequence types ofpatterns and limited this paper to the two most common obfus-cation techniques (i.e., drop and reorder), we believe the finalproposed mechanism can eventually cover more pattern typesand obfuscation techniques to decrease the adversary’s abilityto distinguish between the original and modified streams. Inthe following, we first elaborate on our approach, present thepreliminary experiment results, and conclude the paper.2 OUR APPROACHThis paper aims to minimize the impacts of concealing PrPs ondetecting PuPs, even in the presence of knowledgeable adver-saries. In Figure 1 (left), the initial system design of the pattern-level privacy preservation system is exhibited. Here, we do notprovide our own pattern generation for PrPs but build on ex-isting concepts for the flexible transformation of privacy re-quirements to PrPs[5]. However, finding the best obfuscationtechnique which maximizes the utility and at the same time doesnot reveal the concealing of the PrPs to adversaries is non-trivial.The first challenge in this research is the utility metric bywhich the performance of each OTmodel on a specific PrP can beassessed. One significant criterion to compare the performanceof models is their ability to keep detecting PuPs while decreasingthe number of PrPs revealed. Moreover, the false detection ofPuPs should be considered a negative factor since it reduces185DEBS ’23, June 27–30, 2023, Neuchatel, Switzerland Majid Lotfian Delouee, Boris Koldehofe, and Viktoriya Degeler    CEP Middleware   Operators Network          Producers P1 P2 Pp . . .          Consumers C1 C2 Cc . . . DOi Query Privacy Requirements      Controller Public/Private Patterns Pattern Generator Query Optimizer Obfuscation Technique Utility Analyzer OT Deployment OT  Adaptation      Local DO-Specific Global    CEP Middleware   Operators Network C1 C2 P1 P2 DOi Union streams related to each DO    CEP Middleware    C1 C2 P1 P2 DOi    CEP Middleware     C1 C2 Pn P1 . . . Union all  streams   30405060708090100Private 1 Private 2 Private 3 Private 4 Private 5Utility (in %)No Privacy Drop (e1) Drop (e2) Drop (e3) Reorder (e1,e2) Reorder (e1,e3) Reorder (e2,e3)303540455055606570Drop - Pub1 Drop - Pub2 Drop - PubSet Reorder - Pub1 Reorder - Pub2 Reorder - PubSetUtility (in %)Local Global DO-SpecificFigure 1: (left) System Design, (middle) Obfuscation Technique’s Deployment Strategies, (right) The Initial Resultsthe OT model’s detection accuracy. Besides, modeling the adver-saries’ knowledge is another part of the mentioned utility metricthat ensures the obfuscation’s performance against the potentialstatistical knowledge an adversary might gain from the previ-ous queries or other sources. To this end, event dependenciesshould be defined beforehand to be considered in the processof OT model selection. Such dependencies can be presented asCausal dependencies (i.e., the occurrence of event 𝑒2 dependson the event 𝑒1), Periodic events (e.g., event 𝑒1 happens every 2hours), or Infeasible events (e.g., event "at the office" cannot occur5 minutes after event "at home" when the fastest route betweenhome and office is 30 minutes). It is worth noticing that, in somecases, concealing a PrP might cause one or more other PrPs to berevealed or obfuscated. Therefore, a potential solution requiresconsidering the impacts of an OT model on the rest of the PrPs.As a second challenge, where an OT model is deployed bringseven more complications. As illustrated in Figure 1 (middle),the decision metric is whether or not the CEP middleware isassumed to be trustable. In the case of no trust, two strategiescan be deployed to apply OT models. In the first strategy, thesystem union all the input event streams before entering theCEP middleware, the so-called Global strategy. Here, concealinga PrP makes the system more prone to further false detection(i.e., False Positive (FP)) or no detection (i.e., False Negative(FN)) of PuPs. The second strategy, so-called DO-Specific, unionsstreams associated with a specific data owner and then, appliesOT models on the combined stream. Here, any producer mustbe assigned only to one data owner, e.g., a camera that generatesstreams related to multiple targets cannot be involved. On theother hand, in a trustable CEP middleware, each PrP can beobfuscated in the sink node exactly before delivering the resultsto consumers. Such a strategy is called Local deployment, wherethe probability of influencing the detection of other PuPs be-comes lower, leading to higher utility values. Notice that sincethe system chooses various OT models for different queries, anOmnipresent Adversary can realize the pattern obfuscation (e.g.,a dropped event for a query might be delivered in the results ofanother query). However, the first two strategies can overcomesuch a threat since they provide the same stream to consumersrelated to a specific data owner.3 PRELIMINARY EXPERIMENTSOur Main evaluation goals are to figure out 1) makes the choiceof obfuscation technique impacts the utility of event processing,and 2) how does the deployment of the obfuscation operators in-fluence the utility and dealing with the adversary’s knowledge.Simulation Setup: We evaluated our ideas by analyzing a syn-thetic dataset and for event detection, we build on FlinkCEP , alibrary implemented on top of Apache Flink. PrPs in our simu-lation are three-events sequence patterns (i.e., 𝑒1 → 𝑒2 → 𝑒3),and PuP is formed by a sequence of two events. We comparethe OT models using a utility function calculated as a weightedsum of truly detected PuPs (𝑇𝑃𝑝𝑢𝑏 ), false detected PuPs (𝐹𝑃𝑝𝑢𝑏 ),truly obfuscated PrPs (𝑇𝑂𝑝𝑟𝑖𝑣 ), and false revealed PrPs (𝐹𝑅𝑝𝑟𝑖𝑣 ).Note that 𝐹𝑃𝑝𝑢𝑏 and 𝐹𝑅𝑝𝑟𝑖𝑣 have negative impacts on the utilityfunction, and misdetection of PuPs is already counted in 𝑇𝑃𝑝𝑢𝑏 .Moreover, we assume the weights for detected PrPs (i.e., TO andFR) equal the expected matches of PuPs divided by the expectedmatches of PrPs in each window. This way, we made the obfus-cation of each PrP so crucial and dynamic, compared to staticweights in [3] only based on the number of PuPs.Initial results: Figure 1 (right) shows that applying variousmodels of obfuscation techniques on a specific PrP producesunequal utility values. This means selecting the OT model withthe highest value for each PrP to improve obfuscation perfor-mance matters. Besides, this figure indicates no OT model fits allPrPs. Although dropping events performs better for most PrPs,reordering sometimes shows its value. The main vulnerability ofdrop-based OT models is the possibility of misdetection in PuPs(i.e., FNs), whereas reordering-based models tend to wronglydetect extra matches in both types (i.e., 𝐹𝑃𝑝𝑢𝑏 and 𝐹𝑅𝑝𝑟𝑖𝑣 ). Re-garding deployment, Local and DO-Specific strategies performsimilarly, whereas Both defeat the Global strategy. This provesour primary assumption about the tendency of Global strategyto produce more FPs and FNs for PuPs. Notice that despite Lo-cal deployment, the DO-Specific strategy is able to withstandthe Omnipresent threat model, which is in harmony with con-sidering the adversary’s background knowledge. In conclusion,involving more PrPs and PuPs with different levels of dependen-cies will open up more dimensions of this topic. Also, definingparameters to explain the relationship between PrPs and PuPswould lead to autonomous obfuscation technique adaptation,making obfuscation decisions independent of the event streams.REFERENCES[1] M. Lotfian Delouee, B. Koldehofe, and V. Degeler. 2022. Towards AdaptiveQuality-Aware Complex Event Processing in the Internet of Things. In Pro-ceedings of the MSN. IEEE, pp.571–575.[2] M. Lotfian Delouee, B. Koldehofe, and V. Degeler. 2023. AQuA-CEP: Adap-tive Quality-Aware Complex Event Processing in the Internet of Things. InProceedings of the DEBS. ACM press, 12 pages. In Press.[3] S.M. Palanisamy. 2020. Towards Multiple Pattern Type Privacy Protection inComplex Event Processing Through Event Obfuscation Strategies. In Proceed-ings of the ESORICS. pp.178–194.[4] S.M. Palanisamy, F. Dürr, M.A. Tariq, and K. Rothermel. 2018. PreservingPrivacy and Quality of Service in Complex Event Processing through EventReordering. In Proceedings of the DEBS. pp.40–51.[5] C. Stach and F. Steimle. 2019. Recommender-based privacy requirementselicitation-EPICUREAN: an approach to simplify privacy settings in IoT appli-cations with respect to the GDPR. In Proceedings of the SAC. pp.1500–1507.186

International Migration, Integration and Social Cohesion online publications

UvA-DARE is a service provided by the library of the University of Amsterdam (https://dare.uva.nl)UvA-DARE (Digital Academic Repository)Poster: Towards Pattern-Level Privacy Protection in Distributed Complex EventProcessingLotfian Delouee, M.; Koldehofe, B.; Degeler, V.DOI10.1145/3583678.3603278Publication date2023Document VersionFinal published versionPublished inDEBS 2023LicenseArticle 25fa Dutch Copyright Act (https://www.openaccess.nl/en/in-the-netherlands/you-share-we-take-care)Link to publicationCitation for published version (APA):Lotfian Delouee, M., Koldehofe, B., & Degeler, V. (2023). Poster: Towards Pattern-LevelPrivacy Protection in Distributed Complex Event Processing. In DEBS 2023: proceedings ofthe 17th ACM International Conference on Distributed and Event-based Systems : June 27-30, 2023, Neuchâtel, Switzerland (pp. 185-186). Association for Computing Machinery.https://doi.org/10.1145/3583678.3603278General rightsIt is not permitted to download or to forward/distribute the text or part of it without the consent of the author(s)and/or copyright holder(s), other than for strictly personal, individual use, unless the work is under an opencontent license (like Creative Commons).Disclaimer/Complaints regulationsIf you believe that digital publication of certain material infringes any of your rights or (privacy) interests, pleaselet the Library know, stating your reasons. In case of a legitimate complaint, the Library will make the materialinaccessible and/or remove it from the website. Please Ask the Library: https://uba.uva.nl/en/contact, or a letterto: Library of the University of Amsterdam, Secretariat, Singel 425, 1012 WP Amsterdam, The Netherlands. Youwill be contacted as soon as possible.Download date:27 May 2024Poster: Towards Pattern-Level Privacy Protection inDistributed Complex Event ProcessingMajid Lotfian DeloueeUniversity of GroningenBoris KoldehofeTechnische Universität IlmenauViktoriya DegelerUniversity of AmsterdamABSTRACTIn event processing systems, detected event patterns can re-veal privacy-sensitive information. In this paper, we proposeand discuss how to integrate pattern-level privacy protection inevent-based systems. Compared to state-of-the-art approaches,we aim to enforce privacy independent of the particularities ofspecific operators. We accomplish this by supporting the flexi-ble integration of multiple obfuscation techniques and studyingdeployment strategies for privacy-enforcing mechanisms. Inaddition, we share ideas on how to model the adversary’s knowl-edge to select appropriate obfuscation techniques for the dis-cussed deployment strategies. Initial results indicate that flexiblychoosing obfuscation techniques and deployment strategies isessential to conceal privacy-sensitive event patterns accurately.CCS CONCEPTS• Computer systems organization → Real-time systems.KEYWORDSPrivacy, Complex Event Processing, Pattern.ACM Reference Format:Majid Lotfian Delouee, Boris Koldehofe, and Viktoriya Degeler. 2023.Poster: Towards Pattern-Level Privacy Protection in Distributed Com-plex Event Processing. In The 17th ACM International Conference on Dis-tributed and Event-based Systems (DEBS ’23), June 27–30, 2023, Neuchatel,Switzerland. ACM, New York, NY, USA, 2 pages. https://doi.org/10.1145/3583678.36032781 INTRODUCTIONWhy Pattern-Level Privacy Protection is critical? Distributed Com-plex Event Processing (DCEP) is a state-of-the-art paradigm toprocess streams of simple events (e.g., IoT data) and producevaluable information, so-called complex events, in real time [2].For instance, a road congestion can be inferred by simple events:𝐴𝑣𝑒𝑟𝑎𝑔𝑒_𝑉𝑒ℎ𝑖𝑐𝑙𝑒𝑠_𝑆𝑝𝑒𝑒𝑑 < 20 𝑘𝑚/ℎ and 𝑉𝑒ℎ𝑖𝑐𝑙𝑒𝑠_𝐷𝑒𝑛𝑠𝑖𝑡𝑦 >𝑁𝑜𝑟𝑚𝑎𝑙_𝐷𝑒𝑛𝑠𝑖𝑡𝑦. Although the output of such systems deliversuseful information to various applications[1], detected complexevents might be privacy-sensitive. Besides, most Privacy Pro-tection Mechanisms (PPM) (e.g., access control) provide privacyprotection at the level of single events (i.e., by protecting eventattributes). In contrast, privacy demands often can be repre-sented using a combination of events through event patterns.It means the capabilities of conventional PPMs should be ex-tended from event-level to pattern-level. For example, the bloodpressure and heart rate data can reveal a disease when they areinvolved in an aggregated analysis, while they are not so helpfulseparately. Besides, concealing such a privacy-sensitive eventPermission to make digital or hard copies of part or all of this work for personalor classroom use is granted without fee provided that copies are not made ordistributed for profit or commercial advantage and that copies bear this notice andthe full citation on the first page. Copyrights for third-party components of thiswork must be honored. For all other uses, contact the owner/author(s).DEBS ’23, June 27–30, 2023, Neuchatel, Switzerland© 2023 Copyright held by the owner/author(s).ACM ISBN 979-8-4007-0122-1/23/06. . . $15.00https://doi.org/10.1145/3583678.3603278pattern (i.e., private pattern (PrP) ) can impact the detection ofnon-sensitive event patterns (i.e., public pattern (PuP)). Hence,a pattern-level PPM is required to provide a trade-off betweenprivacy and utility.Existing Solutions and Their Pitfalls. Although the state-of-the-art approaches propose pattern-based access strategies [3, 4],they are limited to dealing only with sequence types of patterns.Besides, they depend highly on the input streams to apply ob-fuscation techniques (OT), thereby failing to obfuscate varioustypes of PrPs for dynamic input event streams. In addition, pre-vious works stated that the CEP middleware is not trustable.This assumption reduces the detection of all matches for PuPssince they merge the input streams before the CEP middleware.However, suppose PrPs are concealed in the sink node withinthe CEP middleware for specific queries. In that case, it willnot negatively impact the results of the other queries. Besides,the potential knowledge an adversary might have needed to bebetter studied and involved in the obfuscation procedure.In this paper, we present a pattern-level PPM to fulfill dataowners’ privacy requirements while considering adversaries’ po-tential background knowledge. The ending goal of this approachis to provide a system that obtains privacy requirements (i.e.,PrPs) and situations of interest (i.e., PuPs) in the form of eventpatterns as input, and decide about obfuscation technique byproviding a trade-off between concealing PrPs when deliveringthe results to the queries. Moreover, we model the adversary’spotential background knowledge based on event dependenciesand possible statistical information gathered from the availableevent streams. While we initially focused on sequence types ofpatterns and limited this paper to the two most common obfus-cation techniques (i.e., drop and reorder), we believe the finalproposed mechanism can eventually cover more pattern typesand obfuscation techniques to decrease the adversary’s abilityto distinguish between the original and modified streams. Inthe following, we first elaborate on our approach, present thepreliminary experiment results, and conclude the paper.2 OUR APPROACHThis paper aims to minimize the impacts of concealing PrPs ondetecting PuPs, even in the presence of knowledgeable adver-saries. In Figure 1 (left), the initial system design of the pattern-level privacy preservation system is exhibited. Here, we do notprovide our own pattern generation for PrPs but build on ex-isting concepts for the flexible transformation of privacy re-quirements to PrPs[5]. However, finding the best obfuscationtechnique which maximizes the utility and at the same time doesnot reveal the concealing of the PrPs to adversaries is non-trivial.The first challenge in this research is the utility metric bywhich the performance of each OTmodel on a specific PrP can beassessed. One significant criterion to compare the performanceof models is their ability to keep detecting PuPs while decreasingthe number of PrPs revealed. Moreover, the false detection ofPuPs should be considered a negative factor since it reduces185DEBS ’23, June 27–30, 2023, Neuchatel, Switzerland Majid Lotfian Delouee, Boris Koldehofe, and Viktoriya Degeler    CEP Middleware   Operators Network          Producers P1 P2 Pp . . .          Consumers C1 C2 Cc . . . DOi Query Privacy Requirements      Controller Public/Private Patterns Pattern Generator Query Optimizer Obfuscation Technique Utility Analyzer OT Deployment OT  Adaptation      Local DO-Specific Global    CEP Middleware   Operators Network C1 C2 P1 P2 DOi Union streams related to each DO    CEP Middleware    C1 C2 P1 P2 DOi    CEP Middleware     C1 C2 Pn P1 . . . Union all  streams   30405060708090100Private 1 Private 2 Private 3 Private 4 Private 5Utility (in %)No Privacy Drop (e1) Drop (e2) Drop (e3) Reorder (e1,e2) Reorder (e1,e3) Reorder (e2,e3)303540455055606570Drop - Pub1 Drop - Pub2 Drop - PubSet Reorder - Pub1 Reorder - Pub2 Reorder - PubSetUtility (in %)Local Global DO-SpecificFigure 1: (left) System Design, (middle) Obfuscation Technique’s Deployment Strategies, (right) The Initial Resultsthe OT model’s detection accuracy. Besides, modeling the adver-saries’ knowledge is another part of the mentioned utility metricthat ensures the obfuscation’s performance against the potentialstatistical knowledge an adversary might gain from the previ-ous queries or other sources. To this end, event dependenciesshould be defined beforehand to be considered in the processof OT model selection. Such dependencies can be presented asCausal dependencies (i.e., the occurrence of event 𝑒2 dependson the event 𝑒1), Periodic events (e.g., event 𝑒1 happens every 2hours), or Infeasible events (e.g., event "at the office" cannot occur5 minutes after event "at home" when the fastest route betweenhome and office is 30 minutes). It is worth noticing that, in somecases, concealing a PrP might cause one or more other PrPs to berevealed or obfuscated. Therefore, a potential solution requiresconsidering the impacts of an OT model on the rest of the PrPs.As a second challenge, where an OT model is deployed bringseven more complications. As illustrated in Figure 1 (middle),the decision metric is whether or not the CEP middleware isassumed to be trustable. In the case of no trust, two strategiescan be deployed to apply OT models. In the first strategy, thesystem union all the input event streams before entering theCEP middleware, the so-called Global strategy. Here, concealinga PrP makes the system more prone to further false detection(i.e., False Positive (FP)) or no detection (i.e., False Negative(FN)) of PuPs. The second strategy, so-called DO-Specific, unionsstreams associated with a specific data owner and then, appliesOT models on the combined stream. Here, any producer mustbe assigned only to one data owner, e.g., a camera that generatesstreams related to multiple targets cannot be involved. On theother hand, in a trustable CEP middleware, each PrP can beobfuscated in the sink node exactly before delivering the resultsto consumers. Such a strategy is called Local deployment, wherethe probability of influencing the detection of other PuPs be-comes lower, leading to higher utility values. Notice that sincethe system chooses various OT models for different queries, anOmnipresent Adversary can realize the pattern obfuscation (e.g.,a dropped event for a query might be delivered in the results ofanother query). However, the first two strategies can overcomesuch a threat since they provide the same stream to consumersrelated to a specific data owner.3 PRELIMINARY EXPERIMENTSOur Main evaluation goals are to figure out 1) makes the choiceof obfuscation technique impacts the utility of event processing,and 2) how does the deployment of the obfuscation operators in-fluence the utility and dealing with the adversary’s knowledge.Simulation Setup: We evaluated our ideas by analyzing a syn-thetic dataset and for event detection, we build on FlinkCEP , alibrary implemented on top of Apache Flink. PrPs in our simu-lation are three-events sequence patterns (i.e., 𝑒1 → 𝑒2 → 𝑒3),and PuP is formed by a sequence of two events. We comparethe OT models using a utility function calculated as a weightedsum of truly detected PuPs (𝑇𝑃𝑝𝑢𝑏 ), false detected PuPs (𝐹𝑃𝑝𝑢𝑏 ),truly obfuscated PrPs (𝑇𝑂𝑝𝑟𝑖𝑣 ), and false revealed PrPs (𝐹𝑅𝑝𝑟𝑖𝑣 ).Note that 𝐹𝑃𝑝𝑢𝑏 and 𝐹𝑅𝑝𝑟𝑖𝑣 have negative impacts on the utilityfunction, and misdetection of PuPs is already counted in 𝑇𝑃𝑝𝑢𝑏 .Moreover, we assume the weights for detected PrPs (i.e., TO andFR) equal the expected matches of PuPs divided by the expectedmatches of PrPs in each window. This way, we made the obfus-cation of each PrP so crucial and dynamic, compared to staticweights in [3] only based on the number of PuPs.Initial results: Figure 1 (right) shows that applying variousmodels of obfuscation techniques on a specific PrP producesunequal utility values. This means selecting the OT model withthe highest value for each PrP to improve obfuscation perfor-mance matters. Besides, this figure indicates no OT model fits allPrPs. Although dropping events performs better for most PrPs,reordering sometimes shows its value. The main vulnerability ofdrop-based OT models is the possibility of misdetection in PuPs(i.e., FNs), whereas reordering-based models tend to wronglydetect extra matches in both types (i.e., 𝐹𝑃𝑝𝑢𝑏 and 𝐹𝑅𝑝𝑟𝑖𝑣 ). Re-garding deployment, Local and DO-Specific strategies performsimilarly, whereas Both defeat the Global strategy. This provesour primary assumption about the tendency of Global strategyto produce more FPs and FNs for PuPs. Notice that despite Lo-cal deployment, the DO-Specific strategy is able to withstandthe Omnipresent threat model, which is in harmony with con-sidering the adversary’s background knowledge. In conclusion,involving more PrPs and PuPs with different levels of dependen-cies will open up more dimensions of this topic. Also, definingparameters to explain the relationship between PrPs and PuPswould lead to autonomous obfuscation technique adaptation,making obfuscation decisions independent of the event streams.REFERENCES[1] M. Lotfian Delouee, B. Koldehofe, and V. Degeler. 2022. Towards AdaptiveQuality-Aware Complex Event Processing in the Internet of Things. In Pro-ceedings of the MSN. IEEE, pp.571–575.[2] M. Lotfian Delouee, B. Koldehofe, and V. Degeler. 2023. AQuA-CEP: Adap-tive Quality-Aware Complex Event Processing in the Internet of Things. InProceedings of the DEBS. ACM press, 12 pages. In Press.[3] S.M. Palanisamy. 2020. Towards Multiple Pattern Type Privacy Protection inComplex Event Processing Through Event Obfuscation Strategies. In Proceed-ings of the ESORICS. pp.178–194.[4] S.M. Palanisamy, F. Dürr, M.A. Tariq, and K. Rothermel. 2018. PreservingPrivacy and Quality of Service in Complex Event Processing through EventReordering. In Proceedings of the DEBS. pp.40–51.[5] C. Stach and F. Steimle. 2019. Recommender-based privacy requirementselicitation-EPICUREAN: an approach to simplify privacy settings in IoT appli-cations with respect to the GDPR. In Proceedings of the SAC. pp.1500–1507.186

https://pure.rug.nl/ws/files/774946564/3583678.3603278.pdf

Towards Pattern-Level Privacy Protection in Distributed Complex Event Processing

Abstract

Similar works

Full text

Available Versions

ARTS repository - University of Groningen

UvA-DARE

ARTS repository - University of Groningen

International Migration, Integration and Social Cohesion online publications

International Migration, Integration and Social Cohesion online publications