Privacy Risk in Anonymized Heterogeneous Information Networks

Anonymized user datasets are often released for research or indus-try applications. As an example, t.qq.com released its anonymized users ’ profile, social interaction, and recommendation log data in KDD Cup 2012 to call for recommendation algorithms. Since the entities (users and so on) and edges (links among entities) are of multiple types, the released social network is a heterogeneous in-formation network. Prior work has shown how privacy can be com-promised in homogeneous information networks by the use of spe-cific types of graph patterns. We show how the extra information derived from heterogeneity can be used to relax these assumptions. To characterize and demonstrate this added threat, we formally de-fine privacy risk in an anonymized heterogeneous information net-work to identify the vulnerability in the possible way such data are released, and further present a new de-anonymization attack that exploits the vulnerability. Our attack successfully de-anonymized most individuals involved in the data—for an anonymized 1,000-user t.qq.com network of density 0.01, the attack precision is over 90 % with a 2.3-million-user auxiliary network