Making quantitative measurements of privacy/analysis tradeoffs inherent to packet trace anonymization

Abstract

Anonymization provides a mechanism for sharing data while obscuring private/sensitive values within the shared data. However, anonymization for sharing also sets up a fundamental tradeoff - the stronger the anonymization protection, the less information remains for analysis. This privacy/analysis tradeoff has been descriptively acknowledged by many researchers but no one has yet attempted to quantify this tradeoff. We perform anonymization options on network packet traces and make empirical measurements using IDS alarms as an indicator for security analysis capability. Preliminary results show most packet fields have unexpected complex tradeoffs while only two fields exhibiting the classic zero sum tradeoff. © 2008 Springer-Verlag Berlin Heidelberg.