# US 2021/0334261 A1 · Adaptive statistical data de-identification based on evolving data streams > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2021/0334261 A1 - Document ID: US20210334261A1 - Status: Published application - Kind: A1 - Application number: 17/370,277 - Filed: 2021-07-08 - Published: 2021-10-28 - Earliest claimed: 2017-12-20 - Assignees: International Business Machines Corporation - Applicants: International Business Machines Corporation - Inventors: ARIS GKOULALAS-DIVANIS - Web page: https://patentgrep.com/patent/US20210334261A1 ## CPC - G06F 16/23: Updating - G06F 11/3476: {Data logging (G06F11/14, G06F11/2205 take precedence)} - G06F 17/18: for evaluating statistical data {, e.g. average values, frequency distributions, probability functions, regression analysis (forecasting specially adapted for a specific administrative, business or logistic context G06Q10/04)} - G06F 21/6254: {by anonymising data, e.g. decorrelating personal data from the owner's identification} - G06N 3/08: Learning methods - G06N 5/025: Extracting rules from data - G06N 20/00: Machine learning - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract A system dynamically changes a data de-identification ruleset applied to a dataset for de-identifying data and comprises at least one processor. The system periodically monitors a dataset derived from data that is de-identified according to a data de-identification ruleset under a set of conditions. The set of conditions for the data de-identification ruleset is evaluated with respect to the monitored data to determine applicability of the data de-identification. One or more rules of the data de-identification ruleset are dynamically changed in response to the evaluation indicating one or more conditions of the set of conditions for the data de-identification ruleset are no longer satisfied. Embodiments of the present invention may further include a method and computer program product for dynamically changing a data de-identification ruleset applied to a dataset for de-identifying data in substantially the same manner described above. ## Claims ### Claim 1 A method of dynamically changing a data de-identification ruleset applied to a dataset for de-identifying data to transform values of the dataset to protect sensitive information comprising: periodically monitoring a dataset including a plurality of attributes via a processor, wherein the dataset changes over time and is derived from data that is de-identified according to a data de-identification ruleset under a set of conditions, and wherein the data de-identification ruleset indicates one or more manners of de-identifying data to suppress a first amount of information within each of one or more corresponding attributes of the dataset; evaluating, via the processor, the set of conditions for the data de-identification ruleset with respect to the monitored dataset and determining that one or more conditions of the set of conditions for the data de-identification ruleset are no longer satisfied by the monitored dataset; and dynamically changing, via the processor, one or more rules of the data de-identification ruleset to apply at least one different manner of de-identifying data to at least one corresponding attribute of the dataset to suppress a second amount of information within each of the at least one corresponding attribute greater than the first amount of information and provide de-identified data satisfying each condition of the set of conditions. ### Claim 2 (depends on 1) The method of claim 1, wherein evaluating the set of conditions comprises one or more from a group of: performing triangulation attacks of the monitored dataset against one or more external datasets to indicate a probability of successful re-identification; retrieving statistics from publicly available and other external datasets to derive population density and population uniqueness criteria; evaluating correlations between attributes of the monitored dataset based on the monitored dataset or knowledge from external datasets that indicate indirect re-identification; and determining changes to data distribution that affect the data de-identification ruleset. ### Claim 3 (depends on 1) The method of claim 1, further comprising: generating a first notification of the change to the one or more rules of the data de-identification ruleset to notify a data owner, and a second notification of transit to another data de-identification ruleset whose conditions are currently satisfied. ### Claim 4 (depends on 1) The method of claim 1, wherein dynamically changing one or more rules of the data de-identification ruleset further comprises: replacing the data de-identification ruleset with a new data de-identification ruleset selected from among a group of data de-identification rulesets based on the evaluation, wherein conditions of the new data de-identification ruleset are satisfied. ### Claim 5 (depends on 4) The method of claim 4, wherein replacing the data de-identification ruleset further comprises: replacing the data de-identification ruleset with the new data de-identification ruleset in response to a change in a threshold of a data de-identification rule in the data de-identification ruleset. ### Claim 6 (depends on 4) The method of claim 4, further comprising: preventing release of the monitored dataset in response to the evaluation indicating one or more conditions for each data de-identification ruleset of the group are not satisfied. ### Claim 7 (depends on 1) The method of claim 1, wherein dynamically changing one or more rules of the data de-identification ruleset further comprises: changing one or more conditions of the data de-identification ruleset to enable each of the conditions to be satisfied. ### Claim 8 (depends on 1) The method of claim 1, wherein dynamically changing one or more rules of the data de-identification ruleset further comprises: dynamically changing one or more rules of the data de-identification ruleset based on machine learning. ### Claim 9 A system for dynamically changing a data de-identification ruleset applied to a dataset for de-identifying data to transform values of the dataset to protect sensitive information comprising: at least one processor configured to: periodically monitor a dataset including a plurality of attributes, wherein the dataset changes over time and is derived from data that is de-identified according to a data de-identification ruleset under a set of conditions, and wherein the data de-identification ruleset indicates one or more manners of de-identifying data to suppress a first amount of information within each of one or more corresponding attributes of the dataset; evaluate the set of conditions for the data de-identification ruleset with respect to the monitored dataset and determine that one or more conditions of the set of conditions for the data de-identification ruleset are no longer satisfied by the monitored dataset; and dynamically change one or more rules of the data de-identification ruleset to apply at least one different manner of de-identifying data to at least one corresponding attribute of the dataset to suppress a second amount of information within each of the at least one corresponding attribute greater than the first amount of information and provide de-identified data satisfying each condition of the set of conditions. ### Claim 10 (depends on 9) The system of claim 9, wherein evaluating the set of conditions comprises one or more from a group of: performing triangulation attacks of the monitored dataset against one or more external datasets to indicate a probability of re-identification; retrieving statistics from publicly available datasets to derive population density and population uniqueness criteria; evaluating correlations between attributes of the monitored dataset based on the monitored dataset or knowledge from external datasets that indicate indirect re-identification; and determining changes to data distribution that affect the data de-identification ruleset. ### Claim 11 (depends on 9) The system of claim 9, wherein the at least one processor is further configured to: generate a first notification of the change to the one or more rules of the data de-identification ruleset to notify a data owner, and a second notification of transit to another data de-identification ruleset whose conditions are currently satisfied. ### Claim 12 (depends on 9) The system of claim 9, wherein dynamically changing one or more rules of the data de-identification ruleset further comprises: replacing the data de-identification ruleset with a new data de-identification ruleset selected from among a group of data de-identification rulesets based on the evaluation, wherein conditions of the new data de-identification ruleset are satisfied. ### Claim 13 (depends on 12) The system of claim 12, wherein replacing the data de-identification ruleset further comprises: replacing the data de-identification ruleset with the new data de-identification ruleset in response to a change in a threshold of a data de-identification rule in the data de-identification ruleset. ### Claim 14 (depends on 12) The system of claim 12, wherein the at least one processor is further configured to: prevent release of the monitored dataset in response to the evaluation indicating one or more conditions for each data de-identification ruleset of the group are not satisfied. ### Claim 15 (depends on 9) The system of claim 9, wherein dynamically changing one or more rules of the data de-identification ruleset further comprises: changing one or more conditions of the data de-identification ruleset to enable each of the conditions to be satisfied. ### Claim 16 (depends on 9) The system of claim 9, wherein dynamically changing one or more rules of the data de-identification ruleset further comprises: dynamically changing one or more rules of the data de-identification ruleset based on machine learning. ### Claim 17 A computer program product for dynamically changing a data de-identification ruleset applied to a dataset for de-identifying data to transform values of the dataset to protect sensitive information, the computer program product comprising one or more computer readable storage media collectively having computer readable program code embodied therewith, the computer readable program code executable by at least one processor to cause the at least one processor to: periodically monitor a dataset including a plurality of attributes, wherein the dataset changes over time and is derived from data that is de-identified according to a data de-identification ruleset under a set of conditions, and wherein the data de-identification ruleset indicates one or more manners of de-identifying data to suppress a first amount of information within each of one or more corresponding attributes of the dataset; evaluate the set of conditions for the data de-identification ruleset with respect to the monitored dataset and determine that one or more conditions of the set of conditions for the data de-identification ruleset are no longer satisfied by the monitored dataset; and dynamically change one or more rules of the data de-identification ruleset to apply at least one different manner of de-identifying data to at least one corresponding attribute of the dataset to suppress a second amount of information within each of the at least one corresponding attribute greater than the first amount of information and provide de-identified data satisfying each condition of the set of conditions. ### Claim 18 (depends on 17) The computer program product of claim 17, wherein evaluating the set of conditions comprises one or more from a group of: performing triangulation attacks of the monitored dataset against one or more external datasets to indicate a probability of re-identification; retrieving statistics from publicly available datasets to derive population density and population uniqueness criteria; evaluating correlations between attributes of the monitored dataset based on the monitored dataset or knowledge from external datasets that indicate indirect re-identification; and determining changes to data distribution that affect the data de-identification ruleset. ### Claim 19 (depends on 17) The computer program product of claim 17, wherein the computer readable program code is further configured to cause the at least one processor to: generate a first notification of the change to the one or more rules of the data de-identification ruleset to notify a data owner, and a second notification of transit to another data de-identification ruleset whose conditions are currently satisfied. ### Claim 20 (depends on 17) The computer program product of claim 17, wherein dynamically changing one or more rules of the data de-identification ruleset further comprises: replacing the data de-identification ruleset with a new data de-identification ruleset selected from among a group of data de-identification rulesets based on the evaluation, wherein conditions of the new data de-identification ruleset are satisfied. ### Claim 21 (depends on 20) The computer program product of claim 20, wherein replacing the data de-identification ruleset further comprises: replacing the data de-identification ruleset with the new data de-identification ruleset in response to a change in a threshold of a data de-identification rule in the data de-identification ruleset. ### Claim 22 (depends on 20) The computer program product of claim 20, wherein the computer readable program code is further configured to cause the at least one processor to: prevent release of the monitored dataset in response to the evaluation indicating one or more conditions for each data de-identification ruleset of the group are not satisfied. ### Claim 23 (depends on 17) The computer program product of claim 17, wherein dynamically changing one or more rules of the data de-identification ruleset further comprises: changing one or more conditions of the data de-identification ruleset to enable each of the conditions to be satisfied. ### Claim 24 (depends on 17) The computer program product of claim 17, wherein dynamically changing one or more rules of the data de-identification ruleset further comprises: dynamically changing one or more rules of the data de-identification ruleset based on machine learning.