Access control policies (ACPs) are essential for creating a secure access control system. ACPs are often studied and specified based on access control models, such as attribute-based access control (ABAC). Moreover, the execution of business process instances is typically recorded in a business process event log. Ensuring conformance with ABAC policies for the process log at the time of post-execution is crucial. To perform conformance testing of ABAC policies for event logs, it is necessary to formalize the ABAC policies. However, this formalization is typically carried out manually, leading to low efficiency and maintainability, as well as a high risk of errors and difficulty in detecting them. Also, the top-down approach for ABAC policy engineering is often less feasible due to the challenges and costs associated with manually developing ABAC policies, which makes it difficult to document security requirements. Besides, there is a lack of an ABAC metamodel that supports the formalization and conformance testing of ABAC policies, and little attention is paid to constructing ABAC policies from existing event logs. This paper presents a fine-grained and highly automated model-driven framework enabling the formalization and conformance testing of ABAC policies for business processes. In our approach, an ABAC metamodel and its patterns are proposed to solve the problems mentioned above. The approach is experimented with and evaluated on three business processes: One simulated and two real-world processes.

The shuffle model of DP (Differential Privacy) provides high utility by introducing a shuffler that randomly shuffles noisy data sent from users. However, recent studies show that existing shuffle protocols suffer from the following two major drawbacks. First, they are vulnerable to local data poisoning attacks, which manipulate the statistics about input data by sending crafted data, especially when the privacy budget$\varepsilon$is small. Second, the actual value of$\varepsilon$is increased by collusion attacks by the data collector and users. In this paper, we address these two issues by thoroughly exploring the potential of the augmented shuffle model, which allows the shuffler to perform additional operations, such as random sampling and dummy data addition. Specifically, we propose a generalized framework for local-noise-free protocols in which users send (encrypted) input data to the shuffler without adding noise. We show that this generalized protocol provides DP and is robust to the above two attacks if a simpler mechanism that performs the same process on binary input data provides DP. Based on this framework, we propose three concrete protocols providing DP and robustness against the two attacks. Our first protocol generates the number of dummy values for each item from a binomial distribution and provides higher utility than several state-of-the-art existing shuffle protocols. Our second protocol significantly improves the utility of our first protocol by introducing a novel dummy-count distribution: asymmetric two-sided geometric distribution. Our third protocol is a special case of our second protocol and provides pure ∊-DP. We show the effectiveness of our protocols through theoretical analysis and comprehensive experiments.

Event logs often record the execution of business process instances. Detecting traces in the event logs that do not comply with access control policies, such as role-based access control (RBAC) policies, is essential to ensuring system security. Moreover, process mining has been extensively utilized for security analysis in recent years. However, pattern-based approaches for designing and analyzing RBAC policies in the context of business processes through process mining are notably absent. In this paper, we present a systematic framework for checking the conformance of RBAC implemented in the event logs of business processes with the RBAC policies specified in domain knowledge. To facilitate the representation of the RBAC policies derived from the domain knowledge, we employ an RBAC domain-specific language (DSL) combined with our RBAC-driven object constraint language (OCL) invariant patterns built from the various types of RBAC constraints. The implemented RBAC in an event log is represented as snapshots within our framework. Then, we validate the snapshots with the RBAC policies to be able to detect RBAC conformance issues. The proposed framework is experimented with and evaluated on two business process logs, one simulated log and one real-world event log named “BPI Challenge 2017”.

LDP (Local Differential Privacy) and its variants have been recently studied to analyze personal data collected from IoT (Internet of Things) devices while strongly protecting user privacy. In particular, a recent study proposes a general privacy notion called ID-LDP (Input-Discriminative LDP), which introduces a privacy budget for each input value to deal with different levels of sensitivity. However, it is unclear how to set an appropriate privacy budget for each input value, especially in current situations where re-identification is considered a major risk, e.g., in GDPR. Moreover, the possible number of input values can be very large in IoT. Consequently, it is also extremely difficult to manually check whether a privacy budget for each input value is appropriate. In this paper, we propose algorithms to automatically tune privacy budgets in ID-LDP so that obfuscated data strongly prevent re-identification. We also propose a new instance of ID-LDP called OneID-LDP (One-Budget Input-Discriminative LDP) to prevent re-identification with high utility. Through comprehensive experiments using four real datasets, we show that existing instances of ID-LDP lack either utility or privacy – they overprotect personal data or are vulnerable to re-identification attacks. Then we show that our OneID-LDP mechanisms with our privacy budget tuning algorithm provide much higher utility than LDP mechanisms while strongly preventing re-identification.

Blockchain has become popular in recent times through its data integrity and wide scope of applications. It has laid the foundation for cryptocurrencies such as Ripple, Bitcoin, Ethereum, and so on. Blockchain provides a platform for decentralization and trust in various applications such as finance, commerce, IoT, reputation systems, and healthcare. However, prevailing challenges like scalability, resilience, security and privacy are yet to be overcome. Due to rigorous regulatory constraints such as HIPAA, blockchain applications in the healthcare industry usually require more stringent authentication, interoperability, and record sharing requirements. This article presents an extensive study to showcase the significance of blockchain technology from both application and technical perspectives for healthcare domain. The article discusses the features and use-cases of blockchain in different applications along with the healthcare domain interoperability. The detailed working operation of the blockchain and the consensus algorithms are presented in the context of healthcare. An outline of the blockchain architecture, platforms, and classifications are discussed to choose the right platform for healthcare applications. The current state-of-the-art research in healthcare blockchain and available blockchain based healthcare applications are summarized. Furthermore, the challenges and future research opportunities along with the performance evaluation metrics in realizing the blockchain technology for healthcare are presented to provide insight for future research. We also layout the various security attacks on the blockchain protocol with the classifications of threat models and presented a comparative analysis of the detection and protection techniques. Techniques to enhance the security and privacy of the blockchain network is also discussed.

Privacy-preserving data mining techniques are useful for analyzing various information, such as Internet of Things data and COVID-19-related patient data. However, collecting a large amount of sensitive personal information is a challenging task. In addition, this information may have missing values, which are not considered in the existing methods for collecting personal information while ensuring data privacy. Failure to account for missing values reduces the accuracy of the data analysis. In this paper, we propose a method for privacy-preserving data collection that considers many missing values. The patient data are anonymized and sent to a data collection server. The data collection server creates a generative model and a contingency table suitable for multi-attribute analysis based on expectation-maximization and Gaussian copula methods. Using differential privacy (the de facto standard) as a privacy metric, we conduct experiments on synthetic and real data, including COVID-19-related data. The results are 50--80\% more accurate than those of existing methods that do not consider missing values.

Anti-spam measures include methods for determining unsolicited email from the email content and methods for using sender information. If it can be determined from the sender's IP address of sender information and the sender's domain name whether the email should be received, it is possible to reduce the processing of the spam filter by the email content that has a high processing load for the determination. This study uses sender authentication technology to identify the sender of forwarded email. We consider that the sender of this forwarded email is the legitimate email sender to receive, and propose to use these as an allow list. In this paper, we propose a method to further improve the method we proposed and reduce misjudgment of the allow list. We verified that this new method is effective by using the log information of the emails actually received.

Many Internet-of-Things (IoT) systems use machine learning techniques, such as deep neural networks. IoT systems can predict attributes, such as age, sex, car speed, human walking speed, and types of animals, using machine learning techniques. Although the functionality of machine learning is undeniable, the prediction accuracy is not always high. When a machine learning model is used to recognize several objects in an object counting system, the estimated count will have a significant error because of the accumulation of the recognition error of each object. In this study, a count estimation method that uses a confusion matrix generated in the training phase was proposed. The proposed method consists of an iterative Bayesian technique with the confusion matrix for count estimation and mitigating over-iterations technique for reducing estimated errors. The proposed method can be used even for a low-accuracy machine learning model. Experiments with synthetic and real data sets were conducted to demonstrate the functionality of the proposed method. The estimation errors of the proposed method were reduced by 64.3% in average compared to the baseline method in the experiments.

In recent years, just about all subjects require students to learn panoramic information. Because the need exists for cross-curriculum learning aimed at relating subject areas, it is useful for multiple-choice questions to include panoramic information for learners. A question including panoramic information refers to content that includes transverse related information and makes respondents grasp the whole knowledge. However, it is costly to manually generate and collect appropriate multiple-choice questions for questioners and learners. Therefore, in this research, we propose a method for the automatic generation of multiple-choice questions including panoramic information using Linked Data. Linked Data is graphical data that can link structured data, and it is used as a technology for data integration and utilization. Some attempts have been made to use Linked Data as a resource for creating teaching material, and the possibility of using Semantic Web technology in education has been verified. In this paper, we aim to realize a system for automatically generating two types of multiple-choice questions by implementing an approach to generating questions and choices. An evaluation method for the generation of questions and choices involves setting indicators for each evaluation item, such as validity and the degree of the inclusion of panoramic information.

Contemporary societies face many urban issues. To address these issues, governments, corporations and individuals should disclose and share their related statistical and sensory data. However, existing published data appear in various formats and contain defects. Therefore, few problems have been solved using these data. In this research, we sought to address this problem, by considering a university campus as a microcosm of society, designed data integration schema, and consolidated data into a knowledge graph. We then, applied and modified existing completion methods. In particular, regarding the bicycle environment, we trained our knowledge graph and evaluated it with the conventional method and our proposed derivative method, respectively. Using approximately 650 parking data with various dates and times, our method correctly estimated 54.5 more bicycles than the conventional method by comparing each time's mean absolute error.

A number of studies on privacy-preserving data mining have been proposed. Most of them assume that they can separate quasi-identifiers (QIDs) from sensitive attributes. For instance, they assume that address, job, and age are QIDs but are not sensitive attributes and that a disease name is a sensitive attribute but is not a QID. However, all of these attributes can have features that are both sensitive attributes and QIDs in practice. In this paper, we refer to these attributes as sensitive QIDs and we propose novel privacy models, namely, (l1, ..., lq)-diversity and (t1, ..., tq)-closeness, and a method that can treat sensitive QIDs. Our method is composed of two algorithms: An anonymization algorithm and a reconstruction algorithm. The anonymization algorithm, which is conducted by data holders, is simple but effective, whereas the reconstruction algorithm, which is conducted by data analyzers, can be conducted according to each data analyzer's objective. Our proposed method was experimentally evaluated using real data sets.

Mobile crowdsensing, which collects environmental information from mobile phone users, is growing in popularity. These data can be used by companies for marketing surveys or decision making. However, collecting sensing data from other users may violate their privacy. Moreover, the data aggregator and/or the participants of crowdsensing may be untrusted entities. Recent studies have proposed randomized response schemes for anonymized data collection. This kind of data collection can analyze the sensing data of users statistically without precise information about other users' sensing results. However, traditional randomized response schemes and their extensions require a large number of samples to achieve proper estimation. In this paper, we propose a new anonymized data-collection scheme that can estimate data distributions more accurately. Using simulations with synthetic and real datasets, we prove that our proposed method can reduce the mean squared error and the JS divergence by more than 85% as compared with other existing studies.

Mobile devices that can sense their location using GPS or Wi-Fi have become extremely popular. However, many users hesitate to provide their accurate location information to unreliable third parties if it means that their identities or sensitive attribute values will be disclosed by doing so. Many approaches for anonymization, such as k-anonymity, have been proposed to tackle this issue. Existing studies for k-anonymity usually anonymize each user's location so that the anonymized area contains k or more users. Existing studies, however, do not consider location errors and the probability that each user actually exists at the anonymized area. As a result, a specific user might be identified by untrusted third parties. We propose novel privacy and utility metrics that can treat the location and an efficient algorithm to anonymize the information associated with users' locations. This is the first work that anonymizes location while considering location errors and the probability that each user is actually present at the anonymized area. By means of simulations, we have proven that our proposed method can reduce the risk of the user's attributes being identified while maintaining the utility of the anonymized data.

Participatory sensing, which collects environmental information from mobile phone users, is growing in popularity. The collected information can be used for national policy or decision-making for companies. However, sensing users may violate their privacy. Recent studies have proposed negative surveys which can analyze the attributes of users statistically without precise information about each user's information. The traditional negative surveys need a lot of samples for proper estimation. These days, several types of negative surveys are used that can estimate the distribution of user attributes with a high degree of accuracy. However, privacy levels of these methods are relatively low. Moreover, existing studies assume that the privacy levels of all users are the same. In this paper, we propose a new negative survey that can estimate data distributions with more precision and can be used in a situation where the privacy levels are different based on each user's demand. By simulations of a synthetic and a real data set, we prove that our proposed method can estimate more precisely than existing methods.

Many surprising recipes which have different the ingredients or the cooking processes from the normal recipes exist in the user-generated recipe sites. The easiest way to find surprising recipes is to use the search function of the recipe sites. However, the title of surprising recipes do not always include the keyword “surprise”. Therefore, we cannot find surprising recipes in an easy way. In this paper, we propose a method to extract surprising recipes from the user-generated recipe sites. We propose RF-IIF (Recipe Frequency-Inverse Ingredient Frequency) based on TF-IDF (Term Frequency-Inverse Ingredient Frequency). First, we calculate the surprising value of the ingredients by using RF-IIF. Then, we calculate the surprising value of each recipe by summing the surprising value of the ingredients appearing in a recipe. Finally, we extract recipes which have high surprising value of the recipe as surprising recipes of the dish category. In the evaluation experiment, the subjects were requested an evaluation about each surprising recipe. As a results, we showed that the extracted recipes were valid recipe and had the element of surprise. And, we showed the usefulness of the our proposed method.

Nowadays, anybody can easily express their opinion publicly through Consumer Generated Media. Because of this, a phenomenon of flooding criticism on the Internet, called flaming, frequently occurs. Although there are strong demands for flaming management, namely, a service to reduce damage caused by a flaming after one occurs, it is very difficult to properly do so in practice. We are trying to keep the flaming from happening. Concretely, we propose methods to identify a potential tweet which will be a likely candidate of a flaming on Twitter, considering public opinion among twitter users. We divide flamings into three categories: criminal episodes, struggles between conflicting values and secret exposures. The first two represent the vast majority of flaming cases. As for the CEs, a Naive Bayes-based method has been promising to identify the cases. As for the SBCVs, we propose a dynamic P/N analysis based on daily polarity, which represents the strength of the polarity of public opinion on a given topic. An experiment using a past flaming case has shown that the method has successfully explained the case as one caused by a gap between the polarity of the tweet and that of public opinion.

When a data holder wants to share databases that contain personal attributes, individual privacy needs to be considered. Existing anonymization techniques, such as l-diversity, remove identifiers and generalize quasi-identifiers (QIDs) from the database to ensure that adversaries cannot specify each individual's sensitive attributes. Usually, the database is anonymized based on one-size-fits-all measures. Therefore, it is possible that several QIDs that a data user focuses on are all generalized, and the anonymized database has no value for the user. Moreover, if a database does not satisfy the eligibility requirement, we cannot anonymize it by existing methods. In this paper, we propose a new technique for l-diversity, which keeps QIDs unchanged and randomizes sensitive attributes of each individual so that data users can analyze it based on QIDs they focus on and does not require the eligibility requirement. Through mathematical analysis and simulations, we will prove that our proposed method for l-diversity can result in a better tradeoff between privacy and utility of the anonymized database.

There is a need for the development of systems that are compliant with laws in public administration, because their administrative activities are based on laws. When new laws are made or existing laws are amended, however, civil servants need to develop or modify the systems in the short time before the laws are issued. Related work in requirements elicitation from the legal texts includes approaches using ontology but there are difficulties in building an ontology for practical use. In this paper we propose pre-defined templates with the expression of functional requirements to identify legal texts, including their functional requirements, and a support tool consisting of two functions, one for automatic summary creation from complicated legal texts and one for the suggestion of the legal texts, including their functional requirements. We have also applied this approach to Japanese laws and have evaluated its accuracy. Our research revealed that using this approach can identify functional requirements with high accuracy.

Distributed hash tables (DHT) are used for data management in P2P environments. However, since most hash functions ignore relations between items, DHTs are not efficient for operations on related items. In this paper, we modify a DHT into a distributed array (DA) that enables efficient operations on logical arrays. The array elements of a DA are placed in a P2P overlay network according to a simple rule such that the load is balanced and the number of messages required to access elements sequentially is reduced. The number of messages required for array operations is much smaller than that for operations on DHTs. We demonstrate this theoretically and experimentally.

Distributed hash tables (DHTs) are a class of decentralized distributed systems that can efficiently search for objects desired by the user. However, a lot of communication traffic comes from multi-word searches. A lot of work has been done to reduce this traffic by using bloom filters, which are space-efficient probabilistic data structures. There are two kinds of bloom filters: fixed-size and variable-size bloom filters. We cannot use variable- size bloom filters because doing so would mean wasting time to calculating hash values. On the other hand, when using fixed- size bloom filters, all the nodes in a DHT are unable to adjust their false positive rate parameters. Therefore, the reduction of traffic is limited because the best false positive rate differs from one node to another. Moreover, in related works, the authors took only two-word searches into consideration. In this paper, we present a method for determining the best false positive rate for three- or more word searches. We also used a new filter called a ringed filter, in which each node can set the approximately best false positive rate. Experiments showed that the ringed filter was able to greatly reduce the traffic.