Several "data-for-good" projects [1, 5, 12] initiated by major companies (e.g., Meta, Google) release to the public spatio-temporal datasets to benefit COVID-19 spread modeling [17, 47, 64] and understand human mobility [14, 24]. Most often, spatio-temporal data are provided in the form of snapshot high resolution population density information, where the released statistics capture population counts in small areas for short time periods. Since high resolution is required for utility (e.g., in modeling COVID hotspots) privacy risks are elevated. To prevent malicious actors from using the data to infer sensitive details about individuals, the released datasets must be first sanitized. Typically, [1, 5, 7, 12], differential privacy (DP) is employed as protection model, due to its formal protection guarantees that prevent an adversary to learn whether a particular individual's data has been included in the release or not.

Accurately monitoring the number of individuals inside a building is vital to limiting COVID-19 transmission. Low adoption of contact tracing apps due to privacy concerns has increased pervasiveness of passive digital tracking alternatives. Large arrays of WiFi access points can conveniently track mobile devices on university and industry campuses. The CrowdMap system employed by the University of Southern California enables such tracking by collecting aggregate statistics from connections to access points around campus. However, since these devices can be used to infer the movement of individuals, there is still a significant risk that even aggregate occupancy statistics will violate the location privacy of individuals. We examine the use of Differential Privacy in reporting statistics from this system as measured using point and range count queries. We propose discretization schemes to model the positions of users given only user connections to WiFi access points. Using this information we are able to release accurate counts of occupants in areas of campus buildings such as labs, hallways, and large discussion halls with minimized risk to individual users' privacy.

Mobile apps and location-based services generate large amounts of location data. Location density information from such datasets benefits research on traffic optimization, context-aware notifications and public health (e.g., disease spread). To preserve individual privacy, one must sanitize location data, which is commonly done using differential privacy (DP). Existing methods partition the data domain into bins, add noise to each bin and publish a noisy histogram of the data. However, such simplistic modelling choices fall short of accurately capturing the useful density information in spatial datasets and yield poor accuracy. We propose a machine-learning based approach for answering range count queries on location data with DP guarantees. We focus on countering the sources of error that plague existing approaches (i.e., noise and uniformity error) through learning, and we design a neural database system that models spatial data such that density features are preserved, even when DP-compliant noise is added. We also devise a framework for effective system parameter tuning on top of public data, which helps set important system parameters without expending scarce privacy budget. Extensive experimental results on real datasets with heterogeneous characteristics show that our proposed approach significantly outperforms the state of the art.

CrowdMap is an anonymous occupancy monitoring system developed in response to the COVID-19 pandemic. CrowdMap collects, cleans, and visualizes occupancy data derived from connection logs generated by large arrays of Wi-Fi access points. Thus, CrowdMap is a passive digital tracking tool that can be used to reopen buildings safely, as it helps actively manage occupancy limits and identify utilization trends at scale. Occupancy monitoring is possible at various levels of resolution over large spatial (e.g., from individual rooms to entire buildings) and temporal (e.g., from hours to months) extents. The CrowdMap web-based front-end implements powerful spatiotemporal querying and visualization tools to quickly and effectively explore occupancy patterns throughout large campuses. We will demonstrate CrowdMap and its spatiotemporal GUI that was deployed for an entire university campus with data continuously being collected since summer 2020.

Mobile apps that use location data are pervasive, spanning domains such as transportation, urban planning and healthcare. Important use cases for location data rely on statistical queries, e.g., identifying hotspots where users work and travel. Such queries can be answered efficiently by building histograms. However, precise histograms can expose sensitive details about individual users. Differential privacy (DP) is a mature and widely-adopted protection model, but most approaches for DP-compliant histograms work in a data-independent fashion, leading to poor accuracy. The few proposed data-dependent techniques attempt to adjust histogram partitions based on dataset characteristics, but they do not perform well due to the addition of noise required to achieve DP. We identify density homogeneity as a main factor driving the accuracy of DP-compliant histograms, and we build a data structure that splits the space such that data density is homogeneous within each resulting partition. We show through extensive experiments on large-scale real-world data that the proposed approach achieves superior accuracy compared to existing approaches.

Contact tracing is an essential public health tool for controlling epidemic disease outbreaks such as the COVID-19 pandemic. Digital contact tracing using real-time locations or proximity of individuals can be used to significantly speed up and scale up contact tracing. In this demonstration, we present our system, REACT, for REAl-time Contact Tracing and risk monitoring via privacy-enhanced tracking of users' locations. With privacy enhancement that allows users to control and refine the precision with which their information will be collected and used, REACT will enable: 1) contact tracing of individuals who are exposed to infected cases and identification of hot-spot locations, 2) individual risk monitoring based on the locations they visit and their contact with others. In this paper, we demonstrate the procedure of contact tracing using our application and the utility of contact tracing given the protected locations.

Identifying mobility behaviors in rich trajectory data is of great economic and social interest to various applications including urban planning, marketing and intelligence. Existing work on trajectory clustering often relies on similarity measurements that utilize raw spatial and/or temporal information of trajectories. These measures are incapable of identifying similar moving behaviors that exhibit varying spatiotemporal scales of movement. In addition, the expense of labeling massive trajectory data is a barrier to supervised learning models. To address these challenges, we propose an unsupervised neural approach for mobility behavior clustering, called the Deep Embedded TrajEctory ClusTering network (DETECT). DETECT operates in three parts: first it transforms the trajectories by summarizing their critical parts and augmenting them with context derived from their geographical locality (e.g., using POIs from gazetteers). In the second part, it learns a powerful representation of trajectories in the latent space of behaviors, thus enabling a clustering function (such as k-means) to be applied. Finally, a clustering oriented loss is directly built on the embedded features to jointly perform feature refinement and cluster assignment, thus improving separability between mobility behaviors. Exhaustive quantitative and qualitative experiments on two real-world datasets demonstrate the effectiveness of our approach for mobility behavior analyses.

The proliferation of location-centric applications results in massive amounts of individual location data that can benefit domains such as transportation, urban planning, etc. However, sensitive personal data can be derived from location datasets. In particular, co-location of users can disclose one's social connections, intimate partners, business associates, etc. We derive a powerful inference attack that makes extensive use of background knowledge in order to expose an individual's co-locations. We also show that existing techniques for location protection, which do not focus specifically on co-locations, distort data excessively, resulting in sanitized datasets with poor utility. We propose three privacy mechanisms that are customized for co-locations, and provide various trade-offs in terms of user privacy and data utility. Our extensive experimental evaluation on a real geo-social network dataset shows that the proposed approaches achieve good data utility and do a good job of protecting against discovery of co-locations, even when confronted with a powerful adversary.

We design a scheduler for an M/spl times/N input-queued multicast switch. It is assumed that: 1) each input maintains a single queue for arriving multicast cells and 2) only the cell at the head of line (HOL) can be observed and scheduled at one time. The scheduler needs to be: 1) work-conserving (no output port may be idle as long as there is an input cell destined to it) and 2) fair (which means that no input cell may be held at HOL for more than a fixed number of cell times). The aim is to find a work-conserving, fair policy that delivers maximum throughput and minimizes input queue latency, and yet is simple to implement. When a scheduling policy decides which cells to schedule, contention may require that it leave a residue of cells to be scheduled in the next cell time. The selection of where to place the residue uniquely defines the scheduling policy. Subject to a fairness constraint, we argue that a policy which always concentrates the residue on as few inputs as possible generally outperforms all other policies. We find that there is a tradeoff among concentration of residue (for high throughput), strictness of fairness (to prevent starvation), and implementational simplicity (for the design of high-speed switches). By mapping the general multicast switching problem onto a variation of the popular block-packing game Tetris, we are able to analyze various scheduling policies which possess these attributes in different proportions. We present a novel scheduling policy, called TATRA, which performs extremely well and is strict in fairness. We also present a simple weight-based algorithm, called WBA.

We describe the design, implementation, and performance tuning of a transport layer targeted specifically for ATM networks. The layer has been built from scratch to minimize overhead in the critical path and take advantage of ATM adaptation layer 5 functionality. It provides reliable or unreliable data delivery with feedback or leaky-bucket flow control. These services can be combined to create a customized transport service. Our work is novel in that it is the first end-to-end ATM transport service to provide reliable, flow controlled data transfer. We describe the mechanisms and the operating system support needed to provide these services. A detailed performance measurement allows us to determine the bottlenecks in our system and do tune our implementation. With this tuning, we are able to achieve a user-to-user throughput of 55 Mbps between two 66 MHz Intel 80486 personal computers with Fore Systems' HPA-200 EISA-bus host adaptors. The user-to-user latency for small messages is around 720 /spl mu/s. These figures compare favorably with the performance from far more expensive workstations and validate the correctness of our design choices.

We describe the design, implementation, and performance measurement of a transport layer targeted specifically for asynchronous transfer mode (ATM) networks. The layer has been built from scratch to minimize overhead in the critical path, provide per-virtual circuit quality of service (QoS) guarantees, and take advantage of ATM adaptation layer 5 functionality. It provides reliable and unreliable data delivery with a choice of feedback and leaky-bucket flow control. These services can be combined to create per-virtual-circuit customized transport services. Our work is novel in that it provides high-performance, reliable, flow-controlled transport service using cheap personal computers (PCs). We describe the mechanisms and the operating system support needed to provide these services in detail. An extensive performance measurement allows us to pinpoint and eliminate inefficiencies in our implementation. With this tuning, we are able to achieve a user-to-user throughput of 55 Mb/s between two 66 MHz Intel 80486 personal computers with FORE Systems' HPA-200 EISA-bus host adaptors. The user-to-user latency for small messages is around 720 /spl mu/s. These figures compare favorably with the performance of far more expensive workstations and validate the correctness of our design choices.