Publishing Search Logs – A Comparative Study of Privacy Guarantees(2012)

Note: Please Scroll Down to See the Download Link.


    Search engine companies collect the “database of intentions”, the histories of their users’ search queries. These search logs are a gold mine for researchers. Search engine companies, however, are wary of publishing search logs in order not to disclose sensitive information.

In this paper we analyze algorithms for publishing frequent keywords, queries and clicks of a search log. We first show how methods

that achieve variants of k-anonymity are vulnerable to active attacks. We then demonstrate that the stronger guarantee ensured by -differential privacy unfortunately does not provide any utility for this problem. We then propose a novel algorithm ZEALOUS and show how to set its parameters to achieve (_, δ)-probabilistic privacy. We also contrast our analysis of ZEALOUS with an analysis that achieves (__, δ_)-in distinguishability.

Our paper concludes with a large experimental study using real applications where we compare ZEALOUS and previous work that achieves k-anonymity in search log publishing. Our results show that ZEALOUS yields comparable utility to k−anonymity while at the same time achieving much stronger privacy guarantees.


        We show that existing proposals to achieve anonymity in search logs are insufficient in the light of attackers who can actively influence the search log. However, we show that it is impossible to achieve good utility with differential privacy.


      Existing work on publishing frequent itemsets often only tries to achieve anonymity or makes strong assumptions about the background knowledge of an attacker


       The main focus of this paper is search logs, our results apply to other scenarios as well. For example, consider a retailer who collects customer transactions. Each transaction consists of a basket of products together with their prices, and a time-stamp. In this case ZEALOUS can be applied to publish frequently purchased products or sets of products. This information can also be used in a recommender system or in a market basket analysis to decide on the goods and promotions in a store.


     Our results show that ZEALOUS yields comparable utility to k−anonymity while at the same time achieving much stronger privacy guarantees.


1.     Query Substitution:

        Query substitutions are suggestions to rephrase a user query to match it to documents or advertisements that do not contain the actual keywords of the query. Query substitutions can be applied in query refinement, sponsored search, and spelling error correction. Query substitution as a representative application for search quality. First, the query is partitioned into subsets of keywords, called phrases, based on their mutual information. Next, for

Each phrase, candidate query substitutions are determined based on the distribution of queries.

2.     Index Caching:

         Index caching, as a representative application for search performance. The index caching application does not require high coverage because of its storage restriction. However, high precision of the top-j most frequent items is necessary to determine which of them to keep in memory. On the other hand, in order to generate many query substitutions, a larger number of distinct queries and query pairs are required. Thus should be set to a large value for index caching and to a small value for query substitution. In our experiments we fixed the memory size to be 1 GB. Our inverted index stores the document posting list for each keyword sorted according to their relevance which allows retrieving the documents in the order of their relevance.             

3.     Item Set Generation and Ranking:

          All of our results apply to the more general problem of publishing frequent items / item sets / consecutive item sets. Our results (positive as well as negative) can be applied more generally to the problem of publishing frequent items or itemsets.We then compare these rankings with the rankings produced by the original search log which serve as ground truth. To measure the quality of the query substitutions. It does not only compare the ranks of a substitution in the two rankings, but is also penalizes highly relevant substitutions according to [q0, . . . , qj−1] that have a very low rank in [q_0 , . . . , q_j−1].              

System Requirements:

Hardware Requirements:

•         System                        : Pentium IV 2.4 GHz.

•         Hard Disk        : 40 GB.

•         Floppy Drive   : 1.44 Mb.

•         Monitor           : 15 VGA Colour.

•         Mouse             : Logitech.

•         Ram                 : 512 Mb.

Software Requirements:

•         Operating system        : - Windows XP.

•         Coding Language       : ASP.Net with C#.

•         Data Base                    : SQL Server 200

Click here to download Publishing Search Logs – A Comparative Study of Privacy Guarantees(2012) source code