Differentially Private Inductive Miner

• Published in: arXiv.org 2024-10
• Main Authors: Schulze, Max, Zisgen, Yorck, Kirschte, Moritz, Mohammadi, Esfandiar, Koschmider, Agnes
• Format: Article
• Language: English
• Subjects: Personal information; Privacy
• ISSN: 2331-8422
• DOI: 10.48550/arxiv.2407.04595

Protecting personal data about individuals, such as event traces in process mining, is an inherently difficult task since an event trace leaks information about the path in a process model that an individual has triggered. Yet, prior anonymization methods of event traces like k-anonymity or event log sanitization struggled to protect against such leakage, in particular against adversaries with sufficient background knowledge. In this work, we provide a method that tackles the challenge of summarizing sensitive event traces by learning the underlying process tree in a privacy-preserving manner. We prove via the so-called Differential Privacy (DP) property that from the resulting summaries no useful inference can be drawn about any personal data in an event trace. On the technical side, we introduce a differentially private approximation (DPIM) of the Inductive Miner. Experimentally, we compare our DPIM with the Inductive Miner on 14 real-world event traces by evaluating well-known metrics: fitness, precision, simplicity, and generalization. The experiments show that our DPIM not only protects personal data but also generates faithful process trees that exhibit little utility loss above the Inductive Miner.