1
Shall I pos his now? Op imized, delay-based
p i acy p o ec ion in social ne wo ks
Ja ie Pa a-A nau, F´
elix G´
omez M´
a mol, Da id Rebollo-Monede o and Jo di Fo n´
e
Abs ac —Despi e he se e al ad an ages commonly a ibu ed o social ne wo ks such as easiness and immediacy o
communica e wi h acquain ances and iends, signi ican p i acy h ea s p o oked by unexpe ienced o e en i esponsible use s
ecklessly publishing sensi i e ma e ial a e also no iceable. Ye , a di e en , bu equally signi ican p i acy isk migh a ise om
social ne wo ks p o iling he online ac i i y o hei use s based on he imes amp o he in e ac ions be ween he o me and he
la e . In o de o hwa his las ype o commonly neglec ed a acks, his pape p oposes an op imized de e al mechanism o
messages in online social ne wo ks. Such solu ion sugges s in elligen ly delaying ce ain messages pos ed by end use s in social
ne wo ks in a way ha he obse ed online-ac i i y p o ile gene a ed by he a acke does no e eal any ime-based sensi i e
in o ma ion, while p ese ing he usabili y o he sys em. Expe imen al esul s as well as a p oposed a chi ec u e implemen ing
his app oach demons a e he sui abili y and easibili y o ou mechanism.
Index Te ms—Time-based p o iling, online social ne wo ks, p i acy-enhancing echnology, Shannon’s en opy, p i acy-u ili y
ade-o .
F
1 INTRODUCTION
INFORMATION and communica ion echnologies
(ICT) ha e e olu ionized ou li es, leading o an
unp eceden ed socie al ans o ma ion aimed o each
he so called “digi al e a”. In ha sense, we a e
wi nessing oday how social ne wo ks a e pa ing he
way o each such ans o ma ion by in luencing and
e en modi ying he way we in e ac wi h each o he
and beha e amongs us. Amid he ple ho a o ad an-
ages b ough by social ne wo ks we ind he easiness
o communica e wi h iends and acquain ances, he
easiness o sha e hough s, opinions and expe iences
in any o ma (plain ex , pic u es, audio, ideo, e c.)
and e en he immedia e eac ion in case o eme gency
o ca as ophe.
Ye , despi e hei p o en con enience, online social
ne wo ks migh also pose se ious p i acy isks [1],
mos o he imes due o i esponsible o unexpe-
ienced use s who ecklessly pos p i a e o sensi-
i e in o ma ion exposing hemsel es (and some imes
maybe e en hei iends and connec ions in he social
ne wo k) [2], [3] o undesi ed and unexpec ed si ua-
ions (bullying, b ibe y, iden i y he , e c.) [4], [5].
Likewise, an equally signi ican p i acy h ea in-
he en o social ne wo ks migh also become a bu den
o he cons an inc ease o hei wide deploymen and
accep ance. Howe e , unlike he p e ious one, such
•J. Pa a-A nau, D. Rebollo-Monede o and J. Fo n´e and a e wi h
he Depa men o Telema ics Enginee ing, Uni e si a Poli `ecnica de
Ca alunya, C. Jo di Gi ona 1-3, E-08034 Ba celona, Spain.
E-mail: ja ie .pa a,da id. ebollo,[email p o ec ed].
•F. G´omez M´a mol is wi h NEC Labo a o ies Eu ope, Ku ¨u s en-
Anlage 36, 69115 Heidelbe g, Ge many.
E-mail: [email p o ec ed].
Manusc ip p epa ed Oc obe , 2015.
h ea is no based on he con en i sel published
by he end use s and, he e o e, i migh no be as
e iden as he a o emen ioned one. Whene e we
in e ac wi h any social ne wo k (pos a commen on
Facebook, w i e a message in Twi e , e c.), ega dless
o he con en associa ed wi h such in e ac ion, i
is easonably easy o he social ne wo k o log a
imes amp s a ing he ins an when he in e ac ion
occu ed. By doing so, he social ne wo k is able o
build, almos e o lessly, an ac i i y p o ile o i s use s
based on he imes amps o each o he in e ac ions
conduc ed by such use s wi hin he social ne wo k.
P o iling use s based on hei online ac i i y
p omp s non-negligible p i acy conce ns. Some ex-
amples ha illus a e he kind o in o ma ion ha
could be in e ed om an ac i i y p o ile include, o
ins ance: when a use no mally wakes up and goes o
bed, whe he a use is unemployed o no , whe he
hey a e single o ma ied, and whe he hey a e on
holidays o no .
The disclosu e o he iming o a message clea ly
heigh ens he isk o p i acy when conside ed in he
con ex o addi ional in o ma ion ob ainable om a
use . In combina ion wi h geo agging and conside ing
also he con en s o he message pos ed, accu a e im-
ing may e eal accu a e beha io al pa e ns, in e ms
o when and o how long a pa icula indi idual does
wha , and whe he hese pa e ns exhibi a pa icula
end o e ime. When iming is added o he weal h
o da a sha ed ac oss nume ous in o ma ion se ices,
which a p i acy a acke could obse e and c oss-
e e ence, such a acke may mo e easily in e , e en i
in a s a is ical sense, ci cums ances and ends a ec -
ing sensi i e aspec s o an indi idual’s li e, including
2
heal h s a us, eligious belie s, social ela ionships o
wo k pe o mance.
O special ele ance a e also he in e ences ha an
a acke may d aw when ce ain backg ound knowl-
edge (e.g., cul u al and eligious pa e ns and habi s)
is a ailable o hem. Fo example, a ecen epo [6]
indica es ha , du ing Ramadan, Facebook and Twi e
use s in he Middle Eas a e in gene al mos ac i e
a e i a ime. In bo h social ne wo ks, howe e ,
signi ican di e ences a e obse ed depending on
he coun y. Fo ins ance, Qa a and he Emi a es
each peaks o ac i i y jus a e he i a , while o he
coun ies like Saudi A abia a e mos ac i e a ound
midnigh 1. In sho , based on his in o ma ion, he
ype o a ack explo ed he e could undoub edly help
an ad e sa y o asce ain whe he a use is Muslim
o no , and hus i could se iously comp omise hei
p i acy.
Wi h he pu pose o hwa ing p o iling a acks
based on he pos ing imes, he pape a hand in es-
iga es a da a dis u bance app oach in he o m o an
op imized message-de e al mechanism. The mecha-
nism unde s udy enables use s o delay a numbe o
hei messages (wi hou loss o gene ali y, in e ac ions
wi h social ne wo ks), hinde ing an a acke in i s
e o s o comp omise hei p i acy om hei ac i i y
p o iles. The ad e sa y model assumed in his pape
conside s an a acke who, based on hose p o iles,
s i es o a ge peculia use s, o said o he wise,
use s who de ia e om he ypical, common beha io .
When a use adhe es o ou mechanism, he p o ile
obse ed by such a acke (which in ou case, as we
will see la e , is no limi ed o he social ne wo king
si e, bu b oadened o any en i y able o collec such
iming in o ma ion), di e s om he o iginal, genuine
use p o ile o online ac i i y in such a way ha i
appea s o be much mo e common and he e o e less
aluable o he ad e sa y.
The pape is o ganized as ollows: Sec. 2 ana-
lyzes gene al p i acy isks and a acks a ec ing social
ne wo ks, and examines se e al p i acy-enhancing
echnologies (PETs) ha may help coun e ime-based
p o iling a acks. Ou op imized de e al mechanism
is in oduced and desc ibed in Sec. 3, while Sec. 4
speci ies he building blocks o an a chi ec u e im-
plemen ing ou solu ion. In u n, Sec. 5 s udies wo
speci ic u ili y me ics o ou app oach, namely, ex-
pec ed message delay and messages s o age capaci y.
A comp ehensi e se o expe imen s demons a ing
he easibili y o ou p oposal has been conduc ed
and i s ou comes a e shown in Sec. 6. Finally, Sec. 7
unde lines some concluding ema ks as well as u u e
esea ch di ec ions.
1. Agg ega ed Facebook and Twi e ac i i y p o iles a e shown
in [7] pe coun y, du ing and be o e Ramadan.
2 STATE OF THE ART
In his sec ion, we b ie ly explo e gene al p i acy isks
and a acks ha may occu in online social ne wo ks.
Then, we e iew se e al PETs ha could be used
o cope wi h he speci ic ime-based p o iling a acks
illus a ed in he p e ious sec ion.
2.1 P i acy Risks and A acks in Social Ne wo ks
A adi ional iew on p i acy isks and a acks em-
ana es om ulne abili ies in sys ems p esumably
p o ec ing con iden ial da a by means o access con-
ol policies. These sys ems may eso o c yp o-
g aphic p o ocols implemen ing se ices o au hen-
ica ion, access con ol, con iden iali y, and in eg i y,
indispensable when he da a o be p o ec ed lows
ac oss an open medium. A g ea deal o he as ly
abundan li e a u e on cybe secu i y conce ns such
ype o adi ional secu i y and p i acy isks.
Online social ne wo ks, a mode n, widely popu-
la eposi o y o a weal h o pe sonal, po en ially
sensi i e da a, a e clea ly subjec o mos o ms o
adi ional isks and a acks, as any o he online in-
o ma ion sys em would. Somewha less ob ious is
he ac ha he pa icula na u e o social ne wo ks
exposes hem o a numbe o p i acy ulne abili ies
dis inc i e o his pa icula ype o online se ice. In
o de o be e ou line he con ex o he wo k p e-
sen ed he e, in he ollowing, we would like o make
a succinc dig ession on p i acy isks and a acks ha
a ec online social ne wo ks due o hei speci ic na-
u e, beyond adi ionally well-known ulne abili ies
uni e sally common o in o ma ion sys ems.
Whe he hose ulne abili ies cons i u e gla ing
isks inhe en o he mode o ope a ion o he ne -
wo k, o equi e conside able e o on behal o an
a acke , is o en a ma e o he le el o sophis ica ion
o he a ack, and he a ious esou ces a ailable o
he a acke . The quan i y and quali y o he e o
equi ed by an a ack is an impo an p agma ic ques-
ion add essed in he assump ions adop ed in he
ollowing desc ip ions, whose de ails can be ound in
he accompanying e e ences.
A undamen al ca ego y o p i acy a acks dis inc-
i ely di ec ed agains social ne wo ks d aws upon
he p inciple o iden i y he . By impe sona ing a use ,
an a acke may es ablish online ( iendship) ela ion-
ships wi h known egis e ed con ac s, in o de o gain
access o con iden ial in o ma ion o he wise es ic ed
o ela ed pee s. Tha in o ma ion may be abou he
impe sona ed use o hei con ac s. Two a ia ions
o his a ack a e s udied in [8], wi h a ious deg ees
o sophis ica ion, possibly in ol ing p o ile cloning,
po en ially agg a a ed by means o au oma ed c awling
h ough he online social ne wo k, o e en ac oss si es,
and he au oma ed b eaking o CAPTCHA codes. The
au ho s o e empi ical e idence o he plausibili y
3
o hese a acks in Facebook, S udiVZ, MeinVZ and
XING.
Ano he class o a acks, ela ed o he p e ious
ca ego y on iden i y he , in ol es Sybil a acks [9].
In he con ex o pee - o-pee ne wo ks, and o he
communi y-based online sys ems, a Sybil a ack is an
a ack whe ein a use o ges a la ge numbe o iden i-
ies, in o de o sub e he unde lying us model o
epu a ion sys em, and hus gain a disp opo iona ely
la ge in luence.
These a acks a e ele an in online social ne wo ks
because hey e ec i ely cons i u e collabo a i e ec-
ommende sys ems elying on use con en a ings,
o en implemen ed by means o “like” and “dislike”
anno a ions. Hence, malicious Sybil a acke s may
ou o e hones use s in o de o al e he sugges ed
ele ance o con en o be e con o m wi h hei
pe sonal in e es s, possibly a ec ing he popula i y
and epu a ion o o he membe s o he social ne -
wo k. Mechanisms concei ed o coun e Sybil a acks
in online social ne wo ks a e explo ed, o ins ance,
in [10], [11]. The main coun e measu e allows he
o ge y o many iden i ies, bu p ecludes he c ea ion
o excessi e us ela ionships.
A inal example o ypes o p i acy a acks speci ic
o online social ne wo k encompasses hose e e ed
o as neighbo hood a acks [12], [13]. Unde he usual
model o an online social ne wo k as a g aph, wi h
e ices ep esen ing use s, and edges ep esen ing
ela ionships among hem, we conco dan ly de ine
he (1-)neighbo hood o an indi idual as he induced
subg aph consis ing o all immedia ely adjacen e -
ices. E en i he iden i ies o he indi iduals in he
o e all g aph we e pu pose ully hidden, an a acke
wi h knowledge o he neighbo hood subg aph o a
known use could s ill a emp o ma ch he sub-
g aph s uc u e and success ully eiden i y he use
in ques ion, hus iola ing he supposed anonymi y.
Mo eo e , i se e al use s we e eiden i ied in his
manne , knowledge o he anonymized g aph would
enable his a acke o in e possible di ec ela ion-
ships be ween hem, ela ionships ha may also be
cons ued as con iden ial in o ma ion. S a egies o
mi iga e he e ec o hose a acks a e he subjec o
he a o emen ioned wo k [12], [13].
2.2 P i acy-Enhancing Technologies agains
Time-based P o iling A acks
To he bes o ou knowledge, he e is no p i acy-
enhancing mechanism speci ically concei ed o coun e
he ime-based p o iling a ack in oduced in Sec. 1. In
his sec ion, we e iew some gene al-pu pose ech-
nologies ha migh be adop ed o ackle his kind
o a acks. Pa ly inspi ed by [14], we classi y hese
echnologies in o h ee ca ego ies: enc yp ion-based
me hods, app oaches based on us ed hi d pa ies
(TTPs) and da a-pe u ba i e echniques.
In adi ional app oaches o p i acy, use s o de-
signe s decide whe he ce ain sensi i e in o ma ion
is o be made a ailable o no . On he one hand, he
a ailabili y o his da a enables ce ain unc ionali y,
e.g., sha ing pic u es wi h iends on a social ne wo k.
On he o he hand, i s una ailabili y, adi ionally
a ained by means o access con ol o enc yp ion,
p oduces he highes le el o p i acy. In he scena io
conside ed in his wo k, he use o enc yp ion-based
echniques could limi access o he con en o he
messages pos ed on a social ne wo k, by p o iding o
no a c yp og aphic key pe mi ing hei deciphe ing.
Ne e heless, e en hough his key was no p o ided,
an a acke wi h access o he enc yp ed messages
could s ill be able o jeopa dize use p i acy — en-
c yp ion may conceal he con en o such messages,
bu i canno hide he ime ins an s when hey we e
pos ed.
A concep ually-simple app oach o p o ec use
p i acy consis s in a TTP ac ing as an in e media y
o anonymize be ween he use and an un us ed
in o ma ion sys em. In his scena io, he sys em can-
no know he use ID, bu me ely he iden i y o
he TTP i sel in ol ed in he communica ion. Al-
e na i ely, he TTP may ac as a pseudonymize by
supplying a pseudonym ID’ o he se ice p o ide ,
bu only he TTP knows he co espondence be ween
he pseudonym ID’ and he ac ual use ID. In online
social ne wo ks, he use o ei he app oach would
be unapp op ia ed as use s o hese ne wo ks a e
equi ed o be logged in. Al hough he adop ion o
TTPs o his end would he e o e be uled ou , use s
hemsel es could p o ide a pseudonym a he sign-
up p ocess, hus playing he ole o a pseudonymize .
In his line, some si es ha e s a ed o e ing social-
ne wo king se ices whe e use s a e no equi ed o
e eal hei eal iden i ie s2.
Un o una ely, none o hese app oaches may p e-
en an a acke om p o iling a use based on mes-
sage con en , and ul ima ely in e ing hei eal iden-
i y. In i s simples o m, eiden i ica ion is possible
due o he pe sonally iden i iable in o ma ion o en in-
cluded in he messages pos ed. Howe e , e en hough
no iden i ying in o ma ion is included, pseudonyms
could also be insu icien o p o ec bo h anonymi y
and p i acy. As an example, suppose ha an obse e
has access o ce ain beha io al pa e ns o online
ac i i y associa ed wi h a use , who occasionally dis-
closes hei ID, possibly du ing in e ac ions no in-
ol ing sensi i e da a. The same use could a emp o
hide unde a pseudonym ID’ o exchange in o ma ion
o con iden ial na u e. Ne e heless, i he use ex-
hibi ed simila beha io al pa e ns, he unlinkabili y
be ween ID and ID’ could be comp omised h ough
hese simila pa e ns. In his case, any pas p o iling
2. SocialNumbe (h p://www.socialnumbe .com) is an example
o such ne wo ks, whe e use s mus choose a unique numbe as
iden i ie .
4
in e ences ca ied ou o he pseudonym ID’ would
be linked o he ac ual use ID.
Ano he class o PETs elying on us ed en i-
ies is anonymous-communica ion sys ems (ACSs).
In anonymous communica ions, one o he goals is
o conceal who alks o whom agains an ad e sa y
who obse es he inpu s and ou pu s o he anony-
mous communica ion channel. Mix sys ems [15], [16],
[17] a e a basic building block o implemen ing
anonymous-communica ion channels. These sys ems
pe o m c yp og aphic ope a ions on messages such
ha i is no possible o co ela e hei inpu s and
ou pu s based on hei bi pa e ns. In addi ion, mixes
delay and eo de messages o hinde he linking o
inpu s and ou pu s based on iming in o ma ion.
In he con ex o ou wo k, ACSs may hide he
link be ween social ne wo king si es and use s, and
he e o e may p o ec use p i acy agains he in-
e media y en i ies enabling he communica ions be-
ween hem. We may dis inguish be ween wo cases
— he case whe e messages a e public, and he case
whe e messages a e kep p i a e o a ailable o au-
ho ized use s. In he o me case, ACSs ob iously
canno p o ide any p i acy gua an ees, as use online
ac i i y is publicly a ailable. In he la e case, he
use o anonymous communica ions migh con ibu e
o p i acy enhancemen p o ided ha he a acke is
no he social-ne wo king si e3.
Among a a ie y o p i acy and h ea models ha
ha e been p oposed o ACSs [18], [19], [20], [21],
[22], he impo an case when he ad e sa y knows
all he sende s (inpu s) and ecei e s (ou pu s) would
ende he anonymous sys em useless unde he ime-
based p o iling a ack a hand: i would be enough o
his ad e sa y o obse e he messages gene a ed by
he a ge use . In o he wo ds, unde he assump ion
o an ex e nal and global a acke [20], [23], an ACS
would no be an app op ia e app oach o hwa an
ad e sa y who s i es o p o ile use s based on hei
online ac i i y.
An al e na i e o hinde an a acke in i s e o s
o p o ile use s consis s in pe u bing he in o ma ion
hey disclose when communica ing wi h an in o ma-
ion sys em. The submission o alse da a, oge he
wi h he use ’s genuine da a, is an illus a i e exam-
ple o da a-pe u ba i e mechanism. In he con ex o
in o ma ion e ie al, que y o ge y [24] p e en s p i-
acy a acke s om p o iling use s accu a ely based
on he con en o que ies, wi hou ha ing o us
nei he he se ice p o ide no he ne wo k ope a-
o , bu ob iously a he cos o a ic o e head. A
so wa e implemen a ion o que y o ge y is he Web
b owse add-on T ackMeNo [25]. This popula add-
on exploi s RSS eeds and o he sou ces o in o ma ion
o ex ac keywo ds, which a e hen used o gene a e
3. Clea ly, i he a acke was he social ne wo king pla o m, any
in o ma ion disclosed by he use would be known o he ad e sa y.
alse que ies. The add-on gi es use s he op ion o
choose how o o wa d such que ies. In pa icula , a
use may send bu s s o bogus que ies, hus mimick-
ing he way people sea ch, o may submi hem a
p ede ined in e als o ime.
Clea ly, he pe u ba ion o use p o iles o p i acy
p o ec ion may be ca ied ou no only by means o
he inse ion o bogus ac i i y, bu also by supp es-
sion. An example o his la e kind o pe u ba ion
may be ound in [26], [27], whe e he au ho s p opose
he elimina ion o ags as a p i acy-enhancing s a -
egy in collabo a i e- agging applica ions. Tag sup-
p ession allows use s o enhance hei p i acy o a
ce ain deg ee, bu i comes a he expense o deg ad-
ing he seman ic unc ionali y o hose applica ions,
as ags ha e he pu pose o associa ing meaning wi h
esou ces.
The da a-pe u ba i e mechanisms desc ibed abo e
aim o p e en an a acke om p o iling use s based
on hei in e es s. Al hough hese mechanisms could
also be used o a oid p o iling a acks based on he
ime ins an s when use s communica e h ough social
ne wo ks, we belie e ha hey would no be adop ed
in p ac ice — use s o social ne wo ks would be
e icen o elimina e hei commen s and o gene a e
ake commen s, as hese ac ions would ha e a signi i-
can impac on he in o ma ion-exchange unc ionali y
p o ided by social ne wo ks.
3 PRIVACY PROTECTION VIA MESSAGE DE-
FERRAL
This sec ion p esen s he de e al o messages as a
PET. The desc ip ion o his echnology is p e aced
by a sho illus a ion o ime-based p o iling a acks
in social ne wo ks (including a b ie explana o y use
case), and ollowed by a succinc in oduc ion o he
concep s o so p i acy and ha d p i acy. A e wa ds,
we p opose a model o ep esen ing use ac i i y and
desc ibe he assump ions abou he p i acy a acke
assumed in his wo k. Finally, we de ine a quan i iable
measu e o p i acy and u ili y, and p esen a o mu-
la ion o he ade-o be ween hese wo aspec s.
3.1 Illus a ion o Time-based P o iling A acks in
Online Social Ne wo ks
The disclosu e o he iming ac i i y o a use may
p omp se ious p i acy conce ns, especially when his
in o ma ion is conside ed in combina ion wi h addi-
ional da a abou hem. Toge he wi h loca ion agging
and he con en o he pos ed messages hemsel es,
he exposu e o p ecise iming ac i i y may unco e
beha io al pa e ns om which a p i acy a acke
migh lea n when and o how long a pa icula
indi idual does wha , and whe e, and whe he hese
pa e ns show a pa icula end o e ime. When
said iming in o ma ion is added o he da a a ail-
able a o he online se ices such as sea ch engines,
5
mul imedia sha ing pla o ms and e-mail, an a acke
ha migh c oss- e e ence his in o ma ion may ind
i easy o asce ain si ua ions and ends a ec ing
se e al sensi i e aspec s o a pe son, including, o
example, heal h s a us, inancial si ua ion, social ela-
ionships, wo k pe o mance, o changes in poli ical
p e e ences. The ollowing use case illus a es he
kind o in e ences and p i acy h ea s ha he sole
disclosu e o iming in o ma ion may cause.
3.1.1 Use case: In e ence o Religious Belie s
Isabella Kaya, a s uden o iginally om Tu key, has
jus inished he M.S. deg ee a he School o Law,
Uni e si y o Texas. Since she was a eenage , ou
ic ional cha ac e has been egis e ed wi h he mos
popula social ne wo ks. Gene ally she is qui e ac i e.
In he Twi e and Ins ag am p o iles, he ollowe s
can ind pic u es o he dog and, mo e ecen ly, com-
men s and cong a ula ions o he g adua ion. Du ing
he Ramadan mon h, howe e , he beha io in he
ne wo ks is al e ed: Isabella is Muslim and du ing
ha pe iod o ime, he online ac i i y is no ably
inc eased a noon. Due o he as , she has clea ly mo e
oppo uni ies o log in o he social ne wo ks a ha
ime o he day.
A couple o mon hs ago, Isabella applied o a
posi ion in a p es igious law i m. The Depa men
o Human Resou ces o his i m, simila ly o many
o he companies, o en uses social ne wo ks o ge
a glimpse o he candida e ou side he con ines o
a CV, co e le e and in e iew. Al hough Isabella
pos s a ound 20 messages a day and is awa e ha
i ms migh snoop on hem, she is no wo ied abou
a possible in asion o he p i acy: she is e y ese ed
and espec ul wi h he commen s, and does no ha e
any comp omising pic u es o no hing blamewo hy
in he mo e han 8 yea s o ac i i y. Howe e , she
keeps a cons an eye on he commen s ha o he s may
publish in he p o ile. Now ha she is looking o a
job, his con ol is e en s ic e .
Isabella had an in e iew yes e day. Al hough e -
e y hing wen smoo hly, she was su p ised by he
excessi e in e es o he in e iewe in he o igin
o he su name. Because she had hea d o a ew
cases o disc imina o y p ac ices agains he Muslim
communi y by his company, she me ely esponded
he su name was Eu opean so as no o educe he
chances o ge ing he posi ion.
No sa is ied wi h he esponse, he in e iewe ’s
cu iosi y could lead him, in a hypo he ical case, o
examine he p o iles in he social ne wo ks. Al hough
he would no ind any commen ha migh unco e
he eligious belie s, again hypo he ically he could
con i m his in ui ion by conduc ing a basic sea ch
on he publicly a ailable social-ne wo k p o iles. In
pa icula , he could no ice ha exac ly om 18 June o
17 July (pe iod o he las Ramadan) Isabella’s online
ac i i y ollows a dis inc , cha ac e is ic pa e n, and
obse e ha his same beha io is exhibi ed p ecisely
du ing he Ramadan mon h o he p e ious yea ( om
29 June o 28 July), and he one om wo yea s ago
( om 9 July o 8 Augus ), and so i goes on o he
las 8 yea s o ac i i y, all a ailable a he public
Twi e and Facebook accoun s. Also hypo he ically,
his could be he eason why she did no ge he job
in he end.
3.2 So P i acy and Ha d P i acy
The p i acy esea ch li e a u e [28] ecognizes he
dis inc ion be ween he concep s o so p i acy and
ha d p i acy. In a so -p i acy model, use s en us
an ex e nal en i y o TTP o sa egua d hei p i acy.
Tha is, use s pu hei us in an en i y which will
he ea e be in cha ge o p o ec ing hei p i a e da a.
In he li e a u e, nume ous a emp s o p o ec
use p i acy ha e ollowed he adi ional me hod o
anonymous communica ions, which is based on he
supposi ions o so p i acy. Addi ional examples o
PETs building on his model a e anonymize s and
pseudonymize s. The main d awbacks o all hese
echnologies, as we commen ed in Sec. 2, a e ha
hey come a he cos o in as uc u e and a e no
comple ely e ec i e [29], [30], [31], [32]. Besides, e en
in hose cases whe e we could ully us in he
e ec i eness o an en i y, ha en i y could be legally
en o ced o e eal he in o ma ion i has access o [33].
The AOL sea ch da a scandal [34] is ano he example
ha shows ha he us ela ionship be ween use s
and TTPs may be b oken. In sho , whe he p i acy
is p ese ed o no unde his model depends on he
us wo hiness o he da a con olle and i s capaci y
o manage he en us ed da a.
On he o he ex eme is he ha d-p i acy model,
whe e use s mis us any communica ing en i y and
hus endea o o e eal as li le p i a e in o ma ion as
possible. In he applica ion scena io a hand, ha d p i-
acy means ha use s need no us an ex e nal en i y
such as he social ne wo king p o ide o he ne -
wo k ope a o . Mechanisms p o iding ha d-p i acy
gua an ees p ima ily ely on da a pe u ba ion and
ope a e on he use side. An a che ypal example
is T ackMeNo , a Web b owse ex ension ins alled
on he use ’s machine ha aims a pe u bing hei
Web sea ch p o ile h ough he submission o alse
que ies. As we shall see nex , he p i acy-p ese ing
echnology p oposed he e leans on his model.
3.3 Message De e al
In he in oduc o y sec ion, we emphasized he isk o
p o iling based on he ime ins an s when use s sub-
mi messages o a social ne wo king si e. In pa icula ,
we men ioned ha , building on his online beha io ,
an ad e sa y could ex ac an accu a e snapsho o
hei p o iles o ac i i y h oughou ime and hus
could comp omise use p i acy.

6
In his si ua ion, we p opose a da a dis u bance
app oach consis ing o he de e al o messages as a
concep ually-simple mechanism ha may hwa his
kind o p o iling a acks. The p oposed mechanism
allows use s o delay he submission o ce ain mes-
sages, by s o ing hem locally and a e wa ds sending
hem o he social-ne wo k p o ide in ques ion. The
applica ion o his mechanism may help use s p o ec
hei p i acy o a ce ain ex en , a he cos o no
in as uc u e, and wi hou ha ing o us nei he he
se ice p o ide no any o he ex e nal en i y. Since
p i acy p o ec ion akes place exclusi ely on he use
side, ou mechanism con ibu es o he p inciple o
da a minimiza ion 4and a oids any po en ial leakage
by ex e nal p i acy sys ems, social-ne wo king si es,
In e ne se ice p o ide s (ISPs), p oxies, ou e s and
o he ne wo king en i ies. In a nu shell, i p o ides
ha d-p i acy gua an ees, meaning ha he p o ec ion
o e ed by he mechanism is obus in he p esence o
un us ed o no ully us ed ex e nal en i ies like he
abo e migh be.
Delaying messages may he e o e allow ce ain p i-
acy p o ec ion, bu his ine i ably comes a he ex-
pense o da a-s o age capaci y and, mo e impo an ly,
he u ili y o he se ices p o ided by he online social
ne wo k. As an example, conside a use pos ing
a wee 5 o con i m a mee ing his e ening. I his
wee was pos poned, he con i ma ion could a i e
la e and, i so, he in o ma ion-exchange unc ionali y
would be useless. In sho , he de e al o messages
poses a ade-o be ween he con as ing aspec s o
p i acy on he one hand, and u ili y on he o he .
Fig. 1 shows a concep ual depic ion o ou mecha-
nism.
In he coming sec ions, we shall in es iga e he
de e al o messages as a echnique ha may p ese e
use s’ p i acy agains an a acke who ies o p o ile
hem based on hei pos ing imes. No e ha his is in
con as o o he ypes o p o iling a acks ha exploi
he con en o he in o ma ion disclosed, a he han
he ime when his in o ma ion is e ealed.
Na u ally, his la e kind o use p o iling may
occu in conjunc ion wi h he o me , bu he deg ee o
sophis ica ion and compu a ional e o s a e p esum-
ably much highe o he o me ype o a acks, i.e.,
hose ha capi alize on con en in o ma ion. Mainly
o his eason, online social ne wo king se ices and
mic oblogging se ices like Twi e and Facebook a e
mo e p one o ime-based p o iling. In hese in o -
ma ion sys ems, an a acke would ha e o analyze
he con en o pos s, whe e, in addi ion o ex , use s
o en include images and ideos. P ocessing all hese
4. Acco ding o [35], he da a-minimiza ion p inciple means ha
a da a con olle , e.g., he social-ne wo king pla o m, should e-
s ic he collec ion o pe sonal da a o wha is s ic ly necessa y o
achie e i s pu pose. Also, i implies ha he con olle should s o e
he da a only o as long as is necessa y o ul il he pu pose o
which he in o ma ion was collec ed.
5. A wee is a message sen using Twi e .
Fig. 1: Message de e al as a mechanism o p o ec he p i acy o
he online ac i i y o a use by delaying he submission o ce ain
messages.
da a and ex ac ing ea u es om hem would equi e
a mo e compu a ional e o s6 han simply e ie ing
he imes amp ield o hose pos s. A Web applica ion
ha exempli ies he ease wi h which ime-based p o-
iles can be buil is [36].
Despi e he po en ial occu ence o hese ime-based
p o iling a acks and he e iden p i acy isks hey
en ail, we acknowledge ha , wi hin he con ex o
ce ain social-ne wo king applica ions, use s may no
be willing o ole a e a deg ada ion o he in ended
unc ionali y due o message de e al. This is he
case, o example, o eal- ime con e sa ions, which
may no be pa icula ly conduci e o ou p i acy
mechanism. We belie e, howe e , ha many o he
uses o he social ne wo ks may allow i .
3.4 Ad e sa y Model
In o de o e alua e he le el o p i acy p o ided
by ou mechanism, i is undamen al o speci y he
conc e e assump ions abou he a acke , ha is, i s
capabili ies, p ope ies o powe s. This is known as
he ad e sa y model and i s impo ance lies in he ac
ha he le el o p i acy p o ided is measu ed wi h
espec o i .
Nex , we desc ibe he ad e sa y model assumed
in his wo k, in e ms o he applica ion scena io
conside ed, he ype o ad e sa ies able o p o ile
use s, he way hese ad e sa ies model use ac i i y,
and he objec i e behind he cons uc ion o hese
ac i i y models.
•Scena io. Fi s , we conside a ypical scena io
whe e use s a e equi ed o be logged in o a social
ne wo king si e o hei messages o be pos ed.
This could be he case o Google Plus, Twi e
and Facebook. In addi ion, we may easonably
assume ha use s o hese applica ions p o ide
hei eal iden i ie s o c ea e hei accoun s. We
mus has en o s ess ha , e en hough a use em-
ploys pseudonyms, he con en o he messages
exchanged o he knowledge o hei “ iends”
in hose social ne wo ks may lead an a acke o
asce ain he ac ual iden i y o his use .
6. This is in con as o o he in o ma ion sys ems whe e use
da a (e.g., ags, que ies o a ings) a e simple o p ocess.
7
Time o day [hou ]
(a)
Time o day [hou ]
(b)
Fig. 2: Ac ual use p o ile (a) and appa en use p o ile (b). Bo h p o iles ep esen he p o ile o ac i i y ac oss a day, in pa icula , he
pe cen age o messages pos ed be ween 0 a.m. and 1 a.m., 1 a.m. and 2 a.m., and so on.
•P i acy a acke s. In his scena io, any en i y
capable o cap u ing use s’ messages is ega ded
as a po en ial p i acy a acke . This includes
he social ne wo k p o ide , he In e ne se -
ice p o ide (ISP), and he in e media y en i ies
(swi ches, ou e s, i ewalls) enabling he commu-
nica ions be ween use s and social ne wo king
si es. Besides, since pos ed messages a e o en
publicly a ailable7, any en i y able o collec his
in o ma ion is also aken in o conside a ion in ou
ad e sa y model.
•Use -p o ile model. We assume ha he a acke
ep esen s beha io al pa e ns o online use ac-
i i y as p obabili y mass unc ions (PMFs). Con-
cep ually, a use p o ile may be in e p e ed as
a his og am o ela i e equencies o messages
ac oss a day, week, mon h o yea . The p o-
posed use -p o ile model is a na u al, in ui i e
ep esen a ion in line wi h he models used in
many in o ma ion sys ems o cha ac e ize use
p o iles [27], [37], [38], [39], [40].
In ou ad e sa y model, we dis inguish be ween
wo kinds o p o iles. On he one hand, he use ’s
genuine p o ile, and on he o he , he p o ile
pe cei ed om he ou side, which esul s om
delaying ce ain messages be o e pos ing hem.
He ea e , we shall e e o hese wo p o iles
as he ac ual p o ile qand he appa en p o ile
. Tha said, in his wo k we shall assume ha
he a acke is unawa e o igno es he ac ha
he obse ed, pe u bed p o ile does no e lec
he ac ual beha io o he use . Fig. 2 p o ides
an example o such p o iles. In his igu e we
ep esen he p o ile o online ac i i y o a use
wi hin 1-hou slo h oughou one day.
•Objec i e behind p o iling. Finally, ou ad e -
sa y model con empla es wha he a acke is a -
e when p o iling use s. Acco ding o [40], and in
line wi h he echnical li e a u e o p o iling [41],
7. Messages exchanged on Twi e a e publicly isible by de aul .
[42], we assume ha he a acke ’s ul ima e goal
is o a ge peculia use s. Pu di e en ly, we
conside an ad e sa y ha aims o ind use s
who de ia e signi ican ly om he a e age and
common ac i i y p o ile.
The goal o p o iling, oge he wi h he assump ions
abou he scena io and he use -p o ile ep esen a ion,
cons i u e he ad e sa y model upon which ou p i-
acy me ic builds.
3.5 P i acy Me ic o Online Ac i i y
Nex , we jus i y he Shannon en opy and he
Kullback-Leible (KL) di e gence as measu es o p i-
acy when an a acke aims o a ge uncommon use s
based on hei p o iles o ac i i y. The a ionale behind
he use o hese wo in o ma ion- heo e ic quan i ies
as p i acy me ics is documen ed in g ea e de ail
in [40].
Recall ha Shannon’s en opy H( )o a disc e e
andom a iable ( . .) wi h PMF = ( i)n
i=1 on he
alphabe {1, . . . , n}is a measu e o he unce ain y o
he ou come o his . ., de ined as
H( ) = −X ilog i.
Th oughou his wo k, all loga i hms a e aken o base
2, and subsequen ly he en opy uni s a e bi s. Gi en
wo p obabili y dis ibu ions and po e he same
alphabe , he KL di e gence is de ined as
D( kp) = X ilog i
pi
.
The KL di e gence is o en e e ed o as ela i e
en opy, as i may be ega ded as a gene aliza ion
o he Shannon en opy o a dis ibu ion, ela i e o
ano he . Con e sely, Shannon’s en opy is a special
case o KL di e gence, as o a uni o m dis ibu ion
uon a ini e alphabe o ca dinali y n,
D( ku) = log n−H( ).(1)
Le e aging on a celeb a ed in o ma ion- heo e ic
a ionale by Jaynes [43], he Shannon en opy o an
8
appa en use p o ile, modeled as a PMF, may be
ega ded as a measu e o p i acy, o mo e accu a ely,
anonymi y. The leading idea is ha he me hod o
ypes [44] om in o ma ion heo y es ablishes an
app oxima e mono onic ela ionship be ween he like-
lihood o a PMF in a s ochas ic sys em and i s en opy.
Loosely speaking, he highe he en opy o a p o ile,
he mo e likely i is ha he mo e use s beha e
acco ding o i . Unde his in e p e a ion, en opy is a
measu e o anonymi y, no in he sense ha he use ’s
iden i y emains unknown, bu only in he sense ha
highe likelihood o an appa en p o ile, belie ed by
an ex e nal obse e o be he ac ual p o ile, makes
ha p o ile mo e common, hope ully helping he use
go unno iced, less in e es ing o an a acke whose
objec i e is o seek peculia use s.
I an agg ega ed his og am o he whole popu-
la ion o use s we e a ailable as a e e ence p o-
ile p, he ex ension o Jaynes’ a gumen o ela i e
en opy would also gi e an accep able measu e o
anonymi y. Recall ha KL di e gence is a measu e o
disc epancy be ween p obabili y dis ibu ions, which
includes Shannon’s en opy as he special case when
he e e ence dis ibu ion is uni o m. Concep ually,
a lowe KL di e gence hides disc epancies wi h e-
spec o a e e ence p o ile, say he popula ion’s, and
he e also exis s a mono onic ela ionship be ween he
likelihood o a dis ibu ion and i s di e gence wi h
espec o he e e ence dis ibu ion o choice, which
enables us o deem KL di e gence as a measu e o
anonymi y in a sense en i ely analogous o he abo e
men ioned.
Unde his in e p e a ion, he Shannon en opy is
he e o e in e p e ed as an indica o o he common-
ness o simila p o iles. As such, Shannon’s en opy
appea s as a meaning ul anonymi y measu e since i
e ec i ely cap u es he a acke ’s goal behind p o-
iling. We should has en o s ess ha he Shannon
en opy is a measu e o anonymi y a he han p i acy,
in he sense ha he ob usca ed in o ma ion is he
uniqueness o he p o ile behind he online ac i i y,
a he han he ac ual p o ile i sel .
3.6 Fo mula ion o he T ade-O be ween P i acy
and Message-De e al Ra e
In his sec ion, we p esen a o mula ion o he op-
imal p i acy-u ili y ade-o posed by ou message-
de e al mechanism.
In ou ma hema ical model, we ep esen he mes-
sages o a use as a sequence o independen and
iden ically dis ibu ed (i.i.d.) . .’s aking on alues in
a common ini e alphabe o n ime pe iods, namely
he se {1, . . . , n} o some in ege n⩾2. As an
example, he se o ime pe iods could be he hou s o
a day o a week, o he days o a mon h. Acco ding o
his model, we cha ac e ize he ac ual p o ile o a use
as he common PMF o hese . .’s, q= (q1, . . . , qn).
In concep ual e ms, ou model o use p o ile is a
no malized his og am o messages o e hose ime
pe iods.
Based on his model, we quan i y he ini ial p i acy
le el as he Shannon en opy o he use ’s ac ual
p o ile, H(q). Fo he sake o ac abili y, we measu e
u ili y as he de e al a e ϕ∈[0,1), ha is, he a io
o he numbe o messages ha a use is willing o
delay o he o al numbe o messages.
When a use accep s delaying hei wee s, com-
men s o , in gene al, messages, hei ac ual p o ile
qis seen om he ou side as he appa en p o ile
=q−s+ , acco ding o a s o ing s a egy sand a
o wa ding s a egy . These s a egies a e wo n- uples
ha would ell he use when o e ain hose messages
and when o elease hem. Mo e speci ically, he i- h
componen o he s o ing s a egy is he ac ion o
messages ha his use should s o e a ime pe iod
i. Simila ly, iis he p opo ion o messages o o al
numbe o messages ha he use should o wa d
a ime i. Clea ly, hese wo s a egies mus sa is y
ha si, i⩾0,qi−si+ i⩾0, o all i, and ha
Psi=P i=ϕso ha is a PMF.
Acco ding o his no a ion, we deno e by H( ) he
( inal) p i acy le el and de ine he p i acy-de e al
unc ion as
P(ϕ) = max
,s
i⩾0, si⩾0,
qi−si+ i⩾0,
Psi=P i=ϕ
H(q−s+ ),(2)
which models he op imal ade-o be ween p i acy
and message-de e al a e.
The op imiza ion p oblem inhe en in his de ini ion
belongs o he ex ensi ely s udied class o con ex
op imiza ion p oblems [45]. Mos o hese p oblems
do no ha e an analy ical solu ion and hus need o
be sol ed nume ically. Fo his, he e exis a numbe
o ex emely e icien me hods, such as in e io -poin
algo i hms. The p oblem o mula ed he e, howe e ,
u ns ou o be a pa icula case o a mo e gene al
op imiza ion p oblem, o which in e es ingly he e is
an explici closed- o m solu ion, albei piecewise [46].
In p ac ice, his means ha we shall be able o
ind an analy ical exp ession o he op imal s o ing
and o wa ding s a egies, i.e., hose s a egies ha
maximize use p i acy o a gi en ϕ. La e on, in
Sec. 5.1, we shall show ha (2) is a pa icula iza ion
o his la e p oblem.
4 ARCHITECTURE
As we commen ed on Sec. 3.2, ou PET le e ages on
he ha d-p i acy model. In essence, his means ha
use s seek o sa egua d hei p i acy hemsel es, since
any communica ing en i y (e.g., he ne wo k p o ide ,
social-ne wo king pla o m, ISP) may be ega ded as
a po en ial a acke . Because ou mechanism akes
9
Time o day [hou ]
Rela i e equency o ac i i y [%]
1 4 7 10 13 16 19 22 24
0
2
4
6
8
10
12
14
16
18
(a)
Time o day [hou ]
Rela i e equency o ac i i y [%]
1 4 7 10 13 16 19 22 24
0
2
4
6
8
10
12
14
16
18
(b)
Fig. 3: Example o use p o ile (a) and i s op imal s o ing and o wa ding s a egies and s(b) o a de e al-message a e ϕ= 4%.
place on hei side and he e o e does no ely on any
ex e nal pa y, i o e s ha d-p i acy p o ec ion.
In his sec ion, we speci y he building blocks o
an a chi ec u e implemen ing ou p i acy-enhancing,
message-de e al mechanism. As we shall see la e ,
he sys em a chi ec u e e ol es a ound a module
ha compu es he op imal o wa ding and s o ing
s a egies om (2). In essence, he p oposed sys em
will employ hese wo s a egies o dis o he ac ual
p o ile in a way ha use p i acy is maximized. We
would like o s ess ha , since ou da a-pe u ba i e
mechanism is op imized o any message-de e al
a e, any pe u ba ion in oduced in he ac ual p o ile
will always be in he di ec ion o p o iding a be e
p i acy p o ec ion. In o he wo ds, and in con as
o andomized pe u ba i e mechanisms, de ia ions
om he ac ual p o ile caused by ou mechanism
always gua an ee an imp o emen in p i acy.
The a chi ec u e p oposed in his sec ion p o ides
high-le el unc ional aspec s so ha ou PET can
be implemen ed as so wa e unning on he use ’s
local machine, o example, in he o m o a Web-
b owse ex ension. Speci ically, ou a chi ec u e builds
on he a o emen ioned ha d-p i acy model, which
implies ha use s need no us any ex e nal en i y
o p o ec hei p i acy. We only assume, howe e ,
ha use s us he piece o so wa e ha implemen s
ou mechanism, in e ms o he da a i collec s and i s
execu ion, exac ly as hey us hei Web b owse .
Ou assump ions abou he p oposed a chi ec u e
a e desc ibed nex :
•Fi s , we assume ha bo h he use and he ad-
e sa y use he same ime pe iods, o example,
24 uni o mly dis ibu ed ime slo s wi hin a day.
This implies ha he p o ile compu ed on he
use ’s side coincides wi h he p o ile buil by he
a acke .
•Secondly, acco ding o equa ion (2), ou app oach
needs he use ’s ac ual p o ile q o compu e he
op imal s o ing and o wa ding s a egies. Be-
cause o his, we con empla e a aining pe iod
be o e ou a chi ec u e s a s delaying messages.
Howe e , since he a acke migh lea n abou he
use p o ile du ing his aining pe iod, he use
could al e na i ely p o ide he so wa e wi h an
es ima e o hei p o ile.
•Las ly, we suppose ha , in he es ima ion o he
ela i e his og am, he componen s o he use
p o ile emain s able a e he aining phase. We
acknowledge, howe e , ha a p ac ical imple-
men a ion o ou mechanism should ake in o ac-
coun ha he use ac i i y may a y signi ican ly
o e ime.
Be o e we p oceed wi h he desc ip ion o ou a chi-
ec u e, we shall p o ide an example showing wha
he op imal s o ing and o wa ding s a egies mean
in p ac ice. Fo his, conside he p o ile qdepic ed
in Fig. 3(a), which co esponds o a use wi h ini ial
p i acy isk P(0) ≃4.2775 bi s. I his use decided o
delay ϕ= 4% o hei messages, he ela i e p i acy
gain would be a ound 5.18%. Tha is, in his pa icula
case we obse e ha he p i acy gain would be,
in e es ingly, g ea e han he delay a e in oduced.
The op imal s a egies a e illus a ed in Fig. 3(b).
The s o ing s a egy sugges s bu e ing 3.37% and
0.63% o messages a ime ins an s 1 and 2, espec-
i ely8. On he o he hand, he o wa ding s a egy
ecommends ex ac ing 0.84% o he o al numbe o
messages om he bu e a ime pe iods 7, 8, 9 and
10, and 0.64% o he messages a ime 13.
In Fig. 4 we depic he p oposed a chi ec u e, which
consis s o a numbe o modules, each o hem pe -
o ming a speci ic ask. F om a gene al pe spec i e,
his igu e shows a use in e ac ing wi h a social
ne wo king si e, an en i y ha basically s o es he
messages gene a ed by his and o he use s. Nex , we
p o ide a unc ional desc ip ion o he modules o his
a chi ec u e.
•Use -p o ile cons uc o . I is esponsible o he
es ima ion o he use ’s p o ile. Speci ically, his
module ecei es he messages he use gene a es,
8. Those ime ins an s a e, in ac , ime pe iods o one hou each.
In pa icula , he ime index iconsis s in he in e al (i−1, i].
16
0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8
'c i
0
1
2
3
4
5
6
7
Use s [%]
(a) Twi e .
0 0.1 0.2 0.3 0.4 0.5 0.6 0.7
'c i
0
1
2
3
4
5
6
7
Use s [%]
(b) Facebook.
0 0.1 0.2 0.3 0.4 0.5 0.6
'c i
0
1
2
3
4
5
6
7
Use s [%]
(c) Ins ag am.
0 2 4 6 8 10 12 14
;c i
0
5
10
15
Use s [%]
(d) Twi e .
0 1 2 3 4 5 6 7
;c i
0
1
2
3
4
5
6
7
Use s [%]
(e) Facebook.
0 1 2 3 4 5 6 7
;c i
0
1
2
3
4
5
6
7
Use s [%]
Fo ge y
De e al
( ) Ins ag am.
Fig. 10: P obabili y dis ibu ion o he c i ical a es o op imized de e al and o ge y o he h ee da a se s conside ed in Sec. 6.
con ex combina ion = (1 −ϕ)q+ϕ u. By i ue o
hese equi alences, i is also s aigh o wa d o e i y
ha uni o m de e al a ains c i ical p i acy i , and
only i , ϕ= 1. This is ob iously in he non- i ial
case when q6=u. Th oughou his sec ion, we shall
occasionally e e his s a egy as “ andom” de e al.
6.3 Resul s
In ou i s se ies o expe imen s, we compu ed he
p obabili y dis ibu ion o ϕc i and ρc i , ha is, he
de e al and o ge y a es beyond which he maxi-
mum p i acy le el is a ained13. The PMFs o such
c i ical a es a e shown in Fig. 10. In he case o
op imized message de e al and he Twi e da a se ,
we obse e ha he minimum, maximum and a e age
alues o ϕc i a e app oxima ely 0.01, 0.67 and 0.33.
Also, we spo ha a signi ican mass o p obabili y
is concen a ed be ween ϕ≃0.2and ϕ≃0.4, in
pa icula , a 74% o use s. This means ha mos
use s will no equi e delaying a la ge pe cen age o
hei wee s o hei appa en p o iles o become he
uni o m dis ibu ion.
Simila esul s a e obse ed o he o he wo da a
se s. In he case o Facebook, o example, he c i ical
de e al a e has an a e age alue o 0.33, sligh ly
smalle han o Twi e , bu he minimum alue is
0.14. As o Ins ag am, he esul s a e a bi be e :
he maximum and a e age alues o ϕc i a e 0.53 and
0.30, espec i ely.
13. We omi he dis ibu ion o he c i ical-de e al a e o he
uni o m s a egy since, as commen ed in Sec. 6.2, his s a egy
achie es c i ical p i acy only when ϕ= 1. Consequen ly, he PMF
o he c i ical a e is he i ial Di ac del a unc ion cen e ed a 1.
The dis ibu ions o he c i ical o ge y a e a e
plo ed in Figs. 10(d- ). The main conclusion ha can
be d awn om hese igu es is ha use s will need
la ge alues o ρ, in mos cases abo e 100%, o hei
p i acy o a ain he maximum le el. The esul s o
Twi e , Facebook and Ins ag am yield an a e age
a e o 1.921, 1.932 and 1.794, espec i ely. This is in
con as o he c i ical a e o he p oposed de e al
mechanism, which by de ini ion canno exceed 1.
The ollowing igu e, Fig. 11, shows he PMFs o he
expec ed delay o ou op imized de e al mechanism
and o he uni o m de e al s a egy se o h in
Sec. 6.2. The esul s a e plo ed in he case when
all use s apply hese wo mechanisms wi h he c i -
ical de e al a e o ou op imized echnology, gi en
by (4). The esul s p o ided o op imized de e al has
been ob ained analy ically by using he exp essions
de i ed in Sec. 5.2.
F om Figs. 11(a-c), we check ha he alues o
¯
δ|ϕ=ϕc i a e oughly concen a ed be ween 1 and 8
hou s. In he case o Twi e , howe e , he p obabili y
dis ibu ion seems o be mo e dispe sed. The a e age
alues o his social ne wo k, Facebook and Ins a-
g am a e 3.898, 3.474 and 2.996, espec i ely, which
means ha Ins ag am use s will expe ience smalle
a e age delays o he same le el o (maximum) p i-
acy p o ec ion.
In he case o “ andom” de e al (Figs. 11(d- )), no
en i ely unexpec edly we spo mo e sca e ed dis i-
bu ions o ¯
δ|ϕ=ϕc i . Fo example, in he h ee da a se s
conside ed in hese expe imen s, we no ice expec ed
delays o up o 14 hou s, whe eas he maximum alue
p o ided by ou op imized de e al s a egy was 9.05
hou s. In addi ion, we obse e ha he mean alues

17
0 2 4 6 8 10
7
/[hou ]
0
1
2
3
4
5
6
7
Use s [%]
(a) Twi e .
0 2 4 6 8 10
7
/[hou ]
0
1
2
3
4
5
6
7
Use s [%]
(b) Facebook.
02468
7
/[hou ]
0
1
2
3
4
5
6
7
Use s [%]
(c) Ins ag am.
0 2 4 6 8 10 12 14 16
7
/[hou ]
0
2
4
6
8
10
Use s [%]
(d) Twi e .
0 2 4 6 8 10 12 14 16
7
/[hou ]
0
2
4
6
8
10
Use s [%]
(e) Facebook.
0 2 4 6 8 10 12 14 16
7
/[hou ]
0
1
2
3
4
5
6
7
Use s [%]
Random
De e al
( ) Ins ag am.
Fig. 11: PMFs o he expec ed delay when all use s apply a de e al a e ϕ=ϕc i , o he op imized de e al s a egy p oposed in his
wo k and o he nai e “ andom” delay mechanism desc ibed in Sec. 6.2.
o he Twi e , Facebook and Ins ag am da a se s
a e signi ican ly g ea e han hose exhibi ed by ou
mechanism. In pa icula , hese mean alues show
an inc ease o 67.8% (Twi e ), 24.5% (Facebook) and
66.3% (Ins ag am) wi h espec o op imized de e al.
Fig. 12 shows he bu e capaci y o he op imized
de e al mechanism and o he uni o m s a egy de-
sc ibed in Sec. 6.2. Analogously o Fig. 11, hese esul s
ha e been ob ained unde he assump ion ha use s
choose a de e al a e ϕ=ϕc i as gi en by (4).
F om Fig. 12(a), we no ice ha he minimum, mean
and maximum alues o C|ϕ=ϕc i a e 8.92, 31.24 and
63.52% o Twi e use s’ messages. Simila esul s
a e obse ed o he o he wo da a se s. In he
case o Facebook and Ins ag am, hough, we no ice
sligh ly smalle mean alues o capaci y. In pa icula ,
Figs. 12(b-c) show an expec ed bu e size o 28.31%
and 27.75% o use s’ messages, espec i ely.
In he case o a uni o m delay s a egy, we obse e
use s wi h bu e capaci ies a ound 1% o Twi e ,
and app oxima ely 3% and 2% o Facebook and
Ins ag am. This is in s a k con as o he de e al
mechanism in es iga ed in his wo k, which, acco d-
ing o hese expe imen s, equi es a minimum o
10% o message-s o age capaci y o a ain he c i ical
p i acy. We no e, howe e , ha hese smalle alues o
capaci y (obse ed o uni o m de e al) do no imply
ha use s will achie e he maximum le el o p i acy.
In ac , as we commen ed in Sec. 6.2, he nai e de e al
s a egy achie es c i ical p i acy i , and only i , ϕ= 1.
Finally, we no ice ha he mean alues o capaci y
o he Twi e , Facebook and Ins ag am da a se s a e
17.7%, 18.6% and 11.6% o use messages.
The second se o expe imen s con empla es a
scena io whe e all use s apply he h ee p i acy-
enhancing mechanisms unde s udy, by using a com-
mon message de e al and o ge y a e. No e ha , in
p ac ice, each use would con igu e his a e indepen-
den ly, acco ding o hei speci ic p i acy and u ili y
equi emen s. Unde he assump ion o a common
a e, Fig. 13 shows he p i acy p o ec ion achie ed
by hose use s in e ms o pe cen ile cu es (10 h,
50 h and 90 h) o ela i e p i acy gain. In he case
o op imized de e al and o ge y, hese esul s ha e
been ob ained by applying he closed- o m exp ession
o he op imal s o ing and o wa ding s a egies de-
i ed in [46]. Speci ically, we compu ed he op imal
s a egies o each use o 100 uni o mly dis ibu ed
alues o ϕ, ρ ∈[0,0.999].
We s a ou analysis o his igu e wi h op imized
de e al and he Twi e da a se . In Fig. 13(a), we
obse e how he pe cen ile cu es o ela i e p i acy
gain inc ease wi h ϕun il a ce ain a e, beyond which
hese cu es a e cons an . This is consis en wi h he
ac ha use s a ain he maximum le el o p i acy,
log n, o ϕ⩾ϕc i . An in e es ing conclusion ha can
be d awn om his igu e is ha Twi e will equi e
ela i ely small ma gins o p i acy gain o achie e
he c i ical-p i acy le el. This may be obse ed, o
example, o ϕ= 0.60, i.e., when almos all use s
ge hei maximum le el o p i acy, acco ding o
Fig. 10(a). Conc e ely, o his alue o ϕ, he 10 h, 50 h
and 90 h pe cen ile cu es show p i acy gains o only
4.59%, 10.78% and 27.60%, espec i ely.
When he s a egy is o pos alse messages, a he
han delaying hem, we obse e pe cen ile cu es
wi h a lowe a e o inc ease han o op imized
18
0 10 20 30 40 50 60 70 80
C[%]
0
1
2
3
4
5
6
7
Use s [%]
(a) Twi e .
0 10 20 30 40 50 60 70
C[%]
0
1
2
3
4
5
6
7
Use s [%]
(b) Facebook.
0 10 20 30 40 50 60
C[%]
0
1
2
3
4
5
6
7
Use s [%]
(c) Ins ag am.
0 10 20 30 40 50 60 70 80
C[%]
0
1
2
3
4
5
6
7
Use s [%]
(d) Twi e .
0 10 20 30 40 50 60 70 80
C[%]
0
1
2
3
4
5
6
7
Use s [%]
(e) Facebook.
0 10 20 30 40 50 60 70 80
C[%]
0
1
2
3
4
5
6
7
Use s [%]
Random
De e al
( ) Ins ag am.
Fig. 12: Bu e capaci y o di e en alues o he message-de e al a e, and o he op imized and uni o m de e al s a egies. The bu e
equi emen s a e exp essed in ela i e e ms, compa ed o use s’ ac i i y.
de e al. Fo example, while he 90 h pe cen ile cu e
a ains i s maximum alue, 28.41%, o ϕ≃0.49, mes-
sage o ge y does no p o ide his le el o p o ec ion
e en o ρ= 0.999 (see Fig. 13(b). A simila beha io
is obse ed o he 10 h and 50 h pe cen ile cu es.
In he special case o uni o m de e al, we no ice
ha o alues o ϕsmalle han 0.69 app oxima ely,
he 90 h pe cen ile cu e is lowe han ha o message
o ge y. Howe e , o ϕ > 0.69, he end is e e sed
and use s sa egua d hei p i acy mo e e icien ly by
applying uni o mly dis ibu ed delays. This, hough,
should come as no su p ise, as acco ding o Figs. 10(d-
) message o ge y exhibi s an a e age ρc i >1.794 in
he h ee da a se s. In o he wo ds, use s applying uni-
o m de e al a ain highe alues o p i acy gain o
la ge pe u ba ion a es, when compa ed o o ge y.
Simila conclusions can be de i ed om he Face-
book and Ins ag am da a se s, wi h he main e-
sul being ha op imized de e al again ou pe o ms
o ge y and uni o m delay. F om Fig. 13(b,e,h), we
obse e ha o ϕ= 0.39, 90% o Facebook use s
ob ain a ela i e p i acy gain g ea e han 21.6%. Fo
an iden ical alue o o ge y a e, he submission o
alse messages by ha same ac ion o use s would
inc ease hei p i acy by a leas 16.8%, almos 5 pe -
cen age poin s below op imized de e al. In he case
o uni o m de e al, his di e ence is accen ua ed o
ha de e al a e; we see 2.5 pe cen age poin s below
o ge y. Howe e , o ϕ > 0.71, he 90 h pe cen ile
cu e su passes ha o message o ge y.
On he o he hand, he di e ences in ela i e p i-
acy gain be ween he h ee da a se s can be ex-
plained on he basis o he ini ial p i acy alues. The
ac ha we ha e smalle alues o p i acy gain o
Ins ag am use s is solely because hese use s ha e
mo e la ened p o iles han hose o Facebook and
Twi e . In pa icula , he a e age ini ial p i acy (i.e.,
when ϕ=ρ= 0) is 4.0230, 4.0410 and 4.1067 bi s
o he use s o Twi e , Facebook and Ins ag am,
espec i ely.
The upsho o his analysis o he h ee echnologies
in e ms o c i ical a e, delay, capaci y and p i acy
gain, is ha ou PET s a egy o e s be e p i acy
gua an ees o any o he u ili y me ics conside ed
in hese expe imen s. Fo a gi en ϕ, he uni o m
s a egy may lead o smalle expec ed delays and
bu e capaci ies, bu ob iously he le el o p i acy a -
ained is no compa able o ha o op imized de e al
and o ge y. This esul is ue only o o ge y a es
oughly on he in e al [0,0.7]. Fo la ge alues o ϕ,
uni o m de e al is mo e e ec i e in p o ec ing use
p i acy han o ge y. As men ioned abo e, his is due
o he ac ha he o ge y mechanism equi es la ge
a es o alse messages, compa ed o uni o m de e al
(ϕc i = 1) and op imized de e al (ϕc i ∈[0.01,0.67]
om Figs. 10(a-c)).
Ha ing examined he impac o ou p i acy mech-
anism on message delay, capaci y and use p i acy,
now we look a he e ec i migh ha e om he
poin o iew o a ic load. Recall ha he objec i e o
message de e al is o maximize he Shannon en opy
o he appa en p o ile and hus o sp ead use ac i i y
uni o mly o e ime. This is ob iously bene icial om
he s andpoin o use p i acy, as we ha e obse ed
in ou p e ious se ies o expe imen s. Bu a he same
ime, en opy maximiza ion may help social ne wo k-
ing si es manage hei ne wo king esou ces mo e
19
0 0.2 0.4 0.6 0.8 1
'
0
5
10
15
20
25
30
Rela i e p i acy gain [%]
(a) Twi e .
0 0.2 0.4 0.6 0.8 1
'
0
5
10
15
20
25
30
Rela i e p i acy gain [%]
(b) Facebook.
0 0.2 0.4 0.6 0.8 1
'
0
5
10
15
20
25
30
Rela i e p i acy gain [%]
(c) Ins ag am.
0 0.2 0.4 0.6 0.8 1
;
0
5
10
15
20
25
30
Rela i e p i acy gain [%]
(d) Twi e .
0 0.2 0.4 0.6 0.8 1
;
0
5
10
15
20
25
30
Rela i e p i acy gain [%]
(e) Facebook. ( ) Ins ag am.
0 0.2 0.4 0.6 0.8 1
'
0
5
10
15
20
25
30
Rela i e p i acy gain [%]
(g) Twi e .
0 0.2 0.4 0.6 0.8 1
'
0
5
10
15
20
25
30
Rela i e p i acy gain [%]
(h) Facebook.
0 0.2 0.4 0.6 0.8 1
'
0
5
10
15
20
25
30
Rela i e p i acy gain [%]
10 h pe cen ile
50 h pe cen ile
90 h pe cen ile
(i) Ins ag am.
Fig. 13: Pe cen ile cu es o ela i e p i acy gain o di e en alues o ϕ, o he h ee p i acy echnologies examined in hese expe imen s,
and o ou Twi e , Facebook and Ins ag am da a se s.
e icien ly, as ou mechanism con ibu es o dis ibu e
he message a ic load e enly.
Fig. 14 illus a es his poin . In pa icula , i shows
he pe cen age o messages pos ed o Twi e by ou
se o use s wi hin a day. Since we compu ed his as
he agg ega ed p o ile o all use s, we e e o i as
he popula ion’s p o ile p. The modi ied e sion o his
ela i e his og am due o ou mechanism is deno ed
by p0. We ha e ep esen ed his p o ile by assuming
ha all use s apply a common message-de e al a e.
No en i ely unexpec edly, Fig. 14(a) shows ha he
ime slo s mos a ec ed by ou PET a e hose wi h
he lowes and highes ac i i y. This is he case o he
in e als 5, 6, 7 and 8 on he one hand, and 15, 16,
17, 18 and 19 on he o he . Fo his ela i ely small
alue o de e al a e, he numbe o messages pos ed
be ween 6 a.m. and 7 a.m. is inc eased by 44.68%,
whe eas he amoun o messages sen be ween 16 p.m.
and 17 p.m. is educed by 12.50%. In Fig. 14(d), ϕ≃
0.4844 and he o e all p o ile o ac i i y p0becomes
nea ly uni o m. In his las case, he la ges inc ease
in he numbe o wee s is obse ed o he ime slo 7,
while he la ges educ ion in he numbe o wee s is
spo ed o he ime pe iod 17. In pa icula , in hose
ime in e als we obse e an inc ease and a educ ion
o 106.03% and 32.65%, espec i ely. In summa y,
should ou da a se be ep esen a i e o he whole
popula ion o Twi e use s, he ex ensi e applica ion
o he p oposed PET could educe subs an ially he
numbe o ne wo king esou ces and maximize he
e iciency o such esou ces.
7 CONCLUSIONS AND FUTURE WORK
Mo i a ed by he lack o p e ious wo ks speci ically
add essing he h ea o ime p o iling in social ne -
wo ks, as well as he dange ha such ype o a ack
en ails, he pape a hand p esen s an op imized,
delay-based mechanism. This app oach consis s in
an in elligen delay o a gi en numbe o messages
pos ed by use s in social ne wo ks in a manne ha
he obse ed p o iles gene a ed by he a acke do no
b eak he p i acy o hose use s. In o he wo ds, he
a acke is unable o in e any ime-based sensi i e
in o ma ion by jus obse ing and logging he imes-
amp o each in e ac ion o he end use s wi h he
social ne wo king si es.
20
1 4 7 10 13 16 19 22 24
0
2
4
6
8
Time o day [hou ]
Rela i e equency o ac i i y [%]
(a) ϕ≃0.1221.
1 4 7 10 13 16 19 22 24
0
2
4
6
8
Time o day [hou ]
Rela i e equency o ac i i y [%]
(b) ϕ≃0.2422.
1 4 7 10 13 16 19 22 24
0
2
4
6
8
Time o day [hou ]
Rela i e equency o ac i i y [%]
(c) ϕ≃0.3633.
1 4 7 10 13 16 19 22 24
0
2
4
6
8
Time o day [hou ]
Rela i e equency o ac i i y [%]
p
p
(d) ϕ≃0.4844.
Fig. 14: Rela i e his og am o he wee s in ou da a se wi hin one day. We deno e his his og am as p. As a consequence o he op imized
de e al o hose wee s, he p o ile p esul s in he modi ied p o ile p0.
Mo eo e , a de ailed a chi ec u e implemen ing his
mechanism has been desc ibed and analyzed, show-
ing he easibili y o ou p oposal. Ye , any PET
comes a he cos o ce ain u ili y loss. Hence, we
ha e s udied wo meaning ul u ili y me ics speci ic
o ou sma de e al mechanism (bo h in e ms o
he message de e al a e), namely: expec ed message
delay and messages s o age capaci y. As shown, bo h
me ics exhibi an inc easing, nonlinea beha io wi h
ega ds o he de e al a e. When he c i ical de e al
a e (beyond which he maximum le el o p i acy is
a ained) is known, hose ou comes become ema k-
ably help ul o assess he op imal capaci y o he
messages bu e , as well as he a e age expec ed delay
o each message in he sys em.
Finally, a comp ehensi e se o expe imen s has
been conduc ed on h ee o he mos popula social
ne wo ks, Facebook, Ins ag am and Twi e , analyz-
ing he beha io o 1 283 use s, demons a ing he
sui abili y o ou solu ion and compa ing i wi h wo
da a-pe u ba i e p i acy echnologies. In pa icula ,
i has been p o ed ha mos o he s udied use s
will no equi e delaying a la ge pe cen age o hei
wee s o hei appa en p o iles o become he uni-
o m dis ibu ion. Likewise, use s in ou da a se will
equi e ela i ely small ma gins o p i acy gain o
achie e he c i ical-p i acy le el. Ano he in e es ing
conclusion s a es ha ou app oach may help social
ne wo king si es manage hei ne wo king esou ces
mo e e icien ly, as i con ibu es o dis ibu e he
a ic load e enly. Fu he mo e, he mean alues o
he messages expec ed delay and messages s o age
capaci y in ou expe imen s, espec i ely, was 3.89
hou s and 31.24% o use s’ messages.
As o he u u e esea ch lines de i ed om his
wo k, we a e in es iga ing some o he assump ions
made in his wo k. Thus o ins ance, since we ac-
knowledge ha he use ac i i y may a y signi i-
can ly o e ime, we need o conside his ac in o de
o pe iodically upda e use s’ p o iles. In he same di-
ec ion, we wan o s udy he boo s apping p oblem,
i.e., how o de ine use s’ p o iles when he sys em
is launched o he i s ime, o while he sys em is
lea ning he ac ual use s’ p o iles. Las bu no leas ,
we also aim a in es iga ing he challenges de i ed
om deploying and implemen ing ou solu ion o e
a eal en i onmen , such as hose ela ed o he ac
ha use s may in ac exhibi ac i i y p o iles wi h
speci ic ac i e ime pe iods.
REFERENCES
[1] D. Rosenblum, “Wha anyone can know: The p i acy isks o
social ne wo king si es,” IEEE Secu ., P i ., ol. 5, no. 3, pp.
40–49, 2007.
[2] R. Hea he ly, M. Kan a cioglu, and B. Thu aisingham, “P e-
en ing p i a e in o ma ion in e ence a acks on social ne -
wo ks,” IEEE T ansac ions on Knowledge and Da a Enginee ing,
ol. 25, no. 8, pp. 1849–1862, 2013.
21
[3] J. Lindamood, R. Hea he ly, M. Kan a cioglu, and B. Thu ais-
ingham, “In e ing p i a e in o ma ion using social ne wo k
da a,” in P oceedings o he 18 h in e na ional con e ence on Wo ld
wide web. ACM, 2009, pp. 1145–1146.
[4] F. G´
omez M´
a mol, M. Gil P´
e ez, and G. Ma ´
ınez P´
e ez,
“Repo ing O ensi e Con en in Social Ne wo ks: Towa d
a Repu a ion-based Assessmen App oach,” IEEE In e ne
Compu ing, ol. 18, no. 2, pp. 32–40, 2014. [Online]. A ailable:
h p://dx.doi.o g/10.1109/MIC.2013.132
[5] S. Pina Ros, A. Pina Canelles, M. Gil P´
e ez, F. G´
omez M´
a mol,
and G. Ma ´
ınez P´
e ez, “Chasing o ensi e conduc s in social
ne wo ks: A epu a ion-based p ac ical app oach o F isbe ,”
ACM T ansac ions on In e ne Technology, ol. 15, no. 4, pp. 1–20,
2015. [Online]. A ailable: h p://dx.doi.o g/10.1145/2797139
[6] Z. Younis and R. A. Kha ib, “T ending in amadan
— Wha do people wee abou du ing he holy
mon h?” The Online P ojec , Tech. Rep., 2014.
[Online]. A ailable: h p://www. heonlinep ojec .me/ iles/
epo s/T ending in Ramadan - English1.pd
[7] “Social media in amadan — Explo ing a ab use habi s
on Facebook and Twi e ,” The Online P ojec , Tech. Rep.,
2013. [Online]. A ailable: h p:// heonlinep ojec .me/ iles/
newsle e s/Social-Media-in-Ramadan-Repo -English.pd
[8] L. Bilge, T. S u e, D. Balza o i, and E. Ki da, “All you con-
ac s belong o us: Au oma ed iden i y he a acks on social
ne wo ks,” in P oc. ACM In . WWW Con ., Sanibel Island, FL,
May 2009, pp. 551–560.
[9] J. R. Douceu , “The sybil a ack,” in P oc. In . Wo kshop Pee -
o-Pee Sys . (IPTPS). London, UK: Sp inge -Ve lag, 2002, pp.
251–260.
[10] H. Yu, M. Kaminsky, P. B. Gibbons, and A. Flaxman, “Sybil-
Gua d: De ending agains Sybil a acks ia social ne wo ks,”
in P oc. ACM Con . Special In e es G oup Da a Commun. (SIG-
COMM), Pisa, I aly, Sep. 2006, pp. 267–278.
[11] H. Yu, P. B. Gibbons, M. Kaminsky, and F. Xiao, “Sybillimi :
A nea -op imal social ne wo k de ense agains sybil a acks,”
IEEE/ACM T ans. Ne w., ol. 18, no. 3, pp. 885–898, Jun. 2010.
[12] B. Zhou and J. Pei, “P ese ing p i acy in social ne wo ks
agains neighbo hood a acks,” in P oc. IEEE In . Con . Da a
Eng. (ICDE), Canc´
un, Mexico, Ap . 2008, pp. 506–515.
[13] ——, “The k-anonymi y and l-di e si y app oaches o p i-
acy p ese a ion in social ne wo ks agains neighbo hood
a acks,” Knowl., In o m. Sys ., ol. 28, no. 1, pp. 47–77, 2011.
[14] X. Shen, B. Tan, and C. Zhai, “P i acy p o ec ion in
pe sonalized sea ch,” ACM Spec. In e es G oup In o m. Re ie al
(SIGIR) Fo um, ol. 41, no. 1, pp. 4–17, Jun. 2007. [Online].
A ailable: h p://doi.acm.o g/10.1145/1273221.1273222
[15] D. Chaum, “Un aceable elec onic mail, e u n add esses, and
digi al pseudonyms,” Commun. ACM, ol. 24, no. 2, pp. 84–88,
1981.
[16] L. Co ell, “Mixmas e and emaile a acks,” 1994.
[Online]. A ailable: h p://obscu a.com/∼loki/ emaile /
emaile -essay.h ml
[17] G. Danezis, “Mix-ne wo ks wi h es ic ed ou es,” in P oc. In .
Symp. P i . Enhanc. Technol. (PETS). Lec u e No es Compu .
Sci. (LNCS), 2003, pp. 1–17.
[18] D. Kesdogan, J. Egne , and R. B¨
uschkes, “S op-and-go mixes:
P o iding p obabilis ic anonymi y in an open sys em,” in P oc.
In o m. Hiding Wo kshop (IH). Sp inge -Ve lag, Ap . 1998, pp.
83–98.
[19] O. Be hold, A. P i zmann, and R. S and ke, “The disad an-
ages o ee MIX ou es and how o o e come hem,” in P oc.
Design. P i . Enhanc. Technol.: Wo kshop Design Issues Anon.,
Unobse ., se . Lec u e No es Compu . Sci. (LNCS). Be keley,
CA: Sp inge -Ve lag, Jul. 2000, pp. 30–45.
[20] C. D´
ıaz, S. Seys, J. Claessens, and B. P eneel, “Towa ds mea-
su ing anonymi y,” in P oc. In . Symp. P i . Enhanc. Technol.
(PETS), se . Lec u e No es Compu . Sci. (LNCS), ol. 2482.
Sp inge -Ve lag, Ap . 2002, pp. 54–68.
[21] A. Se jan o and G. Danezis, “Towa ds an in o ma ion heo-
e ic me ic o anonymi y,” in P oc. In . Symp. P i . Enhanc.
Technol. (PETS), ol. 2482. Sp inge -Ve lag, 2002, pp. 41–53.
[22] S. S einb eche and S. Kopsell, “Modelling unlinkabili y,” in
P oc. In . Symp. P i . Enhanc. Technol. (PETS). Sp inge -Ve lag,
2003, pp. 32–47.
[23] C. D´
ıaz, “Anonymi y and p i acy in elec onic se ices,” Ph.D.
disse a ion, Ka holieke Uni . Leu en, Dec. 2005.
[24] D. Rebollo-Monede o and J. Fo n´
e, “Op imal que y o ge y
o p i a e in o ma ion e ie al,” IEEE T ans. In o m. Theo y,
ol. 56, no. 9, pp. 4631–4642, 2010.
[25] D. C. Howe and H. Nissenbaum, Lessons om he Iden i y
T ail: P i acy, Anonymi y and Iden i y in a Ne wo ked Socie y.
NY: Ox o d Uni . P ess, 2009, ch. T ackMeNo : Resis ing
su eillance in Web sea ch, pp. 417–436. [Online]. A ailable:
h p://m l.nyu.edu/∼dhowe/ ackmeno
[26] J. Pa a-A nau, A. Pe ego, E. Fe a i, J. Fo n´
e,
and D. Rebollo-Monede o, “P i acy-p ese ing enhanced
collabo a i e agging,” IEEE T ans. Knowl. Da a Eng.,
ol. 26, no. 1, pp. 180–193, Jan. 2014. [Online]. A ailable:
h p://dx.doi.o g/10.1109/TKDE.2012.248
[27] J. Pa a-A nau, D. Rebollo-Monede o, J. Fo n´
e, J. L. Mu˜
noz,
and O. Espa za, “Op imal ag supp ession o p i acy
p o ec ion in he seman ic Web,” Da a, Knowl. Eng., ol.
81–82, pp. 46–66, No . 2012. [Online]. A ailable: h p:
//dx.doi.o g/10.1016/j.da ak.2012.07.004
[28] M. Deng, “P i acy p ese ing con en p o ec ion,” Ph.D. dis-
se a ion, Ka holieke Uni . Leu en, Jun. 2010.
[29] B. N. Le ine, M. K. Rei e , C. Wang, and M. W igh , “Timing
a acks in low-la ency mix sys ems,” in P oc. In . Financial
C yp og . Con . Sp inge -Ve lag, Feb. 2004, pp. 251–265.
[30] K. Baue , D. McCoy, D. G unwald, T. Kohno, and D. Sicke ,
“Low- esou ce ou ing a acks agains anonymous sys ems,”
Uni e si y o Colo ado, Tech. Rep., 2007.
[31] S. J. Mu doch and G. Danezis, “Low-cos a ic analysis o
o ,” in P oc. IEEE Symp. Secu ., P i . (SP), May 2005, pp. 183–
195.
[32] B. P i zmann and A. P i zmann, “How o b eak he di ec RSA
implemen a ion o mixes,” in P oc. Annual In . Con . Theo y,
Appl. o C yp og . Techniques (EUROCRYPT). Sp inge -Ve lag,
May 1990, pp. 373–381.
[33] W. M. G ossman, “al .scien ology.wa ,” 1996. [On-
line]. A ailable: www.wi ed.com/wi ed/a chi e/3.12/al .
scien ology.wa p .h ml
[34] “AOL sea ch da a scandal,” Aug. 2006, accessed on 2013-11-
15. [Online]. A ailable: h p://en.wikipedia.o g/wiki/AOL
sea ch da a scandal
[35] “Eu opean da a p o ec ion supe iso ,” May 2013. [Online].
A ailable: h p://www.edps.eu opa.eu
[36] “Twi e cha s - xe e .” [Online]. A ailable: h p://xe e .
com/ wi e /
[37] Y. Xu, K. Wang, B. Zhang, and Z. Chen, “P i acy-enhancing
pe sonalized Web sea ch,” in P oc. In . WWW Con . ACM,
2007, pp. 591–600.
[38] S. Ye, F. Wu, R. Pandey, and H. Chen, “Noise injec ion o
sea ch p i acy p o ec ion,” in P oc. In . Con . Compu . Sci., Eng.
IEEE Compu . Soc., 2009, pp. 1–8.
[39] A. E ola, J. Cas ell`
a-Roca, A. Viejo, and J. M. Ma eo-Sanz,
“Exploi ing social ne wo ks o p o ide p i acy in pe sonalized
Web sea ch,” J. Sys ., So w., ol. 84, no. 10, pp. 1734–745, 2011.
[Online]. A ailable: h p://www.sciencedi ec .com/science/
a icle/pii/S0164121211001117
[40] J. Pa a-A nau, D. Rebollo-Monede o, and J. Fo n´
e,
“Measu ing he p i acy o use p o iles in pe sonalized
in o ma ion sys ems,” Fu u e Gen. Compu . Sys . (FGCS), Special
Issue Da a, Knowl. Eng., ol. 33, pp. 53–63, Ap . 2014. [Online].
A ailable: h p://dx.doi.o g/10.1016/j. u u e.2013.01.001
[41] M. Hildeb and , J. Backhouse, V. And onikou, E. Benois ,
A. Canho o, C. Diaz, M. Gasson, Z. Ge ad s, M. Mein s,
T. Nabe h, J. P. V. Bendegem, S. V. de Ho , A. Vedde ,
and A. Yannopoulos, “Desc ip i e analysis and in en o y o
p o iling p ac ices – deli e able 7.2,” Fu u e Iden i y In o m.
Soc. (FIDIS), Tech. Rep., 2005.
[42] M. Hildeb and and S. Gu wi h, Eds., P o iling he Eu opean
Ci izen: C oss-Disciplina y Pe spec i es. Sp inge -Ve lag, 2008.
[43] E. T. Jaynes, “On he a ionale o maximum-en opy me hods,”
P oc. IEEE, ol. 70, no. 9, pp. 939–952, Sep. 1982.
[44] T. M. Co e and J. A. Thomas, Elemen s o In o ma ion Theo y,
2nd ed. New Yo k: Wiley, 2006.
[45] S. Boyd and L. Vandenbe ghe, Con ex Op imiza ion. Cam-
b idge, UK: Camb idge Uni e si y P ess, 2004.
[46] J. Pa a-A nau, D. Rebollo-Monede o, and J. Fo n´
e, “Op imal
o ge y and supp ession o a ings o p i acy enhancemen
in ecommenda ion sys ems,” En opy, ol. 16, no. 3, pp.

22
1586–1631, Ma . 2014. [Online]. A ailable: h p://www.mdpi.
com/1099-4300/16/3/1586
[47] T. M. Apos ol, Ma hema ical Analysis. A Mode n App oach o
Ad anced Calculus, 2nd ed. Addison Wesley, 1974.
[48] B. Viswana h, A. Mislo e, M. Cha, and K. P. Gummadi, “On
he e olu ion o use in e ac ion in acebook,” in P oceed-
ings o he 2nd ACM SIGCOMM Wo kshop on Social Ne wo ks
(WOSN’09), Augus 2009.
[49] E. Fe a a, R. In e dona o, and A. Taga elli, “Online popula i y
and opical in e es s h ough he lens o ins ag am,” in P oc.
ACM Con . Hype ex , Soc. Media (HT), 2014, pp. 24–34.