Privacy-preserving data publishing has emerged as a prominent research focus [22]. Currently, the anonymous publishing of social network graphs has received a lot of attention and attracted many researchers to develop advanced methods. k-anonymity [23], as a promising technique, ensures that each node in the anonymized graph is indistinguishable from at least k−1 other nodes based on certain key attributes. If an adversary possesses private attributes of a target node, k-anonymity can prevent him from re-identifying the target node from at least k query results, as there are no significant differences among these results. Xiang et al. [13] proposed a tree-based k-degree anonymity (TKDA) method, which dynamically modifies edges in the original graph using a depth-first traversal algorithm. Lin et al. [14] proposed a novel k-degree anonymity method, which clustered groups of nodes through a greedy partitioning algorithm and then added edges for each group to increase the degree of the node to the maximum. Kaur et al. [15] proposed k-NeuroSVM, which classifies nodes in the original graph using Neural Networks (NN) and SVM into various groups. They add reasonable noise nodes into each group to meet the k-degree anonymity requirement while maintaining similarity with the original graph. However, these degree-based methods cannot completely resist re-identification attacks from an adversary with knowledge about the structural subgraph of a target node. To defend against this attack, k-isomorphism anonymity method [16] is proposed, which makes each node in the anonymized graph have corresponding k same neighborhood subgraphs. This prevents adversaries from accurately recognizing the identity of the target node due to the indistinguishability of queried neighborhood subgraphs. Zhang et al. [17] proposed GPPS, which achieves the indistinguishability of 1-neighborhood structures of each node in the anonymized graph. However, this method cannot guard against structural subgraph attacks beyond the 1-neighborhood range. Ren et al. [18] proposed a (α,β,l,k)-anonymity method, which can effectively resist the combination attack including d-neighborhood attack, homogeneity attack, and background knowledge attack.

The above researches indicate that the k-isomorphism anonymity method is popular for protecting nodes’ identities and edge relationships. However, this method removes all edges between k isomorphic subgraphs, which decreases the utility of the anonymized graph. k-automorphism anonymity [19] is considered as a good solution. It retains the edges between k isomorphic subgraphs as much as possible, which reduces the loss of the original edges. Therefore, this paper obtains the anonymized dynamic graphs with better utility based on the k-automorphic anonymity method.

In real life, social network graphs are dynamic. The static graph anonymization methods mentioned above cannot be directly applied to dynamic graph anonymization. The main reason is that the adversary can easily re-identify nodes’ identities and edge relationships through differences between anonymized graphs at adjacent timestamps. As the research presented in [20], Zhang et al. proposed DSNDG-KIODA, which only considers nodes’ degree anonymization at the corresponding timestamp. The newly added/removed nodes/edges can be re-identified by differences in node structures between two anonymized graphs at adjacent timestamps. To address this issue, Hoang et al. proposed two time-varying attribute degree anonymity methods ((k,l)-sad, kw-tad) [8,9] based on clustering generalization, which can simultaneously protect users’ identities and their sensitive attributes. However, clustering anonymization needs to repeatedly cluster changed groups at different timestamps, making the overall anonymization process inconvenient. Therefore, based on this challenge, this paper minimizes the redundant operations of the original graph anonymization at updated timestamps, facilitating the process of dynamic graph anonymization.

The community structure is an important feature of a social network graph, and it is necessary to preserve the structural features of the original graph while achieving the anonymization of nodes’ identities and edge relationships. Zhang et al. [10] proposed a graph perturbation method (PrivCom) based on node-level differential privacy (node-DP), which maximally preserves the community structure of the original graph by a Katz index-based graph feature extraction algorithm. Based on deep learning techniques, Xiang et al. [11] proposed a graph generation model (CPGAN) with community structure protection, and this model presents good scalability on large graphs. With the aim of protecting community structures and node attributes, Ren et al. [21] proposed a kt-security anonymity method by combining k-anonymity and t-closeness to achieve anonymous publishing of the original graph. However, the above methods only can guarantee the protection of graph structures on static graphs, while they are ineffective for the dynamic protection of community structures of the original graph at different timestamps. Therefore, this paper considers the protection of the original graph structure at each timestamp, ensuring that the changed community structures over time can be protected dynamically.

Based on the above issues, this paper proposes a dynamic social network graph anonymity scheme with community structure protection (DSNGA-CSP). DSNGA-CSP achieves anonymization of nodes’ identities and edge relationships. To improve the utility of anonymized dynamic graphs, we preserve more structural information from the original graph at each timestamp. Additionally, a new information loss metric is defined to measure the utility of anonymized dynamic graphs more accurately.

Given an original graph sequence G={Gt1,⋯,Gtw} during time periods t1∼tw, to protect identities of users, data provider publishes the anonymized versions G′={Gt1′,⋯,Gtw′} of the original graph sequence. By monitoring the published anonymized graphs, an adversary can extract all nodes’ information (e.g., degree and subgraph structure) from G′. When the adversary masters the real information related to nodes and edges in the original graph (e.g., the user’s name and the friendship between two users with real names at a specific timestamp), he/she can re-identify nodes’ identities and edge relationships by observing the difference between two anonymized graphs at adjacent timestamps. The following example illustrates the aforementioned adversary attack:

Fig. 1 represents a 2-degree anonymous graph sequence being published during time periods t1∼t3. That is, each node in each anonymized graph has the indistinguishable degree with at least k−1 other nodes in the anonymized graph. To obtain 2-degree anonymous graphs, the solid red lines in (d)–(f) are added, respectively. Although each graph in (d)–(f) meets 2-degree anonymity, the adversary can easily re-identify the real identities of v9 and v2 by comparing the difference among three anonymized graphs. For instance, the adversary is convinced that v9 is a newly added node at timestamp t2 by observing Gt1′ and Gt2′, and v2 is a deleted node at timestamp t3 by observing Gt2′ and Gt3′. Similarly, the adversary can infer that the edge (v5,v7) is a newly added edge at timestamp t2 by observing Gt1′ and Gt2′. Suppose the adversary knows that Alice is a new user added to the graph Gt2 at timestamp t2, he can re-identify v9 as Alice. In the same way, the real identity of v2 and the real connection of (v5,v7) can also be completely re-identified by him.

Problem statement. Given w undirected and unlabeled graphs {Gt1,⋯,Gtw} during the time periods t1∼tw, and {Gt1′,⋯,Gtw′} are their anonymized graphs. No third party or service provider can re-identify a user’s sensitive information from w anonymized graphs. However, the third party can still perform graph-related analysis and mining tasks.

This paper considers the protection of the original graph structure, so we first detect communities of the original graph at each timestamp. Then, based on graph isomorphism and graph automorphism, we obtain w anonymized graphs. Since the graph automorphism method reflects the symmetry of the graph, it can effectively resist re-identification attacks from adversaries due to the indistinguishability of the graph structure. Therefore, we anonymize community subgraphs by the graph automorphism method at each timestamp, preserving both nodes’ identities and real edge relationships. Graph isomorphism is a more generalized form of graph automorphism. We protect real edge relationships between communities through isomorphic anonymization, ensuring the indistinguishability of these edge relationships for adversaries. The definitions of graph isomorphism and graph automorphism are provided below:

Definition 1 (Graph isomorphism). Let G(V,E) and G′(V′,E′) be two graphs. G is isomorphic to G′, if and only if there exists a bijective function f:V→V′, such that for each edge (vi,vj)∈E, there is an edge (f(vi),f(vj))∈E′.

Definition 2 (Graph automorphism). Given a graph G(V,E), an automorphism of G is an bijective function h on the node set V, such that for each edge (vi,vj)∈E, the edge (h(vi),h(vj))∈E. In other words, a graph automorphism maps the graph to itself, preserving the edge relationships between nodes under the function h.

For an automorphic community subgraph, its anonymity level depends on the number of isomorphic subgraphs (i.e., k) within it. A k-automorphic graph is defined as follows:

Definition 3 (K-automorphic graph). Given a graph G′(V′,E′), G′ is called a k-automorphic graph if two conditions are met for each node vi′∈V′: a) There exists k−1 automorphic functions {h1,⋯,hk−1} of G′, and b) hp(vi′)≠hq(vj′), where vi′≠vj′,p≠q.

In this paper, we achieve the anonymous publishing of w original graphs. Thus, we give the definition of anonymous publishing of dynamic graphs as follows:

Definition 4 (Anonymous publishing of dynamic graphs). Let {Gt1(Vt1,Et1),…,Gtw(Vtw,Etw)} be w original graphs during the time periods t1∼tw, where Vti is the set of nodes in Gti, and Eti is the set of edges. We say that {Gt1′(Vt1′,Et1′),⋯,Gtw′(Vtw′,Etw′)} are anonymized graphs corresponding to the w original graphs if there exists a dynamic graph anonymization mechanism M, such that: a) Vti→Vti′,Eti→Eti′, and b) Vti∩M(Vti)≠∅,Eti∩M(Eti)≠∅, where M(Vti) represents the set of nodes in Gti′, and M(Eti) represents the set of edges in Gti′. These w anonymized graphs are then sequentially published to a third party for data analysis.

In this section, the anonymized graph Gt1′ is obtained at the initial timestamp t1. The anonymization process is detailedly described in the following two subsections: initial community detection and initial community anonymity.

In this section, the anonymized graph Gti′ is obtained at timestamp ti,i=2,⋯,w, and the anonymization process includes two steps: dynamic community detection and dynamic community anonymity.

This section provides a new information loss metric. The main reason is: 1) the single graph metric cannot fully measure the information loss of an anonymized graph; 2) current research on measuring the utility of anonymized graphs is almost only from a single perspective, which is the difference between the anonymized graph and the original graph. Thus, we define a new metric from two perspectives: original information preservation and anonymous information change. The former measures the retention of original information in the anonymized graph, while the latter measures the information changes required to achieve anonymity. To unify measurement, this paper takes the inverse of anonymous information change and combines it with original information preservation to determine the information loss of an anonymized graph. The higher the defined metric, the smaller the distortion of the anonymized graph.

Definition 5 (Information loss). At timestamp ti, given a graph Gti, and Gti′ is the anonymized graph of Gti. The information loss ILti consists of two parts: original information preservation IRti and anonymous information change ICti. ICti is determined by two factors: NCti and ECti, which represent the node difference and edge difference between the original graph and the anonymized graph, respectively. ILti is calculated as follows: (1)ILti=IRti+1ICti (2)IRti=12(|∪j=1nNGti(vj)∩NGti′(vj)|∑j=1ndegGti(vj)+|∪j=1nNGti(vj)∩NGti′(vj)|∑j=1ndegGti′(vj)) (3)ICti=NCti+ECti (4)NCti=|ND(Gti′)∪ND(Gti)|−|ND(Gti′)∩ND(Gti)| (5)ECti=|E(Gti′)∪E(Gti)|−|E(Gti′)∩E(Gti)|

where NGti(vj) is the neighbors of node vj in Gti, NGti′(vj) is the neighbors of vj in Gti′, ND(Gti) and E(Gti) are all nodes and edges in Gti, respectively, and ND(Gti′) and E(Gti′) are all nodes and edges in Gti′, respectively.

According to Definition 5, the information loss of the anonymized graphs over w timestamps is calculated as follows: (6)IL=1w∑i=1wILti

For IL, it reflects the average information loss of w anonymized graphs during the time periods t1∼tw. And the larger IL, the better the average utility of w anonymized graphs.

This section proves that DSNGA-CSP can achieve the anonymity of dynamic social network graphs. Specifically, we prove that anonymized graphs obtained by DSNGA-CSP over w timestamps guarantee the anonymization of nodes’ identities and edge relationships in dynamic original graphs, which can effectively resist re-identification attacks from adversaries. The theorem states as follows:

Theorem 1. Let G={Gt1,⋯,Gtw} be w original graphs during the time periods t1∼tw, G′={Gt1′,⋯,Gtw′} is w anonymized graphs obtained by DSNGA-CSP. For each anonymized graph Gti′, the intra-community anonymity achieves k-automorphism, and the inter-community anonymity achieves k-isomorphism.

Proof of Theorem 1. Taking Gti′(i∈{1,⋯,w}) as an example. At timestamp ti,Gti is first detected as multiple disjoint communities. We first prove that the intra-community anonymity of Gti′ achieves k-automorphism. For communities in Cti1, each community subgraph is anonymized by finding its corresponding anonymized subgraph at timestamp ti−1. Since these anonymized community subgraphs were already k-automorphic at timestamp ti−1, the intra-community anonymity of Cti1 satisfies k-automorphism. For communities in Cti2, the anonymity of these community subgraphs satisfies k-automorphism, and the reasons are as follows: 1) Each newly added node belonging to Ctinon is connected pairwise with other nodes in the current community to achieve k-automorphic anonymity. 2) Newly added nodes/edges belonging to Ctikwa or Ctirec are first assigned to k partitioned blocks at timestamp ti−1, and then these k blocks are performed isomorphism and composition algorithms to achieve k-automorphic anonymity of the current community. For communities in Cti3, the anonymity of community subgraphs formed by these communities also satisfies k-automorphism. Since these communities are re-detected at timestamp ti, the community subgraphs formed by Ctinon,Ctikwa, and Ctirec are re-anonymized in the same way with the perturbation of the initial graph. The intra-community anonymity at the initial timestamp satisfies k-automorphism, so the intra-community anonymity related to these communities also satisfies k-automorphism. Next, we prove that the inter-community anonymity of Gti′ achieves k-isomorphism. As described in Algorithm 4, almost all inter-community edges achieve k-isomorphism at the initial timestamp. The inter-community edges related to Cti1 and Cti2 are anonymized by retaining their k-isomorphic state at timestamp ti−1, and the inter-community edges related to Cti3 are re-anonymized to satisfy k-isomorphism. In summary, the anonymized dynamic graphs obtained by DSNGA-CSP satisfy intracommunity k-automorphism and inter-community k-isomorphism. □

According to Theorem 1, this section provides the probability that the anonymized dynamic graphs defend against re-identification attacks, and the lemma is described as follows:

Lemma 1. DSNGA-CSP can resist re-identification attacks from adversaries. If an adversary only has access to a real node and its edge information within the community or real edge information between communities, the probability that he re-identifies the node’s identity and edge relationships does not exceed 1/k.

Proof of Lemma 1. Given w anonymized graphs G′={Gt1′,⋯,Gtw′} during the time periods t1∼tw. For an intra-community real node and its edge information, or inter-community real edge information, we can always find k−1 other information in Gti′(i={1,⋯,w}) matching them. Thus, assume that a query function Q is used to search an intra-community subgraph structure in Gti′. If the query result R(Gti′,Q) is not empty, there always exists k identical results in R(Gti′,Q). The adversary cannot re-identify the identity of the node and its edge relationships from the subgraph structure with a probability greater than 1/k. Similarly, the probability that the adversary re-identifies inter-community edge relationships does not exceed 1/k. □

Five real-world datasets are used in this paper, consisting of two static graph datasets and three dynamic graph datasets. The primary reason for choosing these datasets is their extensive use in prior studies, making them suitable benchmarks for comparison. The two static datasets, with well-documented properties and distinct community structures, help evaluate the effectiveness of our anonymization method in protecting community structures. The three dynamic datasets cover diverse social network scenarios, with varying time spans and edge changes. Shorter time span datasets simulate frequent social changes, while longer ones evaluate performance under long-term dynamics. These datasets allow us to test DSNGA-CSP’s effectiveness, particularly in resisting re-identification attacks and ensuring utility across different temporal characteristics. The statistics and properties of these datasets are presented in Tables 2 and 3, respectively.

Static graph datasets

1) Ca-GrQc [27]: a collaboration network about Arxiv General Relativity. It denotes an author vp co-authored a paper with author vq if there exists an undirected edge from vp to vq.

2) Ca-HepTh [27]: a collaboration network about Arxiv High Energy Physics Theory. An undirected edge (vp,vq) in this graph indicates that an author vp has co-authored a paper with author vq.

Dynamic graph datasets

1) Infectious SocioPatterns [28]: an infectious socio patterns dynamic contact network. An edge (vp,vq) in this graph represents close-range face-to-face proximity between the concerned persons. This paper selects data from the first half of May in 2009 as the dataset Inf_SocPatterns_1, and the second half of May and the first half of June of the same year as the dataset Inf_SocPatterns_2.

2) Email-Eu-core-temporal [29]: an email communication network spanning 803 days. An edge (vp,vq,ti) in this graph represents a person vp who sent an e-mail to person vq at time ti.

3) CollegeMsg [30]: a college messaging temporal network spanning 193 days. An edge (vp,vq,ti) in this graph represents a user vp who sent a private message to the user vq at time ti.

Data preprocessing. To better evaluate DSNGA-CSP, the aforementioned datasets are preprocessed by the following steps: 1) Converting directed graphs to undirected graphs; 2) Removing duplicate edges and loops; 3) Avoiding publishing impractical graphs with very few edges at certain timestamps, each of three dynamic graphs is split into 20 new graphs by merging continuous raw graphs, and all generated new graphs have a similar number of edges.

This section introduces utility metrics and a privacy metric, which are used to evaluate the performance of anonymized graphs obtained by DSNGA-CSP. The utility metrics include two categories: graph analysis metrics and community structure metrics. The first focuses on general graph characteristics, while the second focuses on graph structural features. The first focuses on general graph characteristics to ensure fundamental structural properties like connectivity and centrality are preserved, which is essential for maintaining graph utility in various network analyses. The second focuses on graph structural features, key features representing clusters of users with similar interests or strong interactions. Preserving these structures ensures the anonymized graph remains useful for community-related studies. The privacy metric measures the uncertainty within the anonymized graph, quantifying the difficulty for adversaries to re-identify nodes or infer relationships. These metrics comprehensively evaluate both utility and privacy, providing a well-rounded understanding of the effectiveness of DSNGA-CSP. The metrics used in this paper are as follows:

Graph analysis metrics

1) Average Path Length (APL): the metric measures the average length of all shortest paths in a graph.

2) Average Clustering Coefficient (ACC): the metric is the average of the local clustering coefficients of nodes in a graph, quantifying how close the neighbors of a node are to being a clique.

3) Eigenvector Centrality (EC): the metric quantifies the importance of a node in a graph, and it depends on the neighbors connected with the node. To avoid the influence of acyclic graphs, a constant is added to the denominator position for subsequent error rate calculation.

4) Transitivity (T): the metric measures the number of triangles in a graph.

5) Average Degree (AVD): the metric measures the average degree of all nodes in a graph.

Community structure metrics

The community structure metrics used include: variation of information (VI) [31], adjusted rand index [32], normalized mutual information (NMI) [31], rand index [33], and modularity (mod) [34]. For VI and mod, the optimal value is 0, while for the rest, 1 is the optimal value. To better understand the results of the evaluation, metrics with an optimal value of 1 are inverted. Therefore, the smaller the measurement of these community structure metrics, the smaller the structural changes in the anonymized graph. Moreover, the first four metrics usually require that the two graphs being measured have the same nodes. Thus, we use the induced subgraph of the original and anonymized graphs with the same nodes to approximately measure these metrics.

Privacy metric

The privacy of the anonymized graph is assessed using a metric (i.e., Shannon entropy [35]) introduced in our previous work [36]. Entropy can be used to measure the uncertainty of the anonymized graph, thereby quantifying the degree to which the original graph is anonymized. If the anonymized graph has high uncertainty, it also has high privacy.

Implementation. To verify whether community structure protection can enhance the utility of anonymized graphs, we first evaluate our anonymization method on two static graph datasets, under scenarios involving community detection and those without. We then evaluate the performance of DSNGA-CSP on two dynamic graph datasets. All experiments are conducted on a PC with an Intel Core i5-10500 CPU, 64 GB RAM, and Windows 10 operating system. All schemes are achieved using the R programming language.

Competitors. We compare two static graph anonymity schemes using the k-composition anonymity method. One scheme, DC, detects the communities of the original graph and then performs k-composition anonymity for each community, while the other, Non−DC, applies k-composition anonymity directly to the original graph without community detection. Then, the proposed DSNGA-CSP scheme is compared with two dynamic graph anonymity schemes TAKG and CTKGA reported in [8] and [9], respectively. Since DSNGA-CSP focuses on anonymity in dynamic undirected graphs, it is compared with TAKG and CTKGA applied to undirected graphs.