With the massive use of online social environments and technologies, users' concern regarding the privacy of their own data has significantly increased. In this paper, we present a method to automatically generate explanations in a social network domain. This method uses the available data from the network to anticipate any potential privacy violation, automatically generates explanations, and shows them to the user with the purpose of avoiding the detected violation.
With the continuous increase of the population of online social networks [
This increasing concern about privacy threats in social networks has attracted the
interest of researchers to find effective mechanisms to deal with privacy violations.
Several privacy management assistance tools have been identified in the literature. In
[
As pointed out in [
Computational argumentation has an extensive and successful history of
applications in law [
Therefore, with this work we intend to pave the way for the automatic generation of explanations in the privacy management domain. Thus, we propose an argumentationbased approach to automatically generate such explanations and prevent privacy violations in social networks. With our system, users can receive warnings and explanations from the social network site that will improve their awareness on the potential consequences of their publications. The paper is structured as follows, Section 2 contextualises the framework of the research presented in this work. Section 3 presents the method proposed to automatically generate explanations to prevent privacy violations in social networks. In Section 4, a case study is set to illustrate how the proposed method works. Finally, Section 5 summarises the main concepts presented in this work and proposes the main lines of future work.
The research carried out in this work is based on two main pillars: PESEDIA, an educational social network which is the application domain of the method proposed in this work, and an argumentation framework for online social networks.
PESEDIA is an online social network for educational and research purposes that
includes: (i) the design and development of new metrics to analyse and quantify privacy
risks [
In [
To properly generate explanations in our argumentation system, it is of the utmost
importance to process the features extracted in a coherent way considering the argumentation
framework. Computational arguments must be generated taking those features into
account and finally, the explanations must be built in such a way that they can be interpreted
by humans. It is important to emphasise that, since the implementation has been carried
out in PESEDIA [
Four different features are considered by our proposed method to generate explanations: Privacy Preferences, Trust, Privacy Risk Score (PRS) and Sensitive Content. All those features are retrieved by the feature extraction module that works as an intermediary between the social network and the argumentation system. Two main sources can be identified when regarding the acquisition of the features: user preferences data and publication data.
When sharing content in an online social network, the author must choose the target audience for each publication. For that purpose, privacy selectors such as the one depicted in Figure 1 are available in our educational social network. The options provided to the author as target audiences are the following: public, friends, collections and private. Public is the adequate option to share content with the whole network. With friends option it is possible to share the content only with the friends of the author. Collections are subsets of friends created by each user. Finally, the private option allow authors to keep a publication only visible to themselves. 3.1.2. Trust
On the other hand, when creating a profile in the social network, each user must define the default target audience for their publications. Thus, the feature extraction module will retrieve both, users privacy preferences and the privacy configuration of the publication going to be shared.
When more users than the author are involved in a publication, it is important to respect every user data privacy to prevent multi party privacy conflicts. In PESEDIA, users can evaluate their friendship with a star based rating as depicted in Figure 2. This evaluation is retrieved by the feature extraction module, allowing us to quantify the existing trust between both users.
When sharing content in online social networks, it is hard to estimate the scope of a
publication. The Privacy Risk Score [
The content of the own publication is also an important feature to be considered when
preventing privacy violations. Based in [
Once all the features have been retrieved, the computational arguments are generated. Those arguments are defined by three parameters: the claim, the type and the support. The claim of an argument in this domain can have two perspectives, positive arguments in favour of sharing the publication or negative arguments against doing it. Secondly, each argument can belong to four different classes depending on the source of the features used to generate it: Privacy, Trust, Risk and Content arguments. Finally, the support is a value computed from the extracted features that allow to both, quantify the individual strength of an argument and determine the claim of it.
Privacy arguments are generated from the privacy features. For this purpose, privacy options are represented with the following values: public (0), friends (0.5), collections (0.75) and private (1). Then, the support of the argument is computed as the difference between the author’s default target audience and the publication privacy configuration. If the resulting value is negative, a privacy argument against making the publication will be generated, since the privacy configuration of the publication is less restrictive than the author’s privacy preferences. Conversely, if the resulting value is not negative, a privacy argument in favour of making the publication will be generated.
Trust arguments are generated only when more than one user is tagged in a publication. The evaluation provided by users when adding friends (i.e., a 0-1 ranged value computed from the star based rating) is taken into account as the support for these arguments. We fixed a threshold of 4/5 stars (i.e., 0.8 in the numerical value scale) to start considering that trust may be enough to share some content without previously consulting. Therefore, a positive trust argument will be generated for each tagged user that has rated the author with 4/5 or 5/5 stars when evaluating the friendship. Conversely, if less stars are given from the tagged users to the author, trust arguments against making the publication will be generated.
Risk arguments are generated with the Privacy Risk Score as their own support. A threshold has been defined to discriminate between safe publications and publications that may cause a privacy violation. Due to the nature of this metric, we defined that threshold in the value 0.2, considering all publications with higher PRS dangerous for the author. Therefore, an argument against doing the publication will be generated if the threshold is surpassed. On the other side, an argument in favour of doing the publication will be generated if the threshold is not surpassed.
Content arguments are always generated against making the publication if any type of sensitive content is detected. The preference value of the user towards the specific type of content detected is used as the support of the generated argument. That value is modelled as follows,
where nt is the number of publications containing some specific type of content t and N is the total amount of publications made by the user. This way, if any type of content predominates in some user publications, we can give priority to other types of content (e.g., a user whose account is medical content based will not be concerned about sharing medical content, but it may be about sharing other types of content). Initially, every user has the same value (1) towards each type of content. To smooth the initial decrements, we use e to make sure the preference value is always higher than zero.
Once all the arguments are generated, an aggregation of the scores of every argument
is done to compute the acceptable set as explained in [
In this method, we propose the use of templates to generate the explanations from the set of acceptable arguments. Table 1 contains how each type of computational argument is translated into natural language in order to be correctly interpreted by human users. Therefore, as many explanations as there are computational arguments in the acceptable set, will be generated and displayed to the author. In the next section, we provide an example of the automatic generation of explanations in the PESEDIA network.
Type of Argument
Explanation Generated Content(Location)
You can be revealing information about where you are or where you’re going.
Privacy Trust
Risk Content(Medical) Content(Drugs) Content(Personal) Content(Relatives) Content(Offensive)
The publication is going to be read by... (no one., your friends., a collection of friends., all the users.)
Some of the people you mention might get upset.
Your publication may be read by unknown people.
You may be publishing private medical information.
People might think you’re on drugs/alcohol.
You could be publishing sensitive personal data.
You could be making public information related to family or friends.
Your publication might offend the people who read it.
A brief example of the proposed method for automatically generating explanations is depicted in both Figure 3 and Figure 5. For this example, we have considered a user profile publicly sharing a message that contains several privacy violations (Figure 3).
The author has his/her default target audience configured with the public option. Additionally, his tagged friend Juan, has rated his relation with the author with only three stars. From all the retrieved features (Table 2) in this scenario, a computational argument in favour of making the publication (i.e., Privacy) and four different computational arguments against sharing the content (i.e., Risk, Trust, Content(Location) and Content(Personal)) will be generated by the argumentation system. The corresponding
User Preferences Data
Publication Data argumentation graph generated by the argumentation system in this scenario is depicted in Figure 4.
With this example it is possible to observe the important difference between Privacy and Risk arguments. Although the author has configured the publication with a privacy policy coherent with his/her preferences, a Risk argument against doing the publication is generated since it is hard to predict to which audience the publication is going to reach. Once the inner procedure of the argumentation system has determined the set of acceptable arguments (against doing the publication), in order to prevent the potential privacy violation, explanations are automatically generated (Figure 5). The author can respond to the generated explanations either accepting them and modifying the original content, asking for more reasons, or else, ignoring them. Therefore, the final decision still relies on the user, but at least it will be made with a clear view on its potential consequences.
In this work, we have proposed a method to automatically generate explanations to prevent privacy violations. For this purpose, an educational social network and an underlying argumentation framework for social networks have been used. The method proposed uses all the available information from the social network and the mechanisms provided by the argumentation framework to properly generate explanations for preventing a potential privacy violation. A case study has also been presented to illustrate the proposed method when facing a real situation.
We foresee several improvements as future work. In the current method, except for privacy arguments (where the audience is considered to generate the explanation), all the explanations are the same without taking into account anything else than the type of the argument. It would be interesting to explore the possibility of generating different explanations for the same type of arguments depending on the strength of them. Another interesting future work task would be to consider not only text, but also image data shared in the network, since data protection rules are even stricter on videos and photos, and many privacy violations are made by these means. Finally, to complement the improvements presented above, we are also considering adding a new type of argument based on the potential legal consequences of sharing some specific content. This new type of argument and its subsequent explanation will be useful in trying to persuade the author of a publication to modify it, warning of the possible legal consequences of sharing the publication.
This work is partially supported by the Spanish Government project TIN2017-89156R, the FPI grant BES-2015-074498, and the Valencian Government project PROMETEO/2018/002.