A Comprehensive Analysis of Privacy-Preserving Solutions Developed for Online Social Networks

Abstract

Owning to the massive growth in internet connectivity, smartphone technology, and digital tools, the use of various online social networks (OSNs) has significantly increased. On the one hand, the use of OSNs enables people to share their experiences and information. On the other hand, this ever-growing use of OSNs enables adversaries to launch various privacy attacks to compromise users’ accounts as well as to steal other sensitive information via statistical matching. In general, a privacy attack is carried out by the exercise of linking personal data available on the OSN site and social graphs (or statistics) published by the OSN service providers. The problem of securing user personal information for mitigating privacy attacks in OSNs environments is a challenging research problem. Recently, many privacy-preserving solutions have been proposed to secure users’ data available over OSNs from prying eyes. However, a systematic overview of the research dynamics of OSN privacy, and findings of the latest privacy-preserving approaches from a broader perspective, remain unexplored in the current literature. Furthermore, the significance of artificial intelligence (AI) techniques in the OSN privacy area has not been highlighted by previous research. To cover this gap, we present a comprehensive analysis of the state-of-the-art solutions that have been proposed to address privacy issues in OSNs. Specifically, we classify the existing privacy-preserving solutions into two main categories: privacy-preserving graph publishing (PPGP) and privacy preservation in application-specific scenarios of the OSNs. Then, we introduce a high-level taxonomy that encompasses common as well as AI-based privacy-preserving approaches that have proposed ways to combat the privacy issues in PPGP. In line with these works, we discuss many state-of-the-art privacy-preserving solutions that have been proposed for application-specific scenarios (e.g., information diffusion, community clustering, influence analysis, friend recommendation, etc.) of OSNs. In addition, we discuss the various latest de-anonymization methods (common and AI-based) that have been developed to infer either identity or sensitive information of OSN users from the published graph. Finally, some challenges of preserving the privacy of OSNs (i.e., social graph data) from malevolent adversaries are presented, and promising avenues for future research are suggested.

1. Introduction

In recent years, the adoption of online social networks (OSNs) has significantly increased (e.g., only Facebook owns 1.23 billion monthly active users), and OSNs have become one of the most famous platforms for social interactions. People use OSNs to interact as well as to share personal experiences and information with their friends. Many companies are using social media platforms to engage with their customers as well as to advertise their products/events. Due to the continuously growing popularity of OSNs, a large amount of personal big data is generated on daily basis (for example, Twitter generates about 500 million tweets each day and around 200 billion tweets per year). These data can assist in improving people’s quality of life as well as benefit various companies (e.g., advertisers, application developers, recommendation companies, content creators and sellers, policy makers, and so on). However, these data encompass sensitive information about people’s social interaction, spatial-temporal activities, demographics, finance, disease, mobility, religious/political views, etc., that needs privacy preservation to protect it from prying eyes. In recent years, privacy preservation has become more challenging due to rapid advancements in data mining and artificial intelligence tools and the availability of personal data (e.g., user profiles on OSN sites). These tools are good at finding sensitive information from large-scale data as well as predicting sensitive information using pre-trained models. Hence, privacy preservation of user data has become one of the most urgent research problems in OSNs.

OSNs are structures that depict a set of entities (i.e., users) and the ties/relations between them [1]. OSNs are usually represented with an undirected graph, G, $G=(V,E)$, where V denotes the set of users (i.e., $V=\{v_1,v_2,\cdots ,v_N\}$), and E is the set of edges (i.e., $E\subseteq \left(\begin{array}{c}V\\ 2\end{array}\right)$). In simple words, $v_i$ is any real-world user of SN, and $\left|E\right|$ denotes the links of $v_i$ with other $N-v_i$ users. The link between any two users, $v_i$ and $v_j$, can be correspondence, friendship, collaboration, affiliation to a group/party, etc. In addition to set E, each node v in a G usually encompasses a set of attributes A, where $A=\{a_1,a_2,\cdots ,a_P\}$. The labels for these attributes can be age, gender, race, and zipcode. For instance, $A=\{a_1=age,a_2=gender,a_3=race,\cdots ,a_P=zipcode\}$. The domain of values for each attribute can be different, for example, if $a_2$=gender, then $a_2=\{M,F\}$. In addition to the non-identifying attributes, in some cases, A can contain one/two types of sensitive information (SI), denoted with S, where $S=\{s_1,s_2,\cdots ,s_I\}$. Hence, the overall structure of attribute set $\delta$ can be represented as $\delta =\{A,S\}$, where A and S denote the basic attributes, known as quasi-identifiers (QIDs) and SI, respectively. The G, when nodes contain attribute information as well, can be denoted as $G=(V,E,\delta )$. A conceptual overview of the G is shown in Figure 1.

In Figure 1, there are nine users labeled as $v_1\to v_9$, and the number of edges is distinct for each user. For example, $v_1$ has three edges, and $v_4$ has one edge. The $\left|E\right|$ of any node ($v_i$) is also called the degree of that respective node, denoted as $deg\left(v_i\right)$. Each node has QIDs as well as SI. For the sake of simplicity, we mark SI with bold fonts in Figure 1. The structure of $\delta$ can be denoted as $\delta =\{A,S\}$, where $A=\{a_1=name,a_2=gender,a_3=age\}$, and $S=\left\{income\right\}$. The G can be directed, undirected, weighted, labeled, unlabeled, etc., depending upon the scenario [2].

In recent years, the distribution of G with researchers/data miners has become a routine matter to find insights from G about people [3]. The sharing and analysis of G have a wide range of benefits for people. For example, better service/product recommendations by community-based clustering [4], information diffusion to targeted users [5], appropriate friend recommendations [6], point of interest recommendations [7], traffic incidents analysis [8], influence spreading [9], and route recommendations [10], to name a few. The usage of SN offers users many other benefits such as increasing their reputation, influencing others, recieving brand offers, receiving support, and connecting with a huge community [11]. However, the flip side of using OSN analysis or mining is the loss of privacy and the inherent consequences of this. Therefore, SNs’ service providers and users are still struggling to find a proper balance of social benefits as well as the potential privacy risks [12]. With the rapid digitization, both the scale and scope of OSN privacy breaches are expanding, impacting millions of users with either the loss of data or dignity. OSNs’ service providers are constantly integrating privacy-protection tools and upgrading the existing privacy settings to combat privacy issues. In this paper, we focus on privacy violations in G, and therefore, we discuss most concepts concerning G analysis, mining, and sharing.

There are two famous and state-of-the-art approaches for privacy preservation in G publishing, named naïve and structural anonymization [13]. In the former category, only the structure of G is published by removing all attributes of nodes and edges (see Figure 2a). In contrast, the latter category modifies the structure of G to preserve privacy (see Figure 2b). In Figure 2b, five new edges have been introduced to anonymize G.

Researchers have noticed that naïve anonymization may not be sufficient to provide strong resilience against privacy breaches [14]. In contrast, structural anonymization provides a relatively higher defense against privacy breaches by modifying graph structures. In Figure 2, five new edges have been introduced to change the structure of G for privacy preservation. Recently, many solutions have been proposed to preserve the privacy of SN users in G publishing [15,16,17,18,19,20,21]. These solutions have been used to preserve either nodes’ or edges’ privacy in the release of G. Recently, differential privacy-based solutions have also been proposed to alter the G’s structure for privacy preservation [22]. Despite the success of these solutions, privacy issues can stem in multiple formats, and robust solutions are needed to overcome all types of privacy issues.

The existing surveys related to G publishing cover many important aspects such as graph anonymization/de-anonymization techniques [23], graph anonymization operations [24], brief taxonomies of privacy models [25], anonymity frameworks for graph data [26], privacy/utility evaluating metrics employed by the anonymization mechanisms [27,28], random G modeling [29], and data mining from G [30]. Although we fully affirm the contributions of these surveys, these studies have the following five research gaps: (i) most surveys provided very limited knowledge about most aspects concerning OSN privacy, especially privacy-preserving G publishing and critical information that needs privacy preservation in G; (ii) the critical and experimental details of most studies have not been reported thoroughly; (iii) the discussion/analysis of privacy preservation in application-specific scenarios of OSNs has not been investigated in detail; (iv) the high-level taxonomy of privacy-preserving approaches (i.e., common + AI) used in publishing G for data mining and analytical purposes has not been provided; (v) the significance of artificial intelligence (AI) techniques in the context of graph publishing as well jeopardizing user’s privacy has not been comprehensively highlighted.

Table 1. Overview and comparisons of existing surveys with our review paper.

Ref.	Coverage of Anonymization Methods						Coverage of de-Anonymization Methods		Privacy in Multiple Scenario (s) of OSNs		Experimental Details
	MM	CM	PAGCM	DPM	AIM	HM	Common	AI	Common	AI
Du et al. [3]	×	×	×	√	×	×	×	×	×	×	∘
Alemany et al. [11]	√	×	×	×	√	×	×	×	∘	×	√
Shejy et al. [12]	∘	∘	∘	∘	∘	∘	√	√	√	×	×
Majeed et al. [13]	√	√	∘	∘	×	×	√	×	∘	×	×
Avinash et al. [17]	∘	∘	×	×	×	×	√	×	×	×	√
Ji et al. [23]	√	×	×	∘	×	√	√	×	√	×	∘
Casas et al. [24]	√	√	×	×	×	×	√	×	∘	×	∘
Zhou et al. [25]	√	√	×	×	×	×	√	×	∘	×	×
Wu et al. [26]	√	√	×	×	×	×	×	×	×	×	×
Praveena et al. [27]	√	×	×	√	×	×	√	×	×	×	∘
Joshi et al. [28]	√	√	∘	×	×	×	√	×	√	×	∘
Droby et al. [29]	√	√	√	∘	√	∘	√	∘	√	×	×
Injadat et al. [30]	√	√	×	×	√	×	√	∘	×	∘	×
This review paper	√	√	√	√	√	√	√	√	√	√	√

Abbreviations: MM(modification methods), CM (clustering methods), PACGM (privacy-aware graph computing methods), DPM (differential privacy-based methods), AIM (artificial intelligence-based methods), HM (hybrid methods). Key: √⇒ available/reported and ×⇒ not available/not reported, ∘→ partially covered

presents a detailed comparison of this review paper with existing SOTA surveys and review papers. Many current surveys either present a single type of anonymization or lack basic examples/knowledge that an early researcher needs to gain access to or understand this domain. Furthermore, the role of AI in the privacy of OSNs has not been thoroughly explained. This review article resolves the aforementioned limitations of the existing reviews and provides sufficient knowledge of privacy (or privacy disclosures) in OSNs from a broader perspective.

The major contributions of this article to OSNs’ privacy are summarized as follows.

• It presents a comprehensive analysis and the findings of the state-of-the-art (SOTA) solutions that have been proposed to address privacy issues in OSNs;
• It provides a high-level taxonomy of common as well as AI-based privacy-preserving approaches that have proposed as ways to combat the privacy issues in PPGP along with recent studies in each category;
• It discusses many practical solutions that have been proposed for privacy preservation in application-specific scenarios (e.g., information diffusion, community clustering, influence analysis, friend recommendation, etc.) of OSNs that remained unexplored in the recent literature;
• We discuss various generic and AI-based de-anonymization techniques that have been developed to infer SI from the anonymized graph (a.k.a. the de-anonymization of G);
• Technical challenges of preserving privacy in OSNs in recent times and promising opportunities for future research are discussed in detail;
• The novelty of our work is to provide a systematic analysis of SOTA methods focusing on OSNs from two aspects (e.g., defense → anonymity and attack → de-anonymity), identify novel application scenario(s) of OSNs and corresponding privacy-preserving approaches, analyze the role of AI in privacy preservation of OSNs (or privacy breaches), identify major users’ privacy challenges that OSNs’ service providers are facing or can likely face in the coming years, and list potential research avenues for researchers. Lastly, this work makes a timely contribution towards responsible data science (https://redasci.org/, accessed on 2 May 2022) amid rapid technical advancements in OSNs services/sites in recent years.

The rest of this article is organized as follows. Section 2 presents detailed background of privacy concepts in OSNs. Section 3 discusses the taxonomy of privacy-preserving graph publishing (PPGP) approaches and SOTA developments in each category. Section 4 presents major developments regarding privacy preservation in application-specific scenarios of SNs. Section 5 highlights the major developments in de-anonymization of G. Section 6 discusses the challenges to the privacy protection of G. Section 7 lists various research directions that are vital to combat privacy issues in OSNs. Section 8 discusses the limitations of this review. Finally, we conclude this paper in Section 9. Figure 3 presents the high-level structure of this review article.

2. Background

In this section, we provide a detailed analysis of threats to the validity of this review article and comprehensive background concerning OSNs privacy. In the next subsection, we state the search strings and databases that have been explored to find the related work for this review article.

2.1. Threats to Validity

For this review article, we included the SOTA studies that (1) deal with the privacy preservation of OSN data, (2) target privacy preservation in application-specific scenarios of OSNs, (3) discuss the significance of AI techniques in privacy protection/disclosure in OSNs, (4) deal with jeopardizing OSNs’ users’ privacy by either linking, statistical matching, or background knowledge attacks, and (5) discuss the performance evaluation in terms of privacy, utility, or computational complexity. We have used multiple phrases and combinations of strings such as ‘privacy preservation in OSNs’ and ‘social graph publishing and anonymization’ to extract the peer-reviewed articles from journals, renowned conference proceedings, recently published book chapters, and technical reports. We have mainly targeted eight databases, namely, IEEE Xplore, ScienceDirect, SpringerLink, Scopus, ACM Digital Library, MDPI, Hindawi, and Web of Science. We took advantage of the Google Scholar search engine for forward and backward searches. We have focused on papers that have been highly cited by recent studies and are highly technical with improved results. In total, 3500 documents were retrieved, and 1700 duplicated studies were removed. The titles and the abstracts’ contents were carefully screened to identify potential papers. The full texts of the 1780 studies were assessed to find the highly relevant papers to be included in this review. We have excluded the articles that discussed (1) a defense solution other than anonymization, privacy preservation of stored OSNs data, and content-based privacy attacks in OSNs, (2) cyber attacks (e.g., denial of service) on OSN data, (3) threats to OSNs’ security and privacy breaches in interactions. With a backward and forward search, 16 more closely related studies were retrieved. In total, 291 studies were finally selected for data extraction purposes. Figure 4 depicts the process of the SOTA article selection for this paper that was adopted from the previous SOTA reviews [31,32]. The findings of previous surveys and review articles were also used in addition to these included papers to provide distinctive features and a comprehensive performance evaluation.

2.2. Classification in the Scope of Privacy

The nature of privacy is highly subjective, meaning its perception varies from person to person. In simple words, privacy is all about hiding SI from the prying eyes [33]. The scope of privacy mainly falls into four categories [34], as demonstrated in Figure 5. This work belongs to the first category, which is about handling (i.e., aggregation, storage, analysis, anonymization, distribution, etc.) person-specific data.

Person-specific data can be modeled in a variety of styles such as tables, graphs, matrices, traces, logs, images, multimedia, and hybrid [35]. However, we consider personal data represented in a graph form G, where $G=(V,E,\delta )$, in our work.

2.3. Operation Utility of Social Graphs

The publishing of G is vital for many analytical and data-mining purposes. The operational utility, $OU$, offered by G can be one of the three cases listed in Equation (1):

$$OU(l_1/l_2/l_3)=\left\{\begin{array}{cc}{l}_1,\hfill & \mathrm{Exposure}\mathrm{of}\mathrm{G}\mathrm{structure}\mathrm{only}\hfill \\ l_2,\hfill & \mathrm{Exposure}\mathrm{of}\mathrm{profiles}\mathrm{of}\mathrm{nodes}\hfill \\ l_3,\hfill & \mathrm{Exposure}\mathrm{of}\mathrm{both}{l}_1\mathrm{and}{l}_2\hfill \end{array}\right.$$

(1)

In the first case/level, the SN service provides the release of only the structure of G, and all profile information is usually hidden. In the second case, the structure of G is hidden, but profile information is shared with a researcher. In the last level, both the G structure and the $\delta$ of V is shared for analytical purposes [36].

2.4. Key Privacy Issues That Can Occur in Publishing G with Analysts

As stated earlier, publishing G is vital for many purposes, but it can introduce multiple privacy issues. We summarize the five key privacy issues occurring in G publishing in Figure 6.

2.5. Anonymization Operation That Can Be Applied to G

Many techniques, such as anonymization, masking, encryption, obfuscation, watermarking, zero knowledge proofs, and pseudonymization, are employed to preserve users’ privacy in G. Due to conceptual simplicity, anonymization techniques have been widely used to preserve users’ privacy [37,38]. Various anonymity operations are performed in order to provide sufficient resilience against contemporary privacy issues.

Table 2. Summary of anonymization operations that can be applied to G for privacy preservation.

Anonymity Operation	Brief Description	Examples
G modification	This operation modifies the structure of G by adding/removing vertices or edges.	k-degree anonymity
G generalization	This operation clusters the nodes and edges of G into super nodes/edges.	Node grouping
G Obfuscation	This operation adds noise in the form of fake edges/edges to preserve privacy.	Node-level DP
G computation	This operation computes properties from G, and releases them to analysts.	Degree, size
G Hybrid Operation	More than one anonymity operation are jointly used to perturb G.	k-degree clustered G

presents the concise description of anonymization operations that are applied to G for privacy protection. The strength/weakness and complexity of each operation vary depending upon the size and nature of G.

2.6. Important Aspects of Privacy Preservation in OSN Data

OSNs contain a treasure of information, and sufficient care is needed to preserve the privacy of most parts of that data [39]. In Figure 7, we present the different types of data collected/processed in SN and the pieces of information that require privacy preservation in publishing G. As shown in Figure 7a, there are three main types of data: identity, social, and content in SNs. All these types need privacy preservation from prying eyes. For example, if a rare user of an SN has a just one friend, and the respective friend is known to be an HIV doctor, in this case, the SI of the SN user can be inferred (e.g., he/she might have contracted an HIV disease) [40]. Similarly, profession information can lead to income disclosures. In G, anonymization methods need to preserve most parts of the SI shown in Figure 7b. SN data need more care regarding privacy preservation because most data can be available to the adversaries as background knowledge (BK) [41,42].

In Figure 8, we summarize important BK that can be within the adversaries’ access, and which can lead to privacy breaches. Apart from the BK and other auxiliary types of data, a new risk known as interdependent privacy risk (IPR) has become one of the major privacy threats in SNs in recent times [43,44,45]. Furthermore, inference attacks [46], ML-based attacks [47], privacy leakage in health SNs [48], profile cloning [49], profile matching [50], community-based threats [51], cross-SN user matching [52], and privacy concerns in different OSN services (e.g., recommendation systems [53], query evaluations [54], and sentiment analyses [55]) have made privacy preservation in OSNs an active area of research.

2.7. Role of Artificial Intelligence in the Domain of OSNs

Recently, AI has been extensively used in the information privacy domain for multiple purposes. It has been used to safeguard the personal data from prying eyes as well as for de-anonymizing large G-encompassing data of a substantial number of users [56,57,58]. We summarize the role of AI from three different perspectives as follows:

• AI as a protection tool: AI can be used to preserve the privacy of SN data;
• AI as an attack tool: AI can be used to compromise a user’s privacy from SN data;
• AI as protection of target: Privacy concepts can be used to secure AI systems.

Recently, many graph-type–specific, attack-specific, domain-specific, application-specific, and AI-powered anonymization techniques have been developed. In the rest of this paper, we summarize the major developments concerning G privacy.

3. Overview of Privacy-Preserving Graph Publishing (PPGP) and Taxonomy of PPGP Approaches Used for Online Social Networks

In this section, we discuss the life cycle of PPGP, the basic concepts of G anonymization, and the taxonomy of PPGP approaches. We arrange and discuss the concepts in three different subsections. In the next subsection, we discuss the life cycle of PPGP.

3.1. Overview of the Life Cycle of Ppgp

The typical PPGP process contains six steps. A concise description of all the steps is given below. In Step A, appropriate data are collected from relevant users. Examples of data collection are account-opening procedures in an SN website, or a check-up from a diagnostic center. In both of these scenarios, some basic information (i.e., QIDs) as well as SI is obtained. In this research, we assume that G has already been collected by the SN service providers (a.k.a. data owners). In Step B, the collected G data are stored in safe repositories/databases for further analysis. Storage can be in graph form (e.g., SN data) or tabular form (e.g., hospital/bank data) depending upon the nature of the data. Due to the recent advancements in technology, storage capacity has become significantly large, and fine-grained data can now be stored for utilization in multiple contexts. In Step C, pre-processing is applied to the collected G. During this step, the G is cleaned (outliers and isolated nodes are removed, and redundant nodes/edges are removed). In Step D, the cleaned G from Step C are anonymized. During data anonymization, the structure of the original G is modified to preserve privacy, leaving the anonymized G, which is useful for analysis. The anonymization can be performed in multiple ways (e.g., DP methods, constrained methods, etc.) In Step E, the anonymized G is published for SN analysis and data-mining purposes. In the final step, analytics techniques are applied to the published G in order to extract useful information from it. The extracted information can be used for hypothesis generation/verification or for policy making.

A conceptual overview of the anonymization techniques applied to raw data given in a raw G form for PPDP is demonstrated in Figure 9. As shown in Figure 9, both privacy risks and graph utility are higher at the beginning. Anonymization is applied to G to strike a balance between utility and privacy [59]. The anonymization approaches usually modify the structure of the G in such a way that both privacy and utility are preserved. In the next subsection, we present a conceptual overview of anonymizing G along with an example.

3.2. The Basic Concepts of G Anonymization

Basically, the anonymization approaches change the structure of G into a new graph, $G^{{}^{\prime }}$. The size (# of nodes and edges) of $G^{{}^{\prime }}$ can/cannot be the same as that of G. Hereafter, we refer to G as an original graph, and to $G^6$ as an anonymized graph. In Figure 10, we demonstrate an overview of the G anonymization with examples. The $G^{{}^{\prime }}$ given in Figure 10 satisfies the k-degree anonymity, where $k=2$ because each node has at least two edges. Thus far, many graph anonymization approaches have been developed for sharing $G^{{}^{\prime }}$ with the researchers/analysts [60,61,62]. In the next subsection, we present a taxonomy of graph anonymization approaches and the major developments in each category.

In the next subsection, we present a high-level taxonomy of anonymization approaches that have been proposed to foster graph data publishing, and discuss the SOTA approaches in each category.

3.3. High-Level Taxonomy of PPGP Approaches

There exist plenty of graph anonymization approaches in the literature. In Figure 11, we present a detailed taxonomy of PPGP approaches. The taxonomy presented in this paper is more detailed and complete than existing surveys. The rest of this subsection summarizes the major developments in terms of the SOTA approaches in each category.

3.3.1. Graph Modification Methods

The graph modification methods modify the G’s structure by deleting/adding nodes or edges to protect the privacy of users (see Figure 10). In addition to the add/delete operations, in some cases, the positions of vertices or edges are switched or re-organized to preserve users’ privacy. The graph modification methods are classified into two types: unconstrained and constrained. In the former type, the structure of G is modified without strict criteria. Moreover, the later type stops anonymity when some condition/criteria is being met (e.g., all nodes have achieved the same degree). Both types have been extensively studied in the literature for SN users’ privacy preservation. We demonstrate an example of unconstrained (a.k.a. random) anonymization adopted from [63] in Figure 12. In Figure 12b, two edges have been removed (i.e., ($[v_4,v_5],[v_2,v_3]$)) while two new edges have been added (i.e., ($[v_8,v_9],[v_6,v_7]$)) to produce $G^{{}^{\prime }}$. In contrast, $G^{{}^{\prime }}$, shown in Figure 12c, was obtained by the random edge switch method. In this example, two edges have been switched as: $\{(v_1,v_2)\to (v_1,v_2),(v_4,v_5)\to (v_2,v_5)\}$. As shown in Figure 12, there is no specific constraint/condition to be met while converting $G\to G^{{}^{\prime }}$.

The constrained anonymization methods usually follow the same strategy as unconstrained (a.k.a. random) anonymization, but the strength of nodes/edges is bounded by some constraints (e.g., degree, node counts, the number of edges to be switched/modified, etc.). We present an example of constrained anonymization adopted from [63] in Figure 13. The $G^{{}^{\prime }}$ shown in Figure 13b is two-degree anonymous (i.e., $k=2$). The degree sequence was changed from $deg\left(G\right)=\{2,4,2,1,3,2,2,2,2\}\to deg\left(G^{{}^{\prime }}\right)\{2,3,2,2,3,2,2,2,2\}$ by the edge modification/switching method. In this particular example, the constraint was related to the number of edges in the network. The $G^{{}^{\prime }}$ shown in Figure 13c is also two-degree anonymous, and it was obtained by applying the new edges and vertex addition. Two new edges ($(v_4,v_{10}),(v_5,v_{10})$), and one node (i.e., $v_{10}$) were included to convert G into $G^{{}^{\prime }}$. In Figure 13c, the modification of G was bounded to the number of both edges and vertices. The degree sequence of each node is as $deg(G^{{}^{\prime }}=\{2,4,2,2,4,2,2,2,2,2\})$. In constrained anonymization, the anonymization process stops on the completion of constraints related to closeness, degree, and/or clustering co-efficient, etc.

There are six main modification techniques that can be applied to anonymize SN data stored in a G form, as shown in Figure 14. The selection of modification techniques usually depends on the graph type (e.g., simple, bipartite, labeled, and uncertain graphs.) and objective of the PPGP.

We summarize and compare the SOTA G modification-based anonymity techniques in

Table 3. Summary and comparison of state-of-the-art graph modification-based techniques.

Ref.	Nature of Study	Key Assertion (s)	Experimental Analysis	G Anonymity Type	Datasets Used
Wang et al. [65]	Technical	Defence against identity disclosure	√	Constrained	R
Casas et al. [66]	Technical	Better utility of large-scale G	√	Constrained	R
Ma et al. [67]	Technical	Defence against identity disclosure	√	Constrained	R
Roma et al. [68]	Technical	Defence for identity and link disclosures	√	Constrained	R
Hamideh et al. [69]	Technical	Fewer modifications while converting G→$G^{{}^{\prime }}$	√	Constrained	R,S
Mauw et al. [70]	Technical	Strong defense against identity disclosure	√	Constrained	R,S
Yuan et al. [71]	Conceptual	Maintains stability of G’s structure.	√(limited)	Constrained	S
Majeed et al. [72]	Technical	Protection of sensitive labels of users	√	Constrained	R
Gangarde et al. [73]	Technical	Protection of nodes, edges, and attributes	√	Constrained	R
Srivatsan et al. [74]	Technical	Lower information loss while changing G→$G^{{}^{\prime }}$	√	Constrained	R
Nettleton et al. [75]	Technical	Strong privacy protection in $G^{{}^{\prime }}$	√	Constrained	R
Ying et al. [76]	Theoretical	Discussion of various privacy attacks in $G^{{}^{\prime }}$	×	Unconstrained	-
Kiabod et al. [77]	Technical	Improve utility of $G^{{}^{\prime }}$ for analysts/data miners	√	Unconstrained	R
Masoumzadeh et al. [78]	Technical	Control distortion while changing G→$G^{{}^{\prime }}$	√	Unconstrained	R
Ren et al. [79]	Technical	Protection against three privacy attacks in $G^{{}^{\prime }}$	√	Unconstrained	R
Ninggal et al. [80]	Technical	Significantly improves the utility of anonymized graph	√	Unconstrained	R
Zhang et al. [81]	Technical	Controls re-identification of users from $G^{{}^{\prime }}$	√	Unconstrained	R,S
Xiang et al. [82]	Technical	Controls privacy issues in dynamic scenarios of G analysis	√	Unconstrained	R
Zhang et al. [83]	Theoretical	Heuristic analysis-based privacy protection in $G^{{}^{\prime }}$	√	Unconstrained	-
Kavianpour et al. [84]	Technical	Privacy protection in interactions between user and third parties	√	Unconstrained	R
Lan et al. [85]	Technical	Effective resolution of privacy utility in G anonymization	√	Unconstrained	R
Hamzehzadeh et al. [86]	Technical	Fewer changes in structure of G during anonymization	√	Unconstrained	R

Key: √⇒ available/reported and ×⇒ not available/not reported, R⇒ real, S⇒ synthetic, and -⇒ not used.

. In Table 3, we compared the existing approaches in terms of assertion(s), study nature, type of datasets on which experiments were performed, and anonymity type. The reason to perform an evaluation based on these metrics is to provide basic as well as experimental analyses that can help researchers to grasp the research status conveniently. Furthermore, these analyses can help researchers to make a rational decision towards conducting high-level research. For example, performance evaluation on a real dataset and writing technical papers are handy takeaways from the below analysis, as most previous studies have been evaluated on real datasets and their nature is technical.

The G modification techniques have been extensively studied in the recent literature. In addition to the analysis presented in Table 3, we refer interested readers to previous surveys for more detailed analyses of the vertex/edge modification techniques [87,88,89,90].

3.3.2. Graph Generalization/Clustering Methods

The generalization/clustering-based G anonymization methods perturb the graph structure by partitioning it into different clusters/groups, and anonymity is applied subsequently [91]. The core anonymization concepts of these methods closely resembles the syntactic methods (i.e., k-anonymity, ℓ-diversity, and t-closeness) of tabular data in terms of classes/cluster formation and the generalization of nodes/edges. However, the size of clusters and the degree of generalization is measured in such a way that maximal information is preserved in $G^{{}^{\prime }}$ for legitimate information consumers. In Figure 15, we present an example of G’s anonymization using graph generalization/clustering methods. In this example, a network G with seven nodes is given as input (see Figure 15a), where each node contains the gender and age information of each user. Afterwards, user are arranged into three clusters based on similarity in gender and age information as follows: $C_1=\{(62,F),(32,F)\}$, $C_2=\{(47,F),(46,M),(42,F)\}$, and $C_3=\{(21,M),(29,M)\}$. Later, all three clusters are generalized to super nodes, as shown in Figure 15b. The two numbers in each super node denotes the number of nodes and intra-cluster edges, respectively. The largest cluster is $C_2$, with three nodes and two intra-cluster edges. Due to the superior results in both utility and privacy, generalization/clustering-based G anonymization methods have been extensively investigated in the recent literature.

We summarize and compare the famous generalization/clustering-based G anonymization techniques in

Table 4. Summary and comparison of state-of-the-art graph clustering-based techniques.

Ref.	Nature of Study	Key Assertion (s)	Experimental Analysis	G Anonymity Type	Datasets Used
Siddula et al. [92]	Technical	Privacy protection of nodes, edges, and attributes	√	Clustering	R
Li et al. [93]	Technical	Prevention of inference attacks in SN data	√	Clustering	R
Gangarde et al. [94]	Technical	Strong defense against users’ identities revelation in OSNs	√	Clustering	R
Karimi et al. [95]	Technical	Privacy preservation of multiple SAs in G publishing	√	Clustering	R
Jethava et al. [96]	Technical	Strong defense against Sybil attack detection attacks in SN data	√	Clustering	R
Li et al. [97]	Technical	Strong defense against social identity linkage problem across SNs	√	Clustering	R, S
Kiranmayi et al. [98]	Technical	Strong defense against attribute couplet attacks via factor analysis	√	Clustering	R
Kaveri et al. [99]	Conceptual	Privacy and utility preservation in SN data anonymization	×	Clustering	R
Langari et al. [100]	Technical	Defence against identity, attribute, link, and similarity attacks	√	Clustering	R
Guo et al. [101]	Technical	Privacy and utility preservation in stream data handling	√	Clustering	R
Sarah et al. [102]	Conceptual	Better utility preservation in $G^{{}^{\prime }}$ by extracting maximum clique	√	Clustering	R, S
Shakeel et al. [103]	Technical	Protection of identity disclosures in SN data publishing	√	Clustering	R
Poulin et al. [104]	Technical	Protection of privacy and information loss in anonymizing G	√	Clustering	S
Ghate et al. [105]	Conceptual	Protection of privacy by restricting more changes in G	√(limited)	Clustering	S
Sihag et al. [106]	Conceptual	Controls heavier changes in the structure of G during anonymity	√(limited)	Clustering	R
Yu et al. [107]	Technical	Strong defense against identity disclosure by injecting false targets	√	Clustering	R
Ros et al. [108]	Technical	Strong defense against identity disclosure in large-scale graphs	√	Clustering	R
Yazdanjue et al. [109]	Technical	Improves runtime of G anonymization by greedy approaches	√	Clustering	R
Tian et al. [110]	Technical	Ensure strong privacy in crawling and mining SN graph data	√	Clustering	R

Key: √⇒ available/reported and ×⇒ not available/not reported, R⇒ real and S⇒ synthetic.

.

In addition to the analysis given in Table 4, further information about clustering-based anonymization can be gained from previous surveys centering solely on these techniques [111,112,113]. Recently, clustering-based anonymization methods have gained popularity from multiple perspectives [114].

3.3.3. Privacy-Aware Graph Computing Methods

Privacy-aware graph computing methods do not perturb the structure of G; instead, they compute interesting characteristics that can be helpful from multiple perspectives. These methods share the analysis of the computation rather than the whole G. The privacy-aware graph computing methods extract useful statistics from G in such a way that the privacy of users is preserved while computed statistics remain applicable for SN analysis and mining purposes [115]. The useful analysis provided by privacy-aware graph computing methods are: G density, count of edges, relationships degree, distributions of degrees, size of the G, closeness, centralities, average similarity/distance between users, the number of subgraphs, top k-users with higher connections, clustering coefficients, path length, the number of communities, hypergraphs, the number of users with d degree, where d can be any real number, tie strength among people, trust/influence of people in G, communication/interactions, etc. We highlight an example of degree computation from G in Figure 16. The G shown in Figure 16 has the degree counts as follows: $deg\left(G\right)=\{v_1=1,v_2=3,v_3=1,v_4=1,v_5=2,v_6=5,v_7=3,v_8=3,v_9=2,v_{10}=1\}$. The distribution of degrees can be determined using the following formula: $P_{deg}\left(degreevalue\right)$. For instance, the fraction of nodes for degree 1 can be computed as: $P_{deg}\left(1\right)=\frac{2}{5}$, as shown in Figure 16. Only graph statistics (i.e., degree) are published, thereby preserving users’ privacy. The degree information gives important information concerning G’s structure.

Instead of degree distributions, many such statistics (i.e., subgraphs [116]) can be computed from G. In Figure 17, we present an example of triangle computations from G. Aside from triangles, the start can also be computed for finding influential people in SNs. These statistics can be used for information diffusion/contagion purposes, marketing, collaborative filtering, opinion/preference mining and analysis, and epidemiological investigations.

The key findings of the latest SOTA privacy-aware graph computing methods are summarized as follows. Shun et al. [117] developed a simple, fast, and in-memory parallel triangles computing algorithm for large-scale SN data. The proposed method requires fewer parameter tunings and is scalable. Yang et al. [118] developed a linear-algebra-based platform for computing multiple statistics from G on GPU platforms. Mazlumi et al. [119] explored the possibility of using SN analysis concepts in the IoT domain regarding path length optimization, critical nodes identification, and advancing IoT applications. Specifically, the authors used SN concepts in the IoT domain for improving multiple aspects of the IoT domain. Behera et al. [120] developed a large clique finding (and missing cliques finding) method from SN graphs. The proposed method has a number of applications such as community detection, pattern recognition, and clustering in SN analysis. Sahraoui et al. [121] applied the SN concepts in the early prevention of the COVID-19 pandemic by detecting contacts in real time. The proposed method detects the communities of people that have likely been exposed to COVID-19 in an analogous way to community detection in SN via analyzing online relationships. Rezvani et al. [122] devised a new and very fast method for detecting communities in SN by using the k-triangle computing method. Laeuchli et al. [123] developed a centrality measurement method in large-scale G. The proposed method has abilities to compute three types of centralities, such as Laplacian, eigenvector, and closeness centralities, from G. A new and low-cost subgraph counting method based on fuzzy set theory for SN data was developed by Hou et al. [124]. Nunez et al. [125] developed a privacy-aware frequent sequential patterns mining method from large-scale G with applications to recommender systems. Further information about privacy-aware graph computing methods can be obtained from the book chapters and reviews in [126,127]. Recently, this category of G privacy has been religiously investigated due to the rapid developments in AI methods and tools.

3.3.4. Differential Privacy-Based Graph Anonymization Methods

Differential privacy (DP) has become a central part of the privacy domain, and it has been extensively investigated in the graph data publishing field [128,129]. DP, in the SN data privacy context, can be defined in simple words as follows. Let us say a query function f is to be evaluated on a graph G. We want to have a privacy-preserving algorithm A running on G and returning $A\left(G\right)$ as an output/answer, and $A\left(G\right)$ should be $f\left(G\right)$ with a minimal amount of noise added. Hence, the goal of DP is to make $A\left(G\right)\approx f\left(G\right)$ in order to preserve data utility, and at the same time have $A\left(G\right)$ protect all entities’ privacy in G. The DP concept has been widely used in SN for multiple purposes, such as computing statistics from G, answering analyst queries by perturbing the output (see Figure 18), and privacy preservation in application-specific scenarios (i.e., recommendations, community clustering, etc.).

As shown in Figure 18, DP can be achieved by injecting an appropriate amount of noise to the query answer, that is, $A\left(G\right)=f\left(G\right)+Z$, where Z is the noise. Adding too much Z may damage data utility, while adding too little Z may yield an insufficient privacy guarantee. Therefore, deciding the appropriate value of Z that can strike the balance well between privacy and utility is a very challenging task. Sensitivity, which denotes the largest change to the query answers caused by deleting/adding any node/edge in the G, is a key parameter to find the magnitude of added Z.

In the DP model, any anonymity algorithm, ℑ, satisfies the $ϵ$-DP property if for all pairs of neighbors $S\subseteq Range(\Im )$ and for all $G_1$, $G_2$ such that $d(G_1,G_2)=1$ (e.g., $G_1$ differs from the $G_2$ by just one node):

$$\frac{Pr(\Im \left(G_1\right)\in S)}{Pr(\Im \left(G_2\right)\in S)}\le exp\left(ϵ\right)$$

(2)

where $ϵ$ represents the privacy loss budget, and the $ϵ$ value is usually higher than 0 (i.e., $ϵ>0$).

If $ϵ=0$, full protection can be guaranteed at the expense of utility. Determining an appropriate value for $ϵ$ is very challenging. DP has been extensively used in different settings for fulfilling the expectation of data owners. Furthermore, it has been extended in multiple ways. Its new variants, such as ($ϵ$,$\delta$)-DP, offer a better trade-off between utility and privacy. DP can be used to compute important statistics from G that can be handy in performing analytics (see Figure 19).

There are two types of DP models: local and global [130]. In the former type, noise is added to the personal data before sharing it with the curator, and the server is assumed to be untrustworthy. In the latter type, the original G is curated at some central place (i.e., the server is assumed to be trustworthy), and noise is added at the time of G’s release to the analysts/parties. In Figure 20, we present both settings of the DP model in real-world settings.

We summarize and compare the famous DP-based G anonymization techniques in

Table 5. Summary and comparison of state-of-the-art DP-based G anonymity techniques.

Ref.	Nature of Study	Key Assertion (s)	Experimental Analysis	DP Anonymity Type	Datasets Used
Gao et al. [131]	Technical	Better utility in $G^{{}^{\prime }}$ under same privacy level	√	Node-level	R
Gao et al. [132]	Technical	Reduction in noise scale while anonymizing G	√	Node-level	R,S
Gao et al. [133]	Technical	Protection of important structures of G	√(limited)	Node-level	R
Gao et al. [134]	Technical	Preserves G’s structure using dK-1, dK-2, and dK-3	√	Node-level	R
Zhang et al. [135]	Technical	Privacy preservation of degree sequence in $G^{{}^{\prime }}$	√	Node-level	R
Zheng et al. [136]	Technical	Privacy preservation at G collection time in IoTs	√	Node-level	R
Fang et al. [137]	Technical	Construction of a synthetic $G^{{}^{\prime }}$ which is close to G	√	Node-level	S
Yin et al. [138]	Technical	Graph data publishing with controlled utility loss	√	Node-level	R
Huang et al. [139]	Technical	Solves privacy–utility trade-off in converting G → $G^{{}^{\prime }}$	√	Node-level	R
Macwan et al. [140]	Technical	Protection of degree distributions in answering queries	√	Node-level	R
Zhu et al. [141]	Technical	Strong privacy in $G^{{}^{\prime }}$ by perturbing edges and nodes	√	Node-level	R
Huang et al. [142]	Conceptual	Privacy preservation by generating synthetic G	√	Node-level	S
Macwan et al. [143]	Theoretical	Privacy guarantees of G with anonymity and node DP	×	Node-level	-
Macwan et al. [144]	Technical	Preserving higher utility in $G^{{}^{\prime }}$ for mining purposes	√	Node-level	R
Liu et al. [145]	Technical	Preservation of G structural properties without privacy loss	√	Node-level	R
Iftikhar et al. [146]	Technical	Reduction in noise to achieve $ϵ$-DP for better utility in $G^{{}^{\prime }}$	√	Node-level	R
Li et al. [147]	Technical	Privacy preservation of edge weights in $G^{{}^{\prime }}$	√	Edge-level	R
Guan et al. [148]	Technical	Privacy preservation of link disclosure in $G^{{}^{\prime }}$	√	Edge-level	R
Wang et al. [149]	Technical	Privacy preservation of links’ attributes in $G^{{}^{\prime }}$	√	Edge-level	R
Yang et al. [150]	Technical	Privacy preservation of degrees of links in $G^{{}^{\prime }}$	√	Edge-level	R
Wang et al. [151]	Technical	Privacy protection in $G^{{}^{\prime }}$ by injecting noise in probability model only	√	Edge-level	R
Wang et al. [152]	Technical	Preserving topological structure of $G^{{}^{\prime }}$ for better utility	√	Edge-level	R
Lv et al. [153]	Technical	Preserving privacy of users by modifying edge structure in $G^{{}^{\prime }}$	√	Edge-level	R
Wang et al. [154]	Technical	Preserving privacy of users by dividing G into subgraphs	√	Edge-level	S
Lei et al. [155]	Technical	Preserving privacy of sensitive edge weights using DP model	√	Edge-level	R
Reuben et al. [156]	Conceptual	Stresses the need of edges’ privacy preservation in $G^{{}^{\prime }}$	√	Edge-level	-
Yan et al. [157]	Technical	Better utility and privacy preservation in SN data	√	Hybrid	R
Yan et al. [158]	Technical	Reduces information loss in G anonymity without sacrificing privacy	√	Hybrid	R
Qian et al. [159]	Technical	Privacy preservation of social links between users via $ϵ$-DP model	√	Hybrid	R
Qiuyang et al. [160]	Technical	Privacy preservation based on sub-graph reconstruction and local DP model	√	Hybrid	R
Qu et al. [161]	Technical	Privacy preservation in dynamically evolving G data with better utility	√	Hybrid	R
Iftikhar et al. [162]	Technical	Privacy protection in DP-based computations for releasing G’s distributions	√	Hybrid	R

Key: √⇒ available/reported and ×⇒ not available/not reported, R⇒ real, S⇒ synthetic, and -⇒ not used.

.

Due to the rigorous privacy guarantees, DP has been widely used with diverse data formats (i.e., tables, graphs, images, texts, matrices, etc.). Detailed information about the DP model in the context of SNs can be learned from DP-specific surveys [163,164,165]. Recently, DP has been extensively used with emerging technologies, such as federated learning, to preserve privacy [166]. Furthermore, DP has been used to preserve the privacy of patients’ COVID-19 data [167]. In the coming years, the synergy and applications of DP are expected to increase drastically.

3.3.5. Artificial Intelligence-Based Graph Anonymization Methods

AI has revolutionized almost every discipline with automated decision-making abilities. In the privacy field, AI-based techniques have been widely used to either safeguard or compromise privacy. Recently, AI has been increasingly used in graph data anonymization [110]. Liu et al. [168] presented the link between machine learning and OSN privacy. The authors highlighted the significance of ML in the privacy domain, and vice versa. In Figure 21, we demonstrate the role of AI in OSNs’ privacy.

As shown in Figure 21, AI and privacy can complement each other in three different ways. The first category is out of the scope of this paper and is about securing AI systems themselves by using either anonymization or DP-based techniques. This area of research (i.e., securing AI systems) is capturing researchers’ interest drastically [169]. The second category is about employing AI methods to safeguard users’ privacy in publishing $G^{{}^{\prime }}$ [68]. As shown in Figure 21, AI techniques (i.e., machine and deep learning) can assist in preserving OSN users’ privacy in multiple ways. The last category is about the dark sides of AI techniques in the information privacy domain. In this category, the adversary takes advantage of the AI techniques in order to predict/infer the private information of individuals from $G^{{}^{\prime }}$ [170,171,172]. In recent years, the synergy between AI and OSNs’ privacy has been extensively investigated in the literature [173]. We summarize and compare the famous AI-based G anonymization techniques used for PPGP in

Table 6. Summary and comparison of state-of-the-art AI-based G anonymity techniques.

Ref.	Nature of Study	Key Assertion (s)	Experimental Analysis	AI Technique Used	Datasets Used
Bilogrevic et al. [174]	Conceptual	Predicts the level of detail for each sharing decision in OSNs	√	Logistic Regression	S
Caliskan et al. [175]	Technical	Predicts the SI in a G using ML and suggests how to safeguard it	√	NB, SVM, RF	S
Yin et al. [176]	Technical	Strikes a balance between privacy and utility in distributing $G^{{}^{\prime }}$	√	k-means algorithm	R
Wang et al. [177]	Technical	Privacy preservation of degree information in releasing $G^{{}^{\prime }}$	√	k-means algorithm	R
Ju et al. [178]	Technical	Strong privacy of V in $G^{{}^{\prime }}$ along with higher accuracy and utility	√	k-means algorithm	R
Zheng et al. [179]	Technical	Strong privacy of V in $G^{{}^{\prime }}$ and fewer changes to G’s structure	√	GNN algorithm	R
Paul et al. [180]	Technical	Preserves the structural properties of G in anonymization process	√	k-means algorithm	R
Hoang et al. [181]	Technical	Preserves the privacy of SN users modelled via knowledge of G	√	k-ad algorithm	R
Hoang et al. [182]	Technical	Preserves the privacy of SN users when G is subject to multiple releases	√	CTKGA algorithm	R
Chen et al. [183]	Technical	Privacy preservation of SN users when G contains outliers and categorical attributes	√	DBSCAN clustering	R
Narula et al. [184]	Technical	Privacy preservation of identity and emotion-related information in OSN data	√	CNN algorithm	R
Zitouni et al. [185]	Technical	Privacy preservation by concealing the identity in image data	√	CNN and LSTM	R
Ahmed et al. [186]	Technical	Privacy preservation by concealing the identity and other SI in images	√	Neural Network	R
Matheswaran et al. [187]	Technical	Privacy preservation of image data in retrieval and storage in clouds	√	Watermarking	R
Li et al. [188]	Technical	Both anonymity- and utility-preserving solutions for OSN data	√	GAN Algorithm	R
Lu et al. [189]	Technical	Privacy preservation by reducing the prediction accuracy of sensitive links in G	√	VGAE and ARVGA	R
Li et al. [190]	Technical	Privacy preservation using profile, graph structure, and behavioral information	√	GCNN algorithm	R
Wanda et al. [191]	Technical	Privacy preservation of vulnerable nodes in G using dynamic deep learning	√	CNN architecture	R
Li et al. [192]	Technical	Privacy preservation of users when a user’s job/education-place changes with time	√	Supervised ML	R
Bioglio et al. [193]	Technical	Privacy preservation of contents in OSN platforms based on sensitivity analysis	√	Deep NN	R
Hermansson et al. [194]	Technical	Preserves better accuracy for data-mining and analytical tasks from $G^{{}^{\prime }}$	√	SVM algorithm	R
Kalunge et al. [195]	Technical	Preserves better utility (path length and IL) for data-mining-realted tasks from $G^{{}^{\prime }}$	√	SVM algorithm	R,S
Zhang et al. [196]	Technical	Strong privacy preservation of users against text-based user-linkage attack	√	SVM algorithm	R
Halimi et al. [197]	Technical	Strong privacy preservation by identifying the vulnerable users profiles from G	√	PCA algorithm	R
Kumar et al. [198]	Technical	Strong privacy preservation of graph structure without degrading utility of G	√	PageRank algorithm	R
Kumar et al. [199]	Technical	Strong privacy preservation while showing better utility in three data-mining tasks	√	PPRA algorithm	R
Li et al. [200]	Technical	Strong privacy preservation of communities in G with better usability of $G^{{}^{\prime }}$	√	Pregel model	R
Chavhan et al. [201]	Technical	Strong privacy preservation in $G^{{}^{\prime }}$ by identifying initial cluster centers	√	DST algorithm	R
Wang et al. [202]	Technical	Strong privacy preservation in $G^{{}^{\prime }}$ by dropping the nodes with sparse edges	√	Kruskal & Prim	S
Kansara et al. [203]	Theoretical	Strong privacy preservation in $G^{{}^{\prime }}$ by using non-cryptographic techniques	×	Multiple algorithms	-
Ma et al. [204]	Technical	Strong privacy preservation of user’s location while executing queries on G	√	KNN algorithm	R
Zhang et al. [205]	Technical	Minimization of privacy disclosures in $G^{{}^{\prime }}$ and influence maximization	√	Bayesian Network	R
Mauw et al. [206]	Technical	Strong privacy preservation in $G^{{}^{\prime }}$ in the presence of sybil nodes	√	K-MATCH algorithm	R
Maag et al. [207]	Technical	Strong privacy preservation against multiple attacks in publishing $G^{{}^{\prime }}$	√	EDA algorithm	R
Gao et al. [208]	Technical	Solves multi-objective optimization problem in anonymizing $G^{{}^{\prime }}$ by rewiring edges	√	GAN model	R

Key: √⇒ available/reported and ×⇒ not available/not reported, R⇒ real, S⇒ synthetic, and -⇒ not used.

.

The AI-based approaches have improved various critical aspects of OSN data anonymization. In the coming years, AI will be a central element in privacy-preservation solutions of most data styles because AI-based techniques are more robust than traditional anonymization solutions. Further details about AI’s role in privacy domains can be learned from the previous surveys in [209,210,211]. AI-based methods are improving traditional G anonymity methods from multiple perspectives. Although AI has brought a huge revolution in the privacy domain as a defense tool, the computing complexity (CC) of some models can be very high. Shaukat et al. [212] described the CC of many famous machine learning algorithms. In general, the time complexity of any AI model depends on the nature of the data, the input size (e.g., n), the number of iterations/steps (e.g., k), and the parameters (e.g., N). For example, the complexity of simple decision tree is $O\left(m{n}^2\right)$ for tabular data, where n denotes the number of tuples, and m denotes the number of columns. In contrast, the time complexity of a deep belief network (BBN) is $O\left(\right(n+N\left)k\right)$, where n is the number of records, k denotes the iterations, and N is the number of parameters.

3.3.6. Hybrid Graph Anonymization Methods

Hybrid G anonymization methods employ more than one anonymity operation/method while converting G into $G^{{}^{\prime }}$. For example, graph modification and clustering methods can be jointly applied to anonymize OSN data enclosed in a G form. Many SOTA hybrid G anonymization methods have been proposed to anonymize OSN data with a better balance of privacy and utility. Liu et al. [213] presented a hybrid anonymization algorithm (e.g., k-anonymity and randomization) for OSN data. The proposed algorithm employs the k-anonymous concept to hide the SI in natural groups/classes of OSN data and uses a randomization approach to process the residual data. The proposed algorithm is more stable and changes the G less than the k-degree anonymity and randomization algorithms. Later, k-anonymity and randomization were jointly used to lower the structural changes in the anonymization of G [214]. Mortazavi et al. [215] used both k-anonymity and ℓ-diversity concepts to anonymize OSN data. The proposed method optimizes the privacy–utility trade-off in PPGP and is more computationally efficient than previous algorithms. Liao et al. [216] used both k-degree anonymity and a genetic algorithm in order to anonymize OSN data enclosed in a G form for recommendation purposes. A hybrid algorithm based on fuzzing SI and converting user’s association into an uncertain form was given by Wang et al. [217]. Specifically, the authors define a new attack model in a G and propose an algorithm and safety parameter to safeguard against such attacks.

Qu et al. [218] proposed a hybrid method for a location as well as identity privacy preservation by using a game-based Markov decision process. A new framework that optimizes the utility of $G^{{}^{\prime }}$ by employing multiple anonymization techniques was given by Wang et al. [219]. A generic and hybrid anonymization method that guarantees users’ privacy and utility in OSN data was proposed by Mortazavi et al. [220]. Similarly, a low-cost G anonymization method based on k-degree anonymity and contractions (i.e., inverse operation, vertex cloning, connectivity, etc.) was proposed by Talmon et al. [221]. A contact G-based approach to anonymize OSN data was proposed by An et al. [222]. The proposed method uses a k-anonymity-based method and contact graphs with location patterns to anonymize G. Although hybrid methods yield better performances in most cases, their complexity is relatively higher than the individual methods. Furthermore, applying the hybrid anonymization method can severely degrade either privacy or utility in some cases. Hence, more efforts are needed to improve the technical aspects of the hybrid anonymity method as well as to determine the correct application scenarios for them.

In summary, all anonymization methods developed for G have their own merits and demerits. For example, graph modification methods expose the G’s structure, which can be helpful to analyze the G for recommendation and marketing purposes. In contrast, clustering methods provide better privacy but suppress the G’s structure, which may hinder knowledge discovery in $G^{{}^{\prime }}$ from all perspectives. Privacy-aware G computing methods ensure the strong privacy of users without degrading the utility. The DP-based methods ensure better privacy even if most parts of G are already exposed to the adversaries. However, utility is the main concern of DP-based anonymization methods. AI-based methods are good at striking the balance between utility and privacy. However, pre-mature convergence and deciding optimal values for hyperparameters are the main challenges in AI-based anonymity methods. Hybrid anonymization methods are computationally expensive and may lead to the redundant usage of some techniques. In the current literature, clustering, DP, and AI-based methods are more popular than others. In the coming years, most studies and enhancements are expected in clustering, DP, and AI-based methods. Furthermore, some recent studies have hinted that hybrid anonymization methods are more useful in safeguarding users’ privacy in dynamic settings (e.g., federated learning, collaborative learning, etc.). We compare the methods based on various factors in

Table 7. Comparison of anonymization methods (a.k.a. privacy-preserving solutions) used in OSNs.

Ref.	Privacy and Utility Results Status		Future Research Potentials	Rating in Discipline (OSNs)
	Privacy	Utility
Modification methods	Acceptable	High	Medium	3
Clustering methods	High	Acceptable	High	3
PAGC methods	High	Low	High	4
DP-based methods	High	Low	Very High	4
AI-based methods	High	Acceptable	Very High	4
Hybrid methods	High	High	Very High	5

Abbreviations: PAC (Privacy-aware graph computing); Rating criteria: 5: very high and 1: very low.

. Furthermore, we rate the approaches based on their protection level and future research potential. This analysis can pave the way for choosing the right privacy solutions as well as for exploring the research possibilities of these methods.

4. Major Developments in Privacy Preservation in Application-Specific Scenarios of OSNs

With the passage of time, the services of OSNs are expanding in both scale and scope. For example, OSNs enable the formation of communities of like-minded people where people can interact and share their activities/events [223]. OSNs enable information sharing at a much faster pace than any other medium by identifying and delivering information to influential people [224]. They enable friend recommendations by analyzing the demographic, spatial, and interest similarities among users in a seamless manner [225]. Moreover, OSNs enable topic modeling and event detection (i.e., earthquakes, pandemics, floods, etc.) [226]. In the coming years, OSNs are likely to play a key role in assisting mankind in multiple ways. We refer to these services (i.e., community detection, information spread/control, friend recommendations, topic modeling, events detection, etc.) of OSNs as application-specific scenarios of OSNs. We demonstrate an overview of the community detection from G in Figure 22 before presenting privacy-preserving solutions in different application-specific scenarios of OSNs.

In

Table 8. SOTA techniques proposed for privacy preservation in OSNs’ application-specific scenarios.

Ref.	Nature of Study	Key Assertion (s)	Experimental Analysis	Application Scenario	Datasets Used
Zheng et al. [227]	Technical	Privacy protection of sensitive link information in OSNs	√	Community detection	R
Wang et al. [228]	Technical	Controls privacy leakage to the application server using ZKPs	√	Friend recommendations	R
Li et al. [229]	Technical	A secure plugin for privacy preservation of bystanders in OSNs	√	Content sharing	R
Yi et al. [230]	Technical	Privacy protection of profiles in OSNs using multiple servers and encryptions	√	Profile matching	R
Wei et al. [231]	Technical	Privacy protection of social content using $ϵ$-LDP approach	√	Topic recommendations	R
Valliyammai et al. [232]	Technical	Privacy protection of sensitive topics by detecting sensitive content	√	Diffusion of sensitive topics	R
Casas et al. [233]	Technical	Privacy protection and utility enhancements of users’ data in OSNs	√	Analytics and mining of G	R
Gao et al. [234]	Technical	Privacy protection in partitioning and mining G for analytical purposes	√	Subgraph mining from G	R
Li et al. [235]	Technical	Privacy protection of online communities in sensitive content sharing	√	Content recommendation	R
Mazeh et al. [236]	Technical	Privacy protection of online activity data and purchase histories	√	Recommender systems	R
Yargic et al. [237]	Technical	Privacy protection of users’ sensitive preferences in OSN environments	√	Collaborative filtering	R
Bahri et al. [238]	Theoretical	Privacy protection of users when OSN data is located in multiple locations	×	Decentralized services	-
Dong et al. [239]	Technical	Social proximity analysis with privacy guarantees identification of potential friends in OSNs	√	Friend discovery	S
Liu et al. [240]	Technical	Analyzes the risk of community privacy and suggests ways to hide them in OSNs	√	Hiding community structure	S
Guo et al. [241]	Technical	Quantifies the influence of users based on attributes with privacy preservation in OSNs	√	Influence estimation	R
Yin et al. [242]	Technical	Privacy preservation in OSNs by analyzing the relationship between pairs of users	√	Social relationship	R,S
Kukkala et al. [243]	Technical	Designs a privacy-preservation protocol based on secure multi-party computation for OSNs	√	Influential spreaders	S
Yuan et al. [244]	Technical	Designs a privacy-preservation method for OSNs with restricted changes in the structure of G	√	Node relationships	R
Gao et al. [245]	Technical	Privacy preservation in OSN data by minimally removing edges/nodes from the original G	√	Data publishing	R
Zheng et al. [246]	Technical	Privacy preservation in OSNs by controlling higher distortion in G through DP method	√	Mining and analytics	R
Ferrari et al. [247]	Technical	Privacy preservation in OSN data by clustering and anonymizing people in G	√	Pattern extraction	R
Aljably et al. [248]	Technical	Privacy preservation of the user information from OSNs utilizing restricted LDP	√	Anomaly detection	R
Liang et al. [249]	Technical	Privacy preservation of the user action in OSNs via suboptimal estimator	√	Users action privacy	R
Shan et al. [250]	Technical	Privacy preservation based on user’s privacy preferences in OSN environments	√	Personalized privacy	R
Stokes et al. [251]	Technical	Incidence geometries and clique complexes based privacy preservation of OSN data	√	Statistical analysis	R
Wen et al. [252]	Technical	Privacy preservation of OSN data by identifying and hiding the vulnerable nodes in G	√	Recommendation systems	R

Key: √⇒ available/reported and ×⇒ not available/not reported, R⇒ real, S⇒ synthetic, and -⇒ not used.

, we summarize and compare the SOTA anonymization techniques proposed for privacy preservation in application-specific scenarios of OSNs.

Apart from the famous application-specific scenarios of OSNs listed in Table 8, OSN privacy preservation has been improved by many of the latest techniques, such as federated learning [253]. Therefore, application-specific scenarios of OSNs will be expanded further in the coming years. Furthermore, in some cases, application scenarios of OSNs were used to protect the privacy of OSN users. For example, Rajabzadeh et al. [254] used the community detection concept in a k-degree-based anonymization method in order to preserve the privacy of OSN users (as shown in Figure 23). The proposed method can safeguard users’ privacy without degrading the utility of $G^{{}^{\prime }}$. Bourahla et al. [255] discussed the method of privacy preservation in dynamic scenarios (i.e., sequential publishing) of OSNs. Further information concerning OSN privacy in application-specific scenarios can be learned from previous studies [256,257]. Lastly, privacy preservation in application-specific scenarios of the OSNs is expected to become an emerging avenue of research in the coming years.

5. Major Developments in De-Anonymization of OSNs

The research in OSN privacy is continued in two tracks: defense and attack. The former is concerned with privacy protection from adversaries (a.k.a. anonymization) and the latter is concerned with breaching privacy (a.k.a. de-anonymization). Recently, a substantial number of de-anonymization approaches have been proposed to compromise the privacy of OSN users. The basic goal of the de-anonymization approaches is to re-identify the people uniquely from $G^{{}^{\prime }}$ even though a strong anonymization is performed. The de-anonymization is usually performed by exploiting the weaknesses of the anonymity methods, linking $G^{{}^{\prime }}$ and auxiliary graphs, and/or background knowledge available to adversary. In Figure 24, we demonstrate an example of how de-anonymity is performed on $G^{{}^{\prime }}$. As shown in Figure 24d, adversaries can exploit the structural information between two graphs, and can infer the identity/SI of OSN users.

Recently, many de-anonymization methods have been proposed, and some methods have accuracies of over 80% in correctly identifying nodes from $G^{{}^{\prime }}$ [259]. Recently, due to rapid developments in digitization, the availability of personal information on various OSNs is rising rapidly, leading to a variety of privacy problems [260,261,262,263,264,265]. These developments indicate the eve-increasing interest of researchers in de-anonymization rather than anonymization. In

Table 9. SOTA de-anonymization approaches proposed for breaching users’ privacy in OSNs.

Ref.	Nature of Study	Key Assertion (s)	Privacy Attack	Items Exploited	Datasets Used
Ji et al. [266]	Technical	Privacy disclosure by exploiting attribute and $G^{{}^{\prime }}$ structure	Identity disclosure	User’s attributes	R
Li et al. [267]	Technical	DNN is adopted to learn features for node matching from $G^{{}^{\prime }}$	Identity disclosure	Structure of $G^{{}^{\prime }}$	R
Jiang et al. [268]	Technical	Privacy disclosure through structure and attribute similarity	Identity disclosure	Node properties	R
Sun et al. [269]	Technical	Privacy disclosure through spectrum-partitioning method	Identity disclosure	Subgraphs of $G^{{}^{\prime }}$	S
Qu et al. [270]	Technical	FBI-based method to extract identities of real-world users	Identity disclosure	Profile, $G^{{}^{\prime }}$ structure, & friendship	R
Qu et al. [271]	Technical	RCM-based user matching across OSNs using similarities of concepts	Identity disclosure	Salient features	R
Desai et al. [272]	Technical	Semantic knowledge-based private users’ information disclosure	SI disclosure	Background knowledge	R
Hirschprung et al. [273]	Technical	Identification of people through music preference data	Identity disclosure	Music interests	R
Mao et al. [274]	Technical	Identification of people by thoroughly analyzing the structure of $G^{{}^{\prime }}$	SI disclosure	Structure of $G^{{}^{\prime }}$	R
Qian et al. [275]	Technical	Identification of sensitive data by linking $G^{{}^{\prime }}$ & knowledge graphs	SI disclosure	Structure of $G^{{}^{\prime }}$	R
Li et al. [276]	Technical	NHDS-based method for revealing sensitive data of the users of OSNs	SI disclosure	$G^{{}^{\prime }}$ structure and profiles	R
Feng et al. [277]	Technical	Link privacy breaches in OSNs using three types of similarity metrics	Link prediction	Structure of $G^{{}^{\prime }}$	R
Gulyás et al. [278]	Technical	Correct re-identification of a large number of nodes using similarity function	Re-identify nodes	Auxiliary graphs	R
Horawala et al. [279]	Technical	Correct re-identification of a large number of nodes using ML techniques	Re-identify nodes	Node attributes	R
Wu et al. [280]	Technical	Matching a large number of users via overlapped communities concepts	Re-identify nodes	Overlapping Communities	R
Zhou et al. [281]	Technical	Identify multiple accounts of a same person in different OSNs	Identity linkage	Social interactions	R
Chen et al. [282]	Technical	Identify a user by analyzing the social content (i.e., text and images)	Linking users’ identities	Social contents	R
Halimi et al. [283]	Technical	Identify a user’s profiles with high probability using ML	User’s profiles	Auxiliary data	R
Tang et al. [284]	Technical	Matching users to extract SI in different G using embedding vectors	Link prediction	Neighbors’ information	R
Zhou et al. [285]	Technical	Correctly linking same users across OSNs using graph neural network	Identity linkage	Node distribution	R
Chen et al. [286]	Technical	Correctly linking the identity of user using semi-supervised method	Identity linkage	Semantic features	R
Wang et al. [287]	Technical	Correctly links a profile of users across multiple OSN platforms	Profile linkage	Duplicate profiles	R

Key: R⇒ real, S⇒ synthetic, and -⇒ not used.

, we summarize the findings of various SOTA de-anonymization approaches proposed for OSNs.

This topic (i.e., graph de-anonymization) has become a mainstream research area in OSN privacy in recent times. Many approaches have been proposed in order to infer identity, SI, membership, and degree information by linking $G^{{}^{\prime }}$ and graph data available at external sources. Recently, the use of AI techniques have advanced the de-anonymization area, and many approaches have been proposed for cross-OSN users matching, content-based identity linkage, link prediction, and social connection information disclosure, to name a few. We refer interested readers to learn more about de-anonymizibility from previous surveys focusing solely on privacy attacks in OSNs [288,289,290]. In the coming years, more developments are expected in the graph de-anonymization area amid the rapid rise in auxiliary information as well as the maturity of AI tools.

6. Challenges of Preserving Privacy in Online Social Networks

The privacy preservation of OSNs is relatively more challenging than the tabular data due to the existence of more information in G data [291]. As stated above, OSN privacy can be compromised in various ways, and therefore, privacy preservation in OSN data is highly challenging. In Figure 25, we present a high-level overview of challenges in OSN privacy preservation.

In Figure 25, we classified the challenges into four categories (i.e., flexible anonymity methods, privacy preservation from AI-powered attacks, incorporating privacy preferences in the design of anonymity methods, and accurately quantifying the privacy and utility levels in $G^{{}^{\prime }}$). Apart from these challenges, devising evaluation metrics for G data, evading the power of data mining tools, and resisting the linking of multiple Gs are also very challenging. These challenges can be addressed by devising innovative technologies in the future.

7. Promising Future Research Directions

Researchers are constantly devising new privacy-enhancing techniques for OSNs because the scale and scope of the privacy threats are expanding due to the higher adoption of OSNs across the globe. Privacy preservation of OSNs is more challenging compared to hospitals/banks because a lot of personal data (e.g., user profiles) has already been exposed to adversaries. There are a variety of research tracks in OSNs, for example, privacy preservation in publishing G, de-anonymization of $G^{{}^{\prime }}$, metrics for measuring privacy and utility in PPGP, privacy preservation in mining and crawling users’ data from OSNs’ sites, and privacy preservation using AI tools/methods, to name a few. In the coming years, more practical and robust techniques will be developed in each track cited above. In Figure 26, we list promising avenues for future research based on the extensive analysis of the published literature, the developed anonymization tools, the challenges in OSNs privacy, and dedicated surveys. We believe that the list of research opportunities listed in Figure 26 offers a starting point for early researchers in the OSN privacy area. Furthermore, these research gaps require further investigation/research from the research community amid the rapid rise in OSN privacy breaches.

The development of privacy-preserving approaches that can incorporate the preferences (e.g., users can decide which item among their attributes is most sensitive and thereby needs stronger privacy, or users can specify how their data should be processed in OSN environments) of users is an important avenue for future research. The development of anonymization methods that can be tuned easily based on the type of graph is an active area of research. Devising privacy-preserving solutions that can ensure defense against well-known and executable privacy attacks (e.g., background, linking, minimality attacks, etc.) is a vibrant area of research. Recently, to optimize privacy guarantees, many AI-based techniques have been integrated with traditional anonymization methods. Therefore, exploring the opportunities of AI techniques in terms of privacy preservation in OSNs is an active area of research. The development of anonymization methods that require fewer parameters and that can be used in resource-constrained environments (e.g., cell phones, gadgets, etc.) is another important research direction. The development of hybrid privacy-preserving solutions (e.g., combining different techniques) that can overcome each other’s weaknesses is a vibrant area of research. Developing new metrics that can technically measure the privacy strength from multiple perspectives (i.e., active and passive adversary, across domains, etc.) is an important and active area of research. Developing privacy solutions that can be used in multiple scenarios for privacy protection in OSNs is another potential research direction. Devising methods that can quantify the privacy loss while mining/crawling OSNs data is a prominent area of research. In addition, devising robust de-anonymization methods is a handy direction for the future as it can accelerate development from defense perspectives. Optimizing privacy utility is a longstanding research problem in the privacy domain, and requires technical solutions from the research community. Lastly, developing strong privacy-enhancing techniques to provide resilience against AI-powered attacks/tools is a very hot research area in recent times.

Apart from the research opportunities cited above, exploring the role of the federated learning paradigm in the OSN privacy area is also expected to be a vibrant area of research in the coming years [292]. Recently, a relatively new risk to the individual’s privacy, named interdependent privacy (i.e., co-location and location information), is emerging [293,294]. Therefore, advanced privacy-preserving methods are imperative to addressing this emerging risk [295]. Recently, synthetic data-generation methods are also posing a threat to OSN users’ privacy by creating data similar to real data [296,297]. Therefore, many privacy-preserving approaches are needed to provide resilience against these threats. Additionally, some anonymization methods that are proposed for other data styles (e.g., tabular, traces, sets, matrices, etc.) can be adopted to preserve the privacy of OSN users in the PPGP. Finally, devising practical methods that can restrict user identity linkages across OSNs is also one of the hot research topics for future endeavours.

8. Limitations of This Review Article

Although this review is more systematic, comprehensive, and insightful than previous reviews, certain limitations exist concerning the number of studies and the coverage domain. For example, we could not find many studies that ensured the anonymity of multimedia data (i.e., images or text written over images) in OSNs, which is one of the hot research topics in recent times. In addition, we could not present any analysis or categorization based on the types of social graphs because the anonymization methods proposed for one type of graph cannot be directly applied to another type of graph (e.g., let us say the PPGP approaches proposed for the directed graph cannot be straightforwardly used for the undirected graph, and vice versa). In addition, this paper does not include studies that have adopted the OSN concept for other services. For example, OSNs’ data modeling concepts have been widely used in the COVID-19 arena for infection-spread modeling and analysis. In addition, many OSN concepts have been used for clinical data processing, modeling, and knowledge derivation. Furthermore, we could find some studies that can be simultaneously applied to multiple (i.e., friend recommendations and fried discovery, information spread and contagion, etc.) service scenario(s) in OSNs. This article did not highlight the AI methods in detail (e.g., workflow, parameters, time and space complexity, convergence rates, etc.) but rather focus on AI use in OSNs’ privacy preservation (or breaches). Lastly, we mainly focused on recent studies, and we did not consider a span (e.g., the last 5 years, or the last decade) while searching for the studies. However, these limitations do not significantly undermine the quality of this review and can be investigated in future reviews.

9. Conclusions and Future Work

In this paper, we have presented a systematic review of SOTA and recent anonymization techniques that have proposed ways to combat privacy issues in OSNs. Specifically, we have classified the privacy dilemma into two categories: privacy preservation in publishing G and privacy preservation in application-specific scenarios of OSNs. We have presented an extended (i.e., common approaches + AI approaches) taxonomy of anonymization approaches concerning graph data publishing. Moreover, we have presented various representative techniques that are being developed to address privacy issues in the application-specific scenarios (i.e., community clustering, topic modeling, information diffusion, friend recommendations, etc.) of OSNs. We also described various methods that are used to infer identity or private information from published G. Lastly, we discussed various challenges related to OSN privacy and suggested promising opportunities for future research. Through an extensive analysis of the literature, we found that the privacy preservation of OSNs is a very trendy topic among other data styles (e.g., tabular, set, logs, etc.). Many developments are stemming from both anonymization and de-anonymization perspectives. In the coming years, privacy preservation in OSNs will be more challenging, as OSNs are being adopted by an increasingly large number of people across the world. Furthermore, our reliance on OSNs is also increasing over time, leading to the exposure of more fine-grained data on OSNs sites. In this article, we highlighted the latest SOTA developments concerning the privacy of OSN users. To the best of our knowledge, this is the first work that discusses OSN privacy from a broader perspective, including AI approaches, in the OSN domain. The detailed analysis presented in this article can pave the way for grasping the status of the latest research as well as for developing secure privacy-preserving methods to safeguard OSN users’ privacy from prying eyes. Most importantly, our work aligns with the recent trends toward responsible data science (i.e., preventing misuse of personal data). In the future, we intend to explore the role of the latest technologies, such as federated learning, in preserving users’ privacy in OSNs. We intend to explore privacy and utility metrics that can be used to quantify the level of privacy and utility offered by anonymization methods in PPGP. Lastly, we intend to explore the role of AI in the privacy domain in heterogeneous data formats (e.g., tables, graphs, matrix, logs, traces, sets, etc.), and multiple computing paradigms such as OSNs, cloud computing, location-based systems, Internet of Things, recommender systems, telemedicine, and AI-based services.