Effective Route Recommendation Leveraging Differentially Private Location Data

Abstract

The proliferation of GPS-enabled devices and advances in positioning technologies have greatly facilitated the collection of user location data, making them valuable across various domains. One of the most common and practical uses of these location datasets is to recommend the most probable route between two locations to users. Traditional algorithms for route recommendation rely on true trajectory data collected from users, which raises significant privacy concerns due to the personal information often contained in location data. Therefore, in this paper, we propose a novel framework for computing optimal routes using location data collected through differential privacy (DP)-based privacy-preserving methods. The proposed framework introduces a method for accurately extracting transitional probabilities from perturbed trajectory datasets, addressing the challenge of low data utility caused by DP-based methods. Specifically, to effectively compute transitional probabilities, we present a density-adjusted sampling method that enables the collection of representative data across all areas. In addition, we introduce an effective scheme to approximately estimate transitional probabilities based on sampled datasets. Experimental results on real-world data demonstrate the practical applicability and effectiveness of our framework in computing optimal routes while preserving user privacy.

1. Introduction

The proliferation of GPS-enabled devices and advances in positioning technologies have made it easier to collect user location data, making them valuable in a variety of fields. GPS technology is now ubiquitous, embedded in smartphones, wearables, and vehicles, generating vast amounts of location data every day. These data have diverse applications, ranging from personalized services such as targeted advertising and location-based recommendations to broader applications in urban planning, traffic management, and public safety [1,2,3]. One of the most common and practical uses of these location datasets is route recommendation, which aims to recommend the optimal route between two points (i.e., start and end) to users, thereby improving the navigation experience and helping individuals find the most efficient paths [4,5].

Route recommendation has become a major focus in the field of location-based services. Numerous algorithms have been developed to process trajectory data and identify optimal routes using techniques from data mining, machine learning, and graph theory [6,7,8]. Most of these approaches rely on the availability of true trajectory data collected from a large number of users. In these approaches, accurate and comprehensive data are essential to compute optimal routes and generate highly effective recommendations. However, such data are not always available for all applications because collecting true location information from users raises significant privacy concerns. This is because location data often contain personal information, such as home or work addresses, hospital visits, and even political affiliations [9,10]. For example, analysis of location data could reveal a user’s frequent visits to a medical clinic, indicating specific health problems. As a result, users are becoming increasingly aware of the privacy implications of sharing their location data with application providers. This concern has led to a reluctance to provide true location information, limiting the availability of high-quality datasets for application purposes.

In response to these privacy concerns, considerable research has been conducted to develop methods for protecting location privacy when applications collect, process, and utilize user location information. Anonymity-based approaches, which aim to de-identify user data by transforming personal location information into more generalized data, were among the early solutions [11,12]. However, these methods have limitations regarding their effectiveness and the trade-offs between privacy and data utility. Among the various privacy-preserving techniques, differential privacy (DP) has emerged as a de facto standard. DP ensures that an arbitrary attacker, regardless of their background information, cannot determine whether a particular individual’s data are included in the dataset [13]. This provides strong privacy guarantees while still allowing for meaningful data analysis. As DP has become a popular solution, there have been extensive efforts to apply the concept of DP to the protection of location data [14,15,16].

A more practical solution for computing the optimal route is to utilize location data collected through privacy-preserving methods. In this scenario, data contributors who agree to share their location data provide obfuscated trajectories obtained using DP-based methods. The application then analyzes these privacy-preserved trajectories to extract the necessary information and computes the optimal route based on this extracted information. By employing such privacy-preserving techniques, the true location information of data contributors remains confidential, protecting their privacy while still enabling the computation of the optimal route.

However, a significant challenge arises from the fact that datasets collected under DP-based privacy-preserving methods often have low utility. DP techniques introduce noise to the true data, which diminishes their accuracy and makes it difficult to derive precise and reliable information. This trade-off between privacy and utility necessitates the development of innovative methods that can effectively extract necessary information from low-utility datasets. Thus, in this paper, we propose a method to effectively compute the optimal route using location data collected with DP-based privacy-preserving techniques. In particular, the contributions of this paper are summarized as follows:

• We present a novel framework for effectively computing and recommending an optimal route in a privacy-preserving manner. In particular, we use metric DP [15,17,18], which extends standard DP to handle data with inherent metric or distance measures, such as location data. To the best of our knowledge, this is the first work to compute an optimal route from location datasets collected under metric DP.
• We present a method for effectively extracting transitional probabilities from perturbed trajectory datasets. Directly computing transitional probabilities from perturbed data, which often has low utility, can lead to inaccurate results. Therefore, we propose a novel approach to compute transitional probabilities more effectively from the perturbed trajectory data. Specifically, we first present a density-adjusted sampling method to collect representative data from users. This approach ensures that the collected data comprehensively cover all areas. We then introduce a scheme to approximately estimate transitional probabilities based on sampled datasets.
• Finally, through experiments on real data, we demonstrate that the proposed framework can effectively compute the optimal route with perturbed trajectory datasets, which highlights its practical applicability and effectiveness.

The remainder of this paper is organized as follows: Section 2 presents related work. Section 3 provides the necessary background information and formally defines the problem addressed in this paper. Section 4 presents our proposed framework for computing optimal routes. In Section 5, we experimentally evaluate the proposed approach using real datasets. The conclusion is presented in Section 6.

2. Related Work

There has been significant research focused on computing and recommending optimal routes between two locations using trajectory data collected from numerous users. Chen et al. [19] proposed the Coherence Expanding algorithm, which models a transfer network using historical trajectory data. This network is then used to compute transfer probabilities. In addition, they introduced the Maximum Probability Product algorithm to identify the most popular route from the constructed transfer network. Shafique and Ali [20] developed a technique to recommend the most popular path within a region of interest, which is defined by the areas most frequently visited by users around point of interest (POI). Their method processes historical trajectory data by segmenting trajectories into smaller parts and removing noisy data points to enhance accuracy. Yochum et al. [21] proposed an itinerary recommendation system that suggests optimal routes between POIs. For itinerary recommendation, they developed an adaptive genetic algorithm that incorporates various factors such as the popularity of POIs, time constraints, and the length of the trip to optimize itinerary planning. Liu et al. [22] developed a method for computing the most probable routes with travel cost estimation. They introduced a popular traverse graph to summarize historical trajectories independent of road network information. The authors then created a self-adaptive method to model travel costs for each route over different time intervals, and proposed an efficient algorithm to find the optimal route between source and destination locations based on this graph. Wang et al. [23] proposed a route planning method that recommends optimal routes based on driver preferences. Their proposed method considers various attributes that influence a driver’s choice, such as scenery, congestion, and traffic flow, to recommend popular routes.

There has been extensive research on the efficient computation of optimal routes. Classical methods often use search algorithms, such as dynamic programming, to reduce the search space [24]. For instance, Huang et al. [25] introduced a dynamic programming method for providing mobile sequential recommendations to taxi drivers. Teng et al. [26] addressed a joint optimization problem for POI recommendations that maximizes the diversity of POIs within a given travel budget, such as distance or cost constraints. More recently, advancements in deep learning have led to the development of methods that utilize modern techniques like graph neural networks and generative models to compute optimal routes [6,27,28,29]. Huang et al. [6] proposed a multi-task route recommendation framework that leverages deep learning techniques to extract path representations. They utilized beam search algorithms to provide recommendations for multiple related tasks. Wang et al. [27] proposed a novel approach to personalized route recommendation by utilizing neural networks to automatically learn the cost functions in the A* algorithm. Their method leverages attention-based recurrent neural networks to effectively model the travel cost from the source to the candidate location. By incorporating contextual information, the recommended routes are adjusted to accommodate the individual’s specific needs and preferences.

We note that the existing approaches for calculating and recommending optimal and popular routes rely on users’ true location datasets, which inherently raise significant privacy concerns. However, the method proposed in this paper takes a fundamentally different approach by utilizing privacy-preserving datasets collected under the DP-based method, thereby ensuring the protection of users’ location privacy. By leveraging DP-based techniques, the proposed algorithm effectively mitigates the risks associated with sharing sensitive location data while still providing effective route recommendations.

Several efforts have been made to ensure the privacy of the user’s location through the use of DP in the context of trajectory data in various applications. Kim et al. [30] proposed a method for recommending top-n routes in indoor spaces using local differential privacy (LDP), which is a localized version of DP, to ensure privacy preservation. Du et al. [16] developed a privacy-preserving framework for generating synthetic trajectory data, employing LDP to collect necessary information such as transitional probabilities and the distribution of start and end locations. SPIREL is a privacy-preserving POI recommendation framework that identifies POIs of potential interest to users [31]. To generate these recommendations, SPIREL uses trajectory data along with user check-in history collected using LDP to ensure user privacy. RNN-DP [32] is a dynamic data publishing framework that protects user privacy when publishing sensitive trajectory data. RNN-DP combines recurrent neural networks with DP to protect user privacy while publishing trajectory data.

Recently, with the development and widespread use of generative AI techniques, several efforts have been made to apply these methods to route and trajectory data. Among these, synthetic route data generation has emerged as a particularly popular area, where generative AI is used to generate large amounts of synthetic route data [33,34]. These data can be used in various applications, including optimal route recommendations. Moreover, some approaches in this domain incorporate DP to ensure privacy protection when generating synthetic routes using generative AI. For example, DP-Loc [35] is a DP-based approach that utilizes a variational autoencoder and DP to generate synthetic routes with time information. Similarly, DP-TrajGAN [36] is a privacy-preserving trajectory generation model that combines DP with a generative adversarial network.

3. Background and Problem Definition

3.1. Background

In this subsection, we present the background information for this paper. Recently, DP has become the standard approach for privacy-preserving data processing. DP is based on a formal mathematical framework that provides a probabilistic privacy guarantee, even against attackers with arbitrary background knowledge [13]. It ensures that an attacker cannot confidently determine whether a given individual is included in the published dataset. DP is formally defined as follows:

Definition 1.

(ϵ-DP) A randomized algorithm $\mathcal{A}$ satisfies ϵ-DP if and only if the following condition is satisfied for any two neighboring datasets, $D_1$ and $D_2$, and any possible output O of $\mathcal{A}$:

$$Pr[\mathcal{A}\left(D_1\right)=O]\le e^{ϵ}\times Pr[\mathcal{A}\left(D_2\right)=O].$$

(1)

Here, two datasets, $D_1$ and $D_2$, are considered neighbors if they differ by only one record. This definition implies that for any output of $\mathcal{A}$, an adversary, regardless of his background knowledge, cannot confidently determine whether $D_1$ or $D_2$ was used as input. The parameter $ϵ$, known as the privacy budget, controls the level of privacy: smaller $ϵ$ values provide stronger privacy protection by adding more noise to the result, while larger $ϵ$ values provide weaker privacy protection with less noise.

There have been several proposals to extend standard DP to handle data with inherent metric or distance measures [15,37,38]. Among them, geo-indistinguishability (Geo-Ind) is widely recognized as the standard privacy definition for protecting location data in location-based services [14,15]. In this paper, we use Geo-Ind to collect the location data of the users in a privacy-preserving manner. Geo-Ind is formally defined as follows:

Definition 2.

(ϵ-Geo-Ind) Consider $\mathcal{X}$ as the set of possible user locations and $\mathcal{Y}$ as the set of reported locations, which are typically assumed to be equal. Let K be a randomized mechanism that generates a perturbed location from a user’s true location. A randomized mechanism K satisfies ϵ-Geo-Ind if and only if the following condition holds for all $x_1,x_2\in \mathcal{X}$ and any output location $y\in \mathcal{Y}$:

$$K\left(x_1\right)\left(y\right)\le e^{ϵ·d(x_1,x_2)}\times K\left(x_2\right)\left(y\right),$$

(2)

where $d(x_1,x_2)$ corresponds to the distance between $x_1$ and $x_2$.

There are two primary methods for implementing Geo-Ind: the Laplace mechanism and the matrix-based mechanism. It is well known that the matrix-based mechanism is more effective than the Laplace method [15]. In the matrix-based mechanism, the space is first divided into a set of disjoint grids and the data aggregator computes an obfuscation matrix M that satisfies $ϵ$-Geo-Ind. This matrix is then distributed to users, who use it to perturb their location data according to the probabilities specified in M. Users report the perturbed location to the aggregator instead of their true location. Several approaches have been proposed in the literature to compute the obfuscation matrix that satisfies $ϵ$-Geo-Ind.

3.2. Problem Definition

In this subsection, we formally define the problem and introduce key terminology necessary to describe the algorithm proposed in this paper. Our focus is to identify and recommend an optimal route between two points, which is a common service provided by location based services, in a privacy-preserving manner.

Assume that the entire area is partitioned into $m_1\times m_2$ grids. Let $G=\{g_1,g_2,\dots ,g_m\}$ be a set of grids where $m=m_1\times m_2$. Users’ locations are represented by the grid in which they are located. Let $N\left(g_i\right)\subset G$ denote the set of neighboring grids for $g_i$. Without loss of generality, in this paper, we assume that users can move between neighboring grids.

Let R be a route (or trajectory) of length $\left|R\right|$, and let $R\left[l\right]$ denote the l-th location on the route R. Given a starting point $g_s\in G$ and an ending point $g_e\in G$ specified by a user query, let $S{R}_{s,e}$ represent the set of all possible routes from $g_s$ to $g_e$. That is, each route $R\in S{R}_{s,e}$ satisfies $R\left[0\right]=g_s$ and $R\left[\right|R\left|\right]=g_e$. For each route $R\in S{R}_{s,e}$, let $Pr\left(t_{s,e}\right|R)$ denote the likelihood that users located at $g_s$ will move to $g_e$ via route R. Here, $t_{s,e}$ represents the transition state from grid $g_s$ to grid $g_e$. The problem addressed in this paper is to find an optimal route $R^{*}$ such that the following condition is satisfied:

$$R^{*}=\underset{R\in S{R}_{s,e}}{arg\; max}Pr\left(t_{s,e}\right|R)$$

(3)

In other words, the objective of this paper is to compute the most probable route $R^{*}$ from $g_s$ to $g_e$ that maximizes the likelihood of users traveling between these points. This computation is based on the transitional probabilities derived from location data collected under the Geo-Ind framework.

4. Privacy-Preserving Computation of Optimal Route

In this section, we introduce the proposed method for effectively computing an optimal route that satisfies user queries in a privacy-preserving manner. Figure 1 provides an overview of our approach:

• The server first computes the obfuscation matrix, M, which satisfies $ϵ$-Geo-Ind, and distributes it to the users (Section 4.1).
• Each user selects a subtrajectory from their entire trajectory, perturbs each location along the subtrajectory using M, and sends the perturbed subtrajectory to the server (Section 4.2).
• The server estimates the transitional probabilities between neighboring points based on the perturbed subtrajectory datasets collected from users (Section 4.3).
• Based on the estimated transitional probabilities, the server computes the optimal route in response to a user query and recommends this route to the user (Section 4.4).

4.1. Computing Obfuscation Matrix

A user’s trajectory consists of multiple locations. Therefore, in order to collect trajectory information from users in a privacy-preserving manner using Geo-Ind, it is essential to apply the composition property of DP [13]. This requires dividing the privacy budget, $ϵ$, into multiple sub-privacy budgets, each of which is then used to perturb an individual location along the trajectory.

One straightforward scheme is to divide $ϵ$ by the length of the longest trajectory among users. For example, if the longest trajectory has a length of $L_{max}$, each user first divides $ϵ$ into $L_{max}+1$ sub-privacy budgets (i.e., ${\displaystyle \frac{ϵ}{L_{max}+1}}$), and then uses each sub-privacy budget to perturb the respective locations along the user’s trajectory. However, because most users’ trajectories are significantly shorter than $L_{max}$, this scheme can lead to an ineffective use of the privacy budget, which leads to low data utility for the collected data. Thus, to address this issue, this paper adopts a method in which, instead of collecting all location information along a trajectory, the aggregation server collects subtrajectories of length L (where $L<L_{max}$). This approach is a common solution in DP-based methods to effectively utilize the limited privacy budget when collecting multiple datasets [16].

As explained in Section 3.1, there are two approaches to implement Geo-Ind. In this paper, we utilize the matrix-based mechanism to collect users’ trajectory information in a privacy-preserving manner, especially by utilizing the optimization mechanism proposed in [15]. However, we note that the method proposed in this paper is general enough to be applied to any matrix-based mechanism. In the optimization mechanism, the server first computes the obfuscation matrix, M, by solving a linear programming problem. Let us assume that ${\pi }_G$ is the prior probability distribution of the possible locations of users. The obfuscation matrix, M, which satisfies ${\displaystyle \frac{ϵ}{L+1}}$-Geo-Ind, is then obtained by solving the following linear programming problem [15]:

$$\begin{array}{ccc}\hfill min:& \sum _{g_u,g_v^{\prime }\in G}{\pi }_G\left(g_u\right)·M[u,v]·d(g_u,g_v^{\prime })\hfill & \\ \hfill s.t.:& M[u,v]\le e^{{\displaystyle \frac{ϵ}{L+1}}·d(g_u,g_w)}\times M[w,v]\hfill & g_u,g_w,g_v^{\prime }\in G\\ \hfill & \sum _{g_v^{\prime }\in G}M[u,v]=1\hfill & g_u\in G\\ \hfill & M[u,v]\ge 0\hfill & g_u,g_v^{\prime }\in G\end{array}$$

(4)

Here, $M[u,v]$ represents the probability that a perturbed location $g_v^{\prime }$ is randomly generated from the user’s true location $g_u$ by Geo-Ind (in this paper, we denote the true location by g and the perturbed location by $g^{\prime }$ to distinguish between the user’s true location and the perturbed location). The prior probability distribution of the user’s possible locations, ${\pi }_G$, can be computed using available historical data. If such data are not available, a uniform distribution can be used to define the prior. Once M is computed, it is distributed to each user.

4.2. Density-Adjusted Sampling for Collecting User’s Trajectory Information

After receiving the obfuscation matrix M from the server, each user first selects a subtrajectory of length L from their entire trajectory, and then perturbs each location along the selected subtrajectory according to the probabilities embedded in M. Thus, a straightforward approach is either to select the first $(L+1)$ consecutive locations and ignore the rest [16], or to randomly select $(L+1)$ consecutive locations from the entire trajectory. However, such strategies often fail to collect representative data for computing transitional probabilities across all areas because they do not account for the distribution of users. Typically, users are densely concentrated in the central region and sparsely distributed in areas further from the center [39]. As a result, using these simple selection strategies may result in insufficient data collection to accurately compute transitional probabilities in regions further from the central area.

Figure 2 shows an illustrative example where the original data are densely concentrated near the center of the region and become sparsely distributed as the distance from the center increases. In this scenario, using random sampling may result in insufficient data for regions farther from the center, making it difficult to compute accurate transition probabilities. Therefore, in order to collect samples that are representative of the entire region, it is necessary to consider the distribution of the original data and adjust the sampling probabilities accordingly.

Thus, in this paper, we introduce a density-adjusted sampling method to collect sufficient representative data for computing transitional probabilities across all areas. The main idea of the proposed technique assumes that the distribution of user locations follows a Gaussian distribution. Thus, we first use the inverse of the value of the Gaussian probability density function as the weight for each location along the trajectory, and then randomly select a subtrajectory based on the weight of each location. This strategy assigns higher weights to locations farther away from the central region, preventing the sampled location data from being overly concentrated in the central region and resulting in a more evenly distributed dataset over the entire area.

Let $g_{\langle x,y\rangle }$ be a two-dimensional grid representation corresponding to the grid at the x-th row and the y-th column where $1\le x\le m_1$ and $1\le y\le m_2$. Since the entire domain is divided into $m_1\times m_2$ grids, the grid corresponding to the center of the area is represented as $g_{\langle {\displaystyle \frac{m_1}{2}},{\displaystyle \frac{m_2}{2}}\rangle }$. Then, the Gaussian probability density function centered at $g_{\langle {\displaystyle \frac{m_1}{2}},{\displaystyle \frac{m_2}{2}}\rangle }$ is defined as follows:

$$Pr\left(g_{\langle x,y\rangle }\right)={\displaystyle \frac{1}{2\pi {\sigma }_a{\sigma }_b}}exp\left(-{\displaystyle \frac{1}{2}}\left[{\left({\displaystyle \frac{x-\frac{m}{2}}{{\sigma }_a}}\right)}^2+{\left({\displaystyle \frac{y-\frac{m}{2}}{{\sigma }_b}}\right)}^2\right]\right)$$

(5)

Here, ${\sigma }_a$ and ${\sigma }_b$ represent the standard deviations in the row and column directions, respectively.

Given the user’s trajectory R, a weight $w_i$ for the i-th location $R\left[i\right]$ is defined using the Gaussian probability density function as follows:

$$w_i={\displaystyle \frac{\alpha }{Pr\left(grid\right(R\left[i\right]\left)\right)}}$$

(6)

Here, $grid\left(\right)$ represents the function that maps the location of the trajectory to a two-dimensional grid representation such as $g_{\langle x,y\rangle }$, and $\alpha$ denotes a predefined parameter. In other words, this weighting scheme adjusts the importance of each location along the trajectory based on its distance from the center of the area, with locations further from the center receiving higher weights.

The parameters ${\sigma }_a$ and ${\sigma }_b$ in Equation (5) control the spread of the Gaussian distribution, determining how quickly the weights decrease as the distance from the center increases. Larger values of ${\sigma }_a$ and ${\sigma }_b$ produce a flatter, more uniform distribution, while smaller values produce a steeper distribution that concentrates more weight near the center. Since the inverse of the Gaussian probability density function is used as the weight for each location in Equation (6), setting higher values for ${\sigma }_a$ and ${\sigma }_b$ flattens the distribution of the weights $w_i$. On the other hand, lower values for ${\sigma }_a$ and ${\sigma }_b$ produce a steeper distribution, assigning significantly higher weights to locations farther from the center. By adjusting these parameters, we can control the likelihood that peripheral locations are sampled more frequently. We also note that the choice of these parameter values can be empirically learned from available historical data.

Then, the weight of a subtrajectory of length L starting at $R\left[i\right]$ (i.e., the subtrajectory consisting of locations $R\left[i\right],R[i+1],\dots ,R[i+L]$) is defined as follows:

$$s{w}_i=\sum _{k=0}^L{w}_{i+k}.$$

(7)

In other words, by summing the weights of the locations along each subtrajectory, those consisting of locations farther from the center of the area receive higher overall weights than those closer to the center. As a result, when subtrajectories are randomly selected based on these weights, those farther from the center are more likely to be selected. Thus, even though the density of user locations may be higher in the central area, the proposed scheme ensures a more representative dataset across the entire area by giving a higher chance of selection to subtrajectories in less densely populated regions.

Algorithm 1 represents the pseudocode for the density adjusted sampling that is performed on each user side. The input to Algorithm 1 includes the obfuscation matrix M (which satisfies ${\displaystyle \frac{ϵ}{L+1}}$-Geo-Ind), received from the server, a trajectory R, and the length of the subtrajectory L. In line 1, the list W, which will store the weights of the subtrajectories, is initialized as an empty list. In lines 2 through 4, subtrajectories of length L are extracted from R by moving a sliding window on R from index 0 to $\left|R\right|-L$. The weight of each subtrajectory is then computed based on Equation (7), and the computed weights are then stored in the list W. In line 6, a subtrajectory is randomly sampled based on the weights of each subtrajectory. Then, in line 7, the sampled subtrajectory is perturbed by applying the obfuscation matrix M to each location along the subtrajectory. Finally, the perturbed subtrajectory is sent to the server.

The time complexity of Algorithm 1 is dominated by the for loop, which iterates $\left|R\right|-L$ times. For each iteration, the weight of a subtrajectory of length L is computed, resulting in a total complexity of $O\left(\right(\left|R\right|-L)\times L)$. If L is much smaller than $\left|R\right|$, this simplifies to $O\left(\right|R|\times L)$, which means that the complexity of the algorithm grows linearly with the size of the trajectory and the length of the subtrajectory.

Algorithm 1: Pseudocode for density-adjusted sampling (user side processing)

4.3. Computing Transitional Probabilities

To effectively compute the optimal route, it is essential to model the intra-route mobility of real-world users accurately. For this purpose, we rely on a first-order Markov chain. A first-order Markov chain models the probability of a user moving from one location to another based only on their current location, without considering the history of their previous locations. According to this model, the $(l+1)$-th location, $R[l+1]$, depends only on the previous location, $R\left[l\right]$, rather than all previous locations:

$$Pr\left(R\right[l+1\left]\right|R\left[1\right],\cdots ,R\left[l\right])=Pr(R[l+1]\left|R\right[l\left]\right)$$

(8)

This simplification makes it easier to compute the likelihood of routes when identifying the most probable route between two points.

Based on a first-order Markov chain, we define the transitional probability $Pr\left(t_{i,j}\right)$, which captures the probability that a user whose l-th location is $g_i$ will move to $g_j$ at the next $(l+1)$-th location, as follows:

$$Pr\left(t_{i,j}\right)=\left\{\begin{array}{cc}Pr(R[l+1]=g_j|R\left[l\right]=g_i),\hfill & if{g}_j\in N\left(g_i\right)\hfill \\ 0,\hfill & otherwise\hfill \end{array}\right.$$

(9)

Here, $t_{i,j}$ represents the transition state from grid $g_i$ to grid $g_j$. It is obvious that the sum of the transitional probabilities to all neighboring grids $g_j\in N\left(g_i\right)$ equals 1 (i.e., ${\sum }_{g_j\in N\left(g_i\right)}Pr\left(t_{i,j}\right)=1$). Computing the transitional probability, $Pr\left(t_{i,j}\right)$, is straightforward for the true dataset. The challenge, however, is to computer the transitional probabilities from the perturbed dataset collected under Geo-Ind. Thus, in this subsection, we present a method to effectively estimate the transitional probabilities on the basis of the perturbed datasets.

Let $P{R}_{set}$ be the set of perturbed subtrajectories collected from users in the previous step. For each perturbed subtrajectory $PR\in P{R}_{set}$, the perturbed transitions can be obtained by capturing all pairs of consecutive locations within $PR$. Specifically, for a given perturbed subtrajectory $PR$ of length L, we can extract L transitions (i.e., consecutive location pairs) such as $\left(PR\right[0],PR[1\left]\right),\left(PR\right[1],PR[2\left]\right),\dots ,\left(PR\right[L-1],PR[L\left]\right)$. These perturbed transitions are then used to estimate the true transitions.

Let $\widehat{T}$ be the $m\times m$ observed (perturbed) transition matrix, where $\widehat{T}\left[i\right]\left[j\right]$ represents the frequency of observing a transition from location $g_i$ to location $g_j$ in $P{R}_{set}$. Similarly, let T be the true transition matrix that we aim to estimate, where $T\left[i\right]\left[j\right]$ represents the true frequency of transitions from location $g_i$ to location $g_j$. The relationship between T and $\widehat{T}$ can be described as follows:

$$\widehat{T}=M^T·T·M$$

(10)

In other words, multiplying T by M on the right applies the perturbation to the current location (i.e., $R[l+1]$), while multiplying T by $M^{\top }$ on the left applies the perturbation to the previous location (i.e., $R\left[l\right]$). Given $\widehat{T}$ and M, the true transition matrix T can be estimated as follows:

$$\begin{array}{cc}\hfill \min :& \parallel \widehat{T}-M^{\top }{TM\parallel }_F^2\hfill \\ \hfill \mathrm{subject}\mathrm{to}:& T\left[i\right]\left[j\right]\ge 0\forall g_i,g_j\in G,\hfill \\ \hfill & T\left[i\right]\left[j\right]=0\forall g_j\notin N\left(g_i\right)\hfill \end{array}$$

(11)

Here, ${\parallel ·\parallel }_F^2$ denotes the squared Frobenius norm. The second constraint ensures that transitions are only possible between neighboring grids. We note that directly solving the above optimization problem can be challenging due to the complexity of the objective function and constraints. Therefore, optimization techniques such as sequential least squares programming can be used to find an approximate solution that minimizes the objective function while satisfying the constraints.

After computing the true transition matrix T, the transitional probability $Pr\left(t_{i,j}\right)$ can be obtained as follows:

$$Pr\left(t_{i,j}\right)=\left\{\begin{array}{cc}{\displaystyle \frac{T\left[i\right]\left[j\right]}{{\sum }_{g_k\in N\left(g_i\right)}T\left[i\right]\left[k\right]}},\hfill & if{g}_j\in N\left(g_i\right)\hfill \\ 0,\hfill & otherwise\hfill \end{array}\right.$$

(12)

The above equation ensures that the sum of the transitional probabilities across all neighboring grids equals 1, since the probabilities are normalized by the total number of transitions to all neighboring grids.

4.4. Recommending Optimal Route

Once the transitional probabilities have been computed, the next step is to determine and recommend the optimal route between two points based on these probabilities. As shown in Figure 1, this recommendation process is initiated whenever a user requests a route suggestion. Given the start and end points requested by a user, the probability $Pr\left(t_{s,e}\right|R)$, which denotes the probability that users located at $g_s$ will travel to $g_e$ via route $R\in S{R}_{s,e}$, is then computed as follows:

$$Pr\left(t_{s,e}\right|R)=\prod _{h=0}^{\left|R\right|}Pr\left(t_{R\left[h\right],R[h+1]}\right)$$

(13)

This approach assumes a first-order Markov chain in which the probability of transitioning to the next location is determined solely by the current location, independent of previous locations. As a result, the overall probability of traveling from the start to the end point via a specific route is computed as the product of the transitional probabilities between consecutive locations along that route, which is a method commonly used in the literature [24]. Finally, the server returns the route R in $S{R}_{s,e}$ that maximizes this probability, ensuring that the recommended route is the most likely path that users would take based on the observed data.

The first-order Markov chain model used in this paper simplifies the computation of the optimal route by considering only the current and next locations. However, the process can still be computationally expensive for large datasets. As the grid size increases, the number of possible transitions increases significantly, resulting in higher computational cost for determining the optimal route.

To address this, efficient algorithms such as Dijkstra’s or A* can be incorporated into the route recommendation step to determine the optimal route based on transition probabilities, eliminating the need to enumerate all possible routes. These algorithms, which are widely used in graph traversal problems, enable efficient route computation even for large grid sets. We also note that several proposals have introduced computationally efficient methods for determining the optimal route based on transition probabilities without enumerating all possible routes [24]. The approach proposed in this paper is general enough to incorporate such methods, allowing for efficient route computation even in large grid sets. In addition, parallel or distributed computing techniques can be utilized to further enhance computational efficiency in computing the optimal route.

5. Experiment

In this section, we present an experimental evaluation of the proposed scheme on real-world datasets.

5.1. Experimental Setup

We evaluated the effectiveness of the proposed method using the Porto taxi trajectories dataset [40], which consists of GPS coordinates collected from 442 taxis operating in Porto, Portugal. For the experiments, we first divided the geographic region into three grid sizes: $15\times 20$, $30\times 60$, and $45\times 60$. Next, for each grid configuration, we randomly selected 100,000 trajectories. In order to represent trajectories within the grid space, each location was mapped to its corresponding grid cell based on geographic coordinates.

In the experiment, the privacy budget, $ϵ$, was varied between 1.0 and 5.0. The methods used in the experiments were implemented using Python 3.8, and all experiments were performed on a system equipped with Intel Xeon 5220R CPUs and 64 GB of memory. We first present the experimental results on estimating the transitional probabilities, followed by the results of computing the optimal route.

5.2. Evaluation Results on the Estimation of Transitional Probabilities

In this subsection, we evaluate the performance of the proposed method for computing transitional probabilities using perturbed trajectory datasets. In the experiment, the length of sampled subtrajectories varies from 1 to 8. In addition, ${\sigma }_a$ and ${\sigma }_b$ in Equation (5) are set to ${\displaystyle \frac{m_1}{8}}$ and ${\displaystyle \frac{m_2}{8}}$, respectively, while the value of $\alpha$ in Equation (6) is set to 1. For comparison purposes, we report results for the proposed method ($DA$), which relies on density-adjusted sampling, and results from a method ($BS$) based on simple (non-density-adjusted) sampling. The following metrics are used for evaluation:

• The mean absolute error (MAE) quantifies the difference between the actual transitional probability, $P{r}_{true}\left(t_{i,j}\right)$, and the estimated transitional probability from the perturbed dataset, $P{r}_{est}\left(t_{i,j}\right)$. MAE is defined as

  $$\mathrm{MAE}={\displaystyle \frac{1}{{\sum }_{g_i\in G}\left|N\left(g_i\right)\right|}}\sum _{g_i\in G,g_j\in N\left(g_i\right)}\left|P{r}_{true}\left(t_{i,j}\right)-P{r}_{est}\left(t_{i,j}\right)\right|$$

  (14)
• The Jensen–Shannon Divergence (JSD) measures the difference between the actual transitional probability distribution and the estimated distribution computed from the perturbed dataset. JSD is defined as

  $$\mathrm{Density}\mathrm{Error}=\mathrm{JSD}(D\left(P{r}_{true}\right),D\left(P{r}_{est}\right))$$

  (15)
  Here, $D\left(P{r}_{true}\right)$ represents the distribution of actual transitional probabilities, and $D\left(P{r}_{est}\right)$ denotes the distribution of estimated transitional probabilities computed from datasets collected under $ϵ$-Geo-Ind.

Figure 3 and Figure 4 show the effect of subtrajectory length on MAE and JSD for the proposed method with density-adjusted sampling ($DA$) and the method with simple (non-density-adjusted) sampling ($BS$). In these experiments, the privacy budget $ϵ$ varies between 1.0, 3.0, and 5.0, while the grid size is fixed at $45\times 60$. Key observations based on these figures can be summarized as follows. First, as shown in the figures, MAE and JSD generally increase as the privacy budget decreases, which is a common characteristic observed in DP-based methods. This occurs because a lower privacy budget $ϵ$ corresponds to stronger privacy protection, which is achieved by introducing more noise into the data. While this enhances privacy, it also results in reduced data utility, as the added noise reduces the accuracy of the data collected.

More importantly, across all scenarios, the proposed method using density-adjusted sampling ($DA$) consistently outperforms the simple sampling method ($BS$). This superior performance is evident in both MAE and JSD metrics, confirming that $DA$ provides more accurate estimates of transitional probabilities even under varying levels of privacy. These results validate the effectiveness of the density-adjusted sampling approach in enhancing the accuracy of transitional probability estimation while ensuring privacy.

When the length of the sampled subtrajectory varies from 1 to 8, the best performance is observed at a length of 1. This finding suggests that shorter subtrajectories allow for a more concentrated allocation of the privacy budget to perturb each individual location within the subtrajectory. Specifically, for a subtrajectory of length 1, the privacy budget $ϵ$ is divided into two ${\displaystyle \frac{ϵ}{2}}$ sub-privacy budgets, each of which is used to perturb each location within the subtrajectory. As a result, using a subtrajectory of length 1 allows for the collection of perturbed transition data with higher utility compared to longer subtrajectories, which in turn improves the accuracy of computing transitional probabilities. These experimental results suggest that in situations where privacy and accuracy must be carefully balanced, prioritizing shorter subtrajectories can be a more effective strategy. By focusing on shorter sequences, it is possible to maximize data utility while still meeting privacy requirements, thereby achieving better overall performance in privacy-preserving applications.

5.3. Evaluation Results on Estimating the Optimal Route

In this subsection, we evaluate the performance of the proposed method for estimating the optimal route using transitional probabilities computed from perturbed trajectory datasets collected under Geo-Ind. Since there is no existing method directly comparable to the proposed approach, we compare it with the most similar solution available, as proposed in [30], which computes the top-n routes in indoor environments based on location data collected under LDP, which is a localized version of DP. We adapt the method in [30] to compute top-1 routes instead of top-n routes. However, it is important to note that LDP-based approaches are not directly comparable to Geo-Ind-based approaches because Geo-Ind extends DP by incorporating a distance metric, whereas LDP does not. Despite this difference, this comparison can still provide valuable insight into the relative performance of the proposed approach.

For performance evaluation, we employ the following metrics, which are commonly used in the literature [24]:

• Precision quantifies the accuracy of the estimated route by measuring the proportion of locations in the computed route $R_{est}$ that overlap with the true optimal route $R_{true}$. Precision is defined as

  $$\mathrm{Precision}\left(P\right)={\displaystyle \frac{|R_{true}\cap R_{est}|}{|R_{est}|}}$$

  (16)
• Recall evaluates the coverage of the true optimal route $R_{true}$ by determining the proportion of its locations that are correctly identified in the estimated route $R_{est}$. It is defined as

  $$\mathrm{Recall}\left(R\right)={\displaystyle \frac{|R_{true}\cap R_{est}|}{|R_{true}|}}$$

  (17)
• The $F_1$ score provides a harmonic mean of precision and recall. It is given by

  $$F_1={\displaystyle \frac{2\times P\times R}{P+R}}$$

  (18)

In the experiment, we randomly generate 50 user queries, each consisting of a pair of start and end locations. We then evaluate the performance of the proposed method by calculating the average value of the relevant metrics across all queries.

Figure 5 shows the effect of varying privacy budgets on precision, recall, and $F_1$ score for the proposed approach ($PA$) and the existing approach ($EA$) described in [30]. In these experiments, the grid size is fixed at $15\times 20$, and the length of the sampled subtrajectories collected using $ϵ$-Geo-Ind is set to 1, while $ϵ$ varies from 1 to 5. As expected, precision, recall, and $F_1$ score decrease as the privacy budget decreases. This is because a lower privacy budget introduces more noise into the original data, leading to reduced accuracy in the computation of transition probabilities, as observed in the previous experimental results. As a result, this reduction in accuracy negatively impacts the computation of the optimal route, as the underlying transition probabilities become less reliable.

In systems that rely on DP, there is an inherent trade-off between privacy and data utility. When the privacy budget is small, more noise must be introduced to protect user privacy, which can significantly reduce the utility of the data. In extreme privacy conditions, where $ϵ$ is very small, the added noise may overwhelm the data, making it difficult to distinguish between meaningful user movements and random noise. Even in regions with frequent user activity, a very small $ϵ$ can introduce sufficient noise to reduce the accuracy of transition probabilities, leading to inaccurate route recommendations.

The results shown in the figure also confirm that the proposed approach ($PA$) consistently outperforms the existing approach ($EA$) across all privacy budgets. This consistent performance advantage highlights the effectiveness of the proposed method in balancing privacy and utility. In some cases, the proposed approach can achieve a high level of accuracy, such as 80%. This achievement is particularly noteworthy given the inherent challenges posed by the reduced data utility resulting from the perturbation mechanism of Geo-Ind. The ability of the proposed method to achieve such high accuracy despite these challenges highlights its robustness and reliability in privacy-preserving route recommendation.

Figure 6 shows the effect of varying grid sizes on precision, recall, and $F_1$ score for the proposed approach ($PA$) and the existing approach ($EA$). In these experiments, the grid size varies among $15\times 20$, $30\times 40$, and $45\times 60$, while the length of the sampled subtrajectories is set to 1, and $ϵ$ is fixed at 5. As shown in the figure, precision, recall, and $F_1$ score all decrease as the grid size increases. This trend occurs because, as the grid size increases, the number of possible routes connecting the start and end points increases proportionally. As the number of possible routes increases, the likelihood of accurately estimating the true optimal route decreases due to the increasing complexity of the route estimation problem, which is a challenge commonly observed in route recommendation systems. Despite these challenges, the proposed approach ($PA$) continues to perform better than the existing approach ($EA$), demonstrating its resilience and effectiveness in managing the trade-off between privacy and utility across varying grid sizes.

Table 1. Precision, recall, and $F_1$ scores corresponding to the results shown in Figure 5.

	Precision			Recall			${\mathit{F}}_1$
$\mathit{ϵ}$	PA	EA	Imp (%)	PA	EA	Imp (%)	PA	EA	Imp (%)
1	0.791	0.595	19.56	0.680	0.495	18.52	0.728	0.537	19.06
3	0.857	0.655	20.24	0.724	0.543	18.07	0.781	0.590	19.18
5	0.869	0.701	16.73	0.739	0.581	15.80	0.795	0.631	16.38

presents the precision, recall, and $F_1$ scores corresponding to the results shown in Figure 5. In this table, the improvement of the proposed approach ($PA$) compared to the existing approach ($EA$) is highlighted in the “Imp” column. As shown in the table, for privacy budget settings of $ϵ=1$ and $ϵ=3$, the proposed method achieves an improvement of about 18–20%. For $ϵ=5$, an improvement of 15–16% is observed. These results verify that the proposed approach consistently outperforms the existing method across different privacy levels, providing better accuracy in estimating the optimal route.

6. Conclusions and Future Work

In this paper, we presented a novel privacy-preserving framework for computing optimal routes using location data collected by Geo-Ind. The proposed framework effectively addresses the critical trade-off between data utility and user privacy in privacy-preserving route recommendation systems. By incorporating a density-adjusted sampling method and an innovative scheme for estimating transitional probabilities from perturbed datasets, the proposed framework significantly improves the accuracy of optimal route computation. Experimental results demonstrate the practical effectiveness and reliability of the proposed approach, consistently outperforming existing methods across various privacy budgets and grid sizes. These results highlight the potential of the framework to set a new standard for recommending routes while preserving privacy.

Although the proposed algorithm shows promising results, it has some limitations. First, the computational complexity increases significantly with increasing dataset size and grid size, which can be a challenge for large-scale real-time applications. This can lead to higher processing times, making it difficult to efficiently scale the algorithm in environments where real-time processing is critical. Second, the trade-off between privacy and accuracy inherent in DP-based techniques can result in reduced data utility, especially when stronger privacy guarantees are required. As the level of privacy increases, more noise is introduced into the data, which can negatively impact the accuracy of the computed transition probabilities. This trade-off can be particularly problematic in scenarios where accurate recommendations are critical.

Thus, an important future research direction is to improve the efficiency of optimal route computation, especially for large grid sizes. This can be achieved by parallelizing the computational process to reduce the associated overhead. We plan to explore various parallel processing techniques that distribute both data and computation across a cluster of machines, enabling faster and more efficient route recommendations, especially for large-scale applications. Furthermore, another important research direction is to mitigate the privacy–utility trade-off, possibly through adaptive noise addition methods that adjust the level of noise based on the sensitivity of different regions. In highly sensitive areas, stronger privacy protection would be applied by adding more noise. On the other hand, in less sensitive areas, lower privacy requirements would allow for the collection of higher utility data. This approach would ensure that the framework maintains privacy where it is most needed, while maximizing data utility in regions where privacy concerns are lower. Furthermore, future work will focus on evaluating the system’s performance under varying privacy budgets and conducting a theoretical analysis of the privacy-utility trade-off. This will help to better understand the behavior of the system under DP settings and explore ways to optimize the balance between privacy and utility.