Location Privacy Preservation Mechanism for Location-Based Service With Incomplete Location Data

The Location-Based Service has been widely used for mobile communication networks and location systems. However, privacy disclosure for incomplete collection location data in LBS was ignored in most of the existing works. To solve the problem of privacy disclosure, we propose a location privacy method based k-anonymity to prevent privacy disclosure in LBS constrained in incomplete data collection. The proposed scheme can provide effectively location privacy-preserving in the process of constructing the anonymous set, and against background attacks. In this method, we first designed a construct method for anonymous candidate set(ACS) with compressing sensing technology, to solve the problem of incomplete data of collection location. To prevent the privacy disclosure in the process of construct anonymous, we then adapt the differential privacy mechanism to construct the anonymous set(AS) with the ACS. we finally used the optimization method based on the Stackelberg game model to improve the privacy level of AS to against probabilistic attack. As shown in the theoretical analysis and the experimental results, the proposed method can achieve significant improvements in terms of privacy degree and applicability.


I. INTRODUCTION
In recent years, with the rapid development of mobile internet technology and smart mobile devices, people can obtain various Location-Based Services(LBS) through mobile smart devices. The LBS can meet people's service requests and improve service efficiency by providing the nearby service based on the user's request location. Many high LBS practical applications can facilitate people's life such as Dianping, Gaode Map, Meituan Takeout, etc. These applications obtain the location of the user's service request at the central server and then the server returns corresponding results of user's requested.
Although LBS provides several benefits to people's lives, it still raises serious privacy issues. For example, when people send their service requests to the central server of LBS, the attacker can obtain the user's request location due to the un-trust server of LBS or the attack aim at the server of The associate editor coordinating the review of this manuscript and approving it for publication was Ilsun You .
LBS. In this way, the sensitive locations, which store in the server of LBS, can be stolen by the attacker. The sensitive location of users refers to the location like the hospital, home, and company that can reflect the user's behavior habits and mobility pattern who were requested. When the disclosure of these locations happening, they can help the attackers to get sensitive information of users and thus infer user's roles, behaviors, and habits [1]. This would lead to the disclosure of the user's privacy and hindered the popularity of LBS.
To address the privacy disclosure issues mentioned above, researchers have proposed many methods to preserve location privacy in LBS [31]- [33]. The key idea of these methods is to avoid direct requests to the server of LBS from real request locations. Broadly speaking, existing works of location privacy-preserving can be classified into three categories: offset method [5]- [7], dummy method [2], [3], [8]- [11] and spatial cloaking method [4], [12]- [15]. The offset method is easy to implement but has poor availability. In the dummy and spatial cloaking methods, the k-anonymity idea has a wide range of applications due to it's good balance between privacy VOLUME 8, 2020 This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see https://creativecommons.org/licenses/by/4.0/ and availability. The dummy method realizes privacy protection through anonymity region which contains k − 1 dummy locations and one request location. This approach has a high degree of privacy because of the anonymous locations from the dummy location. The spatial cloaking achieves privacy protection of location and high availability by constructing the cloaked region includes at least k −1 other user's locations around the location of the requested user.
Although the above methods based on k-anonymity can prevent privacy disclosure in LBS, there remain three challenges. Firstly, the incomplete collection locations. It causes incomplete collection locations due to anonymous server failure or other reasons. It is easy to lead to the anonymous failure problem that candidate location was less than k − 1 because of the missing collection locations. Secondly, the attacker's background knowledge. The request location of user in the anonymous set can be easily obtained by ignoring the attacker's background knowledge. The attacker can combine the user's request location probability distribution and the background knowledge such as the protection algorithm to infer the user's real location in the anonymous set. Thirdly, the privacy disclosure when we constructing the anonymous set. The attacker can determine the anonymous locations, which were added in the anonymous set by monitoring the change of anonymous candidate set in the anonymous server and, reduce the difficulty of his attack. All of these challenges will result in the loss of user's privacy.
In this paper, we proposed a novel k-anonymity location privacy through the generation of the anonymous candidate set, construction of anonymous set and optimization of anonymous set scheme to address the aforementioned challenges. Specifically, our scheme adopts the k-anonymity technique, combined with the compressed sensing technology, differential privacy and game model to preserve users' location privacy. In our method, we first use the compressed sensing technology to completing the missed location of collected and then construct the anonymous candidate set(ACS) with the collected data after completing. Then, to avoid privacy disclosure in this process of constructing the anonymous set, we use the exponential mechanism of differential privacy to choosing the anonymous locations from the ACS. Finally, we adopt the Stackelberg model between attack strategy and protection strategy to optimizing the anonymous set and against the background attacks. Overall, our contributions in this paper are as follow: (1) We design a k-anonymity location privacy protection method for incomplete location data in LBS, which not only effectively prevents user request location privacy disclosure after its complete construction, but also prevents location privacy disclosure during anonymous collection construct.
(2) We propose a novel anonymous construction method to prevent privacy disclosure in this process with Differential Privacy. Moreover, this method provides strong protection against probabilistic attacks.
(3) Considering the background attack, we present an optimization method during anonymous set construction based on the Stackelberg Game model between users and attackers, to defensive background attack. Finally, the proposed method is evaluated through extensive experiments on a real-world dataset.
The rest of this paper is organized as follows. Section II reviews the related work. Section III gives Motivation and Basic idea. Following in Section IV, we describe the details of our method. Then, we analyze the security of our method in Section V. Finally, we evaluate the performance and draw the conclusion in Section VI and VII, respectively.

II. RELATED WORK
In recent years, a lot of works have been done to protect the privacy of user's request location in LBS, including the offset dummy and spatial concealment. Also, spatial concealment and dummy technology borrow the idea of k-anonymity to protect location privacy.
The offset reduces attacker's infer accuracy by adding the noise of location to achieve the effect of protecting user privacy, such as using the small area represent the real location. The SpaceTwist achieved location offset mainly by setting anchors around the request location and send services request of LBS based on the anchor location [5]. In reference [6], an offset vector distribution method was proposed to constrain the offset location distribution and to resist the statistical probability attack when the probability density of migration location is constant. By using the differential privacy mechanism, Cao et al. proposed a position offset method to resist the time correlation of user's position, and provided the disturbed location with differential privacy to improve the location availability while resisting attacks [7].
As an important method to protect location privacy, the anonymous method with dummy locations, called dummy, has attracted researchers' attention. The dummy method generates the anonymous set consists of k −1 dummy locations and one real requested locations to achieve privacy protection. The PAD, use the virtual grid to generate the desired dummy locations and to construct an anonymous collections using these dummy locations [8]. In order to further improve the efficiency of defense, Zha et al. proposed a method using virtual circles and grids to generate dummy location to constructed anonymous collections [5]. Niu et al. used the location entropy for generating dummy locations that meets the query probability constraint and realized the construction of anonymous collection [9]. At the same time, in order to save the cache space and improve the hit ratio, Niu et al. generated dummy locations through the method of anonymous entropy and improved the protection effect of anonymity by combining the hit ratio and maximizing the privacy of the query [10].
Although the dummy can address privacy issues successfully, its low availability and high computation expense hinders practices application. Thus, the anonymous method which called spatial concealment, which anonymous locations from other user's request locations. The spatial concealment technology constructs an anonymous area containing k real location for each query user and making it difficult for service providers to determine the real request and against background attack. Literature [11] proposed a privacy method to construct anonymous areas by using the Hilbert curve. In detail, the users location were sorted by the Hilbert curve, and k adjacent location were divided into groups, the anonymous areas were constructed by the same group of location. Literature [12] combined the method of constructing anonymous region with differential privacy and Hilbert curve, and perturbed the similar region with the same Hilbert curve. In this way, the smaller the anonymous region is, the smaller the position can be regarded as the disturbance result. Many other researchers used the entropy of position to divide their positions with similar historical query probability into the same anonymous region to realize k-anonymity [13], [14].
Different from existing works, the proposed scheme achieves k-anonymity by carefully generating real locations surrounding request location and under the missed location. It can not only protect privacy after the completion of anonymous set but also provide privacy security in the process of anonymous set construction.

III. MOTIVATION
The anonymous set consists of a user's request location and the number of k − 1 anonymous locations. The anonymous locations in this paper is mainly derived from the other user's locations around this user's request location. Generally, the process of construct anonymous set works through the following two steps: Step1: The anonymous candidate set is constructed by selecting the real location near the request location; Step2: The anonymity set is constructed by selecting the anonymous location from anonymous candidate set.
In the construction of the anonymous candidate set, existing works construct the anonymous candidate set with the locations, which from the collection of the anonymous server. If the anonymous server can run safely and smoothly, this method can construct successfully. Otherwise, because of the lack of effective location data, which can lead to the failure of construct anonymous candidate sets. This is due to incomplete collection data in the anonymous server and the incomplete collection data stem from the following two aspects: On one hand, the server failure causes the location loss in the process of location acquisition. In this case, when the number of candidate anonymous locations around the real environment is less than k − 1, it is difficult to meet the requirement of k-anonymity. On another hand,the continuous stay of the surrounding users in one location also leads to fewer available anonymous candidate locations. In this situation, the user has to choose a further location for anonymity, which increases the anonymous cost. In summary, incomplete data collection will increase the cost of anonymous and even lead to failure anonymous.
In the construction of the anonymous set, most researchers ignore the issue of privacy disclosure involved in choosing anonymous locations. The adversary can infer the anonymous location by stealing the selection probability of the location in the candidate collection. In particular, the occurrence of the following two situations to lead to anonymous construct with privacy disclosure:1) The attacker can reduce the difficulty of the attack by filtering out anonymous locations with a low probability of historical requests; 2) The attacker can infer the real request location from the difference in distribution probability of the historical anonymous collection. Because the location data selection in the process of anonymous collection construction causes the occurrence of the above problems, we regard this situation as a privacy leakage problem in the process of anonymity. That above attack named the probability attack to refer to that the adversary can obtain the real requested location not only through the different anonymous location request probability in the anonymous set at a single time but also through the difference of the anonymous set distribution in different request time.
After the construction of the anonymous set, the adversary can still identify real request locations according to his background knowledge in the prior works. The background knowledge of the adversary is the historical protection mechanism. From this knowledge, the adversary can infer the location that the user may appear based on the Bayes theorem and filter out some anonymous locations. Thus the attacker can reduce the privacy level of the constructed anonymous set.
To address the aforementioned problems, the main purpose of our scheme is to design an efficient scheme, which fully considers missing location in the constructing anonymous candidate set, privacy disclosure in constructing the anonymous set and the background attack mentioned above. Thus, there are three steps in our method: (1) Construction of anonymous candidate set: To solve the problem of incomplete collection data, we propose an construction scheme of anonymous candidate set by integrating the Compressed Sensing technique and the Realistic Constrain. we can obtain the complete collection dataset with reconstructing the missed request data of user location, which by the Compressed sensing technology. Then, the candidate data set is constructed by choosing the locations that satisfying the realistic constraints from the complete collection data.
(2) Construction of anonymous set: To prevent the leakage privacy of locations selection, we propose an construction of anonymous set with differential privacy. It can cloak location selection probability by using the exponential mechanism of differential privacy. At the same time, the ability to against background attack is improved, by designing the scoring function of the exponential mechanism that takes into account to resist the single-moment attack and continue attack.
(3) Optimization of anonymous set : To resist the background attack, we established an optimization model based on the Stackelberg Game between users and attackers of background attack to obtain the optimal protection strategy. According to this protection strategy, the construction of the anonymous set is optimized and can resist the background attack. VOLUME 8, 2020

IV. OUR PROPOSED METHOD
In this section, we first present the system architecture of our proposed method. Secondly, we show the completion method of missed location and construct the candidate location set. Thirdly, we present the construction method of anonymous set under differential privacy protection. Finally, we present the optimization methods of anonymous set to against user background attacks.

A. SYSTEM ARCHITECTURE
To realize fast LBS privacy protection service, we proposed an LBS anonymous service based on edge computing according to paper [27]. The generation of the anonymous collection is accomplished through the cooperation between the anonymous server (edge server) and the mobile terminal. Based on this architecture as shown in Figure.1, the LBS service flows under privacy protection as follows: (1) Users send service requests and current location to anonymous server by mobile terminal; (2) The anonymous server received the user's request and generates the anonymous set according to proposed method.
(3) In order to improve the generation efficiency of anonymous sets, the anonymous set generation in our method is decomposed into several subtasks.
(4) Then these subtasks migrates to multiple edge servers mobile terminals and cloudy server for execution based on the task decomposition function in edge computing.
(5) After subtask execution completed, the anonymous server aggregate results of subtasks to generate anonymous set and send to LBS server to query. (6) The LBS server sends the query result of anonymous set which include anonymous location and true request location to the anonymous server.
(7) The anonymous server filters anonymous result set according to the user's true location and replies to users'queries.

B. CONSTRUCTION OF ANONYMOUS CANDIDATE SET
First of all, we use a m×n dimension matrix X to represent the number of m user's request location at n different times,which collected by the anonymous server. where x ij ∈ X , 0 ≤ i ≤ m, 0 ≤ j ≤ n, m × n ≥2 k represents the location of the user m at time n.
Due to the above mentioned reason such as machine failure, there are some missing data in the X . In order to reflect if the location is missed in the anonymous server, we give a measure matrix M .
where the element m ij in M reflects whether the location of user i at time j is complete and .×reporesents an operator of dot product. The matrix Q represents an indicator matrix where q ij ∈ Q and q ij = 1, if no data for user i at time j 0, otherwise In order to improve anonymous success ratio, the first task of constructing anonymous candidate set is to complete the missing location in the anonymous server. As the correlation and similarity among users movement trajectories, the matrix X is a low-rank matrix [15]. Then,we can obtainX including the complete location of all users by the compression sensing technology [16]. That means, the completion of missing location in X can be converted to solveX , which satisfies the problem of X −X F minimization, where . F is an operator of the Frobenius Norm.
It is impossible to directly apply aforementioned method to getX as the original matrix and the proper rank is unknown. As a good completionX , it is reasonable to be as close to the matrix M as possible. Thus,we can find the low rank completion by following equation (3) min rank(X ) Because equation (3) has the characteristic of non-convex function, it is difficult to directly solve its solution as it is an NP-Hard problem. Since the kernel norm of a matrix is the most compact convex envelope of the matrix rank [17], the solution of the above non-convex function can be transformed into solving convex function as follow: In order to find theX that satisfies equation (4), we can decompose it based on the matrix decomposition technique [18], which is equivalent tō where X 1 = L 1 2 andX 2 = R 1 2 . Based on various possible decomposition results by equation (5), the optimal is X 1 and X 2 should minimize the norm of F. That is X 1 and X 2 satisfy formula (6) as follow When we obtain X 1 and X 2 by the strictly satisfy the constraint in equation (6), the solution may be fail for the following reasons. First,The over-fitting problem happened due to there are noises in the location data and strictly satisfaction. Second, the rank ofX is only approximate an low-rank matrix. Based on the above analysis, we can convert equation (6) into a convex optimization problem of equation (7) based on Lagrange Method.
To solve the optimization problem in equation (7), we refer literature [19] and propose an iterative algorithm to solve the problem. As shown in algorithm line 7 to line 15. It starts with a random initialization with matrix X 1 . Then it fixes matrix X 1 and solve for matrix X 2 by the least square method. Next, X 2 is fixed and obtain X 1 by the least square method. After a fixed number of iteration k 1 , we can acquire the optimal completion matrix.
After obtain the complete user location around request location, we select the anonymous candidate location from these satisfies the realistic constraint on two aspects. On one hand,the candidate location should satisfy the Nearest Neighbor Constraint(NNC) based on minimum anonymous area A min that to against the adversary can infer request location as its anonymous location distributed too concentrated. It requires the distance between the request location and candidate location should be larger than NNC.
On the other hand, it should satisfy Maximum Reachability Constraint(MRC), which aims to limit on the maximum distance that a user can move from the request location to the next at fixed intervals. this require the distance to be less than MRC and can be computed as where t j − t j−1 represent the time interval from the previous moment t j−1 to the current moment t j and v his is the request user's historical average velocity of user. Based on the above two constrains, we select the number of 2k desired locations from X to join the anonymous candidate set. Meanwhile, an anonymous candidate set(AC)generation algorithm is introduced based on the above steps and is shown in algorithm 1.

C. CONSTRUCTION OF ANONYMOUS SET
In anonymous set construction, the key point is the selection of anonymous location. To protect privacy of the location selection, Differential Privacy is introduced. The Differential Privacy is originated from statistical database. It can provide strong protection for individual data when publishing the aggregate information [20], [21], [30]. In this paper, given a location selection algorithm SA and range(SA) represent the range of results selected. For a candidate anonymous set AC and its adjacent candidate anonymous set AC that differing by only a single location data, the location selection standard differential privacy is defined as follow: Pr(SA(AC) = l) where l ∈range(SA) and ε is the parameters of privacy budget.

VOLUME 8, 2020
The implementation mechanism of differential privacy includes the exponential mechanism and noise mechanism. Instead of directly select location, we use the Exponential Mechanism in Differential Privacy to select anonymous location. As the differential privacy against attacks in any context and the exponential mechanism can prevent the selection probability from being stolen during the data selection process, location selection can be prevented selection probability leakage by use it. Literature [22] first proposed an exponential mechanism, which mainly deals with some algorithms whose output results are non-numeric, such as the selection of splitting attributes in classification operations and histogram selection in histogram data aggregation published. The key to this mechanism is how to design the scoring function u(AC, AC i ), where AC i represents the selected location from AC. The exponential mechanism that satisfies differential privacy is represented as follows: where u is the global sensitivity of the scoring function.According Equation (11), The higher the score u(AC, AC i ) of location AC i is, the higher the probability of AC i being selected to join the anonymous set. Despite the exponential mechanism that was applied can protect privacy in this process, the anonymous location still be identified by the probabilistic attack. The probabilistic attack means the adversary can identify the current real request location according to unevenly distributed request probabilistic at a single-moment and unevenly distributed anonymous in different moment. The single-moment attack means that the attacker filters out the corresponding anonymous location based on the difference between historical request probability of anonymous location and the historical request probability of real location. The continuous-moment attack means that the probability of distribution in the current anonymous set is differs from the probability of historical distribution and the attacker can infer the corresponding position with this knowledge. The measure of probability of historical distribution such as anonymous set entropy [23].
To preserve privacy under the probabilistic attack, the exponential mechanism scoring is design based on above analysis and include two parts of resist single -moment attack and resist continuous -moment attack. In order to resist the single-moment attack, the anonymous locations should be as equal to the historical request probability of current request location as possible. To satisfy this constraint and make it more convenient to measured, we propose a Location Privacy Metric(LPM) to the position probability distribution in the anonymous set based on the entropy. It can be computed as where p i represents the historical request probability of location AC i in anonymous set and p i = number of historical request in location i number of historical request in all locations (13) We know that the max location privacy metric means that the privacy level is the highest and the attacker can't steal the real location. It can be achieved when the location in the anonymous set has the same history request probability with current request location probability and the LPM will be H max = log 2 p. Thus,We use H i to represent location after AC i joined anonymous set according to the resist single-attack part of scoring function design to achieve max location privacy metric as follow: According to equation (13), the smaller the difference between H i and H max , the easier AC i is to be selected because of its stronger ability to resist the attack. To resist the continuous-time attack, the selected location should satisfy the constraint that the LPM of its current anonymous set distribution is equal to the historical anonymous set distribution. The historical anonymous set represent the anonymous sets whose constructed before current time. In order to satisfy this constraint, we propose an anonymous privacy metric based on variance. As we know, it is difficult to directly apply variance to the above constrain as its huge computational overhead. Based on the above reasons, we use the average entropy variance of the anonymous set. We first compute the average entropy of each historical anonymous sets as Then, the average variance of historical anonymous set can be obtained by where h represents the number of historical anonymous set. After the selected location AC i joins the anonymous set, the smaller the average variance difference between the anonymous set and historical anonymous sets is, the smaller the difference between it and the historical anonymous set is, and it has a stronger ability to resist probability attack. In this way, we can design the resist continue-moment attack part of score function based on current anonymous average variance entropy after AC i joins as A smaller the difference between σ 2 and σ 2 i indicate that AC i has more stronger ability to resist attacks and can be selected. Combine the above two scoring functions, the scoring function u(AC, AC i ) of location selection probability can be obtained show in equation (18) and the laplace noise is added to the anonymous set after complete location selection according to the [24].
As the value range of the equation (15) and the equation (16) is [0,1], so u = 1. Based on the results of the descending formula, we obtain the sequence of location and selected the first k location to construct the anonymous set (AD) as shown in algorithm 2.
For the anonymous collection AD constructed in section C,the background knowledge includes the initial distribution probability of anonymous data and the anonymous protection method. Based on this background knowledge, the objective of adversary is to build an optimized attack strategy Q that can infer the location AD i as close to the request location AD i as possible. The attack probability of adversary as The protector take this strategy as a parameter input to the optimization model to optimize the construction of anonymous collections. The ultimate purpose of protector is to make the location inferred by the attacker as far away from the real location as possible.
In order to realize the purpose of the protector, we can build an optimization model based on Stackelberg Game model. In the optimization model,the protector is reckoned as leader, and the attacker as follower. The game requires the leader to take strategy first and then the follower. The followers execute their strategies based on the observed strategy of the leader. Thus, after protector execute their strategies and give a anonymous set, the adversary optimize his attack strategy based on the anonymous set. Since this game is a leader-first model, its result under the Nash Equilibrium is the optimization protection strategy P to against the optimization attack. In other words, the optimization of AD can be accomplished based on this mechanism P . In this game model, the benefit of participants is the distance d(AD i , AD i ) between the real request location AD i and the infered location AD i . A greater d(AD i , AD i ) means a greater benefit of protector and a higher protection level of the anonymous collection. A smaller d(AD i , AD i ) denotes a the greater benefit of the attacker and a lower protection level of the anonymous collection and thus AD needs to be optimized.
In order to realize the optimization of protection strategy, the protector first use the anonymous collection AD generated in the previous section as his initial strategy. After the attacker makes inferential attacks strategy based on AD, the attack benefit expectations can be expressed as Then,the protector adjusts his protection strategy according to above adversary's attack strategy to maximize his protection benefit.Then his protection benefit expectations can be expressed as (21) where P(AD) = AD ϕ(AD)P (AD|AD i ) as the probability of anonymous collection AD.
The optimized attack strategy is one that minimizes the above expectations and as follow The optimized protect strategy is the one that maxizine the above expectations gainst the optimized attack strategy. VOLUME 8, 2020 Based on equation (22),it is computed as (23) In this Stackelberg Game, the adversary aim to obtain the attack strategy that maximizes the attack benefit, and the protector base and the attack strategy obtain the protection strategy that maximizes the protection benefit.
The purpose of Stackelberg game is to find the Strong Nash Equilibrium(SSE) that the adversary unable to use the optimized attack strategy to gain more benefits. In other words, it makes the adversary can't infer the real request position.In this game, SSE chooses the most beneficial strategy for the leader(protector) when the adversary gains the same benefits from multiple strategies. Therefore, the Nash Equilibrium can be obtained and the optimal protection strategy can be solved under this equilibrium. Combining with (22)(23), we can use (24) to obtain optimal protection AD under the aforementioned Nash Equilibrium Based on the above formulas and the availability constraints β, we use the linear programming model to obtain the optimal protection strategy Max P(AD) To solve the optimal AD based on Equation (25), the optimal attack strategy Q needs to be obtained in advance based on [28], which is difficult to solve. In order to simplify the solving process, we introduce the minmax method to solve the problem. In this solving, the max-min strategy of the protector can be solved to be the optimal protection strategy while minimizing the maximum profit of the adversary and equal to From the description of our method, we can see that the algorithm guarantees the security from two main steps: In the construction of anonymous set, the algorithm 2 adopts the exponential mechanism to select anonymous data and adds Laplace Noise to it with the privacy budget. According to the combination theorem of the differential privacy [12], algorithm 2 realizes differential privacy. With the powerful protection capability of differential privacy, algorithm 2 can effectively prevent attackers from inferring the probability of anonymous data selection, thus prevent the privacy leakage problem of anonymous set construction. At the same time, due to the reasonable design scoring function of the exponential mechanism for data selection, the probability of the selected data meeting the historical request is very close, and the data distribution of the anonymous set in different time is very similar to that of the historical anonymous set, thus effectively prevent privacy leakage under the probabilistic attack.
After completed construct the anonymous set. The anonymous set in this paper include number of k − 1 others location make the real request location disclosure risk less than 1/k even if the attacker knows the distribution of locations. In additional, the differential privacy in construct anonymous set. Moreover, the Stackelberg Game model is established according to (26) to optimize the anonymous data which increases the difficulty of background attack. Combining above steps, our method is secure and can effectively protect the user's location information in above attack.

V. EXPERIMENTAL DESIGN AND PERFORMANCE EVALUTION A. EXPERIMENTAL SEETINGS
We evaluate the performance of the proposed privacypreserving method based on Geolife Dataset, which collected 5 years of trajectory data from 182 users and contains 17621 trajectories in Beijing. As there is no user query service in Geolife Dataset, we simulate to generate the query for each location under the real conditions and the content is replaced by numbers. All experiments have been repeated more than 200 times and each measurement is averaged over 30 instances. The final result comes from the average of this multiple experiments. The k is commonly set from 3 to 5, mp = 5%, b = 0.1, where mp represent the proportion of missing data in complete data and it is realized by random sampling, b represent the background knowledge.
We apply 4 metrics to evaluate the performance of our method. In order to evaluate the privacy protection effect of our method, the privacy level(PL) is introduced and it is computed by formulate (20). To verify the time efficiency of the proposed method, the Response Time(RT) is used for evaluation [29]. In order to evaluate the availability of our algorithm, the location anonymous area(AA) is used and it computed by literature [9]. To evaluate the privacy protection capability of our method under the attack, we use  the Probability of Exposing Real Location (PERL) and it is computed as where k represent the adversary has inferred anonymous location and τ represents the minimum constraint factor and the denominator is equal to 0.

B. EFFECT OF PRIVACY PROTECTION
We first verify our method for privacy protection in the missing anonymous candidate locations(It is equivalent to incomplete collection set). As can be seen from figure 2a, the AA curve of our method tends to increased with the value of mp increases and grow slower after mp = 2.50% under different k also a higher k need larger AA. The figure 2b shows the AA curve with same tendency under different mp. The higher AA represents Anonymous cost and low privacy protection in the missing anonymous candidate locations and vice versa. The AA curve increased reason that it is not possible to find further anonymous locations to build anonymous collections as the number of missing locations increases. The slower growth indicated that the result of completion missing location in our method completed the missing location through the relationship between multiple users. In additional,this complement more and more obviously with the increase of missing location. That means it is very effective to protect the privacy in the missing location according to our method. We secondly verify our method for privacy protection in the anonymous collection construct process. As we can seen from figure 3a, the PERL curve has a decreasing trend with the increase of privacy budget and a higher k has a lower probability of exposure. Figure 3b tell us the PERL curve has a decreasing trend with the value of privacy budget increase and a higher mp made the anonymous location easier to be identified. The reason is that the increase of privacy budget makes there are more budget choices to meet the privacy protect requirement of anonymity and against the probability attack. Since differential privacy based on privacy budget can prevent privacy disclosure in anonymous process, it also indicates VOLUME 8, 2020  that there is more powerful privacy protection capabilities in this process. Based on the above analysis, our method can alleviate the privacy leakage problem in anonymous set construction.
We thirdly verify our method for privacy protection against the background attack. We use the equations (18)to measure the adversary background knowledge. As can be seen from figure 4, the increasing tend of PL curve is become more obvious with the increased b and indicates that the proposed method can effectively against the background attacks. This is due to the fact that we use the game model to optimize the protection strategy and obtain more significant gains. The figure 4 tell us The larger the k value, the better effect of the anonymity protection can be.
We finally verify time efficiency of our method for privacy protection. As can be seen from figure 5, the increase tend of RT curve is becoming the trend is slowing down with the increased k in different mp and. It indicates that our method can provides time-feasible privacy protection.This is because our approach combines privacy optimization after simplified and effectively data selection.

C. EFFECT COMPARISON OF DIFFERENT ALGORITHMS
In this section, we evaluate the privacy protection effect based on the PL,AA,PERL with CirDummy [8] and DLS [9]. Because above methods lack the completion of missing position, we complete the missing data by Kalman Filtering method [26]. As can be seen from Figure 6 with the increase  of k value, the AA of all the three algorithms showed an upward trend in general. Compared with CirDummy and DLS algorithm, our algorithm increases slower because of its completion of the surrounding missing location method and it can select more close location to be anonymous. As the restriction of the anonymous region of CirDummy interacts with its discreteness requirement, its AA is worse than our algorithm which lead to a rapid decrease of query accuracy lower than our algorithm. Figure.7 is the comparison of PL of three algorithms with the change of the number of k. As can be seen from the figure, with the increase of the number of k, there is an increasing trend in PL of these algorithm. Due to our method considering the anonymous historical request probability in the selection of anonymous data, it has the fastest growth. Because the GridDUMMY's dummy location has an equal historical probability in the selection of anonymous data, GridDUMMY's PL is better than DLS.
As can be seen from figure 8, the PERL of three algorithms tends to decline as the value of k increases, which means that the higher the value of k is set, the better the privacy protection effect of the algorithm is. Meanwhile, because our algorithm adopts the method of attack optimization, it achieves best result than the other two methods. That means our method has the best ability to resist background attack.

VI. CONCLUSION
In this paper, we present a privacy-protection scheme to protect user's request location in LBS based on k-anoymity.
In order to solve the problem of low anonymous success rate, the anonymous candidate set establishment method for incomplete collection location reconstruction is proposed. To prevent the disclosure of the selection probability in the process of anonymous set construction, the anonymous set is constructed based on the differential privacy method. Finally, we establish the background knowledge of Stacklberg Game model to resist the attacker and the experiment proves that our method is very effective. On this basis, we will study how to ensure the quality of the anonymous set to satisfy user privacy preferences when the anonymous candidate location is missing in the future work.