Exploring Cellular User Re-Identification Risks With Networking Behaviors Analysis and Modeling

Mobile network operators (e.g., China Mobile, Verizon) are significant for providing communication services and collecting massive amounts of data. However, operators are increasingly concerned about customer data breaches involving third-party application providers (e.g., Tencent, Apple, Netflix). This concern is particularly aggravated when anonymous datasets shared with third-party providers or publicly released can be linked to user data compromised in breaches, leading to severe re-identification attacks and privacy threats. However, comprehensive methods for identifying such privacy risks on a large scale are lacking due to limited networking behavioral data. To address this, we aim to measure the re-identification privacy risk associated with sharing or releasing cellular traces amidst data breaches. Based on the analysis of key privacyimpacting features in traffic usage and base station association data, we propose a novel re-identification method, SURE, which learns similarities between cellular traces to classify if traces belong to the same user. Extensive experiments on a largescale dataset of 10,000 users over four months demonstrate SURE's superior performance, with AUC scores exceeding 0.9. Our findings reveal significant re-identification risks in data sharing/release, influenced by data scale and user attributes, corroborated by a public dataset.