An Empirical Investigation On The Quality Of Open Source Anonymization Tools

Abstract: Context. In mid-2018, the GDPR legislation came into force, makingit less easy for companies to acquire personal data and use that information,for example, with machine learning. In addition, the legislationnow requires personal data to be anonymized to avoid penaltiesbefore giving up such information to other organizations. Therefore,it has been the only way to transfer such information without compliancerisks. Objectives. In this thesis, we use the ISO-25010 model to investigatethe usability, security, and performance efficiency of anonymizationtools. The metrics consist of understanding the perceived quality ofeach tool, measuring the performance in terms of memory usage, andlastly, what security implications each tool has in their source code. Methods. To fulfill our research questions, we conduct a quasiexperimentwith eight participants to understand their view of thetools’ usability—additionally, each tool’s performance by utilizing anapplication profiler to collect the memory usage. Finally, for security,we use a static code analysis tool to review the source code for securityimplications the anonymization tools might have. Results. The experimental results show differences from a usabilityperspective for the tools Amnesia and ARX, indicating that Amnesiais a better choice in terms of usability. Furthermore, looking at thetools in terms of memory usage, we noticed better scalability capabilitiesfor ARX. As for security, we recorded no high-severity bugs forAmnesia, while ARX had one security-related bug. Conclusions. We learned that the tools have their pros and cons andthat neither application was better than the other in all measured characteristics:usability, performance, and security perspectives. Here itbecomes a decision on preferences and priorities regarding what tochoose. To continue the research, we suggest, among others, understandingthe tools’ efficacy and increasing the participant count tounderstand the usability further.