Case-Based Data Masking for Software Test Management

Data masking is a means to protect data from unauthorized access by third parties. In this paper, we propose a case-based assistance system for data masking that reuses experience on substituting (pseudonymising) the values of database fields. The data masking experts use rules that maintain task-oriented properties of the data values, such as the environmental hazards risk class of residential areas when masking address data of insurance customers. The rules transform operational data into hardly traceable, masked data sets, which are to be applied, for instance, during software test management in the insurance sector. We will introduce a case representation for masking a database column, including problem descriptors about structural properties and value properties of the column as well as the data masking rule as the solution part of the case. We will describe the similarity functions and the implementation of the approach by means of myCBR. Finally, we report about an experimental evaluation with a case base of more than 600 cases and 31 queries that compares the results of a case-based retrieval with the solutions recommended by a data masking expert.