An efficient privacy-preserving point-of-interest recommendation model based on local differential privacy

With the rapid development of point-of-interest (POI) recommendation services, how to utilize the multiple types of users’ information safely and effectively for a better recommendation is challenging. To solve the problems of imperfect privacy-preserving mechanism and insufficient response-ability to complex contexts, this paper proposes a hybrid POI recommendation model based on local differential privacy (LDP). Firstly, we introduce randomized response techniques k-RR and RAPPOR to disturb users’ ratings and social relationships, respectively and propose a virtual check-in time generation method to deal with the issue of missing check-in time after disturbance. Secondly, for simultaneously combining multiple types of information, we construct a hybrid model containing three sub-models. Sub-model 1 considers the effect of user preference, social relationship, forgetting feature, and check-in trajectory on similarity calculation. Sub-model 2 analyzes the geographical correlation of POIs. Sub-model 3 focuses on the categories of POIs. Finally, we generate the recommendation results. To test the performance of privacy-preserving and recommendation, we design three groups of experiments on three real-world datasets for comprehensive verifying. The experimental results show that the proposed method outperforms existing methods. Theoretically, our study contributes to the effective and safe usage of multidimensional data science and analytics for privacy-preserving POI recommender system design. Practically, our findings can be used to improve the quality of POI recommendation services.


Introduction
With the rapid development of mobile Internet, digital information, Internet of Things and other technologies, mobile B Chonghuan Xu talentxch@zjgsu.edu.cn 1 from collecting data, users are exposing sensitive and private information with possibly untrustworthy entities. These entities can process, analyze and mine data to extract useful information, but also sell and/or share the collected data with third parties, using it maliciously. Some scholars realize the importance of privacy-preserving in POI recommendation and design a certain number of methods to protect users' information [13][14][15]. These methods adopt several strategies such as privacy parameter optimization, tuning the influence of disturbances, and controlling the modeling errors [16,17] to solve the dilemma between privacy protection effect and recommendation quality. Although the existing methods promote the advancement of POI recommendation, there are still some shortcomings: 1. The most of privacy-preserving techniques used in current POI recommendation methods are centralized protection techniques (i.e., based on the third-party assumption of security) and relatively simple which may lead to risk of information disclosure. 2. The response-ability to complex contexts is insufficient, that is, the multiple factors are not fully considered in current POI recommendation methods. This case may lead to poor recommendation performance.
The purpose of this paper is to solve the above deficiencies and provide more accurate POI recommendation results while the users' privacy information can be well protected.
Unlike existing approaches, we analyze the main cause of issues and propose a hybrid POI recommendation model based on local differential privacy (LDP). Firstly, randomized response techniques k-RR [18] and RAPPOR [19] are introduced to disturb users' ratings and social relationships, respectively. Secondly, user preference, social relationship, forgetting feature, check-in trajectory, geographical correlation of POIs and categories of POIs are combined to make the recommendation performance better. Detailed numerical analysis on three real-world datasets shows that the presented method outperforms other state-of-the-art methods.
The innovations and contributions are as follows: 1. Facing user privacy protection, we disturb users' ratings and social relationships using local differential privacy technique. To solve the problem of missing check-in time after disturbance, a virtual check-in time generation method is proposed. 2. We propose a hybrid POI recommendation model containing three sub-models to improve recommendation effect. Sub-model 1 designs a novel similarity calculation method combining user preference, social relationship, forgetting feature, and check-in trajectory. Sub-model 2 focuses on geographical correlation of POIs. Sub-model 3 focuses on categories of POIs.
3. We use emotional score (i.e. considers emotional intensity and emotional polarity) to reflect user preference of comments. According to the forgetting feature, an effective forgetting function is designed.
To sum up, the advantage of our approach is that it can effectively protect users' privacy information and provide high-quality recommendation results at the same time. Theoretically, our study contributes to the effective and safe usage of multidimensional data science and analytics for privacypreserving POI recommender system design. Practically, our findings can be used to improve the quality of POI recommendation services. The rest of this paper is organized as follows. We introduce the related works in "Literature review". A hybrid POI recommendation model based on local differential privacy is constructed in "The hybrid POI recommendation model based on LDP". The experimental results on three real-world datasets are described in "Experimental results". In "Discussion", we discuss the experimental results. Finally, we conclude the whole paper in "Conclusions and future work".

Literature review
In recent years, personalized recommendation methods have been rapidly developed, most of them are focusing on the methods' accuracy and ignore problems related to security and the users' privacy. Therefore, some scholars pay attention to the studies on privacy-preserving recommendation methods that can achieve safe and effective recommendation services. Despite the efforts to overcome these issues employing different risk reduction techniques, none of them has been completely successful in ensuring security of the users' private information. In this section, we will introduce some representative privacy-preserving recommendation methods which are committed to protecting individual privacy during the recommendation process.
Liu et al. [20] presented an efficient privacy-preserving social POI recommender system (PPS-POI-Rec) which generated recommendation results relying on the cooperation between SNS provider and LBS provider. In the recommendation process, they protected user privacy information. Yin et al. [21] proposed a privacy-preserving POI recommendation method using differential privacy technique. They set a threshold to classified location sensitivity levels through analyzing the users' trajectories and check-in frequencies.
Chen et al. [22] proposed a privacy-preserving POI recommendation (PriRec) framework. They analyzed the features of static data and dynamic data derived from users and designed a linear model and a feature interaction model. In terms of privacy, they presented a secure iterative solution method to protect user privacy. Wang et al. [23] proposed a group preference-based privacy-preserving POI recommendation scheme. They designed anonymous ad hoc wireless peer-to-peer communication to protect users' privacy. Kuang et al. [24] constructed a model of users' check-in sequences based on hidden Markov model (HMM), then used EM algorithm to estimate the parameters. After that, they presented a weighted noise injection method to protect users' location information and predicted user's next movement. Wang et al. [25] proposed a privacy-preserving POI recommendation method using deep learning in location-based social networks. Taiwo et al. [26], proposed a novel privacy-preserving framework using a homomorphic encryption scheme for cross-domain recommender systems that provided a generic template for other secure cross-domain recommender systems. Huo et al. [27] proposed GLP algorithm and FRP algorithm to protect geographical location and friend relationship respectively. Specifically, they designed a virtual circle to obscure the exact location of user and used Laplacian differential privacy to disturb the friend relationship. Finally, they integrated the two privacy-preserving algorithms into recommender systems. Zhang et al. [28] proposed an LDPfriendly POI recommendation method based on improved Hawkes process (HawkesRec). They also introduced the LDP technique to protect user privacy Information. Selvi and Kavitha [29] proposed a stacked discriminative de-noising convolution auto-encoder-decoder with a two-way recommendation scheme to deal with the issues that derive from the lack of security constraints. Himeur et al. [30], discussed the security and privacy challenges in recommender systems. They pointed out that the blockchain technology was presented as a promising strategy to promote security and privacy preservation in recommender systems, not only because of its security and privacy salient features, but also due to its resilience, adaptability, fault tolerance and trust characteristics.
To sum up, scholars use different privacy-preserving techniques to protect users' information and combine many factors such as user profiles, social relationship, geographical information, and temporal information to ensure the better performance of privacy-preserving recommendation. However, the privacy protection strategy is relatively simple and most of protection techniques are centralized protection techniques. In addition, simultaneously combining multiple types of information is insufficient that leads to poor performance.

The hybrid POI recommendation model based on LDP
Local differential privacy (LDP) is proposed as a distributed variant of differential privacy, which locally perturbs the data of each user on the client-side [31][32][33]. It also inherits the comprehensive characteristics of centralized differential privacy. By using randomized response techniques such as W-RR [34], MeanEst [35], Harmony-mean [36], LDP can resist privacy attacks from untrusted third-party with arbitrary background knowledge. Definition 1 Given a privacy-preserving algorithm M and any two items t and t' (t, t ∈ Dom(M)) derived from user relevant dataset. If algorithm M gets the same output tˆ{*}(t * ⊆ Ran(M)), which satisfies the following inequality. Then M satisfies ε-local differential privacy.
in which ε represents privacy budget, which is greater than 0. The smaller the privacy budget is, the stricter the privacypreserving will be.
The recommendation process of the proposed hybrid POI recommendation model based on local differential privacy (LDP) is shown in Fig. 1. In User terminal module, we utilize LDP techniques to disturb user's relevant information. For users, attackers can usually capture the user's preference for a certain POI based on his/her rating information. In the same way, attackers can also infer the check-in probability of a certain POI by a target user based on other associated users' check-in behavior in social network. Therefore, we mainly protect users' ratings and social relationship. In Server module, three sub-models are designed to calculate different similarities. The functions of sub-models can be briefly described as follows. Sub-model 1 integrates user preference, social relationship, forgetting feature, and checkin trajectory into similarity calculation and gets check-in probability. Sub-model 2 gets check-in probability through analyzing geographical correlation of POIs. Sub-model 3 analyzes categories of POIs and gets check-in probability. Finally, we generate comprehensive recommendation results. The adoptive LDP techniques and three sub-models are introduced in detail below.

User information protection
In this section, we introduce two kinds of LDP techniques to disturb users' ratings and social relationships, respectively. Specially, we propose a virtual check-in time generation method to solve the issue of missing check-in time after disturbance.

Ratings disturbance using k-RR
This paper introduces randomized response technique k-RR to disturb users' ratings. k-RR proposed by Kairouz et al., [18]  Definition 2 Given the candidate set χ and |χ | k,for any input R ∈ χ , the response output R ∈ χ is.
The probability of e ε k−1+e ε responds to the real result, while the probability of 1 k−1+e ε responds to one of the rest k-1 values. When k 2, the form is the same as W-RR's.
Assume that user u i (i 1,2,…,n) has checked-in POI l j (j 1,2,…,m), the corresponding rating is R u i l j . R u i l j 0 indicates that the POI has not been checked-in, while R u i l j > 0 means checked-in, and the specific ratings {1,…, R} corresponds to the degree of satisfaction. The response output is as follows: in which R u i l j represents the disturbed rating. For a user, the POI that he has not checked-in (rating is 0 and no check-in time) in raw data, after disturbing randomly, responds to the other k-1 ratings with the probability of 1 k−1+e ε . So, we need to add virtual check-in time to match the corresponding ratings in disturbed data. Basic principle: in accordance with the time series characteristics of user check-in trajectory, we find out two checked-in POIs which are closest to the unchecked-in POI in raw data, and use their check-in times to generate the virtual check-in time for the unchecked-in POI which will turn checked-in POI in disturbed data.
Step 1: calculate the distance d(l a , l b ) between uncheckedin POI l a and other checked-in POI l b (b ∈ [1, m]) in raw data. The formula of d(l a , l b ) is as follows: d(l a , l b ) 2R arcsin sin 2 lat l a − lat l b 2 + cos(lat l a ) cos(lat l b ) sin 2 lon l a − lon l b 2 (4) in which R represents the radius of the earth. Two-tuples (lat, lon) represents the set of longitude and latitude.
Step 2: determine l c and l g which are closest to l a ; Step 3: obtain the check-in time t l c and t l g of l c and l g respectively, suppose that t l c is earlier than t l g ; Step 4: generate virtual check-in time t l a :

Social relationship disturbance using RAPPOR
In this paper, randomized response technique RAPPOR [19] is introduced to disturb users' social relationships. Let A(u i ,u b ) 1 denote that user u i follows user u b , and A(u i ,u b ) 0 denote that user u i does not follow user u b . So set of users followed by u i can be expressed as A u i {0, 0, 1, 0, 0, …, 1, 0, 0, 0, 1}. Firstly, we disturb initial relationship A(u i , u b ) to obtain the permanent randomized response result A'(u i ,u b ).
The disturbance mode is carried out as the following formula, in which f ∈ [0, 1][0, 1] indicates the probability: Then, we make a second disturbance that disturbs A'(u i ,u b ) to obtain the instantaneous randomized response result F(u i ,u b ). The second disturbance mode is carried out as the following formula.

The sub-model combining multiple factors of user
In this sub-model, we fully consider user preference, social relationship, forgetting feature and check-in trajectory.
The analysis of user preference We measure user preference from two aspects: ratings and comments. For calculation of comments, this paper uses emotional score to reflect preference of comments. Firstly, we need to distinguish the emotional degree (i.e., emotional intensity levels). After that, emotional polarity which contains positive emotion and negative emotion is proposed [37].
To be specific, in each comment, the emotional words can be assigned with different values (1-5 points) according to their emotional intensity levels. Then, the positive and negative emotions are assigned with their corresponding values based on the emotional polarity. In the case that a privative appears before an emotional word, the user's real emotion is reflected by multiplying by a certain negative value. Specifically, when the absolute value of the emotional score exceeds 4, we multiply it by -1 to obtain the final emotional score; when the absolute value of the emotional score is 1 to 3 points, we multiply it by -0.5. By considering some special cases that the preceding privative slightly reverse the emotional polarity, for example, in the case of a privative appears before highly positive or negative adjectives, instead of reversing it directly, we multiply it by -0.5. Finally, we analyze the influence of modal verbs in comments as the emergence of modal verbs may weaken the emotion of comments, such as "may", "should", and other words. This article multiplies it by 0.5 to weaken the corresponding emotional level. Based on the above principles, we segment the users' comments and calculate the emotional scores. The emotional score of a comment is calculated by all the emotional words that appeared in the comment.
Assume that user u i comments on POI l j , the obtained comment contains w emotional words. So the formula of emotional score can be expressed as: Special attention should be paid to both positive and negative values of R u i l j . Usually, we only consider the case that the emotional score is positive and the negative value set to 0. Finally, user preference R u i l j can be calculated as follows: in which R u i l j represents historical rating.
The analysis of user social relationship This paper measures user social relationship based on trust transfer. If user u i follows user u b , it means that user u i directly trusts user u b , otherwise, it is an indirect trust relationship. Given user set U {u 1 ,..,u n }, the trust relationship between u i and u b can be expressed as: 1 indicates a direct trust relationship between u i and u b ; A(u i ,u b ) 0 indicates an indirect trust relationship between u i and u b .
The direct trust relationship DTrust(u i ,u b ) is measured by overlap degree of followed users and checked-in POIs.
in which A u i and A u b represent the user sets followed by u i and u b respectively.L u i and L u b represent the checked-in POI sets of u i and u b , respectively. The indirect trust relationship IDTrust(u i ,u b ) can be calculated through trust transferring. If there are multiple paths, we select path according to the largest value of IDTrust(u i ,u b ). Specially, with the increasing of transfer path's length, the user's indirect trust will gradually decline. According to the Six-degree Separation Theory in social networks, the maximum length of trust transfer path is set to 6. The IDTrust(u i ,u b ) is calculated as follows: len(d) > 6 (12) in which len(d) indicates the path's length.
The similarity of user trajectory This paper calculates similarity of user trajectory based on geographic location of checked-in POIs. The trajectory similarity sim track (u i ,u b ) can be expressed as follows: in which d(l u i , l u b ) can be calculated by formula (4).
The comprehensive preference As we know, the user's interest changes over time due to the forgetting feature. Therefore, an effective forgetting function is proposed in this paper to deal with the issue. The formula is as follows: in which t denotes the check-in time, z (0 ≤ z ≤ 1) denotes the forgetting coefficient, and t min and t max represent the earliest and latest check-in times, respectively. In formula (14), parameter z adjusts the rangeability of user interest. According to the average rangeability of users' interests, we set the value of z to 0.5. After that, user preference, social relationship, forgetting feature and check-in trajectory are integrated into the final similarity calculation. The formula can be expressed as follows: in which R u i and R u b denote the arithmetic mean of ratings of user u i and u b , respectively. Finally, R preference (u i ,l o ) denotes the comprehensive preference score of user u i , and its formula is as follows: in which C(u b ,l o ) represents the check-in record. If POI l o has been checked-in by user u b , then C(u b ,l o ) 1; otherwise C(u b ,l o ) 0. For subsequent calculation, we change the comprehensive preference score into check-in probability P preference (u i ,l o ) based on probabilistic processing.

The sub-model based on geographical correlation of POIs
The geographical correlation of POIs also influences the probability of check-in a POI. We use 2-dimensional kernel density estimation to calculate the check-in probability. Kernel density estimation [38,39] can learn user's historical checked-in location, and estimate the unknown probability distribution without user's reference location or current location.
Assume that l v (lat v , lon v ) is a two-dimensional vector, lat v and lon v represents the longitude and latitude, respectively. Then the check-in probability is: in which σ represents the smoothing parameter. The optimal parameter is: Tσ (18) in whichσ represents marginal standard deviation.

The sub-model based on categories of POIs
In general, the categories of POIs can also influence user check-in behavior. In this paper, we use categories of checked-in POIs to make a multi-layer TF-IDF tree for the convenience of calculation. The constructed tree has many nodes, each node represents a category of checked-in POI (i.e., each category has parent category and contains subcategories). The corresponding value reflects the preference degree. Because sub-category reflects the fine-grained interest of user generally, corresponding category level should be higher.
Assume that c denotes a category, the preference value of this category can be expressed as follows: in which n c is the check-in times of POIs of category c, n is the check-in times of all POIs, |L| is the total number of POIs, and |L c | is the number of POIs of category c. The preference degree of user u i for a POI can be calculated by weighting the preference value of the corresponding in which ϕ ln h H indicates that high category level's weight is larger. When the category level is higher, the difference between parent category and sub-category of recommendation results is smaller. Then, we change the preference degree into check-in probability P cate (u i ,l o ) based on probabilistic processing.

The generation of privacy-preserving POI recommendation results
With privacy-preserving, the user's raw rating data are changed into disturbed rating data, and the user's social relationship data are changed into disturbed social relationship data. After that, the three sub-models are fused to calculate the comprehensive check-in probability of a POI. The formula can be expressed as follows: in which α, θ , λ ∈ [0, 1], α + θ + λ 1.
In the process of recommendation, we calculate user's final check-in probability P final (u i ,l o ), sort the unchecked-in POIs in descending order and then recommend Top-K POIs.

Experimental results
To test the stability and generalization ability of the proposed method, we introduce cross-validation [40]. In the experiment, we use fivefold cross-validation that means the experimental results are the mean values over 5 runs.

Datasets
In experiment, three datasets, two benchmark datasets Yelp and Gowalla and another crawled from Meituan platform, are used to verify the performance of the proposed method. These datasets are briefly described as follows.
Yelp 1 is a popular local businesses platform where users score and comment restaurants, shopping, nightlife, home service, etc.

Metrics of recommendation
In previous studies, scholars adopt many metrics to verify the performance of recommendation methods. Therefore, we select four widely used metrics including Precision, Recall, F-score, and Normalized discounted cumulative gain (nDCG) [1,2,[7][8][9] to evaluate the performance of recommendation methods. The metrics are described as follows.
Precision is defined as the ratio of the number of recommended POIs which correctly appeared in the positive set to  the total number of the recommended POIs. The higher the precision is, the better the recommendation performance will be.
Precision |Positive POIs ∩ Recommended POIs| |Recommended POIs| (22) Recall is defined as the ratio of the number of recommended POIs which correctly appeared in the positive set to the total number of the positive POIs. The higher the recall is, the better the recommendation performance will be.

Recall
|Positive POIs ∩ Recommended POIs| |Positive POIs| F-score is defined as the harmonic mean of precision and recall to comprehensive measure the performance. A higher F-score corresponds to better recommendation performance.
nDCG is an evaluation metric of recommendation performance. The higher the nDCG is, the better the recommendation performance will be. The nDCG k can be expressed as follows: in which rel i denotes the graded relevance of the result ranked at position i. Generally, scholars use the binary relevance. k is the length of recommendation list. IDCG k denotes the ideal value.

Metrics of privacy-preserving
This paper uses privacy gain [27] to measure the performance of privacy-preserving. The privacy gain is the difference between the information entropy of disturbed output data and raw data. The greater the privacy gain is, the tighter the privacy-preserving will be.
Definition 3 .Assume that the probability distribution of discrete random variable X is.
x β(x) Then the information entropy of x is calculated as follows: The privacy gain of each user is calculated as follows: Privacy gain u i H u i − H u i (29) in which H u i is the information entropy of the disturbed output data and H u i is the information entropy of the raw data. The average privacy gain is.
Privacy gain n i 1 Privacy gain u i n (30)

Experimental design and compared baselines
In this paper, three main groups of experiments are designed to comprehensively evaluate the recommendation performance of the proposed method. The first group of experiments evaluate the method without privacy-preserving contrast with other methods. The second group of experiments evaluate the method based on privacy-preserving contrast with other methods. The third group of experiments evaluate the impact of privacy-preserving on recommendation performance of the proposed method. The compared baselines are briefly introduced below. In addition, we analyze the effect of data sparsity on recommendation results.

POI recommendation methods without privacy-preserving
The compared methods are described as follows.
Pearson [41] is a traditional method that calculates user similarity based on Pearson correlation coefficient. IRenMF [42] is a POI recommendation method using matrix factorization technique. CoRe [43] is a POI recommendation method integrating geographical location and social relationship. UFC [44] is a POI recommendation method combining user preference, friendship, and check-in relevance. DSPR [45]: is a POI recommendation method integrating user preference and real-time needs.

POI recommendation methods with privacy-preserving
The compared methods are described as follows: PMLS [21]: this method achieves user privacy protection using Laplace mechanism in the recommendation process. PPNPR [24]: this method uses the weighted noise injection to protect location information in the recommendation process. PRGS [27]: this method protects information of geographical location and friend relationship in the recommendation process.
HawkesRec [28]: this method utilizes improved Hawkes process and local differential privacy to achieve user privacy protection in the recommendation process.

First group of experiments
To test the performance of the proposed recommendation without considering privacy-preserving, we need to set the values of parameters at the first. The hybrid POI recommendation model proposed in this paper (named MFRM) contains three parameters α, θ , λ, and α, θ , λ ∈ [0, 1], α+θ +λ 1. We select F-score as the objective function and solve the optimal value of each parameter. To find optimal value range quickly, we set the interval between each value as 0.02. After iterative calculation, on three real-world datasets (recommendation list K 15), we find that when the parameters α ∈ (0.64, 0.66),θ ∈ (0.19, 0.21) and λ ∈ (0.14, 0.16), the F-score is the largest, that is, the recommendation performance is the best. After that, we set the interval between each value as 0.01 and perform more fine-grained iterations, the results are shown in Table 4. Therefore, the parameters in this paper are set as α 0.65, θ 0.20, λ 0.15. Furthermore, we analyze the sensitivity of the parameters on recommendation performance. As shown in Table 4, parameter α plays a major role on influencing the recommendation results, and the greater the value of α is, the better the result will be. However, the results decrease when α surpasses a certain threshold. In addition, the changes of parameters θ , λ have little influence on the results and smaller values of them would bring better recommendation performance.
And then, we observe recommendation performance with different lengths of recommendation list K (i.e. set K as 5, 10, 15 and 20 respectively) on three datasets. The experimental results are shown in Figs. 2, 3, and 4.
By analyzing the results on Gowalla dataset (the number of recommendations is 15), shown in Fig. 3 13.84%, 6.22%, 12.60% and 7.07% respectively; Compared with DSPR, MFRM increases the values of precision, recall, F-score and nDCG by 11.56%, 3.59%, 10.21% and 8.87% respectively. When the number of recommendations is 5,10 or 20, our method also generates the best results.
As illustrated in Fig. 4 When the number of recommendations is 5,10 or 20, our method is still the best.

Second group of experiments
In the second group of experiments, we test the performance of the proposed privacy-preserving POI recommendation method (named LDP-MFRM). The values of parameters α, Furthermore, we observe the privacy-preserving effects vary with privacy budgets ε 1 and ε 2 . We also calculate the privacy gains on Yelp, Gowalla and Meituan datasets respectively, and the results are shown in Fig. 5.
As shown in Tables 5, 6, 7 and Fig. 5, when ε 1 < 0.5 and ε 2 < 0.5, the local differential privacy seriously reduces the recommendation performance, that is, the availability of disturbed data is not high. So the values of this interval are not considered in this paper; when ε 1 > 2.5 and ε 2 > 2.5, the recommendation performance is the best, but the privacy gains are low, so it cannot achieve acceptable privacy-preserving; while when ε 1 ∈ (1.2, 2.0) and ε 2 ∈ (1.0, 1.8), we can achieve better recommendation performance and get higher privacy-preserving effect.
And then, we compare LDP-MFRM with other four privacy-preserving recommendation methods to observe recommendation performance. According to the setting of privacy budgets of compared methods, we set ε 0.5 for PRGS method; set ε 0.7 for PMLS method; set ε 0.6 for PPNPR method; set ε 1.8 for HawkesRec method. The comparison of the average privacy gain of each method on Yelp, Gowalla and Meituan datasets is shown in Table 8.
As shown in Table 8, LDP-MFRM is higher than other methods in average privacy gain which indicates that LDP-MFRM has a better privacy-preserving effect.
After that, we observe recommendation performance with different lengths of recommendation list K (i.e. set K as 5, 10, 15 and 20, respectively) on three datasets. The comparison results are shown in Figs. 6, 7 and 8.

Third group of experiments
In this experiment, we observe the effect of privacypreserving on recommendation performance by comparing MFRM with LDP-MFRM. The metric values of LDP-MFRM are derived from the arithmetic mean with different privacy budgets. We also set the number of recommendations as 5, 10, 15, and 20. The comparison results on three datasets are shown in Figs. 9, 10, and 11.
As shown in Fig. 9, on Yelp dataset, when the number of recommendations is 15, compared with MFRM, LDP-MFRM reduces the values of precision, recall, F-score and nDCG by 4.75%, 2.54%, 2.03% and 3.20%, respectively. In the same way, when the number of recommendations is 5, 10 or 20, LDP-MFRM is inferior to MFRM.
As shown in Fig. 10, on Gowalla dataset, when the number of recommendations is 15, compared with MFRM, LDP-MFRM reduces the values of precision, recall, F-score and nDCG by 5.80%, 2.97%, 4.98% and 6.57%, respectively. In the same way, when the number of recommendations is 5,10 or 20, the recommendation performance of LDP-MFRM is slightly lower than MFRM's.

Effect of data sparsity
The difference in data sparsity will pose a strong impact on POI recommendation performance. Compared with sparse data, the sufficient data can support more useful information which is beneficial to improve the recommendation performance. To investigate the effect of data sparsity on recommendation results, we adopt different proportion of training data in the range of [70%, 90%] scaled by 10%. And we select F-score metric to analyze the changes in recommendation results. The results are shown in Table 9, where we observe that the proportion of training data increases, the performance of all methods improve gradually, which prove that sufficient data can help improve the performance. In addition, we can also see that our proposed method still outperforms other methods in the face of different data sparsity.

Discussion
The experimental results show that our proposed method is superior to some excellent methods and has better privacy-preserving and recommendation performance. In this section, we discuss the results and draw the implication of this study.

Analyzing the difference of POI recommendation methods in the first group of experiments
By exploring Pearson and IRenMF, we find that the former calculates user similarity just based on users' check-in ratings, while the latter utilizes the characteristics of users and POIs to calculate similarity. Our method, by contrast, not only combines the comprehensive preference (e.g., user preference, social relationship, forgetting feature and checkin trajectory), but also considers geographical correlation of POIs and categories of POIs. UFC integrates user preference and check-in correlation to recommend POIs. As a contrast, MFRM considers more factors which brings a better performance. Compare CoRe with MFRM, we find that CoRe analyzes geographical location and social relationship, while MFRM further considers the impact of user comments and categories of POIs. Compare DSPR with MFRM, it can be seen that the former utilizes context information to recommend POIs, while the latter combines social relationship, geographical correlation of POIs and categories of POIs further. In addition, we analyze the recommendation performance with different lengths of POI recommendation list K. Comprehensive metric will increase with the growth of recommended number. Specially, this increase occurs when a certain number of recommendations are satisfied, that means excessive recommendations will lead to performance deterioration. Furthermore, we consider the impact of dataset differences on recommendation performance. Compared with Yelp and Gowalla datasets, Meituan dataset's experimental results are better, while Yelp and Gowalla datasets are sparser. It can be inferred that the sparser the dataset is, the worse the recommendation performance will be.

Analyzing the difference of privacy-preserving POI recommendation methods in the second group of experiments
PMLS and PPNPR only protect the information of geographical location, and HawkesRec only protects the information of check-in ratings. PRGS protects the information of geographical location and friend relationship simultaneously. But our method utilizes LDP technique to protect check-in ratings and social relationship. Generally, the attack on user check-in rating is easy to infer user preference and obtain corresponding geographical location. Therefore, the disturbance of user check-in rating can prevent the disclosure of user's real preference and location. In addition, attackers can also infer user preference from analyzing user social relationships. Therefore, it is necessary to protect user social relationships. Based on the above analysis, our method has a better privacy-preserving effect. Besides, in the recommendation process, PMLS, PPNPR, HawkesRec and PRGS fail

Impact of privacy-preserving on POI recommendation performance
By analyzing the experimental results, it is not difficult to find that privacy-preserving reduces the recommendation performance to a certain extent, but the sparser the dataset, the smaller degree of the reduction. Therefore, it can be judged that when facing massive data (in reality, the dataset is usually very sparse), the performance of our hybrid POI recommendation method based on local differential privacy is almost the same as the method without privacy-preserving.

Implication
The findings demonstrate that simultaneously combining multiple types of information is helpful in recommending POIs and achieving a better performance. By analyzing multiple types of information, we can accurately predict users' preferences and characteristics. The more information we obtain, the more accurate user portrait we design. Although privacy-preserving reduces the recommendation performance to a certain extent, the effect is acceptable when dealing with massive data. Compared with other privacy-preserving strategies, ratings and social relationship disturbance can fuzz more relevant information and achieve a better privacy-preserving effect. In addition, we should set suitable length of recommendation list. In reality, the POI is less likely to arouse user interest when it keeps on a low position in the recommendation list.
Theoretically, our study contributes to the effective and safe usage of multidimensional data science and analytics for privacy-preserving POI recommender system design. Practically, our findings can be used to improve the quality of POI recommendation services.

Conclusions and future work
With the continuous application of POI recommender systems, the issues of privacy disclosure and unsatisfactory recommendation results are gradually exposed. To solve the shortcomings of existing POI recommendation methods in privacy-preserving and recommendation performance, this paper proposes a hybrid POI recommendation model based on local differential privacy.
The innovations of this paper can be described as follows.
1. We introduce random response techniques to disturb user check-in rating and social relationship respectively, and then design a virtual check-in time generation method to solve the problem of missing check-in time after disturbance. Furthermore, these privacy-preserving strategies can be applied to information protection of multipleattribute decision-making problem [46, 47].
2. Three sub-models with their own characteristics are combined to generate recommendation results. Specifically, we design corresponding sub-models for processing different influential factors, and then achieve higher quality recommendation services by integrating the results generated by these sub-models. This hybrid POI recommendation model enriches the previous research.
The limitations of this study are as follows. First, the proposed method fails to consider the balance of recommendation accuracy, diversity, and novelty. The second limitation is that the relationship between users is considered simply while it is complex. In the future works, we will focus on the extension of our privacy-preserving POI recommendation. It can be studied from two aspects: we will further investigate local differential privacy methods to improve privacy and usability of disturbed data. In addition, we will subdivide users' social relationships and design a self-adjusting model  to meet users' demand which will consider the balance of recommendation accuracy, diversity, and novelty.
46. Shit C, Ghorai G, Xin Q, Gulzar M (2022) Harmonic aggregation operator with trapezoidal picture fuzzy numbers and its application in a multiple-attribute decision-making problem. Publisher's Note Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.