Unsupervised approach for detecting shilling attacks in collaborative recommender systems based on user rating behaviours

IET Information SecurityVolume 13, Issue 3 p. 174-187 Research ArticleFree Access Unsupervised approach for detecting shilling attacks in collaborative recommender systems based on user rating behaviours Fuzhi Zhang, Corresponding Author Fuzhi Zhang xjzfz@ysu.edu.cn School of Information Science and Engineering, Yanshan University, Qinhuangdao, Hebei Province, People's Republic of China The Key Laboratory for Computer Virtual Technology and System Integration of Hebei Province, Yanshan University, Qinhuangdao, Hebei Province, People's Republic of ChinaSearch for more papers by this authorZhoujun Ling, Zhoujun Ling School of Information Science and Engineering, Yanshan University, Qinhuangdao, Hebei Province, People's Republic of China The Key Laboratory for Computer Virtual Technology and System Integration of Hebei Province, Yanshan University, Qinhuangdao, Hebei Province, People's Republic of ChinaSearch for more papers by this authorShilei Wang, Shilei Wang School of Information Science and Engineering, Yanshan University, Qinhuangdao, Hebei Province, People's Republic of China The Key Laboratory for Computer Virtual Technology and System Integration of Hebei Province, Yanshan University, Qinhuangdao, Hebei Province, People's Republic of ChinaSearch for more papers by this author Fuzhi Zhang, Corresponding Author Fuzhi Zhang xjzfz@ysu.edu.cn School of Information Science and Engineering, Yanshan University, Qinhuangdao, Hebei Province, People's Republic of China The Key Laboratory for Computer Virtual Technology and System Integration of Hebei Province, Yanshan University, Qinhuangdao, Hebei Province, People's Republic of ChinaSearch for more papers by this authorZhoujun Ling, Zhoujun Ling School of Information Science and Engineering, Yanshan University, Qinhuangdao, Hebei Province, People's Republic of China The Key Laboratory for Computer Virtual Technology and System Integration of Hebei Province, Yanshan University, Qinhuangdao, Hebei Province, People's Republic of ChinaSearch for more papers by this authorShilei Wang, Shilei Wang School of Information Science and Engineering, Yanshan University, Qinhuangdao, Hebei Province, People's Republic of China The Key Laboratory for Computer Virtual Technology and System Integration of Hebei Province, Yanshan University, Qinhuangdao, Hebei Province, People's Republic of ChinaSearch for more papers by this author First published: 01 May 2019 https://doi.org/10.1049/iet-ifs.2018.5131Citations: 1AboutSectionsPDF ToolsRequest permissionExport citationAdd to favoritesTrack citation ShareShare Give accessShare full text accessShare full-text accessPlease review our Terms and Conditions of Use and check box below to share full-text version of article.I have read and accept the Wiley Online Library Terms and Conditions of UseShareable LinkUse the link below to share a full-text version of this article with your friends and colleagues. Learn more.Copy URL Share a linkShare onFacebookTwitterLinkedInRedditWechat Abstract Collaborative recommender systems have been known to be extremely vulnerable to shilling attacks. To prevent such attacks, many detection approaches including supervised and unsupervised have been proposed. However, the supervised approaches are only suitable for detecting known types of attacks and the unsupervised approaches require a priori knowledge to ensure the detection performance. To address the limitations, the authors propose an unsupervised approach for detecting shilling attacks based on user rating behaviours. They first use Gibbs latent Dirichlet allocation model to extract latent topics of user preferences from user rating item sequences, then they use mixture transition distribution model to construct the user's preference model and present several metrics to capture the diversity between genuine and attack users in rating behaviours. In the case of unknown attack size, the number of attack users is obtained by analysing the critical point of rating behaviour suspicious degrees between genuine and attack users, and based on which the attack users are identified. The experimental results on the MovieLens 1 M dataset show that the proposed approach outperforms the baseline methods in terms of recall and precision metrics. Nomenclature U set of users in the recommender system I set of items in the recommender system M number of users in the recommender system N number of items in the recommender system K number of latent topics set whose elements are sets of users who rate items in set I, i.e. set of users who rate item in Z set whose elements are sets of latent topic numbers corresponding to users who rate items in set I, i.e. set of latent topic numbers corresponding to users who rate item in E set of latent topics ek k th latent topic in set E un,m m th user of set who rates item in zn,m latent topic number for the m th user who rates item in excluding the user un,m Ie set of item-latent topics 1 Introduction Collaborative recommender systems can provide personalised recommendations that suit a user's tastes by collecting the user's preferences, which have been widely used in e-commerce websites to deal with information overload problem. The fundamental assumption behind such systems is that users who had similar preferences with other users in the past are likely to have similar preferences in the future. However, this assumption could make a collaborative recommender system extremely vulnerable to shilling attacks [1] or profile injection attacks [2], which can be illustrated by an example of a shilling attack. Consider a movie recommender system that uses the user-based collaborative filtering algorithm to generate recommendations, the system creates a profile for each user according to the user's ratings (in the scale of 1–5 and 1 indicates disliked) on the movies. Table 1 shows the profiles of Alice and seven genuine users (user1–7) and the attack profiles (attack1–3) inserted by an attacker, as well as the correlation similarity with Alice. According to the principle of user-based collaborative filtering algorithm, user6 is the most similar user to Alice when there are no attack profiles, and the system will predict Alice's rating on movie6 to be 2. This means Alice does not like movie6 and the system will not recommend movie6 to her. After the attack profiles are injected, however, attack1 becomes Alice's most similar user, and the system would yield a predicted rating of 5 for movie6 and movie6 will be recommended to Alice. This indicates that the recommendation of the collaborative recommender system can be manipulated by attackers. Table 1. Example of a shilling attack for promoting the target item movie6 Movie1 Movie2 Movie3 Movie4 Movie5 Movie6 Correlation with Alice Alice 5 4 3 2 — ? — user1 5 1 — 3 — 1 0.32 user2 2 4 1 2 — 2 0.31 user3 2 4 3 3 — 2 −0.32 user4 4 2 3 2 3 1 0.67 user5 5 1 3 2 5 — 0.51 user6 4 3 3 2 — 2 0.95 user7 — 5 2 2 3 1 0.74 attack1 5 4 3 2 — 5 1.00 attack2 5 4 3 2 1 5 0.91 attack3 5 3 3 2 — 5 0.92 In shilling attacks, malicious users inject a certain number of fake profiles in an attempt to bias the system's output to their advantage. The fake profiles are generally called attack profiles or shilling profiles. Depending on the purpose of attacks, shilling attacks can be categorised as either push attacks or nuke attacks, which promote or demote a particular item to be recommended [3]. The widely studied shilling attacks include random attack, average attack, bandwagon attack etc. [1, 4]. These attacks present a great challenge to the credibility of collaborative recommender systems. To reduce the influence of shilling attacks on collaborative recommender systems, a variety of shilling attack detection approaches including supervised and unsupervised has been proposed. Meanwhile, the attackers may change their attack strategies to evade detection [5, 6]. Moreover, new types of attacks will continue to appear [7]. With the evolution of shilling attacks, the performance of existing detection approaches is restricted. On the one hand, the supervised detection approaches require labelling data samples and training classifiers, and they are only suitable for detecting known types of attacks. On the other hand, the unsupervised detection approaches can detect shilling attacks without considering the specific attack types, but they usually require a priori knowledge of attacks such as the number of attack users (i.e. attack size) and the candidate spam users labelled. Such prior knowledge is difficult to acquire in real collaborative recommender systems. To address the above limitations, we propose an unsupervised approach for detecting shilling attacks based on user rating behaviours. The proposed approach assumes that the rating distributions of attack users differ from those of genuine ones, and thus making a difference in user preference sequences. On the basis of this hypothesis, we use Gibbs latent Dirichlet allocation (LDA) model to model user's history rating behaviours and use mixture transition distribution (MTD) model to construct the user's preference model in order to analyse the difference between genuine and attack users in rating behaviours. By calculating the sum of rating behaviour suspicious degree differences in each sliding window, the critical point of rating behaviour suspicious degrees between genuine and attack users is recognised, and thus the attack users are obtained. This approach neither does need to know the attack size in advance nor does it needs to label the candidate spam users. The main contributions of this paper are as follows: (i) To analyse the user rating behaviours, we use Gibbs LDA model to extract latent topics of user preferences from the user rating item sequences (ISs). (ii) We use MTD model to construct user's preference model and propose metrics to capture the diversity between genuine and attack users in rating behaviours. (iii) In the case of unknown attack size, the number of attack users is obtained by analysing the critical point of rating behaviour suspicious degrees between genuine and attack users, and based on which the attack users are identified. (iv) To evaluate the proposed approach, we conduct experiments on the MovieLens 1 M dataset and compare it with the baseline methods. The rest of this paper is organised as follows. The related work on shilling attack detection is introduced in Section 2. In Section 3, we propose our approach which includes the detection framework, extraction of latent topics, analysis of diversity in user rating behaviours, and shilling attack detection algorithm. Experimental results are reported in Section 4 and conclusions are drawn in Section 5. 2 Background and related work 2.1 Attack models An attack model is the approach that attackers generate shilling profiles according to the knowledge of collaborative filtering (CF) recommender system, rating database, users, and items [8]. A shilling profile contains a set of biased ratings assigned by specific strategy including a rating for the target item to be promoted or demoted by the attacker. Depending on push or nuke attacks, the target item will be assigned either the maximum rating value rmax or the minimum rating value rmin. The general form of a shilling profile includes four kinds of items, i.e. the selected items, the filler items, the unrated items, and the target items, which can be represented by sets IS, IF, IØ, and It, respectively [4]. The strength of shilling attacks is usually specified by filler size and attack size [9]. The attack models used in this paper are summarised in Table 2, which include random attack, average attack, bandwagon attack, average over popular (AoP) items attack [6], power user attack [7], average-target shift, average-noise injected [5], and hybrid attacks. The hybrid attacks consist of three types of attacks: random attack, average attack, and bandwagon attack. The shilling profiles generated by the hybrid attack model are a mixture of shilling profiles generated by random attack, average attack, and bandwagon attack models. Table 2. Attack models used in this paper Attack models IS IF IT Items Rating Items Rating Rating random attack not used randomly chosen system's mean rmax /rmin average attack not used randomly chosen each item's mean rmax /rmin bandwagon attack popular items rmax randomly chosen system's mean rmax AoP attack not used randomly chosen from top x % of the most popular items each item's mean rmax /rmin power user attack not used randomly chosen from items rated by the power users each item's mean rmax /rmin average-target shift attack not used randomly chosen each item's mean rmax −1/rmin +1 average-noise injected attack not used randomly chosen each item's mean with Gaussian random noise rmax /rmin hybrid attacks (random attack) not used randomly chosen system's mean rmax /rmin (average attack) not used randomly chosen each item's mean rmax /rmin (bandwagon attack) popular items rmax randomly chosen system's mean rmax As shown in Table 2, the set of selected items, IS, is only used by bandwagon attack. The selected items are chosen from popular items (i.e. frequently rated by users) and their ratings are assigned with the maximum rating value rmax. As to the set of filler items, IF, the attackers tend to randomly choose the filler items in order to reduce the knowledge cost of attacks. Particularly, the filler items for AoP attack are randomly chosen from top x % of the most popular items, the filler items for power user attack are randomly chosen from items rated by the power users (i.e. users with the highest number of ratings), and the filler items for other attack models are randomly chosen from non-target items. Depending on the attack models, the ratings of items in set IF are assigned either with normal distribution around the system's mean rating or with normal distribution around each item's mean rating. 2.2 Related work To detect shilling attacks, a variety of approaches have been proposed over the past decade [5, 6, 8, 10-22]. From the perspective of machine learning, the existing attack detection approaches can be generally categorised as supervised and unsupervised approaches according to whether or not the training samples are needed. Table 3 summarises the approaches for shilling attack detection according to this classification. Table 3. Summary of approaches for shilling attack detection Category Approaches Techniques Advantage Disadvantage supervised Williams et al. [2] and Burke et al. [8] supervised learning effective for specific attack strategies less effective for obfuscated attacks Wu et al. [10] semi-supervised learning effective for hybrid and obfuscated attacks overall detection performance is not very high Li et al. [11] supervised learning not easily affected by the obfuscated attack strategies detection precision is not very high for attacks with small filler and attack sizes Zhou et al. [12] supervised learning target item analysis high detection precision low recall for attacks with small attack sizes Yang et al. [13] ensemble learning effective for specific attack strategies much computational effort for classification features Zhang and Zhou [14] supervised learning individual profile-based feature extraction method overall detection performance is not very high Zhang and Chen [15] ensemble learning it does not rely on the rating values of items detection precision is not too high for attacks with small attack sizes unsupervised Bryan et al. [16] variance adjusted mean square residue or Hv -score it performs well in detecting random and average attacks poor performance for bandwagon attack with small filler sizes Mehta and Nejdl [17] principal component analysis regardless of the specific attack strategy poor performance for AoP attack and requires to know the attack size Bhaumik et al. [18] K -means clustering regardless of the specific attack strategy detection of wrong cluster of users can result in filtering out of genuine users Lee and Zhu [19] multidimensional scaling approach and hierarchical clustering regardless of the specific attack strategy less effective for attacks with low filler size Zhang and Kulkarni [20, 21] graph-based method spectral clustering it does not need to specify the exact number of shilling profiles it requires the shilling profiles to be highly correlated Zhang et al. [22] bipartite graph and label propagation algorithm regardless of the specific attack strategy it requires to label the candidate spam users and to know the attack size Yang et al. [23] graph mining and target item analysis it can detect various attacks with different filler sizes and attack sizes less effective for small attack sizes Supervised approaches require labelling training samples and use known types of samples to train a classifier to detect the attacks. Therefore, such approaches are only suitable for detecting known types of attacks. Under the hypothesis that the statistical signature of shilling profiles would differ greatly from that of genuine ones, Williams et al. [2] and Burke et al. [8] proposed several features by analysing the rating patterns of shilling profiles and trained three supervised classifiers for shilling profile classification. These classifiers can detect the standard attacks (i.e. random attack, average attack, and bandwagon attack) with various filler and attack sizes. Wu et al. [10] proposed a semi-supervised method to detect hybrid attacks, which exploited both labelled and unlabelled user profiles to classify attack users. This method is effective in detecting hybrid and obfuscated attacks. Li et al. [11] proposed a shilling attack detection method based on the improved iterative dichotomiser 3 decision tree algorithm, which extracted user's features based on item popularity distributions. This method is not easily affected by the obfuscated attack strategies. Zhou et al. [12] proposed a two-phase attack detection method, which used an SVM-based classifier to obtain a set of suspicious profiles and applied target item analysis method to remove genuine profiles from the set. Yang et al. [13] used a variant of boosting algorithm to detect shilling attacks based on 18 detection features, which is effective in detecting various shilling attacks. In [14], an online method for detecting shilling attacks was proposed by combining Hilbert–Huang transform and support vector machine. This method constructed user rating series according to the novelty and popularity of items and applied Hilbert–Huang transform method to extract user features and trained an SVM-based classifier to detect shilling profiles. In [15], an ensemble method for detecting shilling attacks was proposed, which extracted user features from both ordered popular ISs and ordered novelty ISs and exploited C4.5-based ensemble model to classify shilling profiles. Unsupervised approaches do not require data samples to train classifiers, but they usually require a priori knowledge of attacks, e.g. the number of shilling profiles injected (i.e. attack size) and the candidate spam users to be labelled. Bryan et al. [16] proposed an unsupervised method to detect shilling attacks by introducing a mean square residue or Hv -score metric. This method performs well in detecting random and average attacks, but it works poorly in detecting bandwagon attack with small filler size. Mehta and Nejdl [17] exploited the high correlation between shilling profiles and presented an unsupervised method to detect shilling attacks based on principal component analysis. This method performs well in detecting the standard attacks, but it requires to know the attack size in advance. Bhaumik et al. [18] presented an attribute-based clustering method to detect shilling profiles. This method divided the user profiles into two groups according to several generic detection attributes of shilling profiles and Hv -score metric used in [16], the profiles in the smaller group were viewed as shilling ones. Lee and Zhu [19] assumed that the effective shilling profiles should be located at the centre of the distribution of genuine ones in order to influence most of genuine profiles and proposed a hybrid two-phase method to detect shilling attacks based on multidimensional scaling and clustering technique. This method can effectively detect average attack with high filler size, but it is less effective in detecting random attack with small filler size. Zhang and Kulkarni [20, 21] assumed that the shilling profiles were highly correlated with each other, thus the problem of shilling attack detection could be formulated as finding a maximal sub-matrix in the similarity matrix and presented a graph-based algorithm and a spectral clustering-based algorithm to detect shilling attacks. Zhang et al. [22] started from constructing the user-item bipartite graph and proposed a unified framework for detecting shilling attacks based on the idea of label propagation. This method can detect attacks without considering the specific attack strategy. Nevertheless, it needs to label parts of attackers as the candidate spam users. Yang et al. [23] exploited the similarity of topological structure of attack users in graph model to find out the suspicious users and applied target item analysis method to identify attack users from the suspicious users. 3 Proposed approach To identify the attack users effectively, we propose an unsupervised approach for detecting shilling attacks based on user rating behaviours, which is called detecting shilling attacks based on user rating behaviours (DSA-URB). The framework of DSA-URB is depicted in Fig. 1. Fig. 1Open in figure viewerPowerPoint Framework of DSA-URB As shown in Fig. 1, the detection of shilling attacks can be divided into three stages: extraction of latent topics, analysis of diversity in user rating behaviours, and detection of attack users. In the first stage, each user's rating IS is constructed and converted into the user's preference sequence by Gibbs LDA model. In the second stage, each user's preference matching degree is calculated based on the user's preference sequence and combined with the users’ high ratings matrix to calculate the user rating behaviour suspicious degrees. In the third stage, the boundary between genuine and attack users is determined by calculating the sum of rating behaviour suspicious degree differences in each sliding window and the attack users are detected. The details of DSA-URB will be discussed in the following sections. To facilitate the discussion, ‘Nomenclature’ section gives the descriptions of notations used in this paper. 3.1 Extraction of latent topics In this section, we use LDA model to extract latent topics from user rating ISs and propose an algorithm for extraction of latent topics. A latent topic is a category number that categorises items. LDA topic model is a document generation model, which considers that a document has multiple topics and each topic corresponds to different words. Probabilistic latent semantic analysis (PLSA) [http://en.wikipedia.org/wiki/Probabilistic_latent_semantic_analysis.] is another applicable approach for extraction of latent topics, which is a statistical technique for the analysis of two-mode and co-occurrence data. Compared with PLSA, LDA topic model has better representation ability for original data and the extracted latent topics can better represent item categories. A Gibbs LDA model is the LDA topic model that employs Gibbs sampling technique for parameter estimation and inference. First of all, we give the definition of rating IS. Definition 1.(rating IS): The rating IS of user um ∈U refers to a set of items rated by user um in the order of time, denoted by where represent the items rated by user um at time , respectively. To extract latent topics from rating ISs using LDA model, we view an item in the collaborative recommender system as a document and the users who rate the item as words in the document. A document contains multiple topics and each topic contains multiple words. They are a many-to-many relationship. Therefore, we can use a three-tier representation mechanism (i.e. item-latent topic-user) to investigate the process of latent topic extraction. Fig. 2 illustrates the graphical representation of item-latent topic-user. Fig. 2Open in figure viewerPowerPoint Graphical representation of item-latent topic-user As shown in Fig. 2, each item corresponds to multiple latent topics (i.e. an item can belong to multiple categories) and each latent topic corresponds to multiple users (i.e. multiple users prefer to an item category). The probability of an item belonging to different topics can be obtained through LDA model. The category with the highest probability is taken as the latent topic of the item. LDA model can be decomposed into two physical processes: (i) Generate the latent topic number zn,m by Dirichlet distribution that represents the item-latent topic. (ii) In the K Dirichlet distribution of the latent topic-user, generate the user un,m when selecting ek = zn,m. On the basis of the above two processes, the generative probability of user un,m can be expressed as follows: (1)where zn,m is a latent variable indicating that the user un,m is generated by , denotes the probability of generating user un,m when zn,m = ek, represents the probability of item in belonging to the latent topic ek. Thus, the probability of items rated by the users is (2)For simplicity, we write that and . Thus, (2) can be simplified as (3)Since we cannot accurately obtain the latent topics by LDA model, in this paper we use Gibbs LDA model to extract the latent topics. We first give each user a random latent topic, and then we can obtain the stable latent topics of each user by iterations. In the process of iterations, we use Gibbs sampling method to calculate the probability that the current user prefers to each latent topic when the current latent topic distribution of other users is known, and reselect the user's latent topics based on the probability value. According to the requirements of Gibbs sampling algorithm, we can obtain the probability of user un,m preferring to each latent topic as follows: (4)where and represent the hyperparameters of Dirichlet distribution and , respectively, represents the number of users who rate item in and prefer to the latent topic ek, represents the number of users who rate item in, represents the number of times that user uf prefers to the latent topic ek, represents the number of users who rate items in set I and prefer to the latent topic ek. The derivation process of (4) is given in the Appendix. Equation (4) is the basis for LDA to extract the latent topics. Under the condition that a user's rating IS and the current latent topic distribution of other users are known, the user's latent topic distribution can be obtained by Bayesian law. On the basis of the analysis above, the latent topic extraction algorithm is described as follows. Algorithm 1 (see Fig. 3) mainly includes three parts. The first part (lines 2–10) initialises each user's latent topics randomly. The second part (lines 11–23) trains the LDA model by (4); this process is repeated until the latent topics of all users no longer change. Particularly, lines 15–17 calculate the probability that user un,m prefers to each latent topic when the current latent topic distribution of other users is known. Lines 18, 19, and 22 select the latent topic with the maximum probability value as the current user's latent topic and update the corresponding sets at the same time. The last part (Lines 24–30) constructs the set of item-latent topics Ie. The key to this part is to count the number of users who prefer to each latent topic in set and select the latent topic liked by the largest number of users as item in’ s latent topic. Fig. 3Open in figure viewerPowerPoint Algorithm 1: extraction of latent topics 3.2 Analysis of diversity in user rating behaviours In this section, we transform the user rating ISs into user preference sequences and use MTD model to construct the user preference model. On the basis of that we introduce preference matching degree to analyse the difference between genuine and attack users in rating behaviours. Definition 2.(user preference sequence): The preference sequence of user um ∈U refers to the latent topics corresponding to the items rated by user um in the order of time, which is denoted by where represent the latent topics corresponding to the items rated by user um at time , respectively. The basic idea of high-order Markov chain model is that the current state qo depends only on its previous h states and not any other historical states, which satisfies (5)To prevent the parameter explosion in the high-order Markov chain model, the MTD model is used, which satisfies (6)In the user preference model, we also assume that the user's current preference state depends only on his previous h preference states and not any other historical preference states. Thus, we can use MTD model to construct the user preference model, which is depicted in Fig. 4. Fig. 4Open in figure viewerPowerPoint User preference model As shown in Fig. 4, the first three preference states not only affect the user's current preference state ek5,t 5, but also their influence is not the same. The closer the preference state to ek5,t 5