# An Unsupervised Approach for Detecting Group Shilling Attacks in Recommender Systems Based on Topological Potential and Group Behaviour Features

Authors: Hongyun Cai; Fuzhi Zhang
Journal: Security and Communication Networks
 (2021)

---

## Abstract

To protect recommender systems against shilling attacks, a variety of detection methods have been proposed over the past decade. However, these methods focus mainly on individual features and rarely consider the lockstep behaviours among attack users, which suffer from low precision in detecting group shilling attacks. In this work, we propose a three-stage detection method based on strong lockstep behaviours among group members and group behaviour features for detecting group shilling attacks. First, we construct a weighted user relationship graph by combining direct and indirect collusive degrees between users. Second, we find all dense subgraphs in the user relationship graph to generate a set of suspicious groups by introducing a topological potential method. Finally, we use a clustering method to detect shilling groups by extracting group behaviour features. Extensive experiments on the Netflix and sampled Amazon review datasets show that the proposed approach is effective for detecting group shilling attacks in recommender systems, and theF1-measure on two datasets can reach over 99 percent and 76 percent, respectively.


---

## Body

## 1. Introduction

Information resources are growing explosively with the rapid development of Internet, which causes information overload. To deal with this problem, recommender systems have been widely used in e-commerce, social network, cloud computing, etc. [1]. However, due to the openness, malicious users can register accounts and provide ratings for the items with the intention of promoting or demoting the recommendation of target items. This behaviour has been termed as shilling attacks or profile injection attacks [2, 3]. Previous researches have shown that a large number of injected fake profiles can bias the output of collaborative filtering recommender systems, indicating that the collaborative filtering recommender systems are vulnerable to shilling attacks [4, 5]. Over the past decade, traditional attack models have been well studied, such as random attack, average attack, bandwagon attack, AoP attack, Love/hate attack, etc. In these attacks, attack users try to promote or demote the same target item but select filler items separately. In fact, attack users can easily collude to attack a set of target items in the recommender system. The behaviour wherein a group of attack users collude to promote or demote the recommendation of a set of target items has been termed group shilling attacks [6, 7]. As attack users in the group work together and strategically generate attack profiles, the detection methods proposed for detecting traditional attacks become ineffective for group shilling attacks. Therefore, how to improve the detection performance for group shilling attacks has become a key issue in the recommender systems.To reduce the impact of shilling attacks on recommender systems, researchers have developed a variety of shilling attack detection methods [8–31]. Most methods focus mainly on the features of individual profiles and are used to detect attack profiles for traditional attacks, e.g., random attack and bandwagon attack. These methods rarely consider the collusive behaviours among attack users, which cause low precision in detecting group shilling attacks. Although a few detection methods [27–31] have been proposed for detecting group shilling attacks in recent years, they usually need prior knowledge of attacks (e.g., the number of shilling groups or attackers). Otherwise, they suffer from low detection precision. While some approaches [32, 33] have been presented to spot the collusive groups in e-commerce and social network, the behaviour features of shilling groups vary greatly in different fields. Therefore, the approaches developed for identifying collusive groups in other fields are not suitable for detecting shilling groups in recommender systems.To address the above limitations, we propose an unsupervised method for detecting group shilling attacks in recommender systems based on topological potential theory and group behaviour features, which is named as TP-GBF. The proposed approach focuses on the collusive behaviours among attack users and can accurately detect attack users in group shilling attacks without knowing the number of shilling groups in advance. Particularly, we first construct a weighted user relationship graph by analysing the lockstep behaviours between users. In the graph, vertices and edges represent the users and their relations, respectively. The weight of each edge is calculated by combining direct and indirect collusive degrees. Then, we analyse the network structure of shilling groups and introduce a topological potential method to spot suspicious groups. Finally, we use the clustering method to detect shilling groups by extracting group behaviour features.The main contributions of this paper are summarized as follows:(1)
Unlike existing user relationship graph construction methods that focus mainly on direct relationship between users, we propose a graph construction method by combining direct and indirect collusive degrees between users. This method not only analyses the direct collusive relationship between two different users but also considers transitivity of direct relationship between them and, therefore, can highlight the collusive relationship between users in the same shilling group whether the group is a tightly coupled shilling group or a loosely coupled shilling group.(2)
Existing methods for generating suspicious groups are mainly based on frequent item mining (FIM) or graph clustering. The FIM-based methods are suitable for finding tightly coupled groups and need to set an appropriate minimum support, while the graph-clustering-based methods usually require prior knowledge of group size or number of groups. Differently, our method finds suspicious shilling groups by introducing a topological potential method, which can automatically decide the number of suspicious groups and find all groups with strong relationships among group members.(3)
Different from existing detection methods for group shilling attacks in recommender systems that are presented based on graph structure or individual behaviour features, our method is based on both the graph structure and group behaviour features of shilling groups, which can detect attack users more accurately.The rest of the paper is organized as follows. Section2 introduces the background and related work. Section 3 describes the proposed detection method for group shilling attacks in detail, which includes the construction of the weighted user relationship graph, the generation of the set of suspicious shilling groups, and the detection of shilling groups. The experimental results are reported and discussed in Section 4. The last section draws a conclusion of our work and discusses the future work.


## 2. Background and Related Work

### 2.1. Group Shilling Attacks

In Ref. [6], Su et al. first proposed the concept of group shilling attacks in recommender systems and mentioned two attack scenarios. In these scenarios, multiple attackers are well organized to conceal their intentions. The attackers in a shilling group work together to promote or demote a set of target items in scenario 1 or only attack some items in the target set in scenario 2. In order to achieve the attack intention, a shilling group must contain a certain number of attackers and each attacker in the group should give some normal ratings on nontarget items. Moreover, many shilling groups may coexist in a recommender system.To generate the effective group shilling profiles and avoid the detection of the existing methods, Wang et al. [7] proposed a tricky group shilling attack model which includes a strict version denoted as GSAGens and a loose version denoted as GSAGenl. In their model, some shilling profiles generated by standard attack models, i.e., random attacks or average attacks, are used as the input. Then, they construct high diversity shilling profiles based on the input according to the strict condition or loose condition. Of the two versions, GSAGenl can generate a shilling group with more shilling profiles than GSAGens because GSAGenl has less strict conditions in generating group shilling attack profiles. Table 1 summarizes the group shilling attack models.Table 1
Summary of group shilling attack models.
VersionTypeFiller itemsFiller item ratingTarget item ratingGSAGensGSAGens RanRandomly chosen and only rated by one attacker in the shilling groupSystem meanrmax/rminGSAGens AvgRandomly chosen and only rated by one attacker in the shilling groupItem meanrmax/rminGSAGenlGSAGenl RanRandomly chosen and at least one item is rated by no more than two attackers in the shilling groupSystem meanrmax/rminGSAGenl AvgRandomly chosen and at least one item is rated by no more than two attackers in the shilling groupItem meanrmax/rmin


### 2.2. Topology Potential Field

The concept of field was first proposed by Faraday in 1837, which is used to measure the interactions of protons in physics. The physical quantity representing the field is termed as potential and the corresponding mathematical function is called potential function. In the field of physics, the potential of the node is proportional to the strength of field source around it, and it decreases with the increase of distance from the node to the other field source. Topology potential field [34, 35] is an application of field in a complex network. Nodes in a complex network are not isolated but interact with each other. Therefore, the topology potential of one node represents the sum of the energy radiated by other nodes.LetG = (V, E) be a graph, where V=v1,v2,…,vm represents the set of nodes and E⊆V×Vis the set of edges. According to the definition of potential function, the topology potential of any node vi∈Vis denoted as φviand defined as follows:(1)φvi=∑j=1Vmj×e−disi,j/σ2,where mj≥0 denotes the mass of neighbour vj, ,1≤j≤m; disi,j represents the distance between nodes viand vj; and σ is a parameter that is used to control the influence scope of a node.


### 2.3. Related Work

Over the past decade, a large number of detection methods have been presented for detecting shilling attacks in recommender systems, which try to identify and eliminate the attack profiles from the perspective of ratings, time, and item popularity degree. These methods can be generally divided into two categories: supervised detection methods and unsupervised detection methods.As for supervised detection methods of shilling attacks in recommender systems, Chirita et al. [8] first proposed the features named rating deviation from mean agreement (RDMA) and degree of similarity with top neighbours (DegSim). The effectiveness of two features depends on the attack type, attack size, and filler size. Burke et al. [9] trained a classifier based on some generic and model-specific features, which were extracted by utilizing statistics properties of ratings given by attack users. Although these detection features are helpful for detecting standard attacks, they become ineffective under obfuscated attacks. Wu et al. [10] presented an effective feature selection method for detecting five attacks and proposed the detection algorithm based on supervised learning. However, the proposed method needs to know the type of attack in advance. Yang et al. [11] proposed an ensemble shilling attack detection method based on 18 statistical features, which could obtain better detection performance than the baseline methods using a single classifier. However, it needs to consider the intensive numeric calculation on these features. Tong et al. [12] applied convolutional neural network to extract detection features from user-item rating matrix. This method can detect shilling profiles generated by the single attack method, but it is not suitable for detecting hybrid attacks. Hao et al. [13] first extracted multidimensional detection features from different angles, including ratings, rating time, and item popularity degree, and then they trained a SVM-based classifier for detecting shilling attacks. This method illustrates higher effectiveness than the baseline methods, but the detection performance is not good when the attack size is less than 10%. Zhou et al. [14] presented a deep-learning-based method to detect traditional shilling attacks in recommender systems. This method does not use the hand-crafted features, but it requires a validation set to find the optimal hyper parameters. Zhang et al. [15] proposed a supervised classifier to detect attack profiles, which learned the representations of users by using graph convolutional network and calculated the probability of a user being an attacker. This method can improve the detection performance by exploiting and integrating the rich side information of users, but it requires setting up of some hyper parameters. In [16], a hybrid convolutional neural network and LSTM-based deep learning model were proposed to detect attack profiles in recommender systems. This method can identify attack profiles generated by six different attack models, but its F1-measure decreases with the increase of filler size. Wu et al. [17] also proposed a hybrid method for detecting shilling profiles in recommender system, which trained the classifier based on labelled profiles and unlabelled ones. This method is effective for detecting hybrid shilling attacks, but its detection performance is inferior to that of C4.5 decision tree method. The aforementioned supervised detection methods need to train a classifier based on the labelled profiles in the training set, which are only effective for detecting known types of shilling attacks.As for unsupervised detection methods of shilling attacks in recommender systems, Mehta et al. [18] analysed the similarity structure in attack profiles and proposed the PCA-VarSelect model. This method is effective in detecting some standard shilling attacks including random attack, average attack, etc. However, it needs the prior knowledge of attack size (i.e., number of attack profiles). A detection method based on spectral clustering is presented in Ref. [19]. This method can detect unknown types of shilling attacks, but it also assumes to know the number of attack profiles in advance. In Ref. [20], Xia et al. described an identification method of the target item, which can find the target item by using dynamic time segment. Based on the identified target item, attack profiles can be spotted. This method is suitable for identifying the target item rated by a large number of genuine users before attacks, but it cannot catch the cold-start target item. Zhang et al. [21] designed a ranking algorithm for detecting attack profiles in recommender systems, which calculates the suspiciousness of each user and each item iteratively. This approach can detect unknown types of attacks effectively, but it needs to label some candidate users as seeds and to know the number of attack profiles. In Ref. [22], Zhang et al. presented an unsupervised detection approach for detecting various attacks by analysing diversity between genuine and attack users in rating behaviours. This method can determine the critical point of rating behaviour suspiciousness degrees dynamically, but the critical point is hard to determine if the attack size is low. Yang et al. [23] proposed a unified detection approach for profile injection attacks and covisitation injection attacks, which used the coupled factor graph and label propagation algorithm to determine attack profiles. The approach can detect various types of attacks, but it requires a set of spam user seeds and some empirical thresholds of parameters. The aforementioned unsupervised detection approaches can detect unknown types of shilling attacks. However, these methods usually need some prior knowledge of attacks (i.e., attack size) to ensure the detection performance. Aiming at these limitations, Zhang et al. [24] analysed the behaviour difference in item popularity between genuine profiles and attack ones, and designed a novel detection framework based on hidden Markov model and hierarchical clustering. This method can achieve excellent detection performance in detecting many types of attacks, but it becomes ineffective in detecting AoP attack. In our previous work [25], we extracted user behaviour features based on latent item relationship and detected attack users by utilizing the identified target items. The method is effective for detecting various types of attack profiles in both synthetic and real-world datasets, but it requires a reasonable threshold when the number of target items is more than one. In another work [26], we proposed an unsupervised detection method, which identified the target items with abnormal deviation of rating distributions on items, and detected attack users by performing the Density-Based Clustering of Applications with Noise (DBSCAN) clustering on the set of suspicious users. However, this method cannot identify the target items with less abnormal ratings.The aforementioned approaches focus mainly on detecting shilling attacks based on the features of individual attack profiles in recommender systems; few of them consider the lockstep behaviours among attack users in a shilling group. There are a few methods that analyse shilling behaviours at the group level. Gao et al. [27] introduced a group-based ranking method, which grouped users and calculated their reputations based on their ratings. This approach is effective for detecting those attackers who have only rated a few items and have high rating errors, but its precision is low when there are more original distorted ratings in the dataset. Zhou et al. [28] proposed a two-stage model to detect group shilling attacks in recommender systems, which utilized features based on Rating Deviation from Mean Agreement (RDMA) and Degree of Similarity with Top Neighbours (DegSim). This approach can detect group attacks with high similarity between group members. However, it is ineffective in detecting attack profiles with low similarity in the shilling group. Gimenes et al. [29] introduced an online-Recommendation Fraud Excluder (ORFEL) which used the lockstep behaviour to detect suspicious fraud behaviour. This approach is effective in discovering potential attacks. However, it requires sufficient number of starting seeds to search the lockstep behaviours. Besides, may be not all users with lockstep behaviours are attackers. In Ref. [30], an unsupervised method for detecting shilling groups in recommender systems is presented, which generates candidate groups by dividing the rating tracks on each item and detects shilling groups by employing the bisecting K-means algorithm based on the suspicious degrees of candidate groups. This approach is very effective for detecting group attacks on the Synthesis dataset. However, its precision needs to be improved on the real-world dataset. Hao et al. [31] constructed a user-user graph based on rating behaviours similarity and determined the attacker communities with maximum filling rate of the item. This method can detect the attacker communities in which the attackers are closely connected to each other. The detection precision will decrease if the maximum filling rate of the item in the community is low.Table2 summarizes the above approaches for shilling attack detection in recommender systems.Table 2
Summary of shilling attack detection approaches.
ApproachesCategoryAdvantageDisadvantageChirita et al. [8] and Burke et al. [9]SupervisedEffective for specific attack strategyLess effective for obfuscated attacksWu et al. [10]SupervisedEffective for known attack strategyRequire known attack strategyYang et al. [11]SupervisedEffective for specific attack strategyMuch computational effortTong et al. [12]SupervisedFeature learning by deep learningLess effective for mixed attacksHao et al. [13]SupervisedEffective for various types of attackPerformance is not very high for small attack sizeZhou et al. [14]SupervisedAutomatic feature extractionNeed a validation set to set parametersZhang et al. [15]SupervisedRegardless of the specific attack strategyRequire setting hyper parametersVivekanandan et al. [16]SupervisedAutomatic feature extractionF1 decreases with the increase of filler sizeWu et al. [17]SupervisedEffective for hybrid attacksPerformance is not highMehta et al. [18]UnsupervisedRegardless of the specific attack strategyRequire the prior knowledge of attack sizeZhang et al. [19]UnsupervisedRegardless of the specific attack strategyRequire the prior knowledge of attack sizeXia et al. [20]UnsupervisedEffective for a target item with large number of ratings from normal usersLess effective with cold-start target itemsZhang et al. [21]UnsupervisedRegardless of the specific attack strategyRequire some user seeds and attack sizeZhang et al. [22]UnsupervisedRegardless of the specific attack strategyCritical point is not always accurateYang et al. [23]UnsupervisedEffective for various attacksRequire a set of spam seedsZhang et al. [24]UnsupervisedPerformance is high under various attacksLess effective under AoP attackCai et al. [25]UnsupervisedEffective for various attacksRequire a reasonable threshold when target items are moreCai et al. [26]UnsupervisedRegardless of the specific attack strategyLess effective for identifying target items with a few ratingsGao et al. [27]UnsupervisedEffective if the number of distorted ratings is fewPrecision decreases if the number of distorted ratings is moreZhou et al. [28]UnsupervisedEffective for detecting specific shilling groupsLess effective for attack profiles with low similarityGabriel et al. [29]UnsupervisedEffective for detection users with collusive behaviourRequire some starting seedsZhang et al. [30]UnsupervisedEffective for group shilling attacksRequire setting parametersHao et al. [31]UnsupervisedAutomatic feature learningPrecision depends on the maximum filling rateAnother related work is to detect review spammer groups in e-commerce websites. Existing detection approaches focus on detecting collusive review spammers using frequent pattern mining or graph mining. In Ref. [32], frequent pattern mining technique is first adopted to generate suspicious groups, and then several group shilling features are extracted at the group level. Finally, shilling groups are identified from the suspicious groups by using a PCA-based method. This approach is effective for detecting group shilling attacks with tightly coupled shilling groups. However, the calculations of features need not only ratings and timestamps but also review content. Moreover, they require the threshold of information loss rate as input. Wang et al. [33] modelled spammer groups as biconnected graphs and designed a graph-based framework to detect review spammer groups. This method uses eight group spam indicators to evaluate the suspiciousness of a candidate group, but it also requires setting up of a minimum spam threshold in detecting spammer groups. Since the shilling groups in recommender systems are different from review spammer groups in e-commerce websites, these group spam indicators presented for detecting review spammer groups are no longer applicable to detecting group shilling attacks in recommender systems. Moreover, in a real-world dataset, it is difficult to obtain a suitable minimum suspiciousness threshold or the total number of shilling groups in advance.In this work, we focus on detecting group shilling attacks in recommender systems. Compared with our previous work in Refs. [25, 26], this work highlights the collusive relationship between attackers in the same shilling group and detects shilling attacks at the group level. Unlike the approaches in Refs. [22, 30], our method combines the graph structure and group features, which improves the detection precision for group shilling attacks. Compared with the method in Ref. [31], our method can detect attack users with loose association, which achieves excellent precision especially for detecting loosely coupled shilling groups.


## 2.1. Group Shilling Attacks

In Ref. [6], Su et al. first proposed the concept of group shilling attacks in recommender systems and mentioned two attack scenarios. In these scenarios, multiple attackers are well organized to conceal their intentions. The attackers in a shilling group work together to promote or demote a set of target items in scenario 1 or only attack some items in the target set in scenario 2. In order to achieve the attack intention, a shilling group must contain a certain number of attackers and each attacker in the group should give some normal ratings on nontarget items. Moreover, many shilling groups may coexist in a recommender system.To generate the effective group shilling profiles and avoid the detection of the existing methods, Wang et al. [7] proposed a tricky group shilling attack model which includes a strict version denoted as GSAGens and a loose version denoted as GSAGenl. In their model, some shilling profiles generated by standard attack models, i.e., random attacks or average attacks, are used as the input. Then, they construct high diversity shilling profiles based on the input according to the strict condition or loose condition. Of the two versions, GSAGenl can generate a shilling group with more shilling profiles than GSAGens because GSAGenl has less strict conditions in generating group shilling attack profiles. Table 1 summarizes the group shilling attack models.Table 1
Summary of group shilling attack models.
VersionTypeFiller itemsFiller item ratingTarget item ratingGSAGensGSAGens RanRandomly chosen and only rated by one attacker in the shilling groupSystem meanrmax/rminGSAGens AvgRandomly chosen and only rated by one attacker in the shilling groupItem meanrmax/rminGSAGenlGSAGenl RanRandomly chosen and at least one item is rated by no more than two attackers in the shilling groupSystem meanrmax/rminGSAGenl AvgRandomly chosen and at least one item is rated by no more than two attackers in the shilling groupItem meanrmax/rmin


## 2.2. Topology Potential Field

The concept of field was first proposed by Faraday in 1837, which is used to measure the interactions of protons in physics. The physical quantity representing the field is termed as potential and the corresponding mathematical function is called potential function. In the field of physics, the potential of the node is proportional to the strength of field source around it, and it decreases with the increase of distance from the node to the other field source. Topology potential field [34, 35] is an application of field in a complex network. Nodes in a complex network are not isolated but interact with each other. Therefore, the topology potential of one node represents the sum of the energy radiated by other nodes.LetG = (V, E) be a graph, where V=v1,v2,…,vm represents the set of nodes and E⊆V×Vis the set of edges. According to the definition of potential function, the topology potential of any node vi∈Vis denoted as φviand defined as follows:(1)φvi=∑j=1Vmj×e−disi,j/σ2,where mj≥0 denotes the mass of neighbour vj, ,1≤j≤m; disi,j represents the distance between nodes viand vj; and σ is a parameter that is used to control the influence scope of a node.


## 2.3. Related Work

Over the past decade, a large number of detection methods have been presented for detecting shilling attacks in recommender systems, which try to identify and eliminate the attack profiles from the perspective of ratings, time, and item popularity degree. These methods can be generally divided into two categories: supervised detection methods and unsupervised detection methods.As for supervised detection methods of shilling attacks in recommender systems, Chirita et al. [8] first proposed the features named rating deviation from mean agreement (RDMA) and degree of similarity with top neighbours (DegSim). The effectiveness of two features depends on the attack type, attack size, and filler size. Burke et al. [9] trained a classifier based on some generic and model-specific features, which were extracted by utilizing statistics properties of ratings given by attack users. Although these detection features are helpful for detecting standard attacks, they become ineffective under obfuscated attacks. Wu et al. [10] presented an effective feature selection method for detecting five attacks and proposed the detection algorithm based on supervised learning. However, the proposed method needs to know the type of attack in advance. Yang et al. [11] proposed an ensemble shilling attack detection method based on 18 statistical features, which could obtain better detection performance than the baseline methods using a single classifier. However, it needs to consider the intensive numeric calculation on these features. Tong et al. [12] applied convolutional neural network to extract detection features from user-item rating matrix. This method can detect shilling profiles generated by the single attack method, but it is not suitable for detecting hybrid attacks. Hao et al. [13] first extracted multidimensional detection features from different angles, including ratings, rating time, and item popularity degree, and then they trained a SVM-based classifier for detecting shilling attacks. This method illustrates higher effectiveness than the baseline methods, but the detection performance is not good when the attack size is less than 10%. Zhou et al. [14] presented a deep-learning-based method to detect traditional shilling attacks in recommender systems. This method does not use the hand-crafted features, but it requires a validation set to find the optimal hyper parameters. Zhang et al. [15] proposed a supervised classifier to detect attack profiles, which learned the representations of users by using graph convolutional network and calculated the probability of a user being an attacker. This method can improve the detection performance by exploiting and integrating the rich side information of users, but it requires setting up of some hyper parameters. In [16], a hybrid convolutional neural network and LSTM-based deep learning model were proposed to detect attack profiles in recommender systems. This method can identify attack profiles generated by six different attack models, but its F1-measure decreases with the increase of filler size. Wu et al. [17] also proposed a hybrid method for detecting shilling profiles in recommender system, which trained the classifier based on labelled profiles and unlabelled ones. This method is effective for detecting hybrid shilling attacks, but its detection performance is inferior to that of C4.5 decision tree method. The aforementioned supervised detection methods need to train a classifier based on the labelled profiles in the training set, which are only effective for detecting known types of shilling attacks.As for unsupervised detection methods of shilling attacks in recommender systems, Mehta et al. [18] analysed the similarity structure in attack profiles and proposed the PCA-VarSelect model. This method is effective in detecting some standard shilling attacks including random attack, average attack, etc. However, it needs the prior knowledge of attack size (i.e., number of attack profiles). A detection method based on spectral clustering is presented in Ref. [19]. This method can detect unknown types of shilling attacks, but it also assumes to know the number of attack profiles in advance. In Ref. [20], Xia et al. described an identification method of the target item, which can find the target item by using dynamic time segment. Based on the identified target item, attack profiles can be spotted. This method is suitable for identifying the target item rated by a large number of genuine users before attacks, but it cannot catch the cold-start target item. Zhang et al. [21] designed a ranking algorithm for detecting attack profiles in recommender systems, which calculates the suspiciousness of each user and each item iteratively. This approach can detect unknown types of attacks effectively, but it needs to label some candidate users as seeds and to know the number of attack profiles. In Ref. [22], Zhang et al. presented an unsupervised detection approach for detecting various attacks by analysing diversity between genuine and attack users in rating behaviours. This method can determine the critical point of rating behaviour suspiciousness degrees dynamically, but the critical point is hard to determine if the attack size is low. Yang et al. [23] proposed a unified detection approach for profile injection attacks and covisitation injection attacks, which used the coupled factor graph and label propagation algorithm to determine attack profiles. The approach can detect various types of attacks, but it requires a set of spam user seeds and some empirical thresholds of parameters. The aforementioned unsupervised detection approaches can detect unknown types of shilling attacks. However, these methods usually need some prior knowledge of attacks (i.e., attack size) to ensure the detection performance. Aiming at these limitations, Zhang et al. [24] analysed the behaviour difference in item popularity between genuine profiles and attack ones, and designed a novel detection framework based on hidden Markov model and hierarchical clustering. This method can achieve excellent detection performance in detecting many types of attacks, but it becomes ineffective in detecting AoP attack. In our previous work [25], we extracted user behaviour features based on latent item relationship and detected attack users by utilizing the identified target items. The method is effective for detecting various types of attack profiles in both synthetic and real-world datasets, but it requires a reasonable threshold when the number of target items is more than one. In another work [26], we proposed an unsupervised detection method, which identified the target items with abnormal deviation of rating distributions on items, and detected attack users by performing the Density-Based Clustering of Applications with Noise (DBSCAN) clustering on the set of suspicious users. However, this method cannot identify the target items with less abnormal ratings.The aforementioned approaches focus mainly on detecting shilling attacks based on the features of individual attack profiles in recommender systems; few of them consider the lockstep behaviours among attack users in a shilling group. There are a few methods that analyse shilling behaviours at the group level. Gao et al. [27] introduced a group-based ranking method, which grouped users and calculated their reputations based on their ratings. This approach is effective for detecting those attackers who have only rated a few items and have high rating errors, but its precision is low when there are more original distorted ratings in the dataset. Zhou et al. [28] proposed a two-stage model to detect group shilling attacks in recommender systems, which utilized features based on Rating Deviation from Mean Agreement (RDMA) and Degree of Similarity with Top Neighbours (DegSim). This approach can detect group attacks with high similarity between group members. However, it is ineffective in detecting attack profiles with low similarity in the shilling group. Gimenes et al. [29] introduced an online-Recommendation Fraud Excluder (ORFEL) which used the lockstep behaviour to detect suspicious fraud behaviour. This approach is effective in discovering potential attacks. However, it requires sufficient number of starting seeds to search the lockstep behaviours. Besides, may be not all users with lockstep behaviours are attackers. In Ref. [30], an unsupervised method for detecting shilling groups in recommender systems is presented, which generates candidate groups by dividing the rating tracks on each item and detects shilling groups by employing the bisecting K-means algorithm based on the suspicious degrees of candidate groups. This approach is very effective for detecting group attacks on the Synthesis dataset. However, its precision needs to be improved on the real-world dataset. Hao et al. [31] constructed a user-user graph based on rating behaviours similarity and determined the attacker communities with maximum filling rate of the item. This method can detect the attacker communities in which the attackers are closely connected to each other. The detection precision will decrease if the maximum filling rate of the item in the community is low.Table2 summarizes the above approaches for shilling attack detection in recommender systems.Table 2
Summary of shilling attack detection approaches.
ApproachesCategoryAdvantageDisadvantageChirita et al. [8] and Burke et al. [9]SupervisedEffective for specific attack strategyLess effective for obfuscated attacksWu et al. [10]SupervisedEffective for known attack strategyRequire known attack strategyYang et al. [11]SupervisedEffective for specific attack strategyMuch computational effortTong et al. [12]SupervisedFeature learning by deep learningLess effective for mixed attacksHao et al. [13]SupervisedEffective for various types of attackPerformance is not very high for small attack sizeZhou et al. [14]SupervisedAutomatic feature extractionNeed a validation set to set parametersZhang et al. [15]SupervisedRegardless of the specific attack strategyRequire setting hyper parametersVivekanandan et al. [16]SupervisedAutomatic feature extractionF1 decreases with the increase of filler sizeWu et al. [17]SupervisedEffective for hybrid attacksPerformance is not highMehta et al. [18]UnsupervisedRegardless of the specific attack strategyRequire the prior knowledge of attack sizeZhang et al. [19]UnsupervisedRegardless of the specific attack strategyRequire the prior knowledge of attack sizeXia et al. [20]UnsupervisedEffective for a target item with large number of ratings from normal usersLess effective with cold-start target itemsZhang et al. [21]UnsupervisedRegardless of the specific attack strategyRequire some user seeds and attack sizeZhang et al. [22]UnsupervisedRegardless of the specific attack strategyCritical point is not always accurateYang et al. [23]UnsupervisedEffective for various attacksRequire a set of spam seedsZhang et al. [24]UnsupervisedPerformance is high under various attacksLess effective under AoP attackCai et al. [25]UnsupervisedEffective for various attacksRequire a reasonable threshold when target items are moreCai et al. [26]UnsupervisedRegardless of the specific attack strategyLess effective for identifying target items with a few ratingsGao et al. [27]UnsupervisedEffective if the number of distorted ratings is fewPrecision decreases if the number of distorted ratings is moreZhou et al. [28]UnsupervisedEffective for detecting specific shilling groupsLess effective for attack profiles with low similarityGabriel et al. [29]UnsupervisedEffective for detection users with collusive behaviourRequire some starting seedsZhang et al. [30]UnsupervisedEffective for group shilling attacksRequire setting parametersHao et al. [31]UnsupervisedAutomatic feature learningPrecision depends on the maximum filling rateAnother related work is to detect review spammer groups in e-commerce websites. Existing detection approaches focus on detecting collusive review spammers using frequent pattern mining or graph mining. In Ref. [32], frequent pattern mining technique is first adopted to generate suspicious groups, and then several group shilling features are extracted at the group level. Finally, shilling groups are identified from the suspicious groups by using a PCA-based method. This approach is effective for detecting group shilling attacks with tightly coupled shilling groups. However, the calculations of features need not only ratings and timestamps but also review content. Moreover, they require the threshold of information loss rate as input. Wang et al. [33] modelled spammer groups as biconnected graphs and designed a graph-based framework to detect review spammer groups. This method uses eight group spam indicators to evaluate the suspiciousness of a candidate group, but it also requires setting up of a minimum spam threshold in detecting spammer groups. Since the shilling groups in recommender systems are different from review spammer groups in e-commerce websites, these group spam indicators presented for detecting review spammer groups are no longer applicable to detecting group shilling attacks in recommender systems. Moreover, in a real-world dataset, it is difficult to obtain a suitable minimum suspiciousness threshold or the total number of shilling groups in advance.In this work, we focus on detecting group shilling attacks in recommender systems. Compared with our previous work in Refs. [25, 26], this work highlights the collusive relationship between attackers in the same shilling group and detects shilling attacks at the group level. Unlike the approaches in Refs. [22, 30], our method combines the graph structure and group features, which improves the detection precision for group shilling attacks. Compared with the method in Ref. [31], our method can detect attack users with loose association, which achieves excellent precision especially for detecting loosely coupled shilling groups.


## 3. The Framework of TP-GBF

The framework of TP-GBF is depicted in Figure1, which consists of three stages, i.e., constructing a weighted user relationship graph, generating a set of suspicious groups, and finding shilling groups. In the first stage, we construct a weighted user relationship graph by combining direct and indirect collusive degrees between users. The aim was to highlight the collusive behaviours among attackers in the same shilling group. In the second stage, we introduce a topology potential method to generate the set of suspicious shilling groups. The number of suspicious groups is decided automatically based on the number of nodes with local maximum potential value. In the third stage, group behaviour features are extracted at the group level, and then shilling groups in the set of suspicious groups are detected by using a clustering algorithm.Figure 1
Framework of TP-GBF.To facilitate the discussion, we list the notations and their descriptions used in this paper in Table3.Table 3
Notations and their descriptions.
NotationDescriptionUThe set of users andU=u1,u2,…,umIThe set of items andI=p1,p2,…,pnRUser-item rating matrix andR=ri,jm×nTUser-item rating timestamp matrix andT=ti,jm×nGSetThe set of suspicious groups andG Set=Source1,Source2,…,SourcekSourceiSet of members in theith suspicious group and Sourcei>2TargetiSet of target items in theith suspicious group and Targeti>2i∈1,2,…,k


### 3.1. Constructing a Weighed User Relationship Graph

As described in Subsection2.1, members in the same shilling group work collaboratively to promote or demote more than one target items. Figure 2 shows an example of a group shilling attack, where the rectangle nodes with the solid border and dotted border represent normal items and target items, and circle nodes with the solid border and dotted border represent genuine users and attack users, respectively.Figure 2
An example of a group shilling attack in recommender systems.As shown in Figure2, the set of shilling group members is u2,u4,u5,u6and the set of target items isp2,p3,p4. The pattern of connections between group member and target item may not form a complete bipartite graph, indicating that group members may work in a looser manner. In addition, to reach the attack intention on target items, group members are required to rate several target items in a relatively short period of time and their rating behaviours on the same target item are usually the lockstep. It is to be noted that there may coexist multiple shilling groups simultaneously in a recommender system.Definition 1.
(collusive degree between users (CDBU)). The collusive degree betweenui∈U and uj∈U refers to the relationship strength based on their lockstep behaviours, which is defined as the sum of direct collusive degree DirectCi,j and indirect collusive degree InDirectCi,j, that is,(2)CDBUi,j=DirectCi,j+InDirectCi,j.
Direct collusive degree is related to the number of corated items with lockstep behaviours and indirect collusive degree is considered from the transitivity of direct relationship. For usersui and uj in the same shilling group, if they corate a target item, their rating deviation is usually small and the time interval is usually short. We introduce an indicator function Γi,j,l to denote the lockstep behaviour on item pl for users ui and uj, and let CoNumi,j be the number of corated items with lockstep behaviours. CoNumi,j and Γi,j,l are calculated according to (3) and (4), respectively.(3)CoNumi,j=∑l=1IΓi,j,l.(4)Γi,j,l=1,ifri,l≠0∧rj,l≠0∧ti,l−tj,l≤Δ∧ri,l−rj,l≤ε,0,otherwise.
In (4), Δrepresents the predefined time span for capturing a lockstep behaviour and ε is the predefined small nonnegative number for measuring rating deviation. In this work, ε is set to 1.
Direct collusive degree should increase withCoNumi,j and shows a considerable change around threshold θ(θis set to 2 according to the description of group shilling attacks), which is calculated using the characteristic of the arc tangent function and is defined as(5)DirectCi,j=arctanCoNumi,j−θ+π/2πif CoNumi,j>0,0,otherwise.
Indirect collusive degree between users is determined by their common neighbours and is defined as(6)InDirectCi,j=1U∑u=1UDirectCi,u×DirectCj,u.Definition 2.
(weighted user relationship graph). LetG = (V, E, W) be the weighted user relationship graph, where vertex set V corresponds to the user set, E=ui,uj|CoNumi,j>0,i,j∈1,2,…,Udenotes the edge set and W=wijU×U represents the weight matrix. For users ui∈Uand uj∈U, wij=CDBUi,j when they have lockstep behaviours on corated items; otherwise, wij=0and there is no edge between two nodes.
The algorithm of constructing the weighted user relationship graph is described as follows.
Algorithm1 mainly includes three parts. The first part (line 1) initializes the variables. The second part (lines 2–10) generates the set of edges and the weight matrix. The third part (line 11) constructs the weighted user relationship graph.Algorithm 1: Constructing the weighted user relationship graph.
Input: time matrixT, rating matrix R, predefined time spanΔ, small nonnegative numberε, and threshold θOutput: the weighted user relationship graphG(1)
V←U; E←, ∅;W←0U×U(2)
for∀i,j∈Udo(3)
Calculate the value ofCoNumi,j using (3)(4)
ifCoNumi,j > 0 then(5)
Calculate the value ofDirectCi,j using (5)(6)
Calculate the value ofInDirectCi,j using (6)(7)
Calculate the value ofCDBUi,j using (2)(8)
E←E∪{(i,j)}; wij, ←CDBUi,j(9)
end if(10)
end for(11)
Construct the graphG=(V,E,W)(12)
returnG


### 3.2. Generating the Set of Suspicious Groups

In the weighted user relationship graph, each vertex can be viewed as a topology potential field source and has an impact on other vertexes. However, based on the modularity and community structure characteristics in the real world, topology potential produced by one user on the other user will become very weak when they are far away from each other. According to the classical field theory, the topology potential ofui∈Uon uj∈Ui≠j can be ignored when their distance disi,j is greater than l=⌊3σ/2⌋. Generally speaking, the larger the collusive degree between two users, the lesser the distance between them. However, the same collusive degree may have different effects on different users, e.g., a common user and an active user. Based on the observations, we take a local factor into consideration, which is defined as(7)LFactori,j=CoNumi,j/meantopkif degreei>η,1,otherwise,where degree⋅ means the degree of a user node in the user relationship graph, ηis a threshold, and meantopk indicates the average number of corated items between ui∈Uand its top-k nearest neighbours. In the paper, ηis set to 100 and the top-20 nearest neighbours are considered. Therefore, disi,j is inversely proportional to the product of their local factor and collusive degree if users ui and uj have lockstep behaviours on corated items; otherwise, disi,j refers to the minimum distance between ui and uj and is calculated using the Dijkstra algorithm.In addition, to further reduce the impact of outlier distance and improve the accuracy of suspicious groups, disi,j can be further modified based on k-distance and calculated by(8)disi,j=disi,jk disi×disi,j,where kdis(i) indicates the k-distance of ui∈U. The value of k can be decided according to the F1-measure of the proposed detection method. By experiment, we set the value of k to 10 on both experimental datasets. To save space, the experimental details of this part have not been discussed.Similar to previous research on the topology potential field, we also ignore the massive difference between vertexes and set vertex mass to 1. Therefore, the topology potential of any userui can be calculated by(9)φui=∑j=1,disi,j≤lUe−disi,j/σ2.As described above, the topology potential of one node reflects the total impact of other nodes. In the weighted user relationships graph, nodes of attackers usually show considerably larger topology potential than other user nodes. Moreover, there is a natural peak-valley structure in the topology potential field. This is because nodes belonging to the same shilling group form a local high potential area. To find out every local high potential area, we introduce the definition of local maximum topology potential node.Definition 3.
(local maximum topology potential user). Given a user vertexuiand its neighbour set Neibi, for∀v∈Neibi, ifφv<φui, then uiis a local maximum topology potential user. Let rep be the set of all local maximum topology potential users, which can be defined as:(10)rep=ui|ui∈U∧∀v∈Neibi∧φui>φv.
In this work, a hill-climbing algorithm with multiple random restarts is used to determine all vertexes with local maximum topology potential. In the hill-climbing algorithm, we start with a random initial vertex and search along the direct neighbours with the rising direction of topology potential value until a local maximum topology potential user node is discovered or all reachable vertexes have been checked. By using the hill climbing algorithm, the users with local maximum topology potential are found and represented asrep=rep1,rep2,...,repk, where k represents the total number of local maximum topology potential users in the weighted user relationship graph. Based on repi1≤i≤k, Sourceican be generated. First, the initial Sourcei only contains repi. Next, a reachable vertex ux will be included by Sourcei if dx,i is not greater than l and the potential value is decreased from repi to this vertex. All reachable vertexes are considered based on breadth-first traversal.
Based on the above description, the main steps for generating the set of suspicious groups are as follows:Step 1
Calculate the topology potential of each vertex in the weighted user relationship graphStep 2
Find the local maximum topology potential users using hill-climbing algorithm with multiple random restartsStep 3
Generate the set of suspicious groups based on the local maximum topology potential users
The algorithm of generating the set of suspicious groups is described as follows.
Algorithm2 mainly includes three parts. The first part (lines 1–15) calculates the topology potential value of each user node. The second part (line 16) finds out all nodes with local maximum topology potential value by using a hill-climbing algorithm with multiple random restarts. The third part (lines 17–23) generates a set of suspicious groups, where every suspicious group expands the group size by calling Algorithm 3.
Algorithm3 is used to judge whether the neighbour of the current node should be included. Since group members are considered one by one, Algorithm 3 is called many times during the generation of a suspicious group.Algorithm 2: Generating the set of suspicious groups.
Input: the weighted user relationship graphG=(V,E,W)Output: the set of suspicious groupsG Set=Source1,Source2,...,Sourcek(the value of k is determined automatically)(1)
for∀i,j∈Vdo(2)
ifwij>0 then(3)
ComputeLFactori,j using (7)(4)
disi,j←1/(LFactori,j ×wij)(5)
else(6)
disi, j←the minimum distance between ui and uj calculated by the Dijkstra algorithm(7)
end if(8)
end for(9)
for∀i,j∈Vdo(10)
modifydisi,j using (8)(11)
end for(13)
for∀u∈Vdo(14)
Computeφu using (9)(15)
end for(16)
Find out all local maximum topology potential vertexesrep1,rep2,...,repkusing a hill-climbing algorithm(17)
for∀repi∈rep1,rep2,...,repkdo(18)
Sourcei←repi(19)
pnode←repi(20)
cnode←repi(21)
call Algorithm 3(22)
end for(23)
returnG Set=Source1,Source2,...,SourcekAlgorithm 3: Local expanding
Input:Dis=disi,jU×U, φu,u∈1,2,...,U, Sourcei, cnode, pnode and σOutput:Sourcei(1)
tem←cnode(2)
TSet←all neighbours of tem(3)
for∀x∈TSetdo(4)
ifx∉Sourcei and φx≤φtem and disxpnode≤⌊3σ/2⌋then(5)
Sourcei←Sourcei∪x(6)
cnode←x(7)
call Algorithm 3(8)
end if(9)
end for


### 3.3. Finding Shilling Groups in the Set of Suspicious Groups

Many features have been proposed based on the individual attack profiles over the past decade. However, the effective detection features for shilling groups are limited. Since there may be a strong lockstep relationship between some normal users, groups of these normal users may be misjudged as shilling groups. In this section, six group behaviour features are proposed at the group level to distinguish shilling groups from normal ones in the set of suspicious groups.First, we extract four group features based on our previous work in Ref. [25]. In Ref. [25], two features, namely, SBT (Similarity of Behaviour Track) and ASTW (Average Similarity of Time window) are discussed, which can reflect the behaviour differences in user interest preference between genuine users and attack users. Inspired by these two features, we extract the following four features at the group level.Definition 4.
(group behaviour track similarity (GBTS)). For theith candidate group in GSet, its group behaviour track similarity refers to the average of similarity of user behaviour tracks, which is denoted as GBTSiand calculated by(11)GBTSi=1Sourcei∑u∈SourceiSBTu,where Sourceiis the user set of giand SBTu represents the behaviour track similarity of u.Definition 5.
(group behaviour track fluctuation (GBTF)). For theith candidate group in GSet, its group behaviour track fluctuation refers to the dispersion degree of behaviour track similarity of all users in the group, which is denoted as GBTFi and calculated by(12)GBTFi=1Sourcei−1∑u∈SourceiSBTu−GBTSi2.Definition 6.
(group behaviour window similarity (GBWS)). For theith candidate group in GSet, its group behaviour window similarity refers to the average window similarity of all users in the group, which is denoted as GBWSi and calculated by(13)GBWSi=1Sourcei∑u∈SourceiASTWu,where ASTWu denotes the average of time window similarity of user u inSourcei.Definition 7.
(group behaviour window fluctuation (GBWF)). For theith candidate group in GSet, its group behaviour window fluctuation refers to the dispersion degree of window fluctuation of all users in the group, which is denoted as GBWFi and calculated by(14)GBWFi=1Sourcei−1∑u∈SourceiASTWu−GBWSi2.
Next, we further extract two new features of shilling groups based on attack intention. In recommender systems, members of a shilling group work together to promote or demote the recommendation of a few target items. In order to influence as many genuine users as possible, each member in the shilling group randomly selects some items as filler items. Moreover, in view of attack cost and attack intention, target items for push attacks are usually nonpopular items, while attackers mounting nuke attacks prefer to attack popular items with a large number of high ratings.Definition 8.
(group attack intention (GAI)). For theith candidate group in GSet, its group attack intention refers to the average suspicious degree of all target items, which is denoted as GAIi and calculated by(15)GAIi=1Targeti∑p∈Targeti∑u∈SourceiFu,p∑u′∈UFu′,p,where Fu,pdenotes an indicator function. Fu,p=1 if user u in Sourcei has rated item p with an abnormal rating; otherwise, Fu,p=0.Definition 9.
(group behaviour dissimilarity on nontarget items (GBDN)). For theith candidate group in GSet, its group behaviour dissimilarity on nontarget items refers to the average dissimilarity degree on all nontarget items between members in Sourcei, which is denoted as GBDNi and calculated by(16)GBDNi=1−1Sourcei2∑u,v∈SourceiNTSimu,v,where NTSimu,v denotes the similarity degree on all nontarget items between users u and v. In this work, we use cosine similarity formula to calculate the similarity degree.
To illustrate the effectiveness of the extracted group features, we useGSAGenlRan and GSAGenlAvg to generate 10 shilling groups on the Netflix dataset, which contains 128 attack users. Next, we find out all suspicious groups via Algorithm 2. More details of the suspicious groups are shown in Table 4. It can be seen from Table 4 that 17 suspicious groups are discovered by Algorithm 2. In these groups, the first seven groups contain many genuine users and few attackers while the other groups only consist of attack users. As shown in Table 4, the difference between genuine groups and shilling groups in each extracted feature is significant.
Based on the above discussion, for theith group in GSet, a vector of group features can be constructed and denoted by gfvi= (GBTSi, GBTFi, GBWSi, GBWFi, GAIi, GBDNi). As there is high similarity in group features between shilling groups, we can distinguish shilling groups from normal groups in the set of suspicious groups by using the k-means clustering algorithm.
The algorithm for detecting shilling groups is described as Algorithm4, which mainly includes two parts. The first part (Lines 1–8) calculates six group features. The second part (Lines 9–14) divides all suspicious groups into two parts by using the k-means clustering algorithm. The suspicious groups in the larger cluster are regarded as shilling ones.Algorithm 4: Detecting shilling groups.
Input: time matrixT, rating matrix R, and the set of suspicious groups GSet=g1,g2,...,gkOutput: the set of shilling groups(1)
for∀gi∈GSetdo(2)
Calculate the value of GBTSi using (11)(3)
Calculate the value of GBTFi using (12)(4)
Calculate the value of GBWSi using (13)(5)
Calculate the value of GBWFi using (14)(6)
Calculate the value of GAIi using (15)(7)
Calculate the value of GBDNi using (16)(8)
end for(9)
[C1, C2] ←divide the set of suspicious groups into two clusters by using the k-means algorithm(10)
ifC1>C2then(11)
returnC1(12)
else(13)
returnC2(14)
end ifTable 4
Group features of each group in the set of suspicious groups on the Netflix dataset.
Group IDAre all members attackers in the group?Group sizeGBTSGBTFGBWSGBWFGAIGBDN1No30.28130.02200.79950.04380.00980.64332No2020.26550.02040.60620.10570.01020.94213No40.40970.07790.62390.17300.02370.66974No1890.29790.05010.54870.14860.18350.76715No40.27900.01280.79700.06310.03880.66716No40.31570.03350.74590.10360.00780.67107No30.35870.08510.82430.03410.00870.61978Yes120.27160.00760.33520.04430.67500.89319Yes130.27230.00920.34210.03620.63500.901110Yes140.27160.01040.31830.03390.70620.907911Yes130.27190.00770.31050.03100.73360.901512Yes130.27260.01470.32590.02980.62310.899113Yes130.26880.00840.32150.03400.71550.899414Yes130.26960.00780.33640.03010.73610.900215Yes120.27200.00970.34600.03070.82310.894216Yes120.27270.00990.33370.04140.68640.891617Yes130.27750.01030.32580.02900.72560.9013


## 3.1. Constructing a Weighed User Relationship Graph

As described in Subsection2.1, members in the same shilling group work collaboratively to promote or demote more than one target items. Figure 2 shows an example of a group shilling attack, where the rectangle nodes with the solid border and dotted border represent normal items and target items, and circle nodes with the solid border and dotted border represent genuine users and attack users, respectively.Figure 2
An example of a group shilling attack in recommender systems.As shown in Figure2, the set of shilling group members is u2,u4,u5,u6and the set of target items isp2,p3,p4. The pattern of connections between group member and target item may not form a complete bipartite graph, indicating that group members may work in a looser manner. In addition, to reach the attack intention on target items, group members are required to rate several target items in a relatively short period of time and their rating behaviours on the same target item are usually the lockstep. It is to be noted that there may coexist multiple shilling groups simultaneously in a recommender system.Definition 1.
(collusive degree between users (CDBU)). The collusive degree betweenui∈U and uj∈U refers to the relationship strength based on their lockstep behaviours, which is defined as the sum of direct collusive degree DirectCi,j and indirect collusive degree InDirectCi,j, that is,(2)CDBUi,j=DirectCi,j+InDirectCi,j.
Direct collusive degree is related to the number of corated items with lockstep behaviours and indirect collusive degree is considered from the transitivity of direct relationship. For usersui and uj in the same shilling group, if they corate a target item, their rating deviation is usually small and the time interval is usually short. We introduce an indicator function Γi,j,l to denote the lockstep behaviour on item pl for users ui and uj, and let CoNumi,j be the number of corated items with lockstep behaviours. CoNumi,j and Γi,j,l are calculated according to (3) and (4), respectively.(3)CoNumi,j=∑l=1IΓi,j,l.(4)Γi,j,l=1,ifri,l≠0∧rj,l≠0∧ti,l−tj,l≤Δ∧ri,l−rj,l≤ε,0,otherwise.
In (4), Δrepresents the predefined time span for capturing a lockstep behaviour and ε is the predefined small nonnegative number for measuring rating deviation. In this work, ε is set to 1.
Direct collusive degree should increase withCoNumi,j and shows a considerable change around threshold θ(θis set to 2 according to the description of group shilling attacks), which is calculated using the characteristic of the arc tangent function and is defined as(5)DirectCi,j=arctanCoNumi,j−θ+π/2πif CoNumi,j>0,0,otherwise.
Indirect collusive degree between users is determined by their common neighbours and is defined as(6)InDirectCi,j=1U∑u=1UDirectCi,u×DirectCj,u.Definition 2.
(weighted user relationship graph). LetG = (V, E, W) be the weighted user relationship graph, where vertex set V corresponds to the user set, E=ui,uj|CoNumi,j>0,i,j∈1,2,…,Udenotes the edge set and W=wijU×U represents the weight matrix. For users ui∈Uand uj∈U, wij=CDBUi,j when they have lockstep behaviours on corated items; otherwise, wij=0and there is no edge between two nodes.
The algorithm of constructing the weighted user relationship graph is described as follows.
Algorithm1 mainly includes three parts. The first part (line 1) initializes the variables. The second part (lines 2–10) generates the set of edges and the weight matrix. The third part (line 11) constructs the weighted user relationship graph.Algorithm 1: Constructing the weighted user relationship graph.
Input: time matrixT, rating matrix R, predefined time spanΔ, small nonnegative numberε, and threshold θOutput: the weighted user relationship graphG(1)
V←U; E←, ∅;W←0U×U(2)
for∀i,j∈Udo(3)
Calculate the value ofCoNumi,j using (3)(4)
ifCoNumi,j > 0 then(5)
Calculate the value ofDirectCi,j using (5)(6)
Calculate the value ofInDirectCi,j using (6)(7)
Calculate the value ofCDBUi,j using (2)(8)
E←E∪{(i,j)}; wij, ←CDBUi,j(9)
end if(10)
end for(11)
Construct the graphG=(V,E,W)(12)
returnG


## 3.2. Generating the Set of Suspicious Groups

In the weighted user relationship graph, each vertex can be viewed as a topology potential field source and has an impact on other vertexes. However, based on the modularity and community structure characteristics in the real world, topology potential produced by one user on the other user will become very weak when they are far away from each other. According to the classical field theory, the topology potential ofui∈Uon uj∈Ui≠j can be ignored when their distance disi,j is greater than l=⌊3σ/2⌋. Generally speaking, the larger the collusive degree between two users, the lesser the distance between them. However, the same collusive degree may have different effects on different users, e.g., a common user and an active user. Based on the observations, we take a local factor into consideration, which is defined as(7)LFactori,j=CoNumi,j/meantopkif degreei>η,1,otherwise,where degree⋅ means the degree of a user node in the user relationship graph, ηis a threshold, and meantopk indicates the average number of corated items between ui∈Uand its top-k nearest neighbours. In the paper, ηis set to 100 and the top-20 nearest neighbours are considered. Therefore, disi,j is inversely proportional to the product of their local factor and collusive degree if users ui and uj have lockstep behaviours on corated items; otherwise, disi,j refers to the minimum distance between ui and uj and is calculated using the Dijkstra algorithm.In addition, to further reduce the impact of outlier distance and improve the accuracy of suspicious groups, disi,j can be further modified based on k-distance and calculated by(8)disi,j=disi,jk disi×disi,j,where kdis(i) indicates the k-distance of ui∈U. The value of k can be decided according to the F1-measure of the proposed detection method. By experiment, we set the value of k to 10 on both experimental datasets. To save space, the experimental details of this part have not been discussed.Similar to previous research on the topology potential field, we also ignore the massive difference between vertexes and set vertex mass to 1. Therefore, the topology potential of any userui can be calculated by(9)φui=∑j=1,disi,j≤lUe−disi,j/σ2.As described above, the topology potential of one node reflects the total impact of other nodes. In the weighted user relationships graph, nodes of attackers usually show considerably larger topology potential than other user nodes. Moreover, there is a natural peak-valley structure in the topology potential field. This is because nodes belonging to the same shilling group form a local high potential area. To find out every local high potential area, we introduce the definition of local maximum topology potential node.Definition 3.
(local maximum topology potential user). Given a user vertexuiand its neighbour set Neibi, for∀v∈Neibi, ifφv<φui, then uiis a local maximum topology potential user. Let rep be the set of all local maximum topology potential users, which can be defined as:(10)rep=ui|ui∈U∧∀v∈Neibi∧φui>φv.
In this work, a hill-climbing algorithm with multiple random restarts is used to determine all vertexes with local maximum topology potential. In the hill-climbing algorithm, we start with a random initial vertex and search along the direct neighbours with the rising direction of topology potential value until a local maximum topology potential user node is discovered or all reachable vertexes have been checked. By using the hill climbing algorithm, the users with local maximum topology potential are found and represented asrep=rep1,rep2,...,repk, where k represents the total number of local maximum topology potential users in the weighted user relationship graph. Based on repi1≤i≤k, Sourceican be generated. First, the initial Sourcei only contains repi. Next, a reachable vertex ux will be included by Sourcei if dx,i is not greater than l and the potential value is decreased from repi to this vertex. All reachable vertexes are considered based on breadth-first traversal.
Based on the above description, the main steps for generating the set of suspicious groups are as follows:Step 1
Calculate the topology potential of each vertex in the weighted user relationship graphStep 2
Find the local maximum topology potential users using hill-climbing algorithm with multiple random restartsStep 3
Generate the set of suspicious groups based on the local maximum topology potential users
The algorithm of generating the set of suspicious groups is described as follows.
Algorithm2 mainly includes three parts. The first part (lines 1–15) calculates the topology potential value of each user node. The second part (line 16) finds out all nodes with local maximum topology potential value by using a hill-climbing algorithm with multiple random restarts. The third part (lines 17–23) generates a set of suspicious groups, where every suspicious group expands the group size by calling Algorithm 3.
Algorithm3 is used to judge whether the neighbour of the current node should be included. Since group members are considered one by one, Algorithm 3 is called many times during the generation of a suspicious group.Algorithm 2: Generating the set of suspicious groups.
Input: the weighted user relationship graphG=(V,E,W)Output: the set of suspicious groupsG Set=Source1,Source2,...,Sourcek(the value of k is determined automatically)(1)
for∀i,j∈Vdo(2)
ifwij>0 then(3)
ComputeLFactori,j using (7)(4)
disi,j←1/(LFactori,j ×wij)(5)
else(6)
disi, j←the minimum distance between ui and uj calculated by the Dijkstra algorithm(7)
end if(8)
end for(9)
for∀i,j∈Vdo(10)
modifydisi,j using (8)(11)
end for(13)
for∀u∈Vdo(14)
Computeφu using (9)(15)
end for(16)
Find out all local maximum topology potential vertexesrep1,rep2,...,repkusing a hill-climbing algorithm(17)
for∀repi∈rep1,rep2,...,repkdo(18)
Sourcei←repi(19)
pnode←repi(20)
cnode←repi(21)
call Algorithm 3(22)
end for(23)
returnG Set=Source1,Source2,...,SourcekAlgorithm 3: Local expanding
Input:Dis=disi,jU×U, φu,u∈1,2,...,U, Sourcei, cnode, pnode and σOutput:Sourcei(1)
tem←cnode(2)
TSet←all neighbours of tem(3)
for∀x∈TSetdo(4)
ifx∉Sourcei and φx≤φtem and disxpnode≤⌊3σ/2⌋then(5)
Sourcei←Sourcei∪x(6)
cnode←x(7)
call Algorithm 3(8)
end if(9)
end for


## 3.3. Finding Shilling Groups in the Set of Suspicious Groups

Many features have been proposed based on the individual attack profiles over the past decade. However, the effective detection features for shilling groups are limited. Since there may be a strong lockstep relationship between some normal users, groups of these normal users may be misjudged as shilling groups. In this section, six group behaviour features are proposed at the group level to distinguish shilling groups from normal ones in the set of suspicious groups.First, we extract four group features based on our previous work in Ref. [25]. In Ref. [25], two features, namely, SBT (Similarity of Behaviour Track) and ASTW (Average Similarity of Time window) are discussed, which can reflect the behaviour differences in user interest preference between genuine users and attack users. Inspired by these two features, we extract the following four features at the group level.Definition 4.
(group behaviour track similarity (GBTS)). For theith candidate group in GSet, its group behaviour track similarity refers to the average of similarity of user behaviour tracks, which is denoted as GBTSiand calculated by(11)GBTSi=1Sourcei∑u∈SourceiSBTu,where Sourceiis the user set of giand SBTu represents the behaviour track similarity of u.Definition 5.
(group behaviour track fluctuation (GBTF)). For theith candidate group in GSet, its group behaviour track fluctuation refers to the dispersion degree of behaviour track similarity of all users in the group, which is denoted as GBTFi and calculated by(12)GBTFi=1Sourcei−1∑u∈SourceiSBTu−GBTSi2.Definition 6.
(group behaviour window similarity (GBWS)). For theith candidate group in GSet, its group behaviour window similarity refers to the average window similarity of all users in the group, which is denoted as GBWSi and calculated by(13)GBWSi=1Sourcei∑u∈SourceiASTWu,where ASTWu denotes the average of time window similarity of user u inSourcei.Definition 7.
(group behaviour window fluctuation (GBWF)). For theith candidate group in GSet, its group behaviour window fluctuation refers to the dispersion degree of window fluctuation of all users in the group, which is denoted as GBWFi and calculated by(14)GBWFi=1Sourcei−1∑u∈SourceiASTWu−GBWSi2.
Next, we further extract two new features of shilling groups based on attack intention. In recommender systems, members of a shilling group work together to promote or demote the recommendation of a few target items. In order to influence as many genuine users as possible, each member in the shilling group randomly selects some items as filler items. Moreover, in view of attack cost and attack intention, target items for push attacks are usually nonpopular items, while attackers mounting nuke attacks prefer to attack popular items with a large number of high ratings.Definition 8.
(group attack intention (GAI)). For theith candidate group in GSet, its group attack intention refers to the average suspicious degree of all target items, which is denoted as GAIi and calculated by(15)GAIi=1Targeti∑p∈Targeti∑u∈SourceiFu,p∑u′∈UFu′,p,where Fu,pdenotes an indicator function. Fu,p=1 if user u in Sourcei has rated item p with an abnormal rating; otherwise, Fu,p=0.Definition 9.
(group behaviour dissimilarity on nontarget items (GBDN)). For theith candidate group in GSet, its group behaviour dissimilarity on nontarget items refers to the average dissimilarity degree on all nontarget items between members in Sourcei, which is denoted as GBDNi and calculated by(16)GBDNi=1−1Sourcei2∑u,v∈SourceiNTSimu,v,where NTSimu,v denotes the similarity degree on all nontarget items between users u and v. In this work, we use cosine similarity formula to calculate the similarity degree.
To illustrate the effectiveness of the extracted group features, we useGSAGenlRan and GSAGenlAvg to generate 10 shilling groups on the Netflix dataset, which contains 128 attack users. Next, we find out all suspicious groups via Algorithm 2. More details of the suspicious groups are shown in Table 4. It can be seen from Table 4 that 17 suspicious groups are discovered by Algorithm 2. In these groups, the first seven groups contain many genuine users and few attackers while the other groups only consist of attack users. As shown in Table 4, the difference between genuine groups and shilling groups in each extracted feature is significant.
Based on the above discussion, for theith group in GSet, a vector of group features can be constructed and denoted by gfvi= (GBTSi, GBTFi, GBWSi, GBWFi, GAIi, GBDNi). As there is high similarity in group features between shilling groups, we can distinguish shilling groups from normal groups in the set of suspicious groups by using the k-means clustering algorithm.
The algorithm for detecting shilling groups is described as Algorithm4, which mainly includes two parts. The first part (Lines 1–8) calculates six group features. The second part (Lines 9–14) divides all suspicious groups into two parts by using the k-means clustering algorithm. The suspicious groups in the larger cluster are regarded as shilling ones.Algorithm 4: Detecting shilling groups.
Input: time matrixT, rating matrix R, and the set of suspicious groups GSet=g1,g2,...,gkOutput: the set of shilling groups(1)
for∀gi∈GSetdo(2)
Calculate the value of GBTSi using (11)(3)
Calculate the value of GBTFi using (12)(4)
Calculate the value of GBWSi using (13)(5)
Calculate the value of GBWFi using (14)(6)
Calculate the value of GAIi using (15)(7)
Calculate the value of GBDNi using (16)(8)
end for(9)
[C1, C2] ←divide the set of suspicious groups into two clusters by using the k-means algorithm(10)
ifC1>C2then(11)
returnC1(12)
else(13)
returnC2(14)
end ifTable 4
Group features of each group in the set of suspicious groups on the Netflix dataset.
Group IDAre all members attackers in the group?Group sizeGBTSGBTFGBWSGBWFGAIGBDN1No30.28130.02200.79950.04380.00980.64332No2020.26550.02040.60620.10570.01020.94213No40.40970.07790.62390.17300.02370.66974No1890.29790.05010.54870.14860.18350.76715No40.27900.01280.79700.06310.03880.66716No40.31570.03350.74590.10360.00780.67107No30.35870.08510.82430.03410.00870.61978Yes120.27160.00760.33520.04430.67500.89319Yes130.27230.00920.34210.03620.63500.901110Yes140.27160.01040.31830.03390.70620.907911Yes130.27190.00770.31050.03100.73360.901512Yes130.27260.01470.32590.02980.62310.899113Yes130.26880.00840.32150.03400.71550.899414Yes130.26960.00780.33640.03010.73610.900215Yes120.27200.00970.34600.03070.82310.894216Yes120.27270.00990.33370.04140.68640.891617Yes130.27750.01030.32580.02900.72560.9013


## 4. Experiments and Evaluation

### 4.1. Experimental Datasets and Settings

To evaluate the effectiveness of the proposed method, we use the following two datasets as the experimental data:(1)
The Netflix dataset (this dataset was published to support participants in the Netflix prize (http://netflixprize.com)): this dataset is a contest dataset including 103,297,638 rating records from 480,186 users on 17,770 items. Each rating record is a four-tuple of user id, item id, rating, and timestamp. All ratings are integers between 1 and 5, where 5 and 1 denote most liked and most disliked, respectively. We randomly sampled 215,884 records on 4,000 items by 2000 users between January 2000 and December 2005. Similar to the previous work of shilling attack detection in recommender systems, all profiles on this dataset are viewed as genuine ones. Shilling groups are generated by GSAGenlRan (or GSAGenlAvg) and injected into the sampled dataset to construct a synthetic experimental dataset. The size of a shilling group is affected by the filler size and the input attack size in random (or average) attack, where the profile size in a shilling group equals the filler size and the number of profiles in a shilling group is usually much lower than the attack size. In the experiments, the input attack size is 20%, and the filler size is 2% and 3% in random (or average) attack, respectively. For each experiment, we generate 10 shilling groups with the same filler size. Each shilling group randomly selects five target items and each group member at least attacks 3 of 5 target items. The timestamp of each injected attack profile is randomly generated within a short period (e.g., 30 days in this paper). All attackers in each shilling group aim to push the target items. To make the results more accurate, we repeat the experiment 10 times. All experimental results are the average results of 10 experiments. More details of shilling groups injected in the experiments are shown in Table 5.For ease of description, shilling groups generated under the condition of filler size 3% and 2% are denoted as loosely coupled shilling groups and tightly coupled shilling groups, respectively. As shown in Table4, the group size of a tightly coupled shilling group is larger than that of a loosely coupled shilling group.(2)
The sampled Amazon review dataset: this dataset contains 1,205,125 rating records on 136,785 items by 645,072 users. Every rating is an integer and on a scale of one to five, where 1 and 5 represent the most disliked and liked, respectively. For the purpose of experimental evaluation, a sampled Amazon review dataset is obtained based on those labelled reviewers [36], which includes 53,777 rating records from 5055 users on 17,610 items. In the experiment, we filter out those users whose number of ratings is less than 5.Table 5
Total size of ten shilling groups generated and injected into the Netflix dataset in ten experiments.
Profile size in a shilling group (%)Total size of ten shilling groups in ten experiments31221301181201231231301251331232190197189210200195195205204195


### 4.2. Evaluation Metrics

For the Netflix dataset, we have the ground truth information about the shilling groups because the injected shilling groups are generated by using group attack models proposed in Ref. [7]. For the sampled Amazon dataset, we have no ground truth information of shilling groups, e.g., the number of shilling groups, the size, the relationship between attack users and shilling groups, and so on. To evaluate the detection performance of TP-GBF and compare it with the existing detection methods, we first identify shilling groups and then calculate the number of attack users correctly detected and the number of genuine users misclassified as attack ones. The evaluation metrics are precision, recall, and F1-measure, which are defined as follows:(17)precision=TPTP+FP,recall=TPP,F1−measure=2∗precision∗recallprecision+recall,where P denotes the total number of attack users, TP represents the number of attack users correctly detected, and FP refers to the number of genuine users misclassified as attack ones.


### 4.3. Experimental Results and Analysis

To verify the detection performance of the proposed method, we take the following four methods as baselines.(1)
DeR-TIA [28]: an unsupervised method for detecting group attack profiles in recommender systems, which detects attack users by using clustering algorithm and target item analysis. In our experiments, the threshold for determining a target item is set to 6.(2)
CBS (catch the black sheep: unified framework for shilling attack detection based on fraudulent action propagation, CBS for short) [21]: an unsupervised method for detecting attack profiles in recommender systems, which calculates the spam probability of each user and each item iteratively, and detects attackers with the ranking of spam probability. In the experiments on two datasets, the number of attack users is assumed to be known in advance. In the experiments on the Netflix dataset, the detection result is the average result of top-k1(k1 = k − 20), top-k, and top-k2(k2 = k + 20), where k denotes the total number of attackers and 10% attack users are randomly selected as the candidate seeds. In the experiments on the Amazon dataset, the number of candidate seeds is set to 50 and the detection result is the average result of top-k1(k1 = k − 50), top-k, and top-k2(k2 = k + 50), where k denotes the total number of attackers. Considering the randomness of seed selection, each experiment is repeated ten times.(3)
GD-BKM [30]: an unsupervised method for detecting shilling groups in recommender systems, which generates candidate groups by dividing the rating tracks on each item and detects shilling groups by employing the bisecting K-means algorithm based on the suspicious degrees of candidate groups. In the experiments, the parameters K and TIL are set to 4 and 30, respectively.(4)
GSBC [33]: an unsupervised method for detecting spammer groups in e-commerce websites, which models spammer groups as biconnected graphs and identifies those groups with their spamicity scores. In the experiments on the Netflix dataset, coreview time window, similarity threshold, MP, and MINSPAM are set to 30, 0.1, 1000, and 0, respectively. In the experiment on the Amazon dataset, coreview time window, similarity threshold, MP, and MINSPAM are set to 30, 0.1, 1000, and 0.49, respectively.(5)
DSA-URB [22]: an unsupervised method based on MTD model and rank algorithm, which calculates the sum of differences of user suspicious degrees in each sliding window to determine the critical point of distinguishing genuine users from attack users. In the experiment, the hyper parameters α and β are set to 0.5 and 0.1, respectively. The number of topics is set to 20 on the Netflix dataset and is set to 10 on the Amazon dataset.(6)
DSA-AURB [25]: an unsupervised method proposed in our previous work, which detects attack profiles by identifying target items with abnormal rating distribution and analysing user behaviour differences between genuine users and attack users. In the experiment, the number of latent topics is set to 20 on the Netflix dataset and is set to 10 on the sampled Amazon dataset.(7)
DCEDM [31]: an unsupervised method for detecting shilling attacks, which extracted the robust graph features by using the stacked denoising autoencoders. In the experiment, the parameter ρ is set to 0.05 and β is set to 0.9. The noise level α is set to 0.7, 0.6, 0.5, 0.4, 0.3, 0.2, and 0.1, respectively.


### 4.4. Parameters’ Selection

The parameter in TP-GBF is the impact factorσ. In this work, we select the optimal impact factor based on potential entropy [37], which reflects the uncertainty of topological potential and is defined as follows:(18)H=−∑i=1UφuiZlogφuiZ,where Z=∑i=1Uφuiis the normalization factor.The smaller the potential entropy is, the smaller the uncertainty of topological potential is. Therefore, the optimal impact factor is calculated based on the minimum potential entropy. Letσop be the optimal impact factor and Hmin be the minimum potential entropy, then the formula is:(19)σop=argminH.Figure3 shows the relationship between σand potential entropy on two datasets.Figure 3
Relationship between parameterσ and potential entropy on Netflix and Amazon datasets.It can be seen from Figure3 that the values of potential entropy initially decrease and then increase with the increasing of σ. On the Netflix dataset, the value of potential entropy reaches the minimum when σ is around 1. On the sampled Amazon dataset, the value of potential entropy reaches the minimum when σ is around 0.47 (2/3). Therefore, we set σ to 1 and 0.47 on the Netflix and sample Amazon datasets, respectively.


### 4.5. Ratio of Remaining Genuine Users and Attack Users on Each Stage

The TP-GBF method consists of three stages for detecting shilling groups. To further illustrate the importance of these stages, we conduct experiments to compare the ratio of the number of remaining genuine (attack) users to the total number of genuine (attack) users before and after the execution of each stage on the Netflix and Amazon datasets. The results are shown in Figure4.Figure 4
Ratio of the number of remaining genuine (attack) users to the total number of genuine (attack) users before and after each stage. (a) Loosely coupled shilling groups on the Netflix dataset. (b) Tightly coupled shilling groups on the Netflix dataset. (c) Shilling groups on the sampled Amazon review dataset.
(a)(b)(c)It can be seen from Figures4(a) and 4(b), on the Netflix dataset, that the ratio of the number of remaining genuine users to the total number of genuine users decreases by about 10% after the first stage with all attack users retained, indicating that some genuine users can be filtered out in this stage but each attack user can be reserved because of having multiple lockstep behaviours. After the execution of stage 2, the ratio of the number of remaining attack users to the total number of attack users slightly decreases but only 20% of genuine users are kept. The reason is that majority of the local maximum potential nodes are attackers and most genuine users are beyond the impact scale of these nodes in the weighted user relationship graph. After the execution of stage 3, the ratio of the number of remaining genuine users to the total number of genuine users reaches zero and that of attack users is about 100%. These results indicate that each stage of TP-GBF plays an important part in detecting group shilling attacks on the Netflix dataset.As shown in Figure4(c), on the sampled Amazon dataset, a small number of genuine users and attack users may be filtered in the first stage. This is because the sampled Amazon review dataset is very sparse and some users (both genuine and attack users) only rate a few items. After the execution of stage 2, the ratio of the number of remaining genuine users to the total number of genuine users is below 20% and the ratio of the number of remaining attack users to the total number of attack users is over 80%, indicating that most genuine users and some attackers are filtered out. The reason is that the group size of some shilling groups in this dataset is too small. After the execution of stage 3, the ratio of the number of remaining genuine users to the total number of genuine users drops below 5% and that of attack users remains over 60%. These results show that each stage of TP-GBF contributes to the detection of group shilling attacks on the sampled Amazon dataset.


### 4.6. Comparison of Detection Results on the Netflix Dataset

Table6 shows the detection results of eight methods on the Netflix dataset. As listed in Table 6, on the Netflix dataset, both the precision and the recall of DeR-TIA are zero, indicating that DeR-TIA cannot detect shilling groups in this dataset. This is because DeR-TIA is designed to detect shilling groups with high similarity. However, the shilling group generated by the group shilling attack model in Ref. [7] shows low similarity between group members, which causes DeR-TIA to fail. When detecting loosely coupled shilling groups on the Netflix dataset, the precision, recall, and F1-measure of CBS are 0.4221, 0.3758, and 0.3976, respectively. The precision, recall, and F1-measure of CBS for detecting tightly coupled shilling groups are 0.4899, 0.4888, and 0.4893, respectively. In the experiments, the ratio of candidate seeds to the total number of attackers is 10%. As the number of candidate seeds is limited, the detection performance of CBS is not good. Moreover, these results also indicate that CBS can obtain better detection performance when there exists a stronger relation between group members. For GSBS, it is ineffective in detecting both loosely coupled and tightly coupled shilling groups on the Netflix dataset. The reason is that the number of target items for each shilling group is small on the Netflix dataset. For DSA-URB, under loosely coupled shilling groups, the precision, recall, and F1-measure are 0.8516, 0.8195, and 0.8352, respectively. For tightly coupled shilling groups, the precision, recall, and F1-measure of DSA-URB are 0.9492, 0.8578, and 0.9012, respectively. The precision of DSA-AURB is better than that of DeR-TIA, CBS, DSA-URB, and DCEDM for detecting two types of shilling groups, but its recall is only 0.8033 when detecting loosely coupled shilling groups. That is because DSA-AURB may omit some target items with a few ratings. For DCEDM, the precision, recall, and F1-measure are 0.8784, 0.9898, and 0.9308, respectively, indicating that DCEDM has very high recall in detecting tightly coupled shilling groups. However, the precision of DCEDM is low when detecting loosely coupled shilling groups. The reason is that DCEDM may divide some genuine users and attack users into a community when detecting loosely coupled shilling groups. The precision, recall, and F1-measure of GD-BKM for detecting loosely coupled shilling groups are 0.9734, 0.9888, and 0.9810, respectively. Under tightly coupled shilling groups, the precision, recall, and F1-measure of GD-BKM are 0.9823, 0.9961, and 0.9892, respectively. These results indicate that GD-BKM can achieve excellent detection performance on the Netflix dataset under group shilling attacks. The reason is that GD-BKM can detect various attackers based on abnormal items with larger number of ratings even if the attackers have a few corated target items. However, the detection precision and F1-measure are still inferior to that of TP-GBF. The precision, recall, and F1-measure of TP-GBF for detecting loosely coupled shilling groups are 0.9903, 0.9983, and 0.9943, respectively. The precision, recall, and F1-measure of TP-GBF for detecting tightly coupled shilling groups are 0.9968, 0.9908, and 0.9938, respectively. These results show that TP-GBF is effective and outperforms seven baseline methods in precision and F1-measure when detecting group shilling attacks on the Netflix dataset.Table 6
Comparison of detection performance for five methods in detecting group attacks on the Netflix dataset.
Injected shilling groupsMethodPrecisionRecallF1-measureLoosely coupled shilling groupsDeR-TIA000CBS0.42210.37580.3976GD-BKM0.97340.98880.9810GSBC000DSA-URB0.85160.81950.8352DSA-AURB0.98000.80330.8829DCEDM0.59700.92310.7251TP-GBF0.99030.99830.9943Tightly coupled shilling groupsDeR-TIA000CBS0.48990.48880.4893GD-BKM0.98230.99610.9892GSBC000DSA-URB0.94920.85780.9012DSA-AURB0.95950.94560.9504DCEDM0.87840.98980.9308TP-GBF0.99680.99080.9938


### 4.7. Comparison of Detection Results on the Sampled Amazon Dataset

Figure5 shows the detection results of eight methods on the sampled Amazon dataset. As seen from Figure 5, on the sampled Amazon dataset, the detection performance of TP-GBF is the best among five methods in detecting group shilling attacks. The precision, recall, and F1-measure of DeR-TIA are 0.3251, 0.0607, and 0.1023, respectively. These results indicate that DeR-TIA can detect a few of the shilling groups correctly, but its recall is too low. The reason is that the sampled Amazon dataset is very sparse and behaviours of shilling groups on this dataset are varied. The precision, recall, and F1-measure of CBS are 0.6473, 0.6471, and 0.6472, respectively, indicating that CBS is effective for detecting group shilling attacks on the sampled Amazon dataset. Although 50 attackers are selected as the seeds, the detection performance of CBS is still inferior to that of TP-GBF. The precision, recall, and F1-measure of GD-BKM are 0.823, 0.673, and 0.74, respectively. Its recall is a little higher than that of TP-GBF, but its precision is much lower than that of TP-GBF, indicating that GD-BKM may misclassify some genuine groups. The precision of GSBC is 0.8409 but its recall is only 0.1146, indicating that many shilling groups cannot be detected by GSBC on the sampled Amazon dataset. This is because shilling groups with a few target items are usually filtered out by GSBC. The precision, recall, and F1-measure of DSA-URB are 0.9069, 0.3817, and 0.5373, respectively, indicating that this method is not effective for detecting group attacks on the sampled Amazon dataset. The reason is that the dataset is too sparse and a number of users only have a few ratings. The recall of DSA-AURB is very high but its precision is less than 0.4, indicating that a number of genuine users are identified as attackers on the Amazon dataset by DSA-AURB. On the sampled Amazon dataset, the precision and recall of DCEDM are 0.8601 and 0.7177, respectively, indicating that DCEDM is very effective for detecting attack groups. The reason is that the attackers in a shilling group usually have a tight relationship with each other on this dataset. The precision, recall, and F1-measure of TP-GBF are 0.9283, 0.6467, and 0.7623, respectively. This means TP-GBF not only can detect shilling groups accurately but also can also discover most of the shilling groups on the sampled Amazon dataset. Although the F1-measure of TP-GBF is slightly lower than the maximum F1-measure of all methods, its precision outperforms that of all baseline methods on the sampled Amazon dataset. These results indicate that TP-GBF is effective for detecting group shilling attacks on the sampled Amazon dataset.Figure 5
Comparison of the detection performance for eight methods on the sampled Amazon dataset.


### 4.8. Comparison of the Prediction Shift before and after Using TP-GBF

To illustrate the practical application of TP-GBF, we use the average prediction shift (ps) to measure the effects of using TP-GBF on the Netflix dataset, which is defined as follows [38]:(20)ps=1Tar⋅1U⋅∑i∈Tar∑u∈Upu,i'−pu,i,where Tar and U indicate target items set and user set,pu,i' and pu,i are the pre- and post-detection predictions of user u on target item i, respectively.We calculate predictions by using basic matrix factorization algorithm and divide the experimental data on a scale of 80% a training set and 20% a test set. All target items are pushed items with a few number of low ratings from genuine users. Figure6 shows the comparision of ps before and after using TP-GBF. As seen in Figure 6, the ps values are 1.0196 and 0.0798 before and after using TP-GBF under attack with loosely coupled shilling groups, and the ps values are 2.1551 and 0.089 before and after using TP-GBF under attack with tightly coupled shilling groups. These results indicate that TP-GBF is very helpful to reduce the influence of group shilling attacks on the Netflix dataset.Figure 6
Comparison of the prediction shift before and after using TP-GBF.


### 4.9. A Case Study on User Satisfaction with Item Recommendation Lists

To illustrate whether TP-GBF can help to improve user satisfaction, we compare users’ recommendation lists before and after group shilling attack detection on the Netflix dataset. We useGSAGenl Ran to generate ten loosely coupled shilling groups that include 119 attackers and inject into the Netflix dataset. The profile size in a shilling group is 3%. Each shilling group randomly selects five target items and each group member at least rates 3 of 5 target items with the maximum rating. The timestamp of each injected attack profile is randomly generated within 30 days. We use a matrix factorization-based collaborative filtering recommendation algorithm to generate an item recommendation list for each user. Table 7 presents the recommendation lists of ten users, where the bold items indicate target items.Table 7
Recommendation lists of ten users before and after group shilling attack detection.
UsersRecommendation listsBefore group shilling attack detectionAfter using TP-GBFu10i2925, i857, i3794, i2726, i2772, i64, i3680, i2907, i2826, i3501i857, i2907, i64, i1322, i1440, i1870, i2289, i3389, i3784, i1799u205i2925, i2726, i3514, i857, i960, i445, i1001, i3328, i885, i1322i2541, i1065, i445, i2648, i3631, i3328, i1263, i862, i1075, i2843u385i2925, i857, i1597, i3794, i2726, i3241, i1398, i3501, i1001, i1263i1597, i1381, i2436, i3389, i1263, i1065, i2748, i12, i188, i2607u764i2925, i1263, i1234, i3939, i3794, i3631, i3687, i1163, i2843, i1075i2362, i1263, i2436, i2474, i1157, i1883, i3039, i1373, i2926, i2772u853i2925, i857, i3680, i2772, i3794, i2726, i2907, i1398, i1860, i3235i2590, i2165, i3715, i2218, i1163, i1014, i1860, i3803, i2648, i575u1093i2925, i857, i3328, i2726, i1398, i2907, i3794, i3680, i3501, i3687i1263, i2436, i2772, i2648, i2176, i3328, i2617, i1322, i1932, i3124u1649i2925, i857, i2726, i2590, i3680, i2772, i3794, i3687, i2907, i1263i2436, i2617, i445, i1065, i2362, i3328, i1014, i1622, i1234, i2343u1673i2925, i857, i2726, i1398, i3680, i1831, i2907, i3794, i3241, i2436i3278, i3374, i1102, i2244, i2610, i3427, i2744, i518, i3505, i2042u1708i857, i2925, i2590, i1263, i2826, i2726, i1014, i2772, i1001, i1404i857, i1322, i2772, i2436, i1263, i3241, i1597, i3278, i2907, i3015u1991i3720, i2362, i1263, i2925, i3784, i2218, i1014, i857, i3687, i2726i2436, i3720, i2474, i2772, i2218, i3631, i1263, i857, i2362, i2617As listed in Table7, the recommendation lists generated for the same user are quite different before and after group shilling attack detection. Before group shilling attack detection, each user’s recommendation list contains at least two target items, which means that the group shilling attacks have a strong influence on the recommendation lists of ten users. After detecting group shilling attacks using TP-GBF, no target items appear in the recommendation lists of ten users, indicating that the recommendation algorithm does not recommend target items to the ten users. By analysing the recommendation lists of the ten users after detecting group shilling attacks using TP-GBF, we found that these users always give high score (i.e., 4 or 5) to the corresponding recommended items, which indicates that the users like the recommended items. Therefore, we can conclude that TP-GBF can help to improve user satisfaction when facing group shilling attacks in recommender systems.


## 4.1. Experimental Datasets and Settings

To evaluate the effectiveness of the proposed method, we use the following two datasets as the experimental data:(1)
The Netflix dataset (this dataset was published to support participants in the Netflix prize (http://netflixprize.com)): this dataset is a contest dataset including 103,297,638 rating records from 480,186 users on 17,770 items. Each rating record is a four-tuple of user id, item id, rating, and timestamp. All ratings are integers between 1 and 5, where 5 and 1 denote most liked and most disliked, respectively. We randomly sampled 215,884 records on 4,000 items by 2000 users between January 2000 and December 2005. Similar to the previous work of shilling attack detection in recommender systems, all profiles on this dataset are viewed as genuine ones. Shilling groups are generated by GSAGenlRan (or GSAGenlAvg) and injected into the sampled dataset to construct a synthetic experimental dataset. The size of a shilling group is affected by the filler size and the input attack size in random (or average) attack, where the profile size in a shilling group equals the filler size and the number of profiles in a shilling group is usually much lower than the attack size. In the experiments, the input attack size is 20%, and the filler size is 2% and 3% in random (or average) attack, respectively. For each experiment, we generate 10 shilling groups with the same filler size. Each shilling group randomly selects five target items and each group member at least attacks 3 of 5 target items. The timestamp of each injected attack profile is randomly generated within a short period (e.g., 30 days in this paper). All attackers in each shilling group aim to push the target items. To make the results more accurate, we repeat the experiment 10 times. All experimental results are the average results of 10 experiments. More details of shilling groups injected in the experiments are shown in Table 5.For ease of description, shilling groups generated under the condition of filler size 3% and 2% are denoted as loosely coupled shilling groups and tightly coupled shilling groups, respectively. As shown in Table4, the group size of a tightly coupled shilling group is larger than that of a loosely coupled shilling group.(2)
The sampled Amazon review dataset: this dataset contains 1,205,125 rating records on 136,785 items by 645,072 users. Every rating is an integer and on a scale of one to five, where 1 and 5 represent the most disliked and liked, respectively. For the purpose of experimental evaluation, a sampled Amazon review dataset is obtained based on those labelled reviewers [36], which includes 53,777 rating records from 5055 users on 17,610 items. In the experiment, we filter out those users whose number of ratings is less than 5.Table 5
Total size of ten shilling groups generated and injected into the Netflix dataset in ten experiments.
Profile size in a shilling group (%)Total size of ten shilling groups in ten experiments31221301181201231231301251331232190197189210200195195205204195


## 4.2. Evaluation Metrics

For the Netflix dataset, we have the ground truth information about the shilling groups because the injected shilling groups are generated by using group attack models proposed in Ref. [7]. For the sampled Amazon dataset, we have no ground truth information of shilling groups, e.g., the number of shilling groups, the size, the relationship between attack users and shilling groups, and so on. To evaluate the detection performance of TP-GBF and compare it with the existing detection methods, we first identify shilling groups and then calculate the number of attack users correctly detected and the number of genuine users misclassified as attack ones. The evaluation metrics are precision, recall, and F1-measure, which are defined as follows:(17)precision=TPTP+FP,recall=TPP,F1−measure=2∗precision∗recallprecision+recall,where P denotes the total number of attack users, TP represents the number of attack users correctly detected, and FP refers to the number of genuine users misclassified as attack ones.


## 4.3. Experimental Results and Analysis

To verify the detection performance of the proposed method, we take the following four methods as baselines.(1)
DeR-TIA [28]: an unsupervised method for detecting group attack profiles in recommender systems, which detects attack users by using clustering algorithm and target item analysis. In our experiments, the threshold for determining a target item is set to 6.(2)
CBS (catch the black sheep: unified framework for shilling attack detection based on fraudulent action propagation, CBS for short) [21]: an unsupervised method for detecting attack profiles in recommender systems, which calculates the spam probability of each user and each item iteratively, and detects attackers with the ranking of spam probability. In the experiments on two datasets, the number of attack users is assumed to be known in advance. In the experiments on the Netflix dataset, the detection result is the average result of top-k1(k1 = k − 20), top-k, and top-k2(k2 = k + 20), where k denotes the total number of attackers and 10% attack users are randomly selected as the candidate seeds. In the experiments on the Amazon dataset, the number of candidate seeds is set to 50 and the detection result is the average result of top-k1(k1 = k − 50), top-k, and top-k2(k2 = k + 50), where k denotes the total number of attackers. Considering the randomness of seed selection, each experiment is repeated ten times.(3)
GD-BKM [30]: an unsupervised method for detecting shilling groups in recommender systems, which generates candidate groups by dividing the rating tracks on each item and detects shilling groups by employing the bisecting K-means algorithm based on the suspicious degrees of candidate groups. In the experiments, the parameters K and TIL are set to 4 and 30, respectively.(4)
GSBC [33]: an unsupervised method for detecting spammer groups in e-commerce websites, which models spammer groups as biconnected graphs and identifies those groups with their spamicity scores. In the experiments on the Netflix dataset, coreview time window, similarity threshold, MP, and MINSPAM are set to 30, 0.1, 1000, and 0, respectively. In the experiment on the Amazon dataset, coreview time window, similarity threshold, MP, and MINSPAM are set to 30, 0.1, 1000, and 0.49, respectively.(5)
DSA-URB [22]: an unsupervised method based on MTD model and rank algorithm, which calculates the sum of differences of user suspicious degrees in each sliding window to determine the critical point of distinguishing genuine users from attack users. In the experiment, the hyper parameters α and β are set to 0.5 and 0.1, respectively. The number of topics is set to 20 on the Netflix dataset and is set to 10 on the Amazon dataset.(6)
DSA-AURB [25]: an unsupervised method proposed in our previous work, which detects attack profiles by identifying target items with abnormal rating distribution and analysing user behaviour differences between genuine users and attack users. In the experiment, the number of latent topics is set to 20 on the Netflix dataset and is set to 10 on the sampled Amazon dataset.(7)
DCEDM [31]: an unsupervised method for detecting shilling attacks, which extracted the robust graph features by using the stacked denoising autoencoders. In the experiment, the parameter ρ is set to 0.05 and β is set to 0.9. The noise level α is set to 0.7, 0.6, 0.5, 0.4, 0.3, 0.2, and 0.1, respectively.


## 4.4. Parameters’ Selection

The parameter in TP-GBF is the impact factorσ. In this work, we select the optimal impact factor based on potential entropy [37], which reflects the uncertainty of topological potential and is defined as follows:(18)H=−∑i=1UφuiZlogφuiZ,where Z=∑i=1Uφuiis the normalization factor.The smaller the potential entropy is, the smaller the uncertainty of topological potential is. Therefore, the optimal impact factor is calculated based on the minimum potential entropy. Letσop be the optimal impact factor and Hmin be the minimum potential entropy, then the formula is:(19)σop=argminH.Figure3 shows the relationship between σand potential entropy on two datasets.Figure 3
Relationship between parameterσ and potential entropy on Netflix and Amazon datasets.It can be seen from Figure3 that the values of potential entropy initially decrease and then increase with the increasing of σ. On the Netflix dataset, the value of potential entropy reaches the minimum when σ is around 1. On the sampled Amazon dataset, the value of potential entropy reaches the minimum when σ is around 0.47 (2/3). Therefore, we set σ to 1 and 0.47 on the Netflix and sample Amazon datasets, respectively.


## 4.5. Ratio of Remaining Genuine Users and Attack Users on Each Stage

The TP-GBF method consists of three stages for detecting shilling groups. To further illustrate the importance of these stages, we conduct experiments to compare the ratio of the number of remaining genuine (attack) users to the total number of genuine (attack) users before and after the execution of each stage on the Netflix and Amazon datasets. The results are shown in Figure4.Figure 4
Ratio of the number of remaining genuine (attack) users to the total number of genuine (attack) users before and after each stage. (a) Loosely coupled shilling groups on the Netflix dataset. (b) Tightly coupled shilling groups on the Netflix dataset. (c) Shilling groups on the sampled Amazon review dataset.
(a)(b)(c)It can be seen from Figures4(a) and 4(b), on the Netflix dataset, that the ratio of the number of remaining genuine users to the total number of genuine users decreases by about 10% after the first stage with all attack users retained, indicating that some genuine users can be filtered out in this stage but each attack user can be reserved because of having multiple lockstep behaviours. After the execution of stage 2, the ratio of the number of remaining attack users to the total number of attack users slightly decreases but only 20% of genuine users are kept. The reason is that majority of the local maximum potential nodes are attackers and most genuine users are beyond the impact scale of these nodes in the weighted user relationship graph. After the execution of stage 3, the ratio of the number of remaining genuine users to the total number of genuine users reaches zero and that of attack users is about 100%. These results indicate that each stage of TP-GBF plays an important part in detecting group shilling attacks on the Netflix dataset.As shown in Figure4(c), on the sampled Amazon dataset, a small number of genuine users and attack users may be filtered in the first stage. This is because the sampled Amazon review dataset is very sparse and some users (both genuine and attack users) only rate a few items. After the execution of stage 2, the ratio of the number of remaining genuine users to the total number of genuine users is below 20% and the ratio of the number of remaining attack users to the total number of attack users is over 80%, indicating that most genuine users and some attackers are filtered out. The reason is that the group size of some shilling groups in this dataset is too small. After the execution of stage 3, the ratio of the number of remaining genuine users to the total number of genuine users drops below 5% and that of attack users remains over 60%. These results show that each stage of TP-GBF contributes to the detection of group shilling attacks on the sampled Amazon dataset.


## 4.6. Comparison of Detection Results on the Netflix Dataset

Table6 shows the detection results of eight methods on the Netflix dataset. As listed in Table 6, on the Netflix dataset, both the precision and the recall of DeR-TIA are zero, indicating that DeR-TIA cannot detect shilling groups in this dataset. This is because DeR-TIA is designed to detect shilling groups with high similarity. However, the shilling group generated by the group shilling attack model in Ref. [7] shows low similarity between group members, which causes DeR-TIA to fail. When detecting loosely coupled shilling groups on the Netflix dataset, the precision, recall, and F1-measure of CBS are 0.4221, 0.3758, and 0.3976, respectively. The precision, recall, and F1-measure of CBS for detecting tightly coupled shilling groups are 0.4899, 0.4888, and 0.4893, respectively. In the experiments, the ratio of candidate seeds to the total number of attackers is 10%. As the number of candidate seeds is limited, the detection performance of CBS is not good. Moreover, these results also indicate that CBS can obtain better detection performance when there exists a stronger relation between group members. For GSBS, it is ineffective in detecting both loosely coupled and tightly coupled shilling groups on the Netflix dataset. The reason is that the number of target items for each shilling group is small on the Netflix dataset. For DSA-URB, under loosely coupled shilling groups, the precision, recall, and F1-measure are 0.8516, 0.8195, and 0.8352, respectively. For tightly coupled shilling groups, the precision, recall, and F1-measure of DSA-URB are 0.9492, 0.8578, and 0.9012, respectively. The precision of DSA-AURB is better than that of DeR-TIA, CBS, DSA-URB, and DCEDM for detecting two types of shilling groups, but its recall is only 0.8033 when detecting loosely coupled shilling groups. That is because DSA-AURB may omit some target items with a few ratings. For DCEDM, the precision, recall, and F1-measure are 0.8784, 0.9898, and 0.9308, respectively, indicating that DCEDM has very high recall in detecting tightly coupled shilling groups. However, the precision of DCEDM is low when detecting loosely coupled shilling groups. The reason is that DCEDM may divide some genuine users and attack users into a community when detecting loosely coupled shilling groups. The precision, recall, and F1-measure of GD-BKM for detecting loosely coupled shilling groups are 0.9734, 0.9888, and 0.9810, respectively. Under tightly coupled shilling groups, the precision, recall, and F1-measure of GD-BKM are 0.9823, 0.9961, and 0.9892, respectively. These results indicate that GD-BKM can achieve excellent detection performance on the Netflix dataset under group shilling attacks. The reason is that GD-BKM can detect various attackers based on abnormal items with larger number of ratings even if the attackers have a few corated target items. However, the detection precision and F1-measure are still inferior to that of TP-GBF. The precision, recall, and F1-measure of TP-GBF for detecting loosely coupled shilling groups are 0.9903, 0.9983, and 0.9943, respectively. The precision, recall, and F1-measure of TP-GBF for detecting tightly coupled shilling groups are 0.9968, 0.9908, and 0.9938, respectively. These results show that TP-GBF is effective and outperforms seven baseline methods in precision and F1-measure when detecting group shilling attacks on the Netflix dataset.Table 6
Comparison of detection performance for five methods in detecting group attacks on the Netflix dataset.
Injected shilling groupsMethodPrecisionRecallF1-measureLoosely coupled shilling groupsDeR-TIA000CBS0.42210.37580.3976GD-BKM0.97340.98880.9810GSBC000DSA-URB0.85160.81950.8352DSA-AURB0.98000.80330.8829DCEDM0.59700.92310.7251TP-GBF0.99030.99830.9943Tightly coupled shilling groupsDeR-TIA000CBS0.48990.48880.4893GD-BKM0.98230.99610.9892GSBC000DSA-URB0.94920.85780.9012DSA-AURB0.95950.94560.9504DCEDM0.87840.98980.9308TP-GBF0.99680.99080.9938


## 4.7. Comparison of Detection Results on the Sampled Amazon Dataset

Figure5 shows the detection results of eight methods on the sampled Amazon dataset. As seen from Figure 5, on the sampled Amazon dataset, the detection performance of TP-GBF is the best among five methods in detecting group shilling attacks. The precision, recall, and F1-measure of DeR-TIA are 0.3251, 0.0607, and 0.1023, respectively. These results indicate that DeR-TIA can detect a few of the shilling groups correctly, but its recall is too low. The reason is that the sampled Amazon dataset is very sparse and behaviours of shilling groups on this dataset are varied. The precision, recall, and F1-measure of CBS are 0.6473, 0.6471, and 0.6472, respectively, indicating that CBS is effective for detecting group shilling attacks on the sampled Amazon dataset. Although 50 attackers are selected as the seeds, the detection performance of CBS is still inferior to that of TP-GBF. The precision, recall, and F1-measure of GD-BKM are 0.823, 0.673, and 0.74, respectively. Its recall is a little higher than that of TP-GBF, but its precision is much lower than that of TP-GBF, indicating that GD-BKM may misclassify some genuine groups. The precision of GSBC is 0.8409 but its recall is only 0.1146, indicating that many shilling groups cannot be detected by GSBC on the sampled Amazon dataset. This is because shilling groups with a few target items are usually filtered out by GSBC. The precision, recall, and F1-measure of DSA-URB are 0.9069, 0.3817, and 0.5373, respectively, indicating that this method is not effective for detecting group attacks on the sampled Amazon dataset. The reason is that the dataset is too sparse and a number of users only have a few ratings. The recall of DSA-AURB is very high but its precision is less than 0.4, indicating that a number of genuine users are identified as attackers on the Amazon dataset by DSA-AURB. On the sampled Amazon dataset, the precision and recall of DCEDM are 0.8601 and 0.7177, respectively, indicating that DCEDM is very effective for detecting attack groups. The reason is that the attackers in a shilling group usually have a tight relationship with each other on this dataset. The precision, recall, and F1-measure of TP-GBF are 0.9283, 0.6467, and 0.7623, respectively. This means TP-GBF not only can detect shilling groups accurately but also can also discover most of the shilling groups on the sampled Amazon dataset. Although the F1-measure of TP-GBF is slightly lower than the maximum F1-measure of all methods, its precision outperforms that of all baseline methods on the sampled Amazon dataset. These results indicate that TP-GBF is effective for detecting group shilling attacks on the sampled Amazon dataset.Figure 5
Comparison of the detection performance for eight methods on the sampled Amazon dataset.


## 4.8. Comparison of the Prediction Shift before and after Using TP-GBF

To illustrate the practical application of TP-GBF, we use the average prediction shift (ps) to measure the effects of using TP-GBF on the Netflix dataset, which is defined as follows [38]:(20)ps=1Tar⋅1U⋅∑i∈Tar∑u∈Upu,i'−pu,i,where Tar and U indicate target items set and user set,pu,i' and pu,i are the pre- and post-detection predictions of user u on target item i, respectively.We calculate predictions by using basic matrix factorization algorithm and divide the experimental data on a scale of 80% a training set and 20% a test set. All target items are pushed items with a few number of low ratings from genuine users. Figure6 shows the comparision of ps before and after using TP-GBF. As seen in Figure 6, the ps values are 1.0196 and 0.0798 before and after using TP-GBF under attack with loosely coupled shilling groups, and the ps values are 2.1551 and 0.089 before and after using TP-GBF under attack with tightly coupled shilling groups. These results indicate that TP-GBF is very helpful to reduce the influence of group shilling attacks on the Netflix dataset.Figure 6
Comparison of the prediction shift before and after using TP-GBF.


## 4.9. A Case Study on User Satisfaction with Item Recommendation Lists

To illustrate whether TP-GBF can help to improve user satisfaction, we compare users’ recommendation lists before and after group shilling attack detection on the Netflix dataset. We useGSAGenl Ran to generate ten loosely coupled shilling groups that include 119 attackers and inject into the Netflix dataset. The profile size in a shilling group is 3%. Each shilling group randomly selects five target items and each group member at least rates 3 of 5 target items with the maximum rating. The timestamp of each injected attack profile is randomly generated within 30 days. We use a matrix factorization-based collaborative filtering recommendation algorithm to generate an item recommendation list for each user. Table 7 presents the recommendation lists of ten users, where the bold items indicate target items.Table 7
Recommendation lists of ten users before and after group shilling attack detection.
UsersRecommendation listsBefore group shilling attack detectionAfter using TP-GBFu10i2925, i857, i3794, i2726, i2772, i64, i3680, i2907, i2826, i3501i857, i2907, i64, i1322, i1440, i1870, i2289, i3389, i3784, i1799u205i2925, i2726, i3514, i857, i960, i445, i1001, i3328, i885, i1322i2541, i1065, i445, i2648, i3631, i3328, i1263, i862, i1075, i2843u385i2925, i857, i1597, i3794, i2726, i3241, i1398, i3501, i1001, i1263i1597, i1381, i2436, i3389, i1263, i1065, i2748, i12, i188, i2607u764i2925, i1263, i1234, i3939, i3794, i3631, i3687, i1163, i2843, i1075i2362, i1263, i2436, i2474, i1157, i1883, i3039, i1373, i2926, i2772u853i2925, i857, i3680, i2772, i3794, i2726, i2907, i1398, i1860, i3235i2590, i2165, i3715, i2218, i1163, i1014, i1860, i3803, i2648, i575u1093i2925, i857, i3328, i2726, i1398, i2907, i3794, i3680, i3501, i3687i1263, i2436, i2772, i2648, i2176, i3328, i2617, i1322, i1932, i3124u1649i2925, i857, i2726, i2590, i3680, i2772, i3794, i3687, i2907, i1263i2436, i2617, i445, i1065, i2362, i3328, i1014, i1622, i1234, i2343u1673i2925, i857, i2726, i1398, i3680, i1831, i2907, i3794, i3241, i2436i3278, i3374, i1102, i2244, i2610, i3427, i2744, i518, i3505, i2042u1708i857, i2925, i2590, i1263, i2826, i2726, i1014, i2772, i1001, i1404i857, i1322, i2772, i2436, i1263, i3241, i1597, i3278, i2907, i3015u1991i3720, i2362, i1263, i2925, i3784, i2218, i1014, i857, i3687, i2726i2436, i3720, i2474, i2772, i2218, i3631, i1263, i857, i2362, i2617As listed in Table7, the recommendation lists generated for the same user are quite different before and after group shilling attack detection. Before group shilling attack detection, each user’s recommendation list contains at least two target items, which means that the group shilling attacks have a strong influence on the recommendation lists of ten users. After detecting group shilling attacks using TP-GBF, no target items appear in the recommendation lists of ten users, indicating that the recommendation algorithm does not recommend target items to the ten users. By analysing the recommendation lists of the ten users after detecting group shilling attacks using TP-GBF, we found that these users always give high score (i.e., 4 or 5) to the corresponding recommended items, which indicates that the users like the recommended items. Therefore, we can conclude that TP-GBF can help to improve user satisfaction when facing group shilling attacks in recommender systems.


## 5. Conclusions and Future Work

Compared with traditional shilling attacks in recommender systems, group shilling attacks are more harmful and much harder to detect. To improve the detection performance and minimize the impact of group shilling attacks on recommender systems, we present a three-stage group shilling attack detection method based on lockstep behaviour and group behaviour features. We propose a method of calculating collusive degree between users based on lockstep behaviour and transitivity of direct relations, based on which a weighted user relationship graph is constructed. We calculate the topology potential for each user node in the weighted user relationship graph and find out all suspicious groups by local maximum potential nodes. We propose six group behaviour features to characterize the differences between shilling groups and normal ones in the set of suspicious groups, and devise ak-means clustering-based algorithm to detect the shilling groups. The experimental results on the Netflix and Amazon datasets show that TP-GBF is effective for detecting group shilling attacks in recommender systems and outperforms three baseline methods in precision, recall, and F1-measure.The proposed TP-GBF detection method uses thek-means clustering algorithm to partition the set of suspicious groups. As the k-means clustering algorithm is a hard classification method, each suspicious group is regarded as a whole and members of the same group are identified as malicious or genuine users. This hard classification method lacks flexibility, which may misclassify a few attackers who have strong correlation with some genuine users.In our future research, we will improve our method by using the fuzzy soft clustering algorithm and dimensionality reduction techniques on big data [39]. By further analysing the rating behaviours of genuine and attack users under group shilling attacks, we measure the membership degree of each user in the corresponding suspicious group to further improve the detection performance of group shilling attacks in recommender systems.



---

*Source: 2907691-2021-09-27.xml*