# KC-GCN: A Semi-Supervised Detection Model against Various Group Shilling Attacks in Recommender Systems

Authors: Hongyun Cai; Jichao Ren; Jing Zhao; Shilin Yuan; Jie Meng
Journal: Wireless Communications and Mobile Computing
 (2023)

---

## Abstract

Various detection methods have been proposed for defense against group shilling attacks in recommender systems; however, these methods cannot effectively detect attack groups generated based on adversarial attacks (e.g., GOAT) or mixed attack groups. In this study, we propose a two-stage method, called KC-GCN, which is based onk-cliques and graph convolutional networks. First, we construct a user relationship graph, generate suspicious candidate groups, and extract influential users by calculating the user nearest-neighbor similarity. We construct the user relationship graph by calculating the edge weight between any two users through analyzing their similarity over suspicious time intervals on each item. Second, we combine the extracted user initial embeddings and the structural features hidden in the user relationship graph to detect attackers. On the Netflix and sampled Amazon datasets, the detection results of KC-GCN surpass those of the state-of-the-art methods under different types of group shilling attacks. The F1-measure of KC-GCN can reach above 93% and 87% on these two datasets, respectively.


---

## Body

## 1. Introduction

The amount of Internet data is exploding with the rapid development of information technology, consequently leading to the increasingly prominent problem of information overload. By analyzing a user’s historical behavior information, recommender systems can extract user preferences and automatically recommend favorite items or services to users [1–3], which have become an essential component of many online information services, including e-commerce [4, 5], live broadcast platforms [6], personalized travel recommendation systems [7], and Internet of Vehicles wireless systems [8], among many others. However, due to their openness, fraudulent users can create and inject a large number of fake user profiles into recommender systems, which can change recommendation results and reduce user experience. For example, The New York Times and Buzzfeed News have reported that many sellers turned to black hat tactics to drive Amazon sales on their products (https://pattern.com/news/pattern-analysis-on-amazon-star-rating-featured-in-new-york-times-buzzfeed/). In recent years, various types of shilling attack models have been presented, including random attacks [9], average attacks [10], and the latest adversarial attacks [11]. Group shilling attacks have also been proposed to generate a group of attack profiles on the basis of the abovementioned individual shilling attacks [12]. Research on group shilling attacks showed that group attacks greatly affect recommender systems when compared to traditional individual attacks [13, 14] because attack users in the same shilling group collude with each other to attack targets, while each attack profile looks more like a genuine profile [15]. Nowadays, people have become increasingly conscious of the importance of shilling attack governance in recommender systems. Many service platforms, such as Amazon, Tripadvisor, and Taobao, are constantly seeking efficient mechanisms to enhance user experience and satisfaction (https://www.bbc.com/news/business-61154748). Therefore, accurate detection under group shilling attacks has emerged as a crucial problem for the existing recommender system security.In recent years, various detection approaches have been put forward to defend recommender systems from group shilling attacks [16–21]. Most of these methods detect shilling groups based on frequent synchronization behaviors on more than one item or through the analysis of the differences in the rating pattern of genuine and attack users. However, these approaches do not perform well if the group attack profiles are generated and injected based on AOP [9], adversarial attacks, or mixed attacks because all attackers in the same shilling group may not attack identical target items. The injected attack profiles are also diverse and look more like genuine ones under these attacks.To solve the abovementioned constraints, we present herein a two-stage method, called KC-GCN. It is a semi-supervised group shilling attack detection model based onk-cliques and the graph convolutional network (GCN) [22, 23]. First, a user relationship graph is generated, and influential users are extracted using the k-clique algorithm and the user nearest-neighbor similarity on the graph. We construct the user relationship graph by calculating the edge weight between any two users through the analysis of their similarity over suspicious time intervals on each item. Second, we obtain the user initial embeddings and train a GCN-based classifier.The significant contributions of this work are as follows:(1)
We construct a weighted user relationship graph, in which the weight is calculated from the perspectives of user preference, attack intention, and time synchronization, to highlight the user relationship between attack users(2)
We use the multilayer graph convolution network to fuse the initial embedded features extracted from the user rating behavior with the structural features hidden in the user relationship graph to extract more effective detection features(3)
The experiments on the Netflix and Amazon datasets demonstrate that KC-GCN outperforms baseline methods in terms of detecting various types of group shilling attacksThe rest of this paper is structured as follows: Section2 presents the background information and related work, Section 3 provides a detailed description of the proposed detection methodology primarily divided into two sections (i.e., extracting influential users and identifying attack users using the trained semi-supervised classifier), Section 4 provides a comparative analysis of the experimental findings, and Section 5 presents the conclusions.


## 2. Background and Related Work

### 2.1. Group Shilling Attacks

To escape from the existing methods of detecting individual shilling attacks (e.g., random attack, average attack, and AOP attack), Wang et al. [24] proposed two generative models of group shilling attack, called GSAGens and GSAGenl. In these attack models, fake profiles are first generated based on one type of individual shilling attacks. Based on which, group shilling attack profiles are then constructed and injected into a set of genuine profiles. The GSAGens model has more stringent conditions when generating group shilling profiles; hence, the group size under GSAGens is smaller than that under GSAGenl. Considering the attack effect on the target items, we only use GSAGenl to generate the group shilling attack profiles, in which the fake profile includes the selected item set, the filler item set, the target item set, and the unrated item set. More details for the group shilling attacks used in this paper are described as follows:
(1)
GSAGenl Ran: generate loose group attack profiles based on a random attack, where the selected items are null, the filler items are randomly chosen, and only one attacker from the whole group rates the items. The filler item rating is the system mean. The target item rating is set to rmax or rmin(2)
GSAGenl Ave: generate loose group attack profiles on the basis of an average attack, where the selected items are null, the filler items are randomly chosen, and only one attacker from the whole group rates the items. The filler item rating is the item mean. The target item rating is set to rmax or rmin(3)
GSAGenl AOP: generate loose group attack profiles based on 50% AOP attack, where the selected items are null, the filler items are randomly chosen, and only one attacker from the whole group rates those items with top 50% popularity. The filler item rating is the item mean. The target item rating is set to rmax or rmin(4)
GSAGenl GOAT: generate loose group attack profiles based on the adversarial attack, called GOAT [11], where each fake user’s selected and filler items are randomly chosen from an item-item graph based on genuine user profiles. A generative adversarial network is used to generate the ratings of the selected and filler items based on the genuine rating distribution. The target items have ratings of rmax−1 or rmin+1(5)
GSAGenl Mixed: generate mixed multiple shilling groups generated according to the four abovementioned group shilling attacks


### 2.2. Related Work

#### 2.2.1. Individual Shilling Attack Detection Methods

Chirita et al. [25] and Burke et al. [26] proposed attack user detection indicators to identify shilling attackers based on fraudulent user rating behavior patterns. These indicators were suitable for detecting specific attacks (i.e., random attack), but failed under obfuscated attacks (e.g., AOP attack). To detect various attack types, Zhang et al. [27] proposed an attack detection framework based on label propagation. The framework used the label propagation algorithm to obtain the suspicious probability of each user. Although this method did not require the consideration of particular attack strategies, it needs a certain number of seed users and must know the number of attackers in advance. Zhang et al. [28] put forward an unsupervised attack detection method, called UD-HMM, which first determined each user’s degree of suspicion based on their hidden Markov model behavior before utilizing hierarchical clustering to identify attackers. However, this method did not work for detecting the AOP attack profiles. Yang et al. [29] proposed a unified detection framework that can detect various malicious attacks, including common access injection and shilling attacks. Their framework transformed the user rating behavior into a coupled association network. The network connections and nodes were assessed for trustworthiness by utilizing coupling factor graphs and label propagation algorithms. Meanwhile, Hao and Zhang [30] proposed a deep learning-based and community detection unsupervised approach, called DECDM. They constructed a graph of weighted user relationships based on user behavior similarity and then reconstructed the user relationship graph using stacked denoising autoencoders (SDAEs) and the k-means algorithm. The experiments showed that the method has excellent detection performance on multiple individual shilling attacks. However, it uses the SDAEs multiple times to extract graph features with different damage rates, resulting in a high algorithm time complexity. Ebrahimian and Kashef [31] proposed a hybrid shilling attack detection model based on the convolutional and recurrent neural networks, which first converted the rating matrix into a three-dimensional array of users, products, and days; extracted the user feature vector by using the convolutional neural network (CNN) model; and finally used the RNN model to divide users into two categories: genuine and attacker users. This model did not rely on specific types of attacks and considered the user characteristics in the time dimension. However, the experimental results on the two datasets of Netflix and MovieLens showed that the detection performance was extremely unstable as the filler size changed. Zhou and Duan [32] proposed a coforest algorithm-based semi-supervised recommendation attack detection method that requires setting a reasonable value for each hyperparameter. Zhang et al. [33] proposed GraphRfi, which trains the GCN to obtain the prediction error and introduces neural random forests to detect fraudulent users. Similar to that in [32], the method also requires multiple hyperparameters, and the detection result is easily affected by the hyperparameters.


#### 2.2.2. Group Attack Detection Methods

Zhou et al. [16] proposed the DeR-TIA to identify group attack profiles. In the first stage, they calculated the user profile attributes using improved RDMA and DegSim. In the second stage, they filtered out attack profiles by using the target item analysis. This method works well for identifying high-correlation attack profiles but fails to detect attack groups with a strong diversity. Zhou et al. [17] proposed a detection method, called SVM-TIA, based on the support vector machine and target item analysis. This method can improve the detection precision by using target items but does not have a high recall. Zhang and Wang [18] proposed the GD-BKM method to detect group shilling attacks. They generated candidate groups based on the rating tracks for each item and calculated the candidate group suspiciousness using the user activity and group item attention degree. They then finally spotted attack groups by using the bisecting k-means algorithm. This method can exhibit an excellent detection performance, regardless of the number of target items. However, it becomes less effective when the size of the shilling group is small. Zhang et al. [19] proposed the GAGE method based on graph embedding. First, they extracted user embeddings using the Node2vec method. Next, they obtained candidate groups by using the k-means++ algorithm and calculated the group suspicious degrees. Ultimately, they identified attack groups using Ward’s hierarchical-clustering algorithm. Their method uses Node2vec sampling with a certain randomness, thereby leading to deviations in the candidate group division and unstable detection results. Meanwhile, Yu et al. [20] proposed the GAD-MDST method based on maximum dense subtensor mining. This method can automatically generate multiscale user features by fusing a CNN and a feature pyramid network but is not suitable for detecting smaller-sized shilling groups. In our previous work [21], we proposed the TP-GBF method by using strongly correlated behaviors among group members and group behavior characteristics, which combined indirect behaviors with the direct collusion behaviors to highlight the collusive relationship between attackers in the same shilling group. TP-GBF performed well on the Netflix dataset but was less effective on the real dataset because it failed to detect smaller-sized attack groups.For easy comparison of the above works, we summarize them in Table1.Table 1
Comparison of different shilling attack detection methods.
CategoryApproachesAdvantageDisadvantageIndividual shilling attack detection methodsChirita et al. [25] and Burke et al. [26]Effective for specific attacksLess effective under obfuscated attacks, e.g., AOP attackZhang et al. [27]A unified framework for detecting various shilling attacksRequire prior knowledge of attacksZhang et al. [28]Effective for a wide variety of shilling attacksLess effective under the AOP attackYang et al. [29]A unified framework for detecting common access injection and shilling attacksRequire setting more parametersHao and Zhang [30]Automatic feature learningHigh computational costEbrahimian and Kashef [31]Regardless of the specific attacksUnstable detection performanceZhou and Duan [32]High detection precisionRequire setting hyperparametersZhang et al. [33]Consider both user preference and reliabilityRequire multiple hyperparametersGroup attack detection methodsZhou et al. [16]Effective for detecting those shilling group profiles with high-correlationLess effective for attack group profiles with a strong diversityZhou et al. [17]High detection precisionLow recall under attacks with a small attack sizeZhang and Wang [18]Excellent detection performance regardless of the number of target itemsLess effective under smaller-sized groupsZhang et al. [19]Automatic feature extractionUnstable detection resultsYu et al. [20]Automatic feature extractionLess effective under a smaller group sizeCai and Zhang [21]Effective for detecting tightly coupled shilling groupsLess effective under smaller-sized shilling groups on the Amazon dataset


## 2.1. Group Shilling Attacks

To escape from the existing methods of detecting individual shilling attacks (e.g., random attack, average attack, and AOP attack), Wang et al. [24] proposed two generative models of group shilling attack, called GSAGens and GSAGenl. In these attack models, fake profiles are first generated based on one type of individual shilling attacks. Based on which, group shilling attack profiles are then constructed and injected into a set of genuine profiles. The GSAGens model has more stringent conditions when generating group shilling profiles; hence, the group size under GSAGens is smaller than that under GSAGenl. Considering the attack effect on the target items, we only use GSAGenl to generate the group shilling attack profiles, in which the fake profile includes the selected item set, the filler item set, the target item set, and the unrated item set. More details for the group shilling attacks used in this paper are described as follows:
(1)
GSAGenl Ran: generate loose group attack profiles based on a random attack, where the selected items are null, the filler items are randomly chosen, and only one attacker from the whole group rates the items. The filler item rating is the system mean. The target item rating is set to rmax or rmin(2)
GSAGenl Ave: generate loose group attack profiles on the basis of an average attack, where the selected items are null, the filler items are randomly chosen, and only one attacker from the whole group rates the items. The filler item rating is the item mean. The target item rating is set to rmax or rmin(3)
GSAGenl AOP: generate loose group attack profiles based on 50% AOP attack, where the selected items are null, the filler items are randomly chosen, and only one attacker from the whole group rates those items with top 50% popularity. The filler item rating is the item mean. The target item rating is set to rmax or rmin(4)
GSAGenl GOAT: generate loose group attack profiles based on the adversarial attack, called GOAT [11], where each fake user’s selected and filler items are randomly chosen from an item-item graph based on genuine user profiles. A generative adversarial network is used to generate the ratings of the selected and filler items based on the genuine rating distribution. The target items have ratings of rmax−1 or rmin+1(5)
GSAGenl Mixed: generate mixed multiple shilling groups generated according to the four abovementioned group shilling attacks


## 2.2. Related Work

### 2.2.1. Individual Shilling Attack Detection Methods

Chirita et al. [25] and Burke et al. [26] proposed attack user detection indicators to identify shilling attackers based on fraudulent user rating behavior patterns. These indicators were suitable for detecting specific attacks (i.e., random attack), but failed under obfuscated attacks (e.g., AOP attack). To detect various attack types, Zhang et al. [27] proposed an attack detection framework based on label propagation. The framework used the label propagation algorithm to obtain the suspicious probability of each user. Although this method did not require the consideration of particular attack strategies, it needs a certain number of seed users and must know the number of attackers in advance. Zhang et al. [28] put forward an unsupervised attack detection method, called UD-HMM, which first determined each user’s degree of suspicion based on their hidden Markov model behavior before utilizing hierarchical clustering to identify attackers. However, this method did not work for detecting the AOP attack profiles. Yang et al. [29] proposed a unified detection framework that can detect various malicious attacks, including common access injection and shilling attacks. Their framework transformed the user rating behavior into a coupled association network. The network connections and nodes were assessed for trustworthiness by utilizing coupling factor graphs and label propagation algorithms. Meanwhile, Hao and Zhang [30] proposed a deep learning-based and community detection unsupervised approach, called DECDM. They constructed a graph of weighted user relationships based on user behavior similarity and then reconstructed the user relationship graph using stacked denoising autoencoders (SDAEs) and the k-means algorithm. The experiments showed that the method has excellent detection performance on multiple individual shilling attacks. However, it uses the SDAEs multiple times to extract graph features with different damage rates, resulting in a high algorithm time complexity. Ebrahimian and Kashef [31] proposed a hybrid shilling attack detection model based on the convolutional and recurrent neural networks, which first converted the rating matrix into a three-dimensional array of users, products, and days; extracted the user feature vector by using the convolutional neural network (CNN) model; and finally used the RNN model to divide users into two categories: genuine and attacker users. This model did not rely on specific types of attacks and considered the user characteristics in the time dimension. However, the experimental results on the two datasets of Netflix and MovieLens showed that the detection performance was extremely unstable as the filler size changed. Zhou and Duan [32] proposed a coforest algorithm-based semi-supervised recommendation attack detection method that requires setting a reasonable value for each hyperparameter. Zhang et al. [33] proposed GraphRfi, which trains the GCN to obtain the prediction error and introduces neural random forests to detect fraudulent users. Similar to that in [32], the method also requires multiple hyperparameters, and the detection result is easily affected by the hyperparameters.


### 2.2.2. Group Attack Detection Methods

Zhou et al. [16] proposed the DeR-TIA to identify group attack profiles. In the first stage, they calculated the user profile attributes using improved RDMA and DegSim. In the second stage, they filtered out attack profiles by using the target item analysis. This method works well for identifying high-correlation attack profiles but fails to detect attack groups with a strong diversity. Zhou et al. [17] proposed a detection method, called SVM-TIA, based on the support vector machine and target item analysis. This method can improve the detection precision by using target items but does not have a high recall. Zhang and Wang [18] proposed the GD-BKM method to detect group shilling attacks. They generated candidate groups based on the rating tracks for each item and calculated the candidate group suspiciousness using the user activity and group item attention degree. They then finally spotted attack groups by using the bisecting k-means algorithm. This method can exhibit an excellent detection performance, regardless of the number of target items. However, it becomes less effective when the size of the shilling group is small. Zhang et al. [19] proposed the GAGE method based on graph embedding. First, they extracted user embeddings using the Node2vec method. Next, they obtained candidate groups by using the k-means++ algorithm and calculated the group suspicious degrees. Ultimately, they identified attack groups using Ward’s hierarchical-clustering algorithm. Their method uses Node2vec sampling with a certain randomness, thereby leading to deviations in the candidate group division and unstable detection results. Meanwhile, Yu et al. [20] proposed the GAD-MDST method based on maximum dense subtensor mining. This method can automatically generate multiscale user features by fusing a CNN and a feature pyramid network but is not suitable for detecting smaller-sized shilling groups. In our previous work [21], we proposed the TP-GBF method by using strongly correlated behaviors among group members and group behavior characteristics, which combined indirect behaviors with the direct collusion behaviors to highlight the collusive relationship between attackers in the same shilling group. TP-GBF performed well on the Netflix dataset but was less effective on the real dataset because it failed to detect smaller-sized attack groups.For easy comparison of the above works, we summarize them in Table1.Table 1
Comparison of different shilling attack detection methods.
CategoryApproachesAdvantageDisadvantageIndividual shilling attack detection methodsChirita et al. [25] and Burke et al. [26]Effective for specific attacksLess effective under obfuscated attacks, e.g., AOP attackZhang et al. [27]A unified framework for detecting various shilling attacksRequire prior knowledge of attacksZhang et al. [28]Effective for a wide variety of shilling attacksLess effective under the AOP attackYang et al. [29]A unified framework for detecting common access injection and shilling attacksRequire setting more parametersHao and Zhang [30]Automatic feature learningHigh computational costEbrahimian and Kashef [31]Regardless of the specific attacksUnstable detection performanceZhou and Duan [32]High detection precisionRequire setting hyperparametersZhang et al. [33]Consider both user preference and reliabilityRequire multiple hyperparametersGroup attack detection methodsZhou et al. [16]Effective for detecting those shilling group profiles with high-correlationLess effective for attack group profiles with a strong diversityZhou et al. [17]High detection precisionLow recall under attacks with a small attack sizeZhang and Wang [18]Excellent detection performance regardless of the number of target itemsLess effective under smaller-sized groupsZhang et al. [19]Automatic feature extractionUnstable detection resultsYu et al. [20]Automatic feature extractionLess effective under a smaller group sizeCai and Zhang [21]Effective for detecting tightly coupled shilling groupsLess effective under smaller-sized shilling groups on the Amazon dataset


## 2.2.1. Individual Shilling Attack Detection Methods

Chirita et al. [25] and Burke et al. [26] proposed attack user detection indicators to identify shilling attackers based on fraudulent user rating behavior patterns. These indicators were suitable for detecting specific attacks (i.e., random attack), but failed under obfuscated attacks (e.g., AOP attack). To detect various attack types, Zhang et al. [27] proposed an attack detection framework based on label propagation. The framework used the label propagation algorithm to obtain the suspicious probability of each user. Although this method did not require the consideration of particular attack strategies, it needs a certain number of seed users and must know the number of attackers in advance. Zhang et al. [28] put forward an unsupervised attack detection method, called UD-HMM, which first determined each user’s degree of suspicion based on their hidden Markov model behavior before utilizing hierarchical clustering to identify attackers. However, this method did not work for detecting the AOP attack profiles. Yang et al. [29] proposed a unified detection framework that can detect various malicious attacks, including common access injection and shilling attacks. Their framework transformed the user rating behavior into a coupled association network. The network connections and nodes were assessed for trustworthiness by utilizing coupling factor graphs and label propagation algorithms. Meanwhile, Hao and Zhang [30] proposed a deep learning-based and community detection unsupervised approach, called DECDM. They constructed a graph of weighted user relationships based on user behavior similarity and then reconstructed the user relationship graph using stacked denoising autoencoders (SDAEs) and the k-means algorithm. The experiments showed that the method has excellent detection performance on multiple individual shilling attacks. However, it uses the SDAEs multiple times to extract graph features with different damage rates, resulting in a high algorithm time complexity. Ebrahimian and Kashef [31] proposed a hybrid shilling attack detection model based on the convolutional and recurrent neural networks, which first converted the rating matrix into a three-dimensional array of users, products, and days; extracted the user feature vector by using the convolutional neural network (CNN) model; and finally used the RNN model to divide users into two categories: genuine and attacker users. This model did not rely on specific types of attacks and considered the user characteristics in the time dimension. However, the experimental results on the two datasets of Netflix and MovieLens showed that the detection performance was extremely unstable as the filler size changed. Zhou and Duan [32] proposed a coforest algorithm-based semi-supervised recommendation attack detection method that requires setting a reasonable value for each hyperparameter. Zhang et al. [33] proposed GraphRfi, which trains the GCN to obtain the prediction error and introduces neural random forests to detect fraudulent users. Similar to that in [32], the method also requires multiple hyperparameters, and the detection result is easily affected by the hyperparameters.


## 2.2.2. Group Attack Detection Methods

Zhou et al. [16] proposed the DeR-TIA to identify group attack profiles. In the first stage, they calculated the user profile attributes using improved RDMA and DegSim. In the second stage, they filtered out attack profiles by using the target item analysis. This method works well for identifying high-correlation attack profiles but fails to detect attack groups with a strong diversity. Zhou et al. [17] proposed a detection method, called SVM-TIA, based on the support vector machine and target item analysis. This method can improve the detection precision by using target items but does not have a high recall. Zhang and Wang [18] proposed the GD-BKM method to detect group shilling attacks. They generated candidate groups based on the rating tracks for each item and calculated the candidate group suspiciousness using the user activity and group item attention degree. They then finally spotted attack groups by using the bisecting k-means algorithm. This method can exhibit an excellent detection performance, regardless of the number of target items. However, it becomes less effective when the size of the shilling group is small. Zhang et al. [19] proposed the GAGE method based on graph embedding. First, they extracted user embeddings using the Node2vec method. Next, they obtained candidate groups by using the k-means++ algorithm and calculated the group suspicious degrees. Ultimately, they identified attack groups using Ward’s hierarchical-clustering algorithm. Their method uses Node2vec sampling with a certain randomness, thereby leading to deviations in the candidate group division and unstable detection results. Meanwhile, Yu et al. [20] proposed the GAD-MDST method based on maximum dense subtensor mining. This method can automatically generate multiscale user features by fusing a CNN and a feature pyramid network but is not suitable for detecting smaller-sized shilling groups. In our previous work [21], we proposed the TP-GBF method by using strongly correlated behaviors among group members and group behavior characteristics, which combined indirect behaviors with the direct collusion behaviors to highlight the collusive relationship between attackers in the same shilling group. TP-GBF performed well on the Netflix dataset but was less effective on the real dataset because it failed to detect smaller-sized attack groups.For easy comparison of the above works, we summarize them in Table1.Table 1
Comparison of different shilling attack detection methods.
CategoryApproachesAdvantageDisadvantageIndividual shilling attack detection methodsChirita et al. [25] and Burke et al. [26]Effective for specific attacksLess effective under obfuscated attacks, e.g., AOP attackZhang et al. [27]A unified framework for detecting various shilling attacksRequire prior knowledge of attacksZhang et al. [28]Effective for a wide variety of shilling attacksLess effective under the AOP attackYang et al. [29]A unified framework for detecting common access injection and shilling attacksRequire setting more parametersHao and Zhang [30]Automatic feature learningHigh computational costEbrahimian and Kashef [31]Regardless of the specific attacksUnstable detection performanceZhou and Duan [32]High detection precisionRequire setting hyperparametersZhang et al. [33]Consider both user preference and reliabilityRequire multiple hyperparametersGroup attack detection methodsZhou et al. [16]Effective for detecting those shilling group profiles with high-correlationLess effective for attack group profiles with a strong diversityZhou et al. [17]High detection precisionLow recall under attacks with a small attack sizeZhang and Wang [18]Excellent detection performance regardless of the number of target itemsLess effective under smaller-sized groupsZhang et al. [19]Automatic feature extractionUnstable detection resultsYu et al. [20]Automatic feature extractionLess effective under a smaller group sizeCai and Zhang [21]Effective for detecting tightly coupled shilling groupsLess effective under smaller-sized shilling groups on the Amazon dataset


## 3. GCN-Based Group Shilling Attack Detection Model

Figure1 depicts the two stages of the KC-GCN detection framework: influential user extraction and attack user identification. In the first stage, we build the user relationship graph by determining the user similarity based on the item suspicious time window. Next, we use the k-clique community discovery algorithm to generate suspicious candidate groups. Finally, we obtain the influential users by calculating the user nearest-neighbor similarity. In the second stage, we extract the users’ initial embeddings from four dimensions. We then combined the extracted user initial embeddings with the structural features hidden in the user relationship graph to train a semi-supervised classifier based on a two-layer GCN, which only utilizes the labels of the identified influential users.Figure 1
Detection framework of KC-GCN.The notations used in this paper are described in Table2.Table 2
Notations and their descriptions.
NotationDescriptionU=u1,u2,⋯,umSet of users in the rating datasetP=p1,p2,⋯,pnSet of items in the rating datasetR=rijm×nUser-item rating matrixT=tijm×nUser-item rating time matrixW=w1,w2,⋯,wvSet of time windows in the rating datasetG=U,E,GA weight user relationship graph⋅The number of elements in a setXUsers’ initial embedding matrix


### 3.1. Extracting Influential Users

#### 3.1.1. Constructing a Weighted User Relationship Graph

Attackers in a shilling group typically cooperate to quickly enhance or demote the recommendation of one or more target items. Based on this characteristic of group attacks, the rating distribution of a target item may fluctuate during the attacked time period. Therefore, we construct a weighted user relationship graph by extracting the suspicious time windows of the suspicious items and calculating the correlation between users within the suspicious time windows.Definition 1 (item window abnormal degree,IWAD).
For∀p∈P and ∀w∈W, the abnormal degree of item p on window m refers to the ratio of the number of users who rated item p with high ratings to the total number of users who rated it on time window w, which is referred to IWADp,w and calculated by
(1)IWADp,w=∑u∈UΓu,p,wNRp,w,where NRp,w represents the number of ratings of item p on the time window w. The time window is regarded as suspicious if IWADp,w>0.5. Γu,p,w is an indicator function, which is formulated as
(2)Γu,p,w=1,ifru,p≥4,0,otherwise.Definition 2 (user rating synchronization, URS).
For∀ui,uj∈U, their rating synchronization refers to how close their rating behavior is within the suspicious time window, which is denoted as URSui,uj and calculated by
(3)URSui,uj=∑p∈Nui,uj,rui,p≥4,ruj,p≥41−tui,p−tuj,pτ,
whereNui,uj represents the set of items corated by users ui and uj, and the rating time is within the suspicious time window of item p;that is, IWADp,w>0.5.Definition 3 (user short preference similarity, USPS).
For∀ui,uj∈U, their short preference similarity is defined as the ratio of Nui,uj to Nui∪Nuj−Nui,uj, which is denoted as USPSui,uj and calculated by
(4)USPSui,uj=Nui,ujNui∪Nuj−Nui,uj,where Nui and Nuj represent the rating item set of users ui and uj, respectively. Nui,uj represents the number of items for which user ui and user uj have the same preference within the suspicious time window, and Nui∪Nuj represents the total number of items rated by user ui and user uj.Definition 4 (user similarity, US).
For∀ui,uj∈U, their user similarity refers to the closeness of their rating times and similarity of their preferences on suspicious items, which is denoted as USui,uj and calculated by
(5)USui,uj=URSui,uj×USPSui,uj.Based on the above definition, a weighted user relationship graph can be constructed. The weighted user relationship graph construction algorithm is described as follows.Algorithm1 is divided into two parts. The first part (lines 1–6) calculates the suspicious time window for each item, with a time complexity of On∗v. The second part (lines 7–21) calculates the relevance degree US of each user and constructs a user relationship graph, with a time complexity of Om2. In conclusion, Algorithm 1 has a time complexity of about Om2.Algorithm 1: Constructing a weighted user relationship graph.
Input: the rating matrix R, the rating time matrix T, the size of sliding time window Ws, the time window anomaly threshold δ, and the relationship strength threshold σOutput: a weighted user relationship graph G1.E⟵∅;C⟵0m×n2.for each item p∈Pdo3.for each time window ∀w∈Wdo4.   computeIWADp,w according to Eq. (1)5.end for6.end for7.for each user ui∈Udo8.for each user uj∈Udo9.   computeURSui,uj according to Eq. (3)10.    computeUSPSui,uj according to Eq. (4)11.ifURSui,uj>σthen12.     computeUSui,uj according to Eq. (5)13.Cuiuj⟵USui,uj14.E⟵E∪ui,uj15.else16.USui,uj⟵017.end if18.end for19.end for20. construct a weight user relationship graphG=U,E,C21.returnG


#### 3.1.2. Extracting Influential Users

Li et al. [34] proposed the maximization problem that is aimed at selecting seed nodes from numerous nodes, thereby maximizing the influence of information on large-scale network transmission [35]. Inspired by the seed node idea, we only used the influential node labels to reduce the cost of labeling a large number of samples.We present herein a two-stage method for extracting influential users. First, we generate suspicious candidate groups on the weighted user relationship graph using thek-clique algorithm [21]. Next, we extract influential users by calculating the user nearest-neighbor similarity.The main steps of generating candidate groups based on thek-clique algorithm are as follows:
(1)
Traverse each node in the user relationship graph to find a complete subgraphGi=u1i,u2i,⋯,uki containing k users, and add the users in Gi into the tightness community set TCS(2)
Convert theTCS into an overlapping community matrix O, where the diagonal elements in the matrix O represent the number of users in the community, and the off-diagonal elements represent the number of shared users in adjacent communities(3)
Merge the small communities in the overlapping community matrixO to obtain the community adjacency matrix A. In the matrix O, these diagonal elements with a value less than k and off-diagonal elements with a value less than k−1 are set to 0, while the left elements are set to 1(4)
Generate the suspicious candidate group based on the community adjacency matrixADefinition 5 (user nearest neighbor similarity,UNNS).
For∀ui∈U, the user’s nearest neighbor similarity refers to the average similarity between the user and its neighbors, which is denoted as UNNSui and calculated by
(6)UNNSui=∑uj∈NeighboruiURui,ujNeighborui,
whereURui,uj represents the similarity of users ui and uj.Algorithm 2: Extracting influential users.
Input: the user’s relationship graph G=U,E,C, the size of smallest clique kOutput: set of influential users IUS1.CSG⟵∅;O⟵0L×L;A⟵0L×L2.for each user ui∈Udo3.ifGi=u1i,u2i,⋯,uki and Gi⊆G and ∀Cumi,uni≠0then4.TG⟵TG∪Gi5.end if6.end for7.forGi∈TGdo8.Oii⟵Gi9.forGj∈TGdo10.Oij⟵Gi∩Gj11.end for12.end for13.for∀i,j∈L and i≠jdo14.ifOii<k or Oij≤k−1then15.Aii⟵016.Aij⟵017.else18.Aii⟵119.Aij⟵120.end if21.end for22.for∀i,j∈Ldo23.ifAij=1then24.CSG⟵Gi∪Gj25.end if26.end for27.for each community cs∈CSGdo.28.for each user u∈csdo29.ifUNNSu>UNNSNeighboruthen30.IUS⟵IUS∪u31.returnIUSDefinition 6 (influential user,IU).
Influential users refer to those users whose nearest neighbor similarity is larger than that of all its first-order neighbors.The algorithm for extracting influential users based on thek-clique algorithm and user nearest neighbor similarity is described as follows.Algorithm2 is divided into four parts. The first part (lines 1–12) identifies tight communities in the graph and generates a community relationship matrix with a time complexity of Om∗l+Ol2. The second part (lines 13–19) merges communities to generate a community adjacency matrix with a time complexity of Ol2+Ol2. The third part (lines 20–24) generates candidate suspicious groups according to the community adjacency matrix, with a time complexity of O1. The last part (lines 25–29) extracts an influential user set based on the user nearest neighbor similarity, with a time complexity of Ol∗m. In conclusion, Algorithm 2 has a time complexity of about Om∗l.


### 3.2. Detecting Attack Users

#### 3.2.1. Generating User Initial Embeddings

Some node-embedding methods (e.g., matrix factorization and autoencoders) are automatic but usually generated using a randomization strategy and cannot represent well the initial node embeddings. Therefore, we generate the user embeddings herein from four perspectives.Definition 7 (user lifetime proportion,ULP).
For∀ui∈U, the user lifetime proportion refers to the ratio of the lifetime of user ui in the system to the lifetime of the entire system, which is denoted as ULPui and calculated by
(7)ULPui=URTui,max−URTui,minSL,where URTui,max and URTui,min represent the latest and the earliest rating time of user ui, respectively. SL represents the lifetime of the entire system.Definition 8 (user nearest neighbor rating synchronization,UNNRS).
For∀ui∈U, the user’s neighbor rating synchronization refers to the average rating synchronization between the user and its neighbors, which is denoted as UNNRSui and calculated by
(8)UNNRSui=∑uj∈NeighboruiURSui,ujNeighborui,where URSui,uj means the synchronization degree of user ui and user uj and Neighborui represents the number of first-order neighbors of user ui.Definition 9 (user nearest neighbor preference similarity,UNNPS).
For∀ui∈U, the user’s nearest neighbor preference refers to the average preference similarity between the user and its direct neighbors, which is denoted as UNNPSui and calculated by
(9)UNNPSui=∑uj∈NeighboruiUPSui,ujNeighborui,where UPSui,uj represents the preference similarity of user ui and user uj.
Based on the above definition, we extract the initial embeddingXu=ULPu,UNNRSu,UNNPSu,UNNSu of user u.


#### 3.2.2. Identifying Attack Users Based on the GCN

In previous graph embedding-based group shilling attack detection methods, researchers focused on how to obtain high-quality user node embeddings in the graph. Zhang et al. [19] obtained a low-dimensional embedding vector of nodes in the graph by adopting the Node2vec method that focuses on obtaining the structural characteristics of the user’s topological neighborhood but ignores the characteristic information of the nodes themselves. The existing group attack detection methods also use hard classification, in which members from the same group are classified as genuine users or attackers, resulting in the misclassification of some users [18–21]. To this end, we utilize user high-quality embedding features from both implicit and explicit perspectives by combining user initial embeddings with their higher-order topological neighborhood structures based on the GCN and employing influential node labels to identify attack users.We first extract the high-quality embeddings of user nodes based on the user initial embedding matrixX and the weighted matrix C. The GCN propagation process is formulated as follows:
(10)Hl+1=σD~−1/2C~D~−1/2HlWl,where Hl+1 represents the output after one convolutional layer. Hl is the input of the lth layer. H0=XN×4 represents the user initial embedding matrix. N is the total number of user nodes in the graph, and the feature vector of each user is represented as Xu=ULPu,UNNRSu,UNNPSu,UNNSu. C~=C+IN is the adjacency matrix by adding self-connection. D~ is the degree matrix, and D~ii=∑jA~ij. Wl∈RP×H denotes the parameter matrix to be trained, P represents the length of the feature matrix, and H represents the number of hidden units. σ is the corresponding activation function, such as ReLU⋅=max0,⋅.High-quality user embeddings can be obtained after multiple convolutional layers. We utilize two convolutional layers and ReLU as the activation function.We then calculate the cross-entropy between the real label one-hot vectorY of all influential user nodes and the label vector T predicted by softmax. Subsequently, we utilize the gradient descent method to train the parameter matrix W0 and W1. The formula for calculating the loss function is as follows.
(11)loss=−∑l∈ϒL∑t=1TYlflnZlf,where ϒL is the set of influential user nodes with labels.Finally, the resulting model is expressed as(12)Z=fX,C=softmaxC^ReLUC^XW0W1,whereZ represents the set of user labels after classification by the softmax function. C^=D~−1/2C~D~−1/2 represents the weighted matrix C after symmetric normalization.The algorithm for detecting attackers is described as follows.Algorithm3 is divided into two parts. The first part (lines 1–8) uses GCN semi-supervised classification model training to get the classification result Z of all user nodes. The second part (lines 9–14) filters out the attack users according to the classification result Z.Algorithm 3: Detecting attack users.
Input: the weighted user’s relationship graph G, the influential user’s set IUS, the user initial embedding matrix X, and maximum training epoch KOutput: set of attack users AU1.AU⟵∅2.fork=1 to Kdo3.  computeZ according to Eq. (12)4.  computeloss according to Eq. (11)5.  Gradient zeroing6.  Back propagation calculation gradient value7.  Update parameters by using gradient descent8.end for9.for each z∈Zdo10.ifz=1then11.AU⟵AU∪z12.end if13.end for14.returnAU


## 3.1. Extracting Influential Users

### 3.1.1. Constructing a Weighted User Relationship Graph

Attackers in a shilling group typically cooperate to quickly enhance or demote the recommendation of one or more target items. Based on this characteristic of group attacks, the rating distribution of a target item may fluctuate during the attacked time period. Therefore, we construct a weighted user relationship graph by extracting the suspicious time windows of the suspicious items and calculating the correlation between users within the suspicious time windows.Definition 1 (item window abnormal degree,IWAD).
For∀p∈P and ∀w∈W, the abnormal degree of item p on window m refers to the ratio of the number of users who rated item p with high ratings to the total number of users who rated it on time window w, which is referred to IWADp,w and calculated by
(1)IWADp,w=∑u∈UΓu,p,wNRp,w,where NRp,w represents the number of ratings of item p on the time window w. The time window is regarded as suspicious if IWADp,w>0.5. Γu,p,w is an indicator function, which is formulated as
(2)Γu,p,w=1,ifru,p≥4,0,otherwise.Definition 2 (user rating synchronization, URS).
For∀ui,uj∈U, their rating synchronization refers to how close their rating behavior is within the suspicious time window, which is denoted as URSui,uj and calculated by
(3)URSui,uj=∑p∈Nui,uj,rui,p≥4,ruj,p≥41−tui,p−tuj,pτ,
whereNui,uj represents the set of items corated by users ui and uj, and the rating time is within the suspicious time window of item p;that is, IWADp,w>0.5.Definition 3 (user short preference similarity, USPS).
For∀ui,uj∈U, their short preference similarity is defined as the ratio of Nui,uj to Nui∪Nuj−Nui,uj, which is denoted as USPSui,uj and calculated by
(4)USPSui,uj=Nui,ujNui∪Nuj−Nui,uj,where Nui and Nuj represent the rating item set of users ui and uj, respectively. Nui,uj represents the number of items for which user ui and user uj have the same preference within the suspicious time window, and Nui∪Nuj represents the total number of items rated by user ui and user uj.Definition 4 (user similarity, US).
For∀ui,uj∈U, their user similarity refers to the closeness of their rating times and similarity of their preferences on suspicious items, which is denoted as USui,uj and calculated by
(5)USui,uj=URSui,uj×USPSui,uj.Based on the above definition, a weighted user relationship graph can be constructed. The weighted user relationship graph construction algorithm is described as follows.Algorithm1 is divided into two parts. The first part (lines 1–6) calculates the suspicious time window for each item, with a time complexity of On∗v. The second part (lines 7–21) calculates the relevance degree US of each user and constructs a user relationship graph, with a time complexity of Om2. In conclusion, Algorithm 1 has a time complexity of about Om2.Algorithm 1: Constructing a weighted user relationship graph.
Input: the rating matrix R, the rating time matrix T, the size of sliding time window Ws, the time window anomaly threshold δ, and the relationship strength threshold σOutput: a weighted user relationship graph G1.E⟵∅;C⟵0m×n2.for each item p∈Pdo3.for each time window ∀w∈Wdo4.   computeIWADp,w according to Eq. (1)5.end for6.end for7.for each user ui∈Udo8.for each user uj∈Udo9.   computeURSui,uj according to Eq. (3)10.    computeUSPSui,uj according to Eq. (4)11.ifURSui,uj>σthen12.     computeUSui,uj according to Eq. (5)13.Cuiuj⟵USui,uj14.E⟵E∪ui,uj15.else16.USui,uj⟵017.end if18.end for19.end for20. construct a weight user relationship graphG=U,E,C21.returnG


### 3.1.2. Extracting Influential Users

Li et al. [34] proposed the maximization problem that is aimed at selecting seed nodes from numerous nodes, thereby maximizing the influence of information on large-scale network transmission [35]. Inspired by the seed node idea, we only used the influential node labels to reduce the cost of labeling a large number of samples.We present herein a two-stage method for extracting influential users. First, we generate suspicious candidate groups on the weighted user relationship graph using thek-clique algorithm [21]. Next, we extract influential users by calculating the user nearest-neighbor similarity.The main steps of generating candidate groups based on thek-clique algorithm are as follows:
(1)
Traverse each node in the user relationship graph to find a complete subgraphGi=u1i,u2i,⋯,uki containing k users, and add the users in Gi into the tightness community set TCS(2)
Convert theTCS into an overlapping community matrix O, where the diagonal elements in the matrix O represent the number of users in the community, and the off-diagonal elements represent the number of shared users in adjacent communities(3)
Merge the small communities in the overlapping community matrixO to obtain the community adjacency matrix A. In the matrix O, these diagonal elements with a value less than k and off-diagonal elements with a value less than k−1 are set to 0, while the left elements are set to 1(4)
Generate the suspicious candidate group based on the community adjacency matrixADefinition 5 (user nearest neighbor similarity,UNNS).
For∀ui∈U, the user’s nearest neighbor similarity refers to the average similarity between the user and its neighbors, which is denoted as UNNSui and calculated by
(6)UNNSui=∑uj∈NeighboruiURui,ujNeighborui,
whereURui,uj represents the similarity of users ui and uj.Algorithm 2: Extracting influential users.
Input: the user’s relationship graph G=U,E,C, the size of smallest clique kOutput: set of influential users IUS1.CSG⟵∅;O⟵0L×L;A⟵0L×L2.for each user ui∈Udo3.ifGi=u1i,u2i,⋯,uki and Gi⊆G and ∀Cumi,uni≠0then4.TG⟵TG∪Gi5.end if6.end for7.forGi∈TGdo8.Oii⟵Gi9.forGj∈TGdo10.Oij⟵Gi∩Gj11.end for12.end for13.for∀i,j∈L and i≠jdo14.ifOii<k or Oij≤k−1then15.Aii⟵016.Aij⟵017.else18.Aii⟵119.Aij⟵120.end if21.end for22.for∀i,j∈Ldo23.ifAij=1then24.CSG⟵Gi∪Gj25.end if26.end for27.for each community cs∈CSGdo.28.for each user u∈csdo29.ifUNNSu>UNNSNeighboruthen30.IUS⟵IUS∪u31.returnIUSDefinition 6 (influential user,IU).
Influential users refer to those users whose nearest neighbor similarity is larger than that of all its first-order neighbors.The algorithm for extracting influential users based on thek-clique algorithm and user nearest neighbor similarity is described as follows.Algorithm2 is divided into four parts. The first part (lines 1–12) identifies tight communities in the graph and generates a community relationship matrix with a time complexity of Om∗l+Ol2. The second part (lines 13–19) merges communities to generate a community adjacency matrix with a time complexity of Ol2+Ol2. The third part (lines 20–24) generates candidate suspicious groups according to the community adjacency matrix, with a time complexity of O1. The last part (lines 25–29) extracts an influential user set based on the user nearest neighbor similarity, with a time complexity of Ol∗m. In conclusion, Algorithm 2 has a time complexity of about Om∗l.


## 3.1.1. Constructing a Weighted User Relationship Graph

Attackers in a shilling group typically cooperate to quickly enhance or demote the recommendation of one or more target items. Based on this characteristic of group attacks, the rating distribution of a target item may fluctuate during the attacked time period. Therefore, we construct a weighted user relationship graph by extracting the suspicious time windows of the suspicious items and calculating the correlation between users within the suspicious time windows.Definition 1 (item window abnormal degree,IWAD).
For∀p∈P and ∀w∈W, the abnormal degree of item p on window m refers to the ratio of the number of users who rated item p with high ratings to the total number of users who rated it on time window w, which is referred to IWADp,w and calculated by
(1)IWADp,w=∑u∈UΓu,p,wNRp,w,where NRp,w represents the number of ratings of item p on the time window w. The time window is regarded as suspicious if IWADp,w>0.5. Γu,p,w is an indicator function, which is formulated as
(2)Γu,p,w=1,ifru,p≥4,0,otherwise.Definition 2 (user rating synchronization, URS).
For∀ui,uj∈U, their rating synchronization refers to how close their rating behavior is within the suspicious time window, which is denoted as URSui,uj and calculated by
(3)URSui,uj=∑p∈Nui,uj,rui,p≥4,ruj,p≥41−tui,p−tuj,pτ,
whereNui,uj represents the set of items corated by users ui and uj, and the rating time is within the suspicious time window of item p;that is, IWADp,w>0.5.Definition 3 (user short preference similarity, USPS).
For∀ui,uj∈U, their short preference similarity is defined as the ratio of Nui,uj to Nui∪Nuj−Nui,uj, which is denoted as USPSui,uj and calculated by
(4)USPSui,uj=Nui,ujNui∪Nuj−Nui,uj,where Nui and Nuj represent the rating item set of users ui and uj, respectively. Nui,uj represents the number of items for which user ui and user uj have the same preference within the suspicious time window, and Nui∪Nuj represents the total number of items rated by user ui and user uj.Definition 4 (user similarity, US).
For∀ui,uj∈U, their user similarity refers to the closeness of their rating times and similarity of their preferences on suspicious items, which is denoted as USui,uj and calculated by
(5)USui,uj=URSui,uj×USPSui,uj.Based on the above definition, a weighted user relationship graph can be constructed. The weighted user relationship graph construction algorithm is described as follows.Algorithm1 is divided into two parts. The first part (lines 1–6) calculates the suspicious time window for each item, with a time complexity of On∗v. The second part (lines 7–21) calculates the relevance degree US of each user and constructs a user relationship graph, with a time complexity of Om2. In conclusion, Algorithm 1 has a time complexity of about Om2.Algorithm 1: Constructing a weighted user relationship graph.
Input: the rating matrix R, the rating time matrix T, the size of sliding time window Ws, the time window anomaly threshold δ, and the relationship strength threshold σOutput: a weighted user relationship graph G1.E⟵∅;C⟵0m×n2.for each item p∈Pdo3.for each time window ∀w∈Wdo4.   computeIWADp,w according to Eq. (1)5.end for6.end for7.for each user ui∈Udo8.for each user uj∈Udo9.   computeURSui,uj according to Eq. (3)10.    computeUSPSui,uj according to Eq. (4)11.ifURSui,uj>σthen12.     computeUSui,uj according to Eq. (5)13.Cuiuj⟵USui,uj14.E⟵E∪ui,uj15.else16.USui,uj⟵017.end if18.end for19.end for20. construct a weight user relationship graphG=U,E,C21.returnG


## 3.1.2. Extracting Influential Users

Li et al. [34] proposed the maximization problem that is aimed at selecting seed nodes from numerous nodes, thereby maximizing the influence of information on large-scale network transmission [35]. Inspired by the seed node idea, we only used the influential node labels to reduce the cost of labeling a large number of samples.We present herein a two-stage method for extracting influential users. First, we generate suspicious candidate groups on the weighted user relationship graph using thek-clique algorithm [21]. Next, we extract influential users by calculating the user nearest-neighbor similarity.The main steps of generating candidate groups based on thek-clique algorithm are as follows:
(1)
Traverse each node in the user relationship graph to find a complete subgraphGi=u1i,u2i,⋯,uki containing k users, and add the users in Gi into the tightness community set TCS(2)
Convert theTCS into an overlapping community matrix O, where the diagonal elements in the matrix O represent the number of users in the community, and the off-diagonal elements represent the number of shared users in adjacent communities(3)
Merge the small communities in the overlapping community matrixO to obtain the community adjacency matrix A. In the matrix O, these diagonal elements with a value less than k and off-diagonal elements with a value less than k−1 are set to 0, while the left elements are set to 1(4)
Generate the suspicious candidate group based on the community adjacency matrixADefinition 5 (user nearest neighbor similarity,UNNS).
For∀ui∈U, the user’s nearest neighbor similarity refers to the average similarity between the user and its neighbors, which is denoted as UNNSui and calculated by
(6)UNNSui=∑uj∈NeighboruiURui,ujNeighborui,
whereURui,uj represents the similarity of users ui and uj.Algorithm 2: Extracting influential users.
Input: the user’s relationship graph G=U,E,C, the size of smallest clique kOutput: set of influential users IUS1.CSG⟵∅;O⟵0L×L;A⟵0L×L2.for each user ui∈Udo3.ifGi=u1i,u2i,⋯,uki and Gi⊆G and ∀Cumi,uni≠0then4.TG⟵TG∪Gi5.end if6.end for7.forGi∈TGdo8.Oii⟵Gi9.forGj∈TGdo10.Oij⟵Gi∩Gj11.end for12.end for13.for∀i,j∈L and i≠jdo14.ifOii<k or Oij≤k−1then15.Aii⟵016.Aij⟵017.else18.Aii⟵119.Aij⟵120.end if21.end for22.for∀i,j∈Ldo23.ifAij=1then24.CSG⟵Gi∪Gj25.end if26.end for27.for each community cs∈CSGdo.28.for each user u∈csdo29.ifUNNSu>UNNSNeighboruthen30.IUS⟵IUS∪u31.returnIUSDefinition 6 (influential user,IU).
Influential users refer to those users whose nearest neighbor similarity is larger than that of all its first-order neighbors.The algorithm for extracting influential users based on thek-clique algorithm and user nearest neighbor similarity is described as follows.Algorithm2 is divided into four parts. The first part (lines 1–12) identifies tight communities in the graph and generates a community relationship matrix with a time complexity of Om∗l+Ol2. The second part (lines 13–19) merges communities to generate a community adjacency matrix with a time complexity of Ol2+Ol2. The third part (lines 20–24) generates candidate suspicious groups according to the community adjacency matrix, with a time complexity of O1. The last part (lines 25–29) extracts an influential user set based on the user nearest neighbor similarity, with a time complexity of Ol∗m. In conclusion, Algorithm 2 has a time complexity of about Om∗l.


## 3.2. Detecting Attack Users

### 3.2.1. Generating User Initial Embeddings

Some node-embedding methods (e.g., matrix factorization and autoencoders) are automatic but usually generated using a randomization strategy and cannot represent well the initial node embeddings. Therefore, we generate the user embeddings herein from four perspectives.Definition 7 (user lifetime proportion,ULP).
For∀ui∈U, the user lifetime proportion refers to the ratio of the lifetime of user ui in the system to the lifetime of the entire system, which is denoted as ULPui and calculated by
(7)ULPui=URTui,max−URTui,minSL,where URTui,max and URTui,min represent the latest and the earliest rating time of user ui, respectively. SL represents the lifetime of the entire system.Definition 8 (user nearest neighbor rating synchronization,UNNRS).
For∀ui∈U, the user’s neighbor rating synchronization refers to the average rating synchronization between the user and its neighbors, which is denoted as UNNRSui and calculated by
(8)UNNRSui=∑uj∈NeighboruiURSui,ujNeighborui,where URSui,uj means the synchronization degree of user ui and user uj and Neighborui represents the number of first-order neighbors of user ui.Definition 9 (user nearest neighbor preference similarity,UNNPS).
For∀ui∈U, the user’s nearest neighbor preference refers to the average preference similarity between the user and its direct neighbors, which is denoted as UNNPSui and calculated by
(9)UNNPSui=∑uj∈NeighboruiUPSui,ujNeighborui,where UPSui,uj represents the preference similarity of user ui and user uj.
Based on the above definition, we extract the initial embeddingXu=ULPu,UNNRSu,UNNPSu,UNNSu of user u.


### 3.2.2. Identifying Attack Users Based on the GCN

In previous graph embedding-based group shilling attack detection methods, researchers focused on how to obtain high-quality user node embeddings in the graph. Zhang et al. [19] obtained a low-dimensional embedding vector of nodes in the graph by adopting the Node2vec method that focuses on obtaining the structural characteristics of the user’s topological neighborhood but ignores the characteristic information of the nodes themselves. The existing group attack detection methods also use hard classification, in which members from the same group are classified as genuine users or attackers, resulting in the misclassification of some users [18–21]. To this end, we utilize user high-quality embedding features from both implicit and explicit perspectives by combining user initial embeddings with their higher-order topological neighborhood structures based on the GCN and employing influential node labels to identify attack users.We first extract the high-quality embeddings of user nodes based on the user initial embedding matrixX and the weighted matrix C. The GCN propagation process is formulated as follows:
(10)Hl+1=σD~−1/2C~D~−1/2HlWl,where Hl+1 represents the output after one convolutional layer. Hl is the input of the lth layer. H0=XN×4 represents the user initial embedding matrix. N is the total number of user nodes in the graph, and the feature vector of each user is represented as Xu=ULPu,UNNRSu,UNNPSu,UNNSu. C~=C+IN is the adjacency matrix by adding self-connection. D~ is the degree matrix, and D~ii=∑jA~ij. Wl∈RP×H denotes the parameter matrix to be trained, P represents the length of the feature matrix, and H represents the number of hidden units. σ is the corresponding activation function, such as ReLU⋅=max0,⋅.High-quality user embeddings can be obtained after multiple convolutional layers. We utilize two convolutional layers and ReLU as the activation function.We then calculate the cross-entropy between the real label one-hot vectorY of all influential user nodes and the label vector T predicted by softmax. Subsequently, we utilize the gradient descent method to train the parameter matrix W0 and W1. The formula for calculating the loss function is as follows.
(11)loss=−∑l∈ϒL∑t=1TYlflnZlf,where ϒL is the set of influential user nodes with labels.Finally, the resulting model is expressed as(12)Z=fX,C=softmaxC^ReLUC^XW0W1,whereZ represents the set of user labels after classification by the softmax function. C^=D~−1/2C~D~−1/2 represents the weighted matrix C after symmetric normalization.The algorithm for detecting attackers is described as follows.Algorithm3 is divided into two parts. The first part (lines 1–8) uses GCN semi-supervised classification model training to get the classification result Z of all user nodes. The second part (lines 9–14) filters out the attack users according to the classification result Z.Algorithm 3: Detecting attack users.
Input: the weighted user’s relationship graph G, the influential user’s set IUS, the user initial embedding matrix X, and maximum training epoch KOutput: set of attack users AU1.AU⟵∅2.fork=1 to Kdo3.  computeZ according to Eq. (12)4.  computeloss according to Eq. (11)5.  Gradient zeroing6.  Back propagation calculation gradient value7.  Update parameters by using gradient descent8.end for9.for each z∈Zdo10.ifz=1then11.AU⟵AU∪z12.end if13.end for14.returnAU


## 3.2.1. Generating User Initial Embeddings

Some node-embedding methods (e.g., matrix factorization and autoencoders) are automatic but usually generated using a randomization strategy and cannot represent well the initial node embeddings. Therefore, we generate the user embeddings herein from four perspectives.Definition 7 (user lifetime proportion,ULP).
For∀ui∈U, the user lifetime proportion refers to the ratio of the lifetime of user ui in the system to the lifetime of the entire system, which is denoted as ULPui and calculated by
(7)ULPui=URTui,max−URTui,minSL,where URTui,max and URTui,min represent the latest and the earliest rating time of user ui, respectively. SL represents the lifetime of the entire system.Definition 8 (user nearest neighbor rating synchronization,UNNRS).
For∀ui∈U, the user’s neighbor rating synchronization refers to the average rating synchronization between the user and its neighbors, which is denoted as UNNRSui and calculated by
(8)UNNRSui=∑uj∈NeighboruiURSui,ujNeighborui,where URSui,uj means the synchronization degree of user ui and user uj and Neighborui represents the number of first-order neighbors of user ui.Definition 9 (user nearest neighbor preference similarity,UNNPS).
For∀ui∈U, the user’s nearest neighbor preference refers to the average preference similarity between the user and its direct neighbors, which is denoted as UNNPSui and calculated by
(9)UNNPSui=∑uj∈NeighboruiUPSui,ujNeighborui,where UPSui,uj represents the preference similarity of user ui and user uj.
Based on the above definition, we extract the initial embeddingXu=ULPu,UNNRSu,UNNPSu,UNNSu of user u.


## 3.2.2. Identifying Attack Users Based on the GCN

In previous graph embedding-based group shilling attack detection methods, researchers focused on how to obtain high-quality user node embeddings in the graph. Zhang et al. [19] obtained a low-dimensional embedding vector of nodes in the graph by adopting the Node2vec method that focuses on obtaining the structural characteristics of the user’s topological neighborhood but ignores the characteristic information of the nodes themselves. The existing group attack detection methods also use hard classification, in which members from the same group are classified as genuine users or attackers, resulting in the misclassification of some users [18–21]. To this end, we utilize user high-quality embedding features from both implicit and explicit perspectives by combining user initial embeddings with their higher-order topological neighborhood structures based on the GCN and employing influential node labels to identify attack users.We first extract the high-quality embeddings of user nodes based on the user initial embedding matrixX and the weighted matrix C. The GCN propagation process is formulated as follows:
(10)Hl+1=σD~−1/2C~D~−1/2HlWl,where Hl+1 represents the output after one convolutional layer. Hl is the input of the lth layer. H0=XN×4 represents the user initial embedding matrix. N is the total number of user nodes in the graph, and the feature vector of each user is represented as Xu=ULPu,UNNRSu,UNNPSu,UNNSu. C~=C+IN is the adjacency matrix by adding self-connection. D~ is the degree matrix, and D~ii=∑jA~ij. Wl∈RP×H denotes the parameter matrix to be trained, P represents the length of the feature matrix, and H represents the number of hidden units. σ is the corresponding activation function, such as ReLU⋅=max0,⋅.High-quality user embeddings can be obtained after multiple convolutional layers. We utilize two convolutional layers and ReLU as the activation function.We then calculate the cross-entropy between the real label one-hot vectorY of all influential user nodes and the label vector T predicted by softmax. Subsequently, we utilize the gradient descent method to train the parameter matrix W0 and W1. The formula for calculating the loss function is as follows.
(11)loss=−∑l∈ϒL∑t=1TYlflnZlf,where ϒL is the set of influential user nodes with labels.Finally, the resulting model is expressed as(12)Z=fX,C=softmaxC^ReLUC^XW0W1,whereZ represents the set of user labels after classification by the softmax function. C^=D~−1/2C~D~−1/2 represents the weighted matrix C after symmetric normalization.The algorithm for detecting attackers is described as follows.Algorithm3 is divided into two parts. The first part (lines 1–8) uses GCN semi-supervised classification model training to get the classification result Z of all user nodes. The second part (lines 9–14) filters out the attack users according to the classification result Z.Algorithm 3: Detecting attack users.
Input: the weighted user’s relationship graph G, the influential user’s set IUS, the user initial embedding matrix X, and maximum training epoch KOutput: set of attack users AU1.AU⟵∅2.fork=1 to Kdo3.  computeZ according to Eq. (12)4.  computeloss according to Eq. (11)5.  Gradient zeroing6.  Back propagation calculation gradient value7.  Update parameters by using gradient descent8.end for9.for each z∈Zdo10.ifz=1then11.AU⟵AU∪z12.end if13.end for14.returnAU


## 4. Experimental Evaluation

### 4.1. Experimental Datasets

The following two datasets are utilized as the experimental datasets to evaluate how well the proposed KC-GCN method performs.(1)
Netflix dataset (this dataset was constructed to support the participants in the Netflix prize (http://netflixprize.com)): this dataset contains 1,032,938 ratings and the rating time for 17,770 movies by 480,186 users. The ratings are expressed in integers from 1 to 5, where 1 and 5 indicate disliked and most liked, respectively. We randomly sample 215,884 ratings and the rating time of 2000 users on 4000 movies for use in the experimental dataset. Similar to the previous research, the 2000 extracted users are regarded as genuine users. Multiple group attack profiles are generated and injected into the dataset by using the group shilling attack model introduced in Section 2.1. Under GSAGenl Ave, GSAGenl Ran, and GSAGenl AOP, 10 attack groups are generated each time. The filler size is set to 2%, and the attack size is set to 2.5%, 5%, 7.5%, and 10%. The target items in each attack group are randomly selected from unpopular items. Two target item strategies are set (denoted as ST1 and ST2) to prove the influence of the relationship between the attack users in the same group on the detection performance. ST1 means that all attackers of the same group rate all the target items (number of target items in the experiments: 3). ST2 means that each attacker of the same group rate any three of the five target items. This results to 4∗2∗3∗2=48 experimental datasets generated. We generate loose group attack profiles to verify the universality of the proposed method using the GSAGenl GOAT and GSAGenl Mixed attack models introduced in Section 2.1 and two target item strategies. The dataset generated based on the GSAGenl GOAT attack model specifically contains eight attack groups. The dataset generated based on the GSAGenl Mixed attack model contains 26 attack groups. For convenience of description, under the condition of the target item strategies ST1 and ST2, the shilling attack groups generated are denoted as loosely and tightly coupled shilling groups, respectively(2)
Amazon dataset [36]: this dataset contains 1,205,125 ratings and the rating time on 136,785 products from 645,072 users crawled from Amazon.cn until August 20, 2012. The ratings are integers between 1 and 5, which indicate disliked and most liked, respectively. We evaluate the proposed method using a sampled dataset with 5055 labeled users. The dataset consists of 53,777 ratings of 17,610 products by 3118 genuine users and 1937 attack users


### 4.2. Evaluation Metrics

Three metrics including precision, recall, and F1-measure are used to evaluate the detection performance of the KC-GCN:(13)Precision=TPTP+FP,(14)Recall=TPTP+FN,(15)F1‐measure=2×Precision×RecallPrecision+Recall,where TP represents the number of attackers accurately recognized, FN represents the number of attackers mistaken for genuine users, and FP represents the number of genuine users mistaken for attackers.


### 4.3. Parameter Selection

Figure2 shows how the F1-measure of the KC-GCN is influenced by parameters θ and k on the Netflix and Amazon datasets. In Figure 2(a), the F1-measure of KC-GCN is the highest for detecting the GSAGenl Ran attack on the Netflix dataset under a θ value set to 0.01. Under a smaller θ value, the user relationship graph contains a large number of weak relationship edges, and the community structure is not obvious, leading to a decrease of the detection precision. At a larger θ, the user relationship graph shows an obvious community structure, but some user nodes are filtered from the graph, thereby degrading the detection recall. Moreover, k=4 has a superior detection performance than k=3; therefore, for the Netflix dataset, we set kto 4 and θ to 0.01. Figure 2(b) shows that when θ=0.052 and k=3, the F1-measure of KC-GCN is close to 0.8776 on the sampled Amazon dataset, which is the best. Therefore, we set k to 3 and θ to 0.052 for the sampled Amazon dataset.Figure 2
The influence of parametersθ and k on the F1-measure of KC-GCN.
(a)
Netflix dataset(b)
Amazon dataset


### 4.4. Experimental Results and Analysis

To verify the effectiveness of KC-GCN, we compare the precision, recall, and F1-measure of KC-GCN with the following methods.We assess the precision, recall, and F1-measure of KC-GCN in comparison to the following methods to confirm its efficacy.(1)
Catch the Black Sheep (CBS) [27]: this detection method uses label propagation to iteratively calculate the malicious probability of users and items, which needs the number of spammers and a certain number of seed users in advance. In contrast to the experiments, the number of seed users on the two datasets is consistent with that of our method(2)
GAGE [19]: this is an unsupervised group shilling attack detection method based on graph embedding, which learns the low-dimensional vector representation of nodes in the user relationship graph using Node2vec and obtains attack groups through clustering. In the experiments, the working strategy is adjusted by setting parameters p=7 and q=0.2 and group size GS=30(3)
TP-GBF [20]: this is an unsupervised group shilling attack detection method based on the strong association between the group members and the group behavior features, which uses a topological potential-based community partition algorithm to generate tight subgraphs as candidate groups and cluster attack groups by group behavior features. In the experiments, parameter θ is set to 2, while parameter σ is set to 1 and 0.47 in the Netflix and Amazon datasets, respectively


#### 4.4.1. Comparison of the Detection Results on the Netflix Dataset

Table3 compares KC-GCN and three baseline methods to identify the group shilling attacks with tightly coupled shilling groups at various attack sizes on the Netflix dataset. In Table 3, the precision and recall values of the CBS remain stable for detecting three types of group shilling attacks, only slightly changing the attack size from 2.5% to 10%. The CBS detection performance is much lower than that of KC-GCN when detecting various types of group shilling attacks with tightly coupled shilling groups, albeit the number of attackers is assumed in advance. Meanwhile, the precision values of GAGE under three types of group attacks are the worst, indicating the misclassification of a large number of genuine users as attack ones. This happened because GAGE generates the user node feature vectors using Node2vec, from which a certain degree of randomness may cause some genuine and attack users to be divided into the same candidate group. The detection performance of TP-GBF is better than those of CBS and GAGE when detecting the group shilling attacks with tightly coupled shilling groups. The detection recall was not high under the GSAGenl AOP. Compared with CBS, GAGE, and TP-GBF, KC-GCN shows the best detection performance because it can extract more effective features when correctly differentiating attack profiles from genuine ones. KC-GCN uses a weighted graph to aggregate the neighbor features, thereby effectively avoiding the merging of user features with different labels. It can fully integrate the user node and structural features, further increasing the difference between attackers and normal users. In conclusion, KC-GCN outperforms the baselines for detecting various types of group shilling attacks with tightly coupled shilling groups at various attack sizes on the Netflix dataset.Table 3
Comparison between KC-GCN and other detection methods for detecting group shilling attacks with tightly coupled shilling groups at various attack sizes on the Netflix dataset.
Attack typeMetricsMethodAttack size2.5%5%7.5%10%GSAGenl RanPrecisionCBS0.78110.79790.79740.8019GAGE0.56300.89060.78560.9124TP-GBF0.99441.00000.99870.9973KC-GCN0.99540.99370.99651.0000RecallCBS0.97160.98790.98700.9912GAGE0.99180.99040.98150.9696TP-GBF0.91520.94280.90540.8189KC-GCN0.94870.98220.97250.9886F1-measureCBS0.86600.88280.88210.8866GAGE0.71830.93790.87270.9401TP-GBF0.95320.97060.94980.8993KC-GCN0.97150.98790.98440.9943GSAGenl AvePrecisionCBS0.80450.80760.81250.8098GAGE0.85840.74450.89130.7624TP-GBF0.99440.98701.00000.9989KC-GCN0.99250.99320.99180.9986RecallCBS0.97970.98150.98650.9838F1-measureGAGE0.98760.98560.85180.9748TP-GBF0.93830.91590.89410.9782KC-GCN0.95000.97350.98710.9914CBS0.88350.88610.89110.8884GAGE0.91850.84830.87110.8556TP-GBF0.96550.95010.94410.9884KC-GCN0.97080.98330.98940.9950GSAGenl AOPPrecisionCBS0.69150.70350.72420.7214GAGE0.70510.74790.8060.7507TP-GBF0.97640.98370.98540.9914KC-GCN0.97400.98750.97730.9886RecallCBS0.85120.86570.88660.8843F1-measureGAGE0.98060.93220.97250.9679TP-GBF0.81180.80250.84770.7744KC-GCN0.96150.90800.95560.9255CBS0.76310.77620.79720.7946GAGE0.82030.82990.88150.8456TP-GBF0.88650.88390.91140.8696KC-GCN0.96770.94610.96630.9560Table4 compares the performances of our proposed KC-GCN and three baseline methods in terms of detecting group shilling attacks with loosely coupled shilling groups at various attack sizes on the Netflix dataset. In Table 4, the precision and recall values of CBS under the three attack models significantly decrease when the relationship between users within the attack group is weakened. This indicates that improving the detection performance is difficult when relying only on the rating bias. The GAGE performance becomes better with the attack size increase, but its precision greatly fluctuates because it may falsely identify some normal users as attackers. TP-GBF shows an excellent detection performance under the GSAGenl Ran and GSAGenl Ave attacks but is less effective under the GSAGenl AOP attack. Its detection performance becomes extremely unstable with the change of the attack size. KC-GCN yields the best detection performance among the four methods. It shows a slight decline in detecting loosely coupled shilling groups mainly because the feature differences between the attackers and the genuine users are weakened with a looser relationship in a group. In conclusion, KC-GCN outperforms the baseline methods in detecting various types of group shilling attacks with loosely coupled shilling groups at various attack sizes on the Netflix dataset.Table 4
Comparison between KC-GCN and other detection methods for detecting group shilling attacks with loosely coupled shilling groups at various attack sizes on the Netflix dataset.
Attack typeMetricsMethodAttack size2.5%5%7.5%10%GSAGenl RanPrecisionCBS0.79930.64410.64220.6479GAGE0.87490.81020.87490.9078TP-GBF1.00000.99850.82470.6856KC-GCN0.96830.98520.98580.9593RecallCBS0.97300.78350.77960.7866GAGE0.94590.98680.95090.9933TP-GBF0.85550.82420.84510.7768KC-GCN0.93130.89650.89100.9940F1-measureCBS0.87770.70700.70420.7105GAGE0.90900.88980.91130.9486TP-GBF0.92210.90300.83480.7284KC-GCN0.94940.93990.93600.9763GSAGenl AvePrecisionCBS0.79720.64390.64390.6487GAGE0.63450.85440.84910.9070TP-GBF0.44970.53620.59390.9137KC-GCN0.95420.97830.98000.9600RecallCBS0.97230.78230.78230.7879F1-measureGAGE0.98840.94820.99000.9138TP-GBF0.70550.79770.76870.7704KC-GCN0.98430.91840.91880.9941CBS0.87610.70640.70640.7115GAGE0.77290.89880.91420.9104TP-GBF0.54930.64130.67010.8360KC-GCN0.96900.94740.94840.9767GSAGenl AOPPrecisionCBS0.54010.56240.56550.5569GAGE0.55010.60430.45450.7517TP-GBF0.87330.56430.73590.6868KC-GCN0.95890.92940.96200.9540RecallCBS0.66640.69060.69440.6824F1-measureGAGE0.91510.91700.94440.9372TP-GBF0.77730.72080.76550.7361KC-GCN0.92110.98750.90480.9432CBS0.59670.62000.62330.6133GAGE0.68710.72850.61340.8343TP-GBF0.82250.63300.75040.7106KC-GCN0.93960.95760.93250.9486Figure3 compares the detection results of the four detection methods under the GSAGenl GOAT attack on the Netflix dataset. In the Netflix dataset, the precision, recall, and F1-measure of CBS when identifying tightly and loosely coupled shilling groups are 0.6791, 0.8184, and 0.7422 and 0.6352, 0.7656, and 0.6943, respectively. The detection performance of CBS is constrained by the number and influence of seed users. These results also indicate that CBS can achieve superior detection performance when a closer relationship exists between the group members. The precision, recall, and F1-measure of GAGE for detecting the tightly and loosely coupled shilling groups are 0.4046, 0.6968, and 0.5119 and 0.3157, 0.9120, and 0.4690, respectively. These results indicate that GAGE is less effective on the Netflix dataset under the GSAGenl GOAT attack because the GOAT attack model uses the genuine user profile as a template to generate the attack profile, which is highly similar to the genuine user. However, the user node feature vector obtained by the Node2vec method cannot effectively distinguish genuine users and attackers. For TP-GBF, the precision, recall, and F1-measure of the tightly coupled shilling groups are 0.9905, 0.7269, and 0.8385, respectively, while those for the loosely coupled shilling groups are 0.7036, 0.5000, and 0.5846, respectively. TP-GBF shows an extremely high precision in identifying the tightly coupled shilling groups; nevertheless, the recall of TP-GBF is poor when identifying the loosely coupled shilling groups because it cannot distinguish weakly related attack groups. Figure 3 shows that GAGE and TP-GBF have poor performances when detecting attack groups generated based on GOAT because the profiles generated by GOAT are very similar to the genuine profiles. The precision, recall, and F1-measure of KC-GCN for detecting the tightly coupled shilling groups are 1, 0.9857, and 0.9928, respectively, while those for the loosely coupled shilling groups are 1, 0.9282, and 0.9628, respectively. These results show that KC-GCN is effective and outperforms the three baseline methods for detecting groups under the GSAGenl GOAT attack on the Netflix dataset. In other words, the feature differences between the attackers and the genuine users can be reinforced by using the weighted GCN to aggregate the user node features.Figure 3
Comparison of the detection results of the four detection methods on the Netflix dataset under the GSAGenl GOAT attack.Figure4 compares the detection results of the four detection methods under the GSAGenl Mixed attack on the Netflix dataset. In this dataset, the precision, recall, and F1-measure of CBS for identifying the tightly and loosely coupled shilling groups are 0.8190, 0.9992, and 0.9002 and 0.8191, 0.9996, and 0.9004, respectively. CBS remains stable when detecting the tightly and loosely coupled group shilling attacks. GAGE shows precision, recall, and F1-measure of 0.9542, 0.9275, and 0.9407, respectively, for the tightly coupled shilling groups. For the loosely coupled shilling groups, the precision, recall, and F1-measure of GAGE are 0.8212, 0.9376, and 0.8759, respectively. Its detection performance significantly declines with the weakening user relationships. The main reason for this is that with the weakening user relationship in the group, its spatial structure changes, resulting in obvious changes in the initial user embedding and a significant decrease in the detection performance. The precision, recall, and F1-measure of TP-GBF for detecting tightly coupled shilling groups are 0.7209, 0.8204, and 0.7674, respectively, while those for loosely coupled shilling groups are 0.6620, 0.6141, and 0.6372, respectively. TP-GBF is less effective on the Netflix dataset under the GSAGenl Mixed attack. The precision, recall, and F1-measure of KC-GCN for identifying the tightly and loosely coupled shilling groups are 0.9978, 0.9430, and 0.9696 and 0.9583, 0.9705, and 0.9644, respectively. These findings demonstrate that KC-GCN is effective and outperforms the three baseline methods in terms of precision and F1-measure under the GSAGenl Mixed attack on the Netflix dataset.Figure 4
Comparison of the detection results of the four detection methods on the Netflix dataset under the GSAGenl Mixed attack.Figure5 shows the results of the four detection methods on the sampled Amazon dataset. The detection performance of KC-GCN is superior to that of the baseline methods on this dataset, yielding precision, recall, and F1-measure of 0.9179, 0.8407, and 0.8776, respectively. This indicates that KC-GCN can effectively combine user node and graph structure features to construct new user features by using GCN, which can distinguish genuine and attack users on the sampled Amazon dataset. The precision, recall, and F1-measure of CBS are 0.6836, 0.8323, and 0.7507, respectively. This means that CBS can detect attack users on the Amazon dataset but that its detection performance is determined by the number of seed users. Meanwhile, GAGE exhibits 0.8004, 0.9277, and 0.8594 of precision, recall, and F1-measure, respectively. The result indicates that GAGE has a certain randomness when sampling with Node2vec, which leads to a bias in the division of the candidate groups, and a precision measurement performance is lower than that of KC-GCN. The precision, recall, and F1-measure of TP-GBF are 0.9283, 0.6467, and 0.7623, respectively. This precision is not much higher than that of KC-GCN, but its recall is lower than that of KC-GCN, indicating that TP-GBF may have filtered out some attack groups with a low density. In summary, KC-GCN shows a superior detection performance over GAGE, CBS, and TP-GBF on the sampled Amazon dataset.Figure 5
Comparison of the detection results of the four detection methods on the Amazon dataset.


## 4.1. Experimental Datasets

The following two datasets are utilized as the experimental datasets to evaluate how well the proposed KC-GCN method performs.(1)
Netflix dataset (this dataset was constructed to support the participants in the Netflix prize (http://netflixprize.com)): this dataset contains 1,032,938 ratings and the rating time for 17,770 movies by 480,186 users. The ratings are expressed in integers from 1 to 5, where 1 and 5 indicate disliked and most liked, respectively. We randomly sample 215,884 ratings and the rating time of 2000 users on 4000 movies for use in the experimental dataset. Similar to the previous research, the 2000 extracted users are regarded as genuine users. Multiple group attack profiles are generated and injected into the dataset by using the group shilling attack model introduced in Section 2.1. Under GSAGenl Ave, GSAGenl Ran, and GSAGenl AOP, 10 attack groups are generated each time. The filler size is set to 2%, and the attack size is set to 2.5%, 5%, 7.5%, and 10%. The target items in each attack group are randomly selected from unpopular items. Two target item strategies are set (denoted as ST1 and ST2) to prove the influence of the relationship between the attack users in the same group on the detection performance. ST1 means that all attackers of the same group rate all the target items (number of target items in the experiments: 3). ST2 means that each attacker of the same group rate any three of the five target items. This results to 4∗2∗3∗2=48 experimental datasets generated. We generate loose group attack profiles to verify the universality of the proposed method using the GSAGenl GOAT and GSAGenl Mixed attack models introduced in Section 2.1 and two target item strategies. The dataset generated based on the GSAGenl GOAT attack model specifically contains eight attack groups. The dataset generated based on the GSAGenl Mixed attack model contains 26 attack groups. For convenience of description, under the condition of the target item strategies ST1 and ST2, the shilling attack groups generated are denoted as loosely and tightly coupled shilling groups, respectively(2)
Amazon dataset [36]: this dataset contains 1,205,125 ratings and the rating time on 136,785 products from 645,072 users crawled from Amazon.cn until August 20, 2012. The ratings are integers between 1 and 5, which indicate disliked and most liked, respectively. We evaluate the proposed method using a sampled dataset with 5055 labeled users. The dataset consists of 53,777 ratings of 17,610 products by 3118 genuine users and 1937 attack users


## 4.2. Evaluation Metrics

Three metrics including precision, recall, and F1-measure are used to evaluate the detection performance of the KC-GCN:(13)Precision=TPTP+FP,(14)Recall=TPTP+FN,(15)F1‐measure=2×Precision×RecallPrecision+Recall,where TP represents the number of attackers accurately recognized, FN represents the number of attackers mistaken for genuine users, and FP represents the number of genuine users mistaken for attackers.


## 4.3. Parameter Selection

Figure2 shows how the F1-measure of the KC-GCN is influenced by parameters θ and k on the Netflix and Amazon datasets. In Figure 2(a), the F1-measure of KC-GCN is the highest for detecting the GSAGenl Ran attack on the Netflix dataset under a θ value set to 0.01. Under a smaller θ value, the user relationship graph contains a large number of weak relationship edges, and the community structure is not obvious, leading to a decrease of the detection precision. At a larger θ, the user relationship graph shows an obvious community structure, but some user nodes are filtered from the graph, thereby degrading the detection recall. Moreover, k=4 has a superior detection performance than k=3; therefore, for the Netflix dataset, we set kto 4 and θ to 0.01. Figure 2(b) shows that when θ=0.052 and k=3, the F1-measure of KC-GCN is close to 0.8776 on the sampled Amazon dataset, which is the best. Therefore, we set k to 3 and θ to 0.052 for the sampled Amazon dataset.Figure 2
The influence of parametersθ and k on the F1-measure of KC-GCN.
(a)
Netflix dataset(b)
Amazon dataset


## 4.4. Experimental Results and Analysis

To verify the effectiveness of KC-GCN, we compare the precision, recall, and F1-measure of KC-GCN with the following methods.We assess the precision, recall, and F1-measure of KC-GCN in comparison to the following methods to confirm its efficacy.(1)
Catch the Black Sheep (CBS) [27]: this detection method uses label propagation to iteratively calculate the malicious probability of users and items, which needs the number of spammers and a certain number of seed users in advance. In contrast to the experiments, the number of seed users on the two datasets is consistent with that of our method(2)
GAGE [19]: this is an unsupervised group shilling attack detection method based on graph embedding, which learns the low-dimensional vector representation of nodes in the user relationship graph using Node2vec and obtains attack groups through clustering. In the experiments, the working strategy is adjusted by setting parameters p=7 and q=0.2 and group size GS=30(3)
TP-GBF [20]: this is an unsupervised group shilling attack detection method based on the strong association between the group members and the group behavior features, which uses a topological potential-based community partition algorithm to generate tight subgraphs as candidate groups and cluster attack groups by group behavior features. In the experiments, parameter θ is set to 2, while parameter σ is set to 1 and 0.47 in the Netflix and Amazon datasets, respectively


### 4.4.1. Comparison of the Detection Results on the Netflix Dataset

Table3 compares KC-GCN and three baseline methods to identify the group shilling attacks with tightly coupled shilling groups at various attack sizes on the Netflix dataset. In Table 3, the precision and recall values of the CBS remain stable for detecting three types of group shilling attacks, only slightly changing the attack size from 2.5% to 10%. The CBS detection performance is much lower than that of KC-GCN when detecting various types of group shilling attacks with tightly coupled shilling groups, albeit the number of attackers is assumed in advance. Meanwhile, the precision values of GAGE under three types of group attacks are the worst, indicating the misclassification of a large number of genuine users as attack ones. This happened because GAGE generates the user node feature vectors using Node2vec, from which a certain degree of randomness may cause some genuine and attack users to be divided into the same candidate group. The detection performance of TP-GBF is better than those of CBS and GAGE when detecting the group shilling attacks with tightly coupled shilling groups. The detection recall was not high under the GSAGenl AOP. Compared with CBS, GAGE, and TP-GBF, KC-GCN shows the best detection performance because it can extract more effective features when correctly differentiating attack profiles from genuine ones. KC-GCN uses a weighted graph to aggregate the neighbor features, thereby effectively avoiding the merging of user features with different labels. It can fully integrate the user node and structural features, further increasing the difference between attackers and normal users. In conclusion, KC-GCN outperforms the baselines for detecting various types of group shilling attacks with tightly coupled shilling groups at various attack sizes on the Netflix dataset.Table 3
Comparison between KC-GCN and other detection methods for detecting group shilling attacks with tightly coupled shilling groups at various attack sizes on the Netflix dataset.
Attack typeMetricsMethodAttack size2.5%5%7.5%10%GSAGenl RanPrecisionCBS0.78110.79790.79740.8019GAGE0.56300.89060.78560.9124TP-GBF0.99441.00000.99870.9973KC-GCN0.99540.99370.99651.0000RecallCBS0.97160.98790.98700.9912GAGE0.99180.99040.98150.9696TP-GBF0.91520.94280.90540.8189KC-GCN0.94870.98220.97250.9886F1-measureCBS0.86600.88280.88210.8866GAGE0.71830.93790.87270.9401TP-GBF0.95320.97060.94980.8993KC-GCN0.97150.98790.98440.9943GSAGenl AvePrecisionCBS0.80450.80760.81250.8098GAGE0.85840.74450.89130.7624TP-GBF0.99440.98701.00000.9989KC-GCN0.99250.99320.99180.9986RecallCBS0.97970.98150.98650.9838F1-measureGAGE0.98760.98560.85180.9748TP-GBF0.93830.91590.89410.9782KC-GCN0.95000.97350.98710.9914CBS0.88350.88610.89110.8884GAGE0.91850.84830.87110.8556TP-GBF0.96550.95010.94410.9884KC-GCN0.97080.98330.98940.9950GSAGenl AOPPrecisionCBS0.69150.70350.72420.7214GAGE0.70510.74790.8060.7507TP-GBF0.97640.98370.98540.9914KC-GCN0.97400.98750.97730.9886RecallCBS0.85120.86570.88660.8843F1-measureGAGE0.98060.93220.97250.9679TP-GBF0.81180.80250.84770.7744KC-GCN0.96150.90800.95560.9255CBS0.76310.77620.79720.7946GAGE0.82030.82990.88150.8456TP-GBF0.88650.88390.91140.8696KC-GCN0.96770.94610.96630.9560Table4 compares the performances of our proposed KC-GCN and three baseline methods in terms of detecting group shilling attacks with loosely coupled shilling groups at various attack sizes on the Netflix dataset. In Table 4, the precision and recall values of CBS under the three attack models significantly decrease when the relationship between users within the attack group is weakened. This indicates that improving the detection performance is difficult when relying only on the rating bias. The GAGE performance becomes better with the attack size increase, but its precision greatly fluctuates because it may falsely identify some normal users as attackers. TP-GBF shows an excellent detection performance under the GSAGenl Ran and GSAGenl Ave attacks but is less effective under the GSAGenl AOP attack. Its detection performance becomes extremely unstable with the change of the attack size. KC-GCN yields the best detection performance among the four methods. It shows a slight decline in detecting loosely coupled shilling groups mainly because the feature differences between the attackers and the genuine users are weakened with a looser relationship in a group. In conclusion, KC-GCN outperforms the baseline methods in detecting various types of group shilling attacks with loosely coupled shilling groups at various attack sizes on the Netflix dataset.Table 4
Comparison between KC-GCN and other detection methods for detecting group shilling attacks with loosely coupled shilling groups at various attack sizes on the Netflix dataset.
Attack typeMetricsMethodAttack size2.5%5%7.5%10%GSAGenl RanPrecisionCBS0.79930.64410.64220.6479GAGE0.87490.81020.87490.9078TP-GBF1.00000.99850.82470.6856KC-GCN0.96830.98520.98580.9593RecallCBS0.97300.78350.77960.7866GAGE0.94590.98680.95090.9933TP-GBF0.85550.82420.84510.7768KC-GCN0.93130.89650.89100.9940F1-measureCBS0.87770.70700.70420.7105GAGE0.90900.88980.91130.9486TP-GBF0.92210.90300.83480.7284KC-GCN0.94940.93990.93600.9763GSAGenl AvePrecisionCBS0.79720.64390.64390.6487GAGE0.63450.85440.84910.9070TP-GBF0.44970.53620.59390.9137KC-GCN0.95420.97830.98000.9600RecallCBS0.97230.78230.78230.7879F1-measureGAGE0.98840.94820.99000.9138TP-GBF0.70550.79770.76870.7704KC-GCN0.98430.91840.91880.9941CBS0.87610.70640.70640.7115GAGE0.77290.89880.91420.9104TP-GBF0.54930.64130.67010.8360KC-GCN0.96900.94740.94840.9767GSAGenl AOPPrecisionCBS0.54010.56240.56550.5569GAGE0.55010.60430.45450.7517TP-GBF0.87330.56430.73590.6868KC-GCN0.95890.92940.96200.9540RecallCBS0.66640.69060.69440.6824F1-measureGAGE0.91510.91700.94440.9372TP-GBF0.77730.72080.76550.7361KC-GCN0.92110.98750.90480.9432CBS0.59670.62000.62330.6133GAGE0.68710.72850.61340.8343TP-GBF0.82250.63300.75040.7106KC-GCN0.93960.95760.93250.9486Figure3 compares the detection results of the four detection methods under the GSAGenl GOAT attack on the Netflix dataset. In the Netflix dataset, the precision, recall, and F1-measure of CBS when identifying tightly and loosely coupled shilling groups are 0.6791, 0.8184, and 0.7422 and 0.6352, 0.7656, and 0.6943, respectively. The detection performance of CBS is constrained by the number and influence of seed users. These results also indicate that CBS can achieve superior detection performance when a closer relationship exists between the group members. The precision, recall, and F1-measure of GAGE for detecting the tightly and loosely coupled shilling groups are 0.4046, 0.6968, and 0.5119 and 0.3157, 0.9120, and 0.4690, respectively. These results indicate that GAGE is less effective on the Netflix dataset under the GSAGenl GOAT attack because the GOAT attack model uses the genuine user profile as a template to generate the attack profile, which is highly similar to the genuine user. However, the user node feature vector obtained by the Node2vec method cannot effectively distinguish genuine users and attackers. For TP-GBF, the precision, recall, and F1-measure of the tightly coupled shilling groups are 0.9905, 0.7269, and 0.8385, respectively, while those for the loosely coupled shilling groups are 0.7036, 0.5000, and 0.5846, respectively. TP-GBF shows an extremely high precision in identifying the tightly coupled shilling groups; nevertheless, the recall of TP-GBF is poor when identifying the loosely coupled shilling groups because it cannot distinguish weakly related attack groups. Figure 3 shows that GAGE and TP-GBF have poor performances when detecting attack groups generated based on GOAT because the profiles generated by GOAT are very similar to the genuine profiles. The precision, recall, and F1-measure of KC-GCN for detecting the tightly coupled shilling groups are 1, 0.9857, and 0.9928, respectively, while those for the loosely coupled shilling groups are 1, 0.9282, and 0.9628, respectively. These results show that KC-GCN is effective and outperforms the three baseline methods for detecting groups under the GSAGenl GOAT attack on the Netflix dataset. In other words, the feature differences between the attackers and the genuine users can be reinforced by using the weighted GCN to aggregate the user node features.Figure 3
Comparison of the detection results of the four detection methods on the Netflix dataset under the GSAGenl GOAT attack.Figure4 compares the detection results of the four detection methods under the GSAGenl Mixed attack on the Netflix dataset. In this dataset, the precision, recall, and F1-measure of CBS for identifying the tightly and loosely coupled shilling groups are 0.8190, 0.9992, and 0.9002 and 0.8191, 0.9996, and 0.9004, respectively. CBS remains stable when detecting the tightly and loosely coupled group shilling attacks. GAGE shows precision, recall, and F1-measure of 0.9542, 0.9275, and 0.9407, respectively, for the tightly coupled shilling groups. For the loosely coupled shilling groups, the precision, recall, and F1-measure of GAGE are 0.8212, 0.9376, and 0.8759, respectively. Its detection performance significantly declines with the weakening user relationships. The main reason for this is that with the weakening user relationship in the group, its spatial structure changes, resulting in obvious changes in the initial user embedding and a significant decrease in the detection performance. The precision, recall, and F1-measure of TP-GBF for detecting tightly coupled shilling groups are 0.7209, 0.8204, and 0.7674, respectively, while those for loosely coupled shilling groups are 0.6620, 0.6141, and 0.6372, respectively. TP-GBF is less effective on the Netflix dataset under the GSAGenl Mixed attack. The precision, recall, and F1-measure of KC-GCN for identifying the tightly and loosely coupled shilling groups are 0.9978, 0.9430, and 0.9696 and 0.9583, 0.9705, and 0.9644, respectively. These findings demonstrate that KC-GCN is effective and outperforms the three baseline methods in terms of precision and F1-measure under the GSAGenl Mixed attack on the Netflix dataset.Figure 4
Comparison of the detection results of the four detection methods on the Netflix dataset under the GSAGenl Mixed attack.Figure5 shows the results of the four detection methods on the sampled Amazon dataset. The detection performance of KC-GCN is superior to that of the baseline methods on this dataset, yielding precision, recall, and F1-measure of 0.9179, 0.8407, and 0.8776, respectively. This indicates that KC-GCN can effectively combine user node and graph structure features to construct new user features by using GCN, which can distinguish genuine and attack users on the sampled Amazon dataset. The precision, recall, and F1-measure of CBS are 0.6836, 0.8323, and 0.7507, respectively. This means that CBS can detect attack users on the Amazon dataset but that its detection performance is determined by the number of seed users. Meanwhile, GAGE exhibits 0.8004, 0.9277, and 0.8594 of precision, recall, and F1-measure, respectively. The result indicates that GAGE has a certain randomness when sampling with Node2vec, which leads to a bias in the division of the candidate groups, and a precision measurement performance is lower than that of KC-GCN. The precision, recall, and F1-measure of TP-GBF are 0.9283, 0.6467, and 0.7623, respectively. This precision is not much higher than that of KC-GCN, but its recall is lower than that of KC-GCN, indicating that TP-GBF may have filtered out some attack groups with a low density. In summary, KC-GCN shows a superior detection performance over GAGE, CBS, and TP-GBF on the sampled Amazon dataset.Figure 5
Comparison of the detection results of the four detection methods on the Amazon dataset.


## 4.4.1. Comparison of the Detection Results on the Netflix Dataset

Table3 compares KC-GCN and three baseline methods to identify the group shilling attacks with tightly coupled shilling groups at various attack sizes on the Netflix dataset. In Table 3, the precision and recall values of the CBS remain stable for detecting three types of group shilling attacks, only slightly changing the attack size from 2.5% to 10%. The CBS detection performance is much lower than that of KC-GCN when detecting various types of group shilling attacks with tightly coupled shilling groups, albeit the number of attackers is assumed in advance. Meanwhile, the precision values of GAGE under three types of group attacks are the worst, indicating the misclassification of a large number of genuine users as attack ones. This happened because GAGE generates the user node feature vectors using Node2vec, from which a certain degree of randomness may cause some genuine and attack users to be divided into the same candidate group. The detection performance of TP-GBF is better than those of CBS and GAGE when detecting the group shilling attacks with tightly coupled shilling groups. The detection recall was not high under the GSAGenl AOP. Compared with CBS, GAGE, and TP-GBF, KC-GCN shows the best detection performance because it can extract more effective features when correctly differentiating attack profiles from genuine ones. KC-GCN uses a weighted graph to aggregate the neighbor features, thereby effectively avoiding the merging of user features with different labels. It can fully integrate the user node and structural features, further increasing the difference between attackers and normal users. In conclusion, KC-GCN outperforms the baselines for detecting various types of group shilling attacks with tightly coupled shilling groups at various attack sizes on the Netflix dataset.Table 3
Comparison between KC-GCN and other detection methods for detecting group shilling attacks with tightly coupled shilling groups at various attack sizes on the Netflix dataset.
Attack typeMetricsMethodAttack size2.5%5%7.5%10%GSAGenl RanPrecisionCBS0.78110.79790.79740.8019GAGE0.56300.89060.78560.9124TP-GBF0.99441.00000.99870.9973KC-GCN0.99540.99370.99651.0000RecallCBS0.97160.98790.98700.9912GAGE0.99180.99040.98150.9696TP-GBF0.91520.94280.90540.8189KC-GCN0.94870.98220.97250.9886F1-measureCBS0.86600.88280.88210.8866GAGE0.71830.93790.87270.9401TP-GBF0.95320.97060.94980.8993KC-GCN0.97150.98790.98440.9943GSAGenl AvePrecisionCBS0.80450.80760.81250.8098GAGE0.85840.74450.89130.7624TP-GBF0.99440.98701.00000.9989KC-GCN0.99250.99320.99180.9986RecallCBS0.97970.98150.98650.9838F1-measureGAGE0.98760.98560.85180.9748TP-GBF0.93830.91590.89410.9782KC-GCN0.95000.97350.98710.9914CBS0.88350.88610.89110.8884GAGE0.91850.84830.87110.8556TP-GBF0.96550.95010.94410.9884KC-GCN0.97080.98330.98940.9950GSAGenl AOPPrecisionCBS0.69150.70350.72420.7214GAGE0.70510.74790.8060.7507TP-GBF0.97640.98370.98540.9914KC-GCN0.97400.98750.97730.9886RecallCBS0.85120.86570.88660.8843F1-measureGAGE0.98060.93220.97250.9679TP-GBF0.81180.80250.84770.7744KC-GCN0.96150.90800.95560.9255CBS0.76310.77620.79720.7946GAGE0.82030.82990.88150.8456TP-GBF0.88650.88390.91140.8696KC-GCN0.96770.94610.96630.9560Table4 compares the performances of our proposed KC-GCN and three baseline methods in terms of detecting group shilling attacks with loosely coupled shilling groups at various attack sizes on the Netflix dataset. In Table 4, the precision and recall values of CBS under the three attack models significantly decrease when the relationship between users within the attack group is weakened. This indicates that improving the detection performance is difficult when relying only on the rating bias. The GAGE performance becomes better with the attack size increase, but its precision greatly fluctuates because it may falsely identify some normal users as attackers. TP-GBF shows an excellent detection performance under the GSAGenl Ran and GSAGenl Ave attacks but is less effective under the GSAGenl AOP attack. Its detection performance becomes extremely unstable with the change of the attack size. KC-GCN yields the best detection performance among the four methods. It shows a slight decline in detecting loosely coupled shilling groups mainly because the feature differences between the attackers and the genuine users are weakened with a looser relationship in a group. In conclusion, KC-GCN outperforms the baseline methods in detecting various types of group shilling attacks with loosely coupled shilling groups at various attack sizes on the Netflix dataset.Table 4
Comparison between KC-GCN and other detection methods for detecting group shilling attacks with loosely coupled shilling groups at various attack sizes on the Netflix dataset.
Attack typeMetricsMethodAttack size2.5%5%7.5%10%GSAGenl RanPrecisionCBS0.79930.64410.64220.6479GAGE0.87490.81020.87490.9078TP-GBF1.00000.99850.82470.6856KC-GCN0.96830.98520.98580.9593RecallCBS0.97300.78350.77960.7866GAGE0.94590.98680.95090.9933TP-GBF0.85550.82420.84510.7768KC-GCN0.93130.89650.89100.9940F1-measureCBS0.87770.70700.70420.7105GAGE0.90900.88980.91130.9486TP-GBF0.92210.90300.83480.7284KC-GCN0.94940.93990.93600.9763GSAGenl AvePrecisionCBS0.79720.64390.64390.6487GAGE0.63450.85440.84910.9070TP-GBF0.44970.53620.59390.9137KC-GCN0.95420.97830.98000.9600RecallCBS0.97230.78230.78230.7879F1-measureGAGE0.98840.94820.99000.9138TP-GBF0.70550.79770.76870.7704KC-GCN0.98430.91840.91880.9941CBS0.87610.70640.70640.7115GAGE0.77290.89880.91420.9104TP-GBF0.54930.64130.67010.8360KC-GCN0.96900.94740.94840.9767GSAGenl AOPPrecisionCBS0.54010.56240.56550.5569GAGE0.55010.60430.45450.7517TP-GBF0.87330.56430.73590.6868KC-GCN0.95890.92940.96200.9540RecallCBS0.66640.69060.69440.6824F1-measureGAGE0.91510.91700.94440.9372TP-GBF0.77730.72080.76550.7361KC-GCN0.92110.98750.90480.9432CBS0.59670.62000.62330.6133GAGE0.68710.72850.61340.8343TP-GBF0.82250.63300.75040.7106KC-GCN0.93960.95760.93250.9486Figure3 compares the detection results of the four detection methods under the GSAGenl GOAT attack on the Netflix dataset. In the Netflix dataset, the precision, recall, and F1-measure of CBS when identifying tightly and loosely coupled shilling groups are 0.6791, 0.8184, and 0.7422 and 0.6352, 0.7656, and 0.6943, respectively. The detection performance of CBS is constrained by the number and influence of seed users. These results also indicate that CBS can achieve superior detection performance when a closer relationship exists between the group members. The precision, recall, and F1-measure of GAGE for detecting the tightly and loosely coupled shilling groups are 0.4046, 0.6968, and 0.5119 and 0.3157, 0.9120, and 0.4690, respectively. These results indicate that GAGE is less effective on the Netflix dataset under the GSAGenl GOAT attack because the GOAT attack model uses the genuine user profile as a template to generate the attack profile, which is highly similar to the genuine user. However, the user node feature vector obtained by the Node2vec method cannot effectively distinguish genuine users and attackers. For TP-GBF, the precision, recall, and F1-measure of the tightly coupled shilling groups are 0.9905, 0.7269, and 0.8385, respectively, while those for the loosely coupled shilling groups are 0.7036, 0.5000, and 0.5846, respectively. TP-GBF shows an extremely high precision in identifying the tightly coupled shilling groups; nevertheless, the recall of TP-GBF is poor when identifying the loosely coupled shilling groups because it cannot distinguish weakly related attack groups. Figure 3 shows that GAGE and TP-GBF have poor performances when detecting attack groups generated based on GOAT because the profiles generated by GOAT are very similar to the genuine profiles. The precision, recall, and F1-measure of KC-GCN for detecting the tightly coupled shilling groups are 1, 0.9857, and 0.9928, respectively, while those for the loosely coupled shilling groups are 1, 0.9282, and 0.9628, respectively. These results show that KC-GCN is effective and outperforms the three baseline methods for detecting groups under the GSAGenl GOAT attack on the Netflix dataset. In other words, the feature differences between the attackers and the genuine users can be reinforced by using the weighted GCN to aggregate the user node features.Figure 3
Comparison of the detection results of the four detection methods on the Netflix dataset under the GSAGenl GOAT attack.Figure4 compares the detection results of the four detection methods under the GSAGenl Mixed attack on the Netflix dataset. In this dataset, the precision, recall, and F1-measure of CBS for identifying the tightly and loosely coupled shilling groups are 0.8190, 0.9992, and 0.9002 and 0.8191, 0.9996, and 0.9004, respectively. CBS remains stable when detecting the tightly and loosely coupled group shilling attacks. GAGE shows precision, recall, and F1-measure of 0.9542, 0.9275, and 0.9407, respectively, for the tightly coupled shilling groups. For the loosely coupled shilling groups, the precision, recall, and F1-measure of GAGE are 0.8212, 0.9376, and 0.8759, respectively. Its detection performance significantly declines with the weakening user relationships. The main reason for this is that with the weakening user relationship in the group, its spatial structure changes, resulting in obvious changes in the initial user embedding and a significant decrease in the detection performance. The precision, recall, and F1-measure of TP-GBF for detecting tightly coupled shilling groups are 0.7209, 0.8204, and 0.7674, respectively, while those for loosely coupled shilling groups are 0.6620, 0.6141, and 0.6372, respectively. TP-GBF is less effective on the Netflix dataset under the GSAGenl Mixed attack. The precision, recall, and F1-measure of KC-GCN for identifying the tightly and loosely coupled shilling groups are 0.9978, 0.9430, and 0.9696 and 0.9583, 0.9705, and 0.9644, respectively. These findings demonstrate that KC-GCN is effective and outperforms the three baseline methods in terms of precision and F1-measure under the GSAGenl Mixed attack on the Netflix dataset.Figure 4
Comparison of the detection results of the four detection methods on the Netflix dataset under the GSAGenl Mixed attack.Figure5 shows the results of the four detection methods on the sampled Amazon dataset. The detection performance of KC-GCN is superior to that of the baseline methods on this dataset, yielding precision, recall, and F1-measure of 0.9179, 0.8407, and 0.8776, respectively. This indicates that KC-GCN can effectively combine user node and graph structure features to construct new user features by using GCN, which can distinguish genuine and attack users on the sampled Amazon dataset. The precision, recall, and F1-measure of CBS are 0.6836, 0.8323, and 0.7507, respectively. This means that CBS can detect attack users on the Amazon dataset but that its detection performance is determined by the number of seed users. Meanwhile, GAGE exhibits 0.8004, 0.9277, and 0.8594 of precision, recall, and F1-measure, respectively. The result indicates that GAGE has a certain randomness when sampling with Node2vec, which leads to a bias in the division of the candidate groups, and a precision measurement performance is lower than that of KC-GCN. The precision, recall, and F1-measure of TP-GBF are 0.9283, 0.6467, and 0.7623, respectively. This precision is not much higher than that of KC-GCN, but its recall is lower than that of KC-GCN, indicating that TP-GBF may have filtered out some attack groups with a low density. In summary, KC-GCN shows a superior detection performance over GAGE, CBS, and TP-GBF on the sampled Amazon dataset.Figure 5
Comparison of the detection results of the four detection methods on the Amazon dataset.


## 5. Conclusions and Future Work

In this work, we put forward a two-stage semi-supervised model to validly detect various types of group shilling attacks on recommender systems. First, we construct a user relationship graph and spot the influential users. In the graph, the edge weight is calculated by analyzing the user similarity over suspicious time intervals on each item. Next, we generate the initial user embeddings based on the proposed four indicators describing the behavior difference between attack and genuine users. A GCN-based classifier is trained, and the attack users are detected based on the influential user labels. The experimental results prove the effectiveness and the generality of KC-GCN.In the future work, we will automatically determine the labels of most influential users by further analyzing the structural properties of the weighted user relationship graph. We will also study the multiaspect data [37] to further help identify users of group shilling attack.



---

*Source: 2854874-2023-02-16.xml*