Profile Injection Attacks Research Articles

Impact of Trust Adjustment Factor on Artificial Intelligence Driven Collaborative Filtering Recommendation Algorithm

Trust on artificial intelligence (AI) is a major concern in the contemporary computing paradigms. Studies show that AI systems may outsmart humans, leading to an ultimate extinction of mankind. Therefore, the behavior of these systems must be controlled to avert potential use by bad actors. Recommender systems, which are variant of AI products, learn shoppers past data and predict items that shoppers may prefer. This helps in identifying items that may be recommended to the active user. Studies indicate that classical recommender systems allow untrustworthy data, tempting unscrupulous dealers to misdirect the learning process. This action potentially defrauds buyers. Our study introduces trust adjustment factor into the AI learning pipeline. We conducted experiments to test the difference in robustness of the trust-enhanced collaborative filtering recommendation algorithm against the classical counterpart. Prediction shift and hit ratios for the two sets of algorithms were measured when subjected to various forms of profile injection attacks. We found that the trust-enhanced variant of the algorithm significantly outperforms classical collaborative filtering recommendation in terms of robustness by up to 52% when measured by prediction shift and by up to 18% when measured by hit ratio. Confirmed by t-test, results suggest that embedding trust adjustment factor into recommender systems improves its robustness.

Trust Enhanced Collaborative Filtering Recommendation Algorithm

Recommender systems have been designed to suggest to users the suitable items based on the user profiles and therefore reduce the danger of information overload, however, the recommender systems are still prone to profile injection attacks which then exposes a user to a potential fraud, which leads to a sense of untrustworthiness and reduced accuracy due to malicious manipulations. In this research, we developed a model which should be embedded into the recommendation pipeline in order to improve trustworthiness of recommender system output. We extended the classical collaborative recommendation algorithm by adding a new trust parameter and then compare the prediction accuracy of the trust enhanced collaborative filtering algorithm against that of the classical collaborative filtering algorithm using Mean Absolute Error and Root Mean Square Error and then test the hypothesis using t-test. We found that the new trust parameter improves the accuracy of collaborating filtering algorithm significantly.

Applying machine learning enabled myriad fragment empirical modes in 5G communications to detect profile injection attacks

Applying machine learning enabled myriad fragment empirical modes in 5G communications to detect profile injection attacks

On the feasibility of crawling-based attacks against recommender systems1

Nowadays, online services, like e-commerce or streaming services, provide a personalized user experience through recommender systems. Recommender systems are built upon a vast amount of data about users/items acquired by the services. Such knowledge represents an invaluable resource. However, commonly, part of this knowledge is public and can be easily accessed via the Internet. Unfortunately, that same knowledge can be leveraged by competitors or malicious users. The literature offers a large number of works concerning attacks on recommender systems, but most of them assume that the attacker can easily access the full rating matrix. In practice, this is never the case. The only way to access the rating matrix is by gathering the ratings (e.g., reviews) by crawling the service’s website. Crawling a website has a cost in terms of time and resources. What is more, the targeted website can employ defensive measures to detect automatic scraping. In this paper, we assess the impact of a series of attacks on recommender systems. Our analysis aims to set up the most realistic scenarios considering both the possibilities and the potential attacker’s limitations. In particular, we assess the impact of different crawling approaches when attacking a recommendation service. From the collected information, we mount various profile injection attacks. We measure the value of the collected knowledge through the identification of the most similar user/item. Our empirical results show that while crawling can indeed bring knowledge to the attacker (up to 65% of neighborhood reconstruction on a mid-size dataset and up to 90% on a small-size dataset), this will not be enough to mount a successful shilling attack in practice.

Three Birds With One Stone: User Intention Understanding and Influential Neighbor Disclosure for Injection Attack Detection

Recommender system, as a data-driven way to help customers locate products that match their interests, is increasingly critical for providing competitive customer suggestions in many web services. However, recommender systems are highly vulnerable to malicious injection attacks due to their fundamental vulnerabilities and openness. With the endless emergence of new attacks, how to provide a feasible way for defending different malicious threats against online recommendations is still an under-explored issue. In this paper, we explore a new way to defend malicious injection attacks through user intention understanding and influential neighbour disclosure. Specifically, we propose a detection approach, termed <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">TBOS</i> ( <underline xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">T</u> hree <underline xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">B</u> irds with <underline xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">O</u> ne <underline xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">S</u> tone), to deal with different malicious threats. In <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">TBOS</i> , we first develop the discrimination of attack target by combining global influence evaluation and risk attitude estimation of users. In order to make <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">TBOS</i> controllable, second, we propose to incorporate an optimal denoising mechanism to remove disturbed information before detection. To enhance the representativeness and predictability of detection model, finally, we propose to leverage a behavioral label propagation mechanism based on constructed label space for the determination of malicious injection behaviors. Extensive experiments on both synthetic and real data demonstrate that <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">TBOS</i> outperforms all baselines in different cases. Particularly, the detection performance of <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">TBOS</i> can achieve an improvement of 6.08% FAR (false alarm rate) for optimal-injection attacks, an improvement of 3.83% FAR in average for co-visitation injection attacks, as well as an improvement of 2.3% for profile injection attacks over benchmarks in terms of FAR while keeping the highest DR (detection rate). Additional experiments on real-world data show that <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">TBOS</i> brings an improvement with the advantage of 6.5% FAR in average compared with baselines.

A METHOD OF COMPUTER SIMULATION MODELING OF USER AND BOT BEHAVIOR IN A RECOMMENDATION SYSTEM USING THE GRAPH DATABASE NEO4J

The subject matter of the article is the process of computer simulation modeling of complex networks. The goal is to develop a method of computer simulation modeling of ordinary user and bot behavior in a recommendation system based on the theory of complex networks to test the accuracy and robustness of various algorithms for generating recommendations. The tasks to be solved are: to develop a computer simulation model of user and bot behavior in a recommendation system with the ability to generate datasets for testing recommendation generation algorithms. The methods used are: graph theory, theory of complex networks, statistics theory, probability theory, methods of object-oriented programming and methods of working with graph databases. Results. A method of computer simulation modeling of users and objects in a recommender system was proposed, which consists of generating the structure of the social graph of a recommender system and simulating user and bot behavior in it. A series of experiments to test the performance of the developed computer simulation model was carried out. During the experiments, working and testing datasets were generated. Based on the working datasets, the preferences of users by the method of collaborative filtering were predicted. Based on testing datasets, the accuracy of prediction predictions was checked. The results of the experiments showed that the jitter of the investigated values of the Precision, Recall and RMSE of prediction predictions in most practical cases confidently fits within the allowable fluctuation limits, and therefore the users' behavior in computer simulation model was not random and it real users' behavior with certain preferences was simulated. This confirms the reliability of the developed computer simulation model of a recommendation system. Conclusions. A method of computer simulation modeling of user and bot behavior in a recommendation system, which allows generating datasets for testing the algorithms for generating recommendations, was proposed. The developed method makes it possible to simulate the behavior of both ordinary users and bots, which makes it possible to create datasets for testing the robustness of recommender systems to information attacks, as well as for testing the effectiveness of methods for detecting and neutralizing botnets. The structure of relations between users and objects of the recommender system was modeled using the theory of complex networks. Information attacks of bots were modeled on the basis of known models of profile-injection attacks on recommender systems.

IMPACT ANALYSIS OF PROFILE INJECTION ATTACKS IN RECOMMENDER SYSTEM

Recommender systems are the backbone of all the prediction-based service platforms e.g. Facebook, Amazon, LinkedIn etc. Even companies now a days are using the recommender systems to show users personalized ads. These service providers capture the right audience for their services/ products and hence, improve overall sales. Social networking platforms are using recommender systems for connecting people of similar interests which is almost impossible without recommender systems. Collaborative filtering-based recommender system is most widely used recommender system. It is used in this research to predict the rating for a specific movie. Accuracy of the prediction define the performance of the overall system. The quality of predictions is degraded by the attackers by injection of fake profiles. In this paper, the various types of profile injection attacks are explained and the attack scenario gets extended to measure the performance of these attacks. Empirical results on the real world publicly available data set shows that these attacks are highly vulnerable. The impact of these attacks in several conditions has been measured and it is tried to find the scenarios where these attacks are more powerful.

Speed up Differential Evolution for ranking of items in recommendation systems

Recommendation systems can suggest users list of items they have not yet seen but might be interested in. To improve the quality of the generated recommendations, different techniques are often used which try to personalize recommendations. Usually user preferences are stored in the form of a vector in which individual values describe to what extent a given feature is desired by the user. To find this vector, metaheuristic algorithms can be used, however their main drawback is their computational complexity. Therefore, in this paper, a modification of the Differential Evolution algorithm is proposed to enable faster computation of the ranking score for each item in the system, which is used to create a recommendation list. Experiments have been performed on the current MovieLens 25m database and they show that our modification can significantly speed up the process of finding a preference vector, without losing their quality for the top-N recommendation task. We will also address the vulnerability of recommendation systems to profile injection attacks, as a result of which an attacker can influence the generated recommendations.

Developing a model of the dynamics of states of a recommendation system under conditions of profile injection attacks

The recommendation systems used to form a news feed in social networks or to create recommendation lists on content websites or Internet stores are often exposed to information profile injection attacks. These attacks are aimed at changing ratings, and thus at changing the frequency of appearing in recommendations, certain objects of a system. This can lead to threats to users’ information security and losses of the system owners. There are methods to detect attacks in recommendation systems, but they require permanent repetitive checks of all users’ profiles, which is a rather resource-intensive operation. At the same time, these methods do not contain any proposals as for determining the optimal frequency of attack checks. However, a properly chosen frequency of such checks will not overload a system too much and, at the same time, will provide an adequate level of its operational security. A mathematical model of the dynamics of states of a recommendation system under conditions of an information attack with the use of the mathematical apparatus of Markovian and semi-Markovian processes was developed. The developed model makes it possible to study the influence of profile injection attacks on recommendation systems, in particular, on their operation efficiency and amount of costs to ensure their information security. The practical application of the developed model enables calculating for recommendation systems the optimum frequency of information attack check, taking into consideration the damage from such attacks and costs of permanent inspections. Based on the developed mathematical model, the method for determining total costs of a recommendation system as a result of monitoring its own information security, neutralization of bot-networks activity and as a result of information attacks was proposed. A method for determining the optimal frequency of checking a recommendation system for information attacks to optimize the overall costs of a system was developed. The application of this method will enable the owners of websites with recommendation systems to minimize their financial costs to provide their information security

Identification of Malicious Injection Attacks in Dense Rating and Co-Visitation Behaviors

Personalized recommender systems are pervasive in different domains, ranging from e-commerce services, financial transaction systems to social networks. The generated ratings and reviews by users toward products are not only favourable to make targeted improvements on the products for online businesses, but also beneficial for other users to get a more insightful review of the products. In reality, recommender systems can also be deliberately manipulated by malicious users due to their fundamental vulnerabilities and openness. However, improving the detection performance for defending malicious threats including profile injection attacks and co-visitation injection attacks is constrained by the challenging issues: (1) various types of malicious attacks in real-world data coexist; (2) it is difficult to balance the commonality and speciality of rating behaviors in terms of accurate detection; and (3) rating behaviors between attackers and anchor users caused by the consistency of attack intentions are extremely similar. In this article, we develop a unified detection approach named IMIA-HCRF, to progressively discriminate malicious injection behaviors for recommender systems. First, disturbed data are empirically eliminated by implementing both the construction of association graph and enhancement of dense behaviors, which can be adapted to different attacks. Then, the smooth boundary of dense rating (or co-visitation) behaviors is further segmented using higher order potentials, which is finally leveraged to determine the concerned injection behaviors. Extensive experiments on both synthetic data and real-world data demonstrate that the proposed IMIA-HCRF outperforms all baselines on various metrics. The detection performance of IMIA-HCRF can achieve an improvement of 7.8% for mixed profile injection attacks as well as 6% for mixed co-visitation injection attacks over the baselines in terms of FAR (false alarm rate) while keeping the highest DR (detection rate). Additional experiments on real-world data show that IMIA-HCRF brings an improvement with the advantage of 11.5% FAR in average compared with the baselines.

Unsupervised and supervised methods for the detection of hurriedly created profiles in recommender systems

Recommender systems try to provide users with accurate personalized suggestions for items based on an analysis of previous user decisions and the decisions made by other users. These systems suffer from profile injection attacks, where malicious profiles are generated in order to promote or demote a particular item introducing abnormal ratings. The problem of automatic detection of such malicious profiles has been recently addressed by a great number of authors in the literature using supervised and unsupervised approaches. In this paper, we propose a framework to identify anomalous rating profiles, where each attacker (outlier) hurriedly creates profiles that inject into the system an unspecified combination of random ratings and specific ratings, without any prior knowledge of the existing ratings. This attack is a superset of the two different attacks (Uniform and Delta) proposed in Harper et al. (ACM Trans Interact Intell Syst 5(4):19, 2016) making the attack model more realistic and its detection more challenging. The proposed detection method is based on several attributes related to the unpredictable behavior of the outliers in a validation set, on the user-item rating matrix, on the similarity between users and on the filler items. In this work, we propose a new attribute (RIS) to capture the randomness in item selection of the abnormal profiles. In this work, three different systems are proposed: (1) a probabilistic framework that estimates the probability of a user to be an outlier by combining several features in a completely unsupervised way. (2) An unsupervised clustering system based on the k-means algorithm that automatically spots the spurious profiles. (3) A supervised framework that uses a random forest classifier for cases where labeling sample data is available. Experimental results on the MovieLens and the Small Netflix datasets demonstrate the high performance of the proposed methods as well as the discrimination accuracy of the proposed features.

L 2, 1‐Norm Regularized Matrix Completion for Attack Detection in Collaborative Filtering Recommender Systems

Collaborative filtering recommender systems (CFRSs) are known to be highly vulnerable to profile injection attacks, in which malicious users insert fake profiles into the rating database in order to bias the systems' output, since their openness, and attack detection is still a challenging problem in CFRSs. In order to provide more accurate recommendations, many schemas have been proposed to detect such shilling attacks. However, almost all of them are proposed to detect one or several specific attack types, and few of them can handle hybrid attack types, which usually happen in practice. With this problem in mind, we propose a novel L2, 1-norm regularized matrix completion incorporating prior information (LRMCPI) model to detect shilling attacks by combining matrix completion and L2, 1-norm. The proposed LRMCPI formalizes the attack detection problem as a missing value estimation problem, and it is appropriate because the user-item rating matrix is approximately low-rank and attack profiles could be considered as structural noise. The proposed LRMCPI model not only can better recover the rating matrix using correct rating value but also can detect the positions where the attackers are injected. We evaluate our model on three well-known data sets with different density and the experimental results show that our model outperforms baseline algorithms in both single and hybrid attack types.

ДОСЛІДЖЕННЯ РОБАСТНОСТІ РЕКОМЕНДАЦІЙНИХ СИСТЕМ З КОЛАБОРАТИВНОЮ ФІЛЬТРАЦІЄЮ ДО ІНФОРМАЦІЙНИХ АТАК

In this article research to the robustness of recommendation systems with collaborative filtering to information attacks, which are aimed at raising or lowering the ratings of target objects in a system. The vulnerabilities of collaborative filtering methods to information attacks, as well as the main types of attacks on recommendation systems - profile-injection attacks are explored. Ways to evaluate the robustness of recommendation systems to profile-injection attacks using metrics such as rating deviation from mean agreement and hit ratio are researched. The general method of testing the robustness of recommendation systems is described. The classification of collaborative filtration methods and comparisons of their robustness to information attacks are presented. Collaborative filtering model-based methods have been found to be more robust than memorybased methods, and item-based methods more resistant to attack than user-based methods. Methods of identifying information attacks on recommendation systems based on the classification of user-profiles are explored. Metrics for identify both individual bot profiles in a system and a group of bots are researched. Ways to evaluate the quality of user profile classifiers, including calculating metrics such as precision, recall, negative predictive value, and specificity are described. The method of increasing the robustness of recommendation systems by entering the user reputation parameter as well as methods for obtaining the numerical value of the user reputation parameter is considered. The results of these researches will in the future be directed to the development of a program model of a recommendation system for testing the robustness of various algorithms for collaborative filtering to known information attacks.

Shilling attacks against collaborative recommender systems: a review

Collaborative filtering recommender systems (CFRSs) have already been proved effective to cope with the information overload problem since they merged in the past two decades. However, CFRSs are highly vulnerable to shilling or profile injection attacks since their openness. Ratings injected by malicious users seriously affect the authenticity of the recommendations as well as users’ trustiness in the recommendation systems. In the past two decades, various studies have been conducted to scrutinize different profile injection attack strategies, shilling attack detection schemes, robust recommendation algorithms, and to evaluate them with respect to accuracy and robustness. Due to their popularity and importance, we survey about shilling attacks in CFRSs. We first briefly discuss the related survey papers about shilling attacks and analyze their deficiencies to illustrate the necessity of this paper. Next we give an overall picture about various shilling attack types and their deployment modes. Then we explain profile injection attack strategies, shilling attack detection schemes and robust recommendation algorithms proposed so far in detail. Moreover, we briefly explain evaluation metrics of the proposed schemes. Last, we discuss some research directions to improve shilling attack detection rates robustness of collaborative recommendation, and conclude this paper.

Uncovering anomalous rating behaviors for rating systems

Abstract Personalization collaborative filtering recommendation plays a key component in online rating systems, which also suffers from profile injection attacks in reality. Although anomalous rating detection for online rating systems has attracted increasing attention in recent years, detection performance of the existing methods has not reached an end. Eliminating the impact of interfering information on anomaly detection is a crucial issue for reducing false alarm rates. Moreover, detecting anomalous ratings for unlabeled and real-world data is always a big challenge. In this paper, we investigate a two-stage detection framework to spot anomalous rating profiles. Firstly, interfering rating profiles are determined by comprehensively analyzing the distributions of user activity, item popularity and special ratings in order to eliminate sparse ratings. Based on the reserved rating profiles, combining target item analysis and non-linear structure clustering is then adopted to further determine the concerned attackers. Extensive experimental comparisons in diverse attacks demonstrate the effectiveness of the proposed method compared with competing benchmarks. Additionally, discovering interesting findings including anomalous ratings and items on two real-world datasets, Amazon and TripAdvisor, is also investigated.

Evaluating Prediction Error for Anomaly Detection by Exploiting Matrix Factorization in Rating Systems

A rating system provides rating data about products or services, which is a key feature of e-commerce websites such as Amazon, TripAdvisor, and so on. In reality, rating systems generally suffer from threats of profile injection attacks or anomalous ratings due to the integration of collaborative recommendation techniques. To reduce these risks, a number of detection methods have been developed for defending such potential threats. However, they either directly calculate similarity between users or items to recognize attack profiles and genuine profiles, or utilize supervised learning methods by extracting features from user profiles for anomaly detection. In this paper, we propose a stepwise detection method to spot anomalous ratings or attacks, which bypasses the hard problems of similarity calculation and feature extraction. First, a part of samples are randomly selected from original user profiles for constructing a sub-matrix (rating matrix). A fast max-margin matrix factorization is then employed to make rating prediction. After that, suspected items can be captured by comprehensively analyzing both the distributions of mean prediction errors of items and users. Finally, anomalous ratings and potential attackers can be directly returned. Extensive experiments on MovieLens-100K data set demonstrate the effectiveness of the proposed approach compared with benchmarked methods. It is noteworthy that suspected items on a large-scale real-world data set, Amazon data, are detected by the proposed method and further analyzed from diverse perspectives, including rating distribution, rating intention, and time series analysis.

Clustering Approach to detect Profile Injection Attacks in Recommender System

Clustering Approach to detect Profile Injection Attacks in Recommender System

Robust collaborative filtering based on non-negative matrix factorization and R1-norm

Collaborative filtering systems are vulnerable to shilling attacks or profile injection attacks in which malicious users can deliberately manipulate the systems’ recommendation output by inserting a number of fake profiles. To address this issue, some robust collaborative filtering methods based on matrix factorization have been proposed. However, these methods suffer from low robustness and recommendation accuracy because they use the squared error function as the loss function that can be easily dominated by large residuals. In this paper we propose a robust collaborative filtering method based on non-negative matrix factorization and R1-norm. Firstly, we introduce R1-norm to construct a robust non-negative matrix factorization model for collaborative filtering and make an analysis of the stability of the model. Secondly, we propose an iterative optimization method of feature matrices based on the iterative updating algorithm of non-negative matrix factorization, which guarantees that the predicted ratings are accurate and non-negative. Finally, we devise a robust collaborative filtering algorithm based on the proposed model. Experimental results on two different datasets show that the proposed method can improve the robustness and recommendation accuracy.

SVM-TIA a shilling attack detection method based on SVM and target item analysis in recommender systems

Due to the open nature of recommender systems, collaborative recommender systems are vulnerable to profile injection attacks, in which malicious users inject attack profiles into the rating matrix in order to bias the systems’ ranking list. Recommender systems are highly vulnerable to shilling attacks, both by individuals and groups. Most of previous research focuses only on the differences between genuine profiles and attack profiles, ignoring the group characteristics in attack profiles of an attack. There also exist class unbalance problems in supervised detecting methods, the detecting performance is not as good when the amount of samples of attack profiles in training set is smaller. In this paper, we study the use of SVM based method and group characteristics in attack profiles. A two phase detecting method SVM-TIA is proposed based on these two methods. In the first phase, Borderline-SMOTE method is used to alleviate the class unbalance problem in classification; a rough detecting result is obtained in this phase; the second phase is a fine-tuning phase whereby the target items in the potential attack profiles set are analyzed. We conduct tests on the MovieLens 100K Dataset and compare the performance of SVM-TIA with other shilling detecting methods to demonstrate the effectiveness of the proposed approach.

Supervised approach for detecting average over popular items attack in collaborative recommender systems

Recent research has shown the significant vulnerabilities of collaborative recommender systems in the face of profile injection attacks, in which malicious users insert fake profiles into the rating database in order to bias the system's output. To reduce this risk, a number of approaches have been proposed to detect such attacks. Although the existing detection approaches can detect the standard type of these attacks effectively, they perform badly when detecting the recently proposed obfuscated type of these attacks, for example, average over popular items (AoP) attack. With this problem in mind, in this study the author propose a supervised approach to detect such attack. First, he uses the theory of term frequency inverse document frequency (TFIDF) to extract the features of AoP attack. Second, he uses the training set to train support vector machine (SVM) to generate a SVM-based classifier. Finally, he uses the generated classifier to detect the AoP attack. The experimental results on MovieLens dataset show that the proposed approach can detect AoP attack with high recall and precision.