The document discusses shilling attacks on recommender systems. It notes that while recommender systems help users find relevant information, they are vulnerable to shilling attacks where malicious users insert biased data to influence recommendations. Different types of attacks aim to increase recommendations for targeted items (push attacks) or decrease recommendations (nuke attacks). The document evaluates the effectiveness of various attack models on user-user and item-item collaborative filtering algorithms. It is found that attacks are more effective on item-item algorithms and for new, low-information items. The document concludes by discussing metrics to potentially detect shilling attacks and improve the security of recommender systems.

1. SUBMITTED BY:-KARAN GOYAL
9911103474
F-3
Shilling Attacks on
Recommender Systems

2. Introduction
 One area of research which has recently gained importance is the
security of Recommender Systems. Recommender Systems are
widely used to help deal with the problem of information overload,
by making personalized recommendations for information, products
and services during a live interaction.
 In recent years, Automated Collaborative Filtering (ACF) has been
successfully employed in them in order to help users deal with the
number of options available to them, by making high quality
recommendations.
 Recommender Systems are not beneficial only to the consumers of
the product but also to the retail companies that produce those
products, since recommendations of their products will in turn result
in increased sales and customer satisfaction.

3. Existing Problems
 However, the open nature of these systems make them vulnerable to
Shilling attacks in which malicious users may influence the system by
inserting biased data into the system, in order to push the prediction
of some targeted items.
 Unscrupulous producers attack such systems to have their products
recommended more often than those of their competitors.
 They hire agents called shills that manipulate the system by giving
false opinion about the target products and mislead the consumers.
 Such attacks may lead to erosion of user’s trust in the objectivity and
accuracy of the system.

4. An attack against a collaborative filtering recommender system consists of a set
of attack profiles, each containing biased rating data associated with a fictitious
user identity, and including a target item to be promoted or demoted. Profile
injection attacks can be categorized based on the knowledge required by the
attacker to mount the attack, the intent of a particular attack, and the size of the
attack. From the perspective of the attacker, the best
A second dimension of an attack is the intent of an attacker.Two simple intents
are push and nuke. An attacker may insert profiles to make a product more likely
(push) or less likely (nuke) to be recommended.
 Push Attack Models:
Two basic Push attack models are the random and average attack models. Both
of these attack models involve the generation of attack profiles using randomly
assigned ratings to the filler items in the profile. In the random attack the
assigned ratings are based on the overall distribution of user ratings in the
database, while in the average attack the rating for each filler item is computed
based on its average rating for all users.
 Nuke Attack Models:
Random and average attack models can also be used for nuking a target item.
This can be accomplished by associating minimum-rating with the target item
instead of maximum-rating, as in push attack models. However, attack models
that are effective for pushing items are not necessarily effective for nuke attacks.
Another possible aim of an attacker might be simple vandalism—to make the
entire system functions poorly. Our work here assumes a more focused economic
motivation on the part of the attacker, namely, that there is something to be
gained by promoting or demoting a particular product.We are concerned
primarily with the “win” for the attacker: the change in the predicted rating of the
attacked item.

5. Proposed Solution
 This paper focuses on the algorithms being used in recommender
systems, effectiveness of the shilling attacks on recommender
systems and detect ability of these attacks
 Recommender Systems are a powerful new technology for
extracting additional value for a business from its user databases.
Some conclusions have been drawn that prevent shilling attacks
on the systems.

6. They Are:-
 Prefer item-item: Results show that item-based techniques hold the
promise of allowing collaborative-based algorithms to scale to large
datasets and at the same time produce high-quality
recommendations. The shilling attacks are more effective in the case
of item-item algorithms than user-user.
 Use recommendation metrics: The paper proposed and investigated
the use of statistical metrics for detecting the patterns of shilling
attacks in a recommender system. MovieLens database has been
evaluated by these metrics and it is shown that the attackers do
indeed exhibit special, noticeable patterns.

7.  Watch Metrics but worry anyway The lower the MAE, the more
accurately the recommendations engine predicts user ratings.
Although MAE is a standard for evaluating the effectiveness of the ACF
algorithms, it is not of much use to the end users since it generally
gives the users a predicted rating of an item whereas the users prefer
system based recommendations.
 Protect new items: Attacks that target recommendation frequency of
low-information items (i.e. ones with few ratings) are more effective
than attacks against high-information items. Thus, new items tend to
get attacked more easily. It is in an attacker's best interest to restrict
the effect of an attack to a small target set of items in order to be more
subtle and try to avoid detection by the system operators.

8. Implementation details and
issues
ACF ALGORITHMSUSED
Collaborative filtering (CF) is the process of filtering for information or patterns using
techniques involving collaboration among multiple agents, viewpoints, data sources,
etc. It’s a method of making automatic predictions (filtering) about the interests of a
user by collecting taste information from many users (collaborating). Applications of
collaborative filtering typically involve very large data sets. Collaborative filtering
methods have been applied to many different kinds of data including sensing and
monitoring data - such as in mineral exploration, environmental sensing over large
areas or multiple sensors. The underlying assumption of CF approach is that those
who agreed in the past tend to agree again in the future. Collaborative filtering has
the advantage that such interactions can be scaled to groups of thousands or even
millions.
The paper largely focuses on personalized recommender systems. In particular ones
that use automated collaborative filtering (ACF), which refers to algorithms that
generate recommendations on the basis that people who have expressed similar
opinions in the past are likely to share opinions in the future. These algorithms
produce recommendations based on the intuition that similar users have similar
tastes. That is, people who you share common likes and dislikes with are likely to be a
good source for recommendations.

9. K-NN USER-USER
 K-NNUSER-USER
This algorithm belongs to the memory-based class of CF algorithms.The standard
collaborative filtering algorithm is based on user-to-user similarity. Predictions under
this algorithm are computed as a two step process. First, the similarities between the
target user and all other users who have rated the target item are computed — most
commonly using the Pearson correlation coefficient.Then the prediction for the
target item is computed using at most k closest users found from step one, and by
applying a weighted average of deviations from the selected users’ means.
 The user-user algorithm uses the following formula to compute a predicted rating p
for a user u on an item i.Here, ru is user u's average rating over all rated items, wu,v is
the mean-adjusted Pearson correlation (similarity) between users u and v, and Uu,i is
user u's neighbourhood with respect to item I and consists of the k users who have
rated i and have the greatest Pearson correlation with u. k is a tuneable parameter
and represents the number of neighbours.

10.  K-NN ITEM-ITEM
This algorithm is also an instance of a memory-based approach. Predictions
are computed by first computing item-item similarities.Once the item-item
similarities are computed, the rating space of the target user is examined to
find all the rated items similar to the target item.The weighted average is
then performed that generates the prediction.Typically, a threshold of k
similar items are used rather than all.The formula used to compute a
prediction in item-item is:
Where J is the set of k similar items, ru,j is the prediction for the user on item j,
and simI,j is the similarity between items i and j.

11. HYPOTHESES
 HYPOTHESIS 1: Different ACF algorithms respond differently to
shilling attacks.
 HYPOTHESIS 2: Shilling attacks affect recommender algorithms
differently from prediction algorithms.
 HYPOTHESIS 3: Shilling attacks are not detectable using traditional
measures of algorithm performance.
 HYPOTHESIS 4 : Ratings distribution of the target item influences
attack effectiveness.

12. METHODS
A total of twenty-four experiments were performed in
a 2x2x2x3 design.The algorithm (user-user or item-
item), attack type (AverageBot or RandomBot), attack
intent (nuke or push), and number of new users/bots
(25, 50, or 100) were varied in each experiment.The
target set for the experiments consists of 22 items.This
set was selected to include a variety of different movie
types including future releases, new releases, obscure
films, popular films, controversial films, and long-
standing favorites. In terms of ratings properties, this
selection of items represents a wide range of popularity
(number of ratings), entropy (a measure of the variance
of ratings), and likability (mean rating).Table 1 displays
the properties of items in the target set.

13. METRICS
Recommender systems research has used several types of measures for evaluating the
quality of a recommender system:
Mean Absolute Error (MAE) between ratings and predictions is a widely used metric. MAE
is a measure of the deviation of recommendations from their true user-specified values. For
each ratings-predictions pair <pi , qi > this metrics treats the absolute error between them
i.e. |pi - qi | equally.The MAE is computed by first summing these absolute errors of the N
corresponding ratings-predictions pairs and then computing the average. Formally,The
lower the MAE, the more accurately the recommendations engine predicts user ratings..
 TOP- N RECOMMENDATION ACCURACY Studies have shown that when given a
recommendation list, the users prefer to browse only the first few items of the list.This
phenomenon can be shown through the following two graphs.These figures show the
browse depth of 137991 MovieLens recommendation searches.
 Stability of Prediction (SOP):This particular model of robustness measures the power of a
recommender system to deliver stable predictions to users in the presence of an arbitrary
amount of inaccurate data in a system. As such, this model is independent of the “true”
ratings for the items over which SOP is calculated.
 Power of Attack (POA) is defined as the average change in prediction toward some target
value over all target users and items. It gives a positive value when the direction of
prediction shift is towards the target.
 Expected Top N Occupancy (exptopn): This metric helps to identify in determining the
expected number of times an item would occur in a top N recommendation list. For
example:The target items are E and F. the top 5 recommendation list is shown in the
following table

14. CONCLUSION
Recommender Systems are a powerful new technology for extracting additional
value for a business from its user databases. Some conclusions have been drawn
that prevent shilling attacks on the systems.
 Prefer item-item: Results show that item-based techniques hold the promise of
allowing collaborative-based algorithms to scale to large datasets and at the
same time produce high-quality recommendations.The shilling attacks are more
effective in the case of item-item algorithms than user-user.
 Use recommendation metrics:This paper proposed and investigated the use of
statistical metrics for detecting the patterns of shilling attacks in a recommender
system. MovieLens database has been evaluated by these metrics and it is
shown that the attackers do indeed exhibit special, noticeable patterns.
 Watch Metrics but worry anyway:There has been considerable research in the
area of recommender systems evaluation. Some of these concepts can also be
applied to the evaluation of the security of recommender systems, but in
evaluating security, topic of interest is not the raw performance, but rather the
change in performance induced by an attack. A strong prediction shift is not a
guarantee that an item will be recommended— it is possible that other items’
scores are affected by an attack as well or that the item scores so low to begin
with that even a significant shift does not promote it to recommended status.
The lower the MAE, the more accurately the recommendations engine predicts
user ratings.Although MAE is a standard for evaluating the effectiveness of the
ACF algorithms, it is not of much use to the end users since it generally gives the
users a predicted rating of an item whereas the users prefer system based
recommendations.

15.  Protect new items:Attacks that target recommendation frequency of
low-information items (i.e. ones with few ratings) are more effective
than attacks against high-information items.Thus, new items tend to
get attacked more easily. It is in an attacker's best interest to restrict
the effect of an attack to a small target set of items in order to be
more subtle and try to avoid detection by the system operators.
 Rest of the paper talks of intrinsic properties of shilling attacks (i.e.
Dimensions of attacks).Along the intent dimension, an attacker may
insert profiles to make a product more likely (push) or less likely (nuke)
to be recommended. Along the target dimension, Shill attacks can be
directed at a particular subset of users or a subset of items in a
recommender system. Along the required knowledge dimension, it is
observed that the attacks that target recommendation frequency of
low-information items are more effective than attacks against high-
information items. Along the cost dimension, there are two primary
components: knowledge cost and execution cost. Along the
dimension of algorithm dependence, Item-based collaborative filtering
might provide significant robustness compared to the user-based
algorithm.Along the detectability dimension, a considerable
complication in detecting shilling attacks is that it is difficult to
precisely and completely define the set of shilling attack patterns.