Several domains have widely benefited from the adoption of Knowledge graphs ( ). For recommender systems (RSs), the adoption of has resulted in accurate, personalized recommendations of items/products according to users' preferences. Among diferent recommendation techniques, collaborative ifltering (CF) is one the most promising approaches to build RSs. Their success is due to the efective exploitation of similarities/correlations encoded in user interaction patterns. Nonetheless, their strength is also their weakness. A malicious agent can add fake user profiles into the platform, altering the genuine similarity values and the corresponding recommendation lists. While the research community has extensively studied to solve various recommendation problems, including the empowerment of semantic-aware shilling attacks, limited attention has been paid on exploiting relatedness measures, i.e., Katz and Exclusivity-based, computed considering 1-hop of graph exploration. We performed an extensive experimental evaluation with four state-of-the-art recommendation systems and two well-known recommendation datasets to investigate the efectiveness of introducing relatedness information on semantic-aware shilling attacks. Since the semantics of relations has a crucial role in , we have also analyzed the impact of relations' semantics by grouping them in various classes. Experimental results indicate the benefit of embracing in favor of the attackers' capability in attacking recommendation systems.
The advent of Knowledge Graphs () has changed the way structured information is stored.
It has become much more than that developed to make the Semantic Web a concrete idea. The
core idea of building a semantic network in which information is represented as directed labeled
graphs (RDF graphs) is disarmingly simple. Nevertheless, thanks to the possibilities it paves,
it has been welcomed with several promises and expectancies. Complete interoperability, the
ability to link knowledge across domains, and the possibility to exploit Logical inference and
proofs are just a few of them. In numerous domains, the exploitation of the information has
become the norm. Thanks to the appearance of wide-ranging Linked Datasets like DBpedia and
Wikidata, we have witnessed the oflurishing of novel techniques in several research fields, like
Machine Learning, Information Retrieval, and Recommender Systems. To date, Recommender
Systems (RSs) are considered the focal solution to assist users’ decision-making process. Since
the volume of the available products on the Web overwhelms the users, RSs support and ease the
decision process. Among them, collaborative filtering (CF) recommendation techniques have
shown very high performance in real-world applications (e.g., Amazon [
Interestingly, despite the astonishing spread of , little attention has been paid to
knowledge-aware strategies to mine RS’s security. Since provide comprehensive
information on numerous knowledge domains, a malicious agent can decide to attack RSs making use of
the items’ semantic descriptions. One work exploiting publicly available information obtained
from to generate more influential fake profiles to threaten CF models’ performance is named
semantics-aware shilling attack SAShA [
In this work, we have overcome this limitation by going beyond the cosine similarity by considering Katz centrality and Exclusivity-based relatedness. Finally, to provide a more fine-grained analysis, we have grouped the semantic relations into three classes: ontological, categorical, and factual relations.
In detail, this study extends the state-of-the-art approach for the integration of semantics in
the shilling attacks [
We have conducted extensive experiments to evaluate the impact of proposed attacks against the recommendation models. To this end, we have exploited two real-world recommender system datasets (LibraryThing and Yahoo!Movies). Experimental results sharply indicate that information is a valuable source of knowledge that improves attacks’ efectiveness. Moreover, adopting semantic relatedness measures can unleash the full potential of the semantics-aware attacks.
The remainder of the paper proceeds as follows. In Section 2, we provide an overview of the state-of-the-art recommendation models and shilling attacks. Section 3 describes the proposed extensions to the SAShA by introducing the semantic relatedness measures, and formalizes the semantic attack strategies. Section 4 focuses on the experimental validation of the proposed attack scenarios. We also provide an in-depth discussion of the experimental results analyzing the several dimensions of the study. Finally, in Section 6, we draw some conclusions and introduce the open challenges.
A recommendation problem can be stated as finding a utility function to automatically predict how much users will like unknown items.
Definition 1 (Recommendation Problem). Let and ℐ denote a set of users and items in a system, respectively. Each user ∈ is related to ℐ+, the set of items she has consumed, or her user profile. Given a utility function : × ℐ → R a Recommendation Problem is defined as ∀ ∈ , ′ = argmax (, ) ∈ℐ where ′ denotes an item not consumed by the user before. We assume that the preference of user ∈ on item ∈ ℐ is encoded with a continuous-valued preference score ∈ ℛ, where ℛ represent the set of (, ) pairs for which is known.
The major class of recommendation models includes content-based filtering (CBF),
collaborative filtering (CF), and hybrid [
RSs exploit various side information such as metadata (e.g., tags, reviews) [
All the former advances have been shown to enhance the recommendation quality or the
overall user experience. Although the algorithms difer on many levels, we can still classify
recommendation techniques into two broad approaches: Path-based methods [
Malicious users, the adversaries, can meticulously craft fake profiles to poison the data and alter
the recommendation behavior toward malicious goals [57, 58, 59]. An adversary may execute a
shilling attack (injection of malicious profiles) to achieve a whole diferent set of objectives.
To name a few, she may want to demote competitor products [
The research works on shilling attacks explored two main research perspectives: proposing
and investigating attack strategies with their efects on the recommendation performance [
A typical characteristic of the first line of research on shilling attacks is that the adversary’s
knowledge is related only to the recommender system’s user-item interaction matrix.
Furthermore, Anelli et al. [
Note that this work focuses on shilling attacks, that are hand-engineered strategies to study
recommender systems’ security. This research line is diferent from machine-learned data
poisoning attack [
This section introduces the reader to the notations and formalisms that may help understand the design of shilling attacks against targeted items integrating information obtained from a knowledge graph ().
A knowledge graph is a structured repository of knowledge, designed in the form of a graph, that encodes various kinds of information: • Factual. General statements as Rika Dialina was born in Crete or Heraklion is the capital of Crete that describe an entity by using a controlled vocabulary of predicates that connect the entity to other entities (or literal values). • Categorical. These statements connect the entity to a particular category (i.e., the categories associated with a Wikipedia page). Often, categories are in turn organized as a hierarchy. • Ontological. These are formal statements that describe the entity’s nature and its ontological membership to a specific class. Classes are often organized in a hierarchical structure. In contrast to categories, sub-classes and super-classes are connected through IS-A relations.
In a knowledge graph, we can express statements through triplets →− , with a subject ( ), a
predicate (or relation) ( ), and an object (). There are several ways to transform the knowledge
coming from a knowledge graph into a feature. We have chosen to represent each distinct path
as an explicit feature [
Given a set of items = {ℐ1, ℐ2, . . . , ℐ } in a collection and the corresponding triples ⟨, , ⟩ in a knowledge graph, the set of 1-hop features is defined as 1- - = {⟨, ⟩ | ⟨, , ⟩ ∈ with ∈ }.
The keystone of the Knowledge Graph representation is the semantics enclosed in the resource
description and the predicates that connect the diferent resources. Nevertheless, if the metric
to compute similarities between the resources is not carefully chosen, this piece of information
is lost irretrievably. Motivated by this awareness, we decided to consider a broad spectrum of
diverse similarity/relatedness metrics in addition to the cosine vector similarity [
Cosine Vector Similarity is a well-known similarity that is very popular in recommendation
systems. The idea is to measure how similar the two diferent representations are. Suppose a
numerical vector can represent the resource description, with the number of the predicate-object
chains observed in the being the vector’s cardinality. Mathematically, it measures the cosine
of the angle between two vectors that represent two diferent resources. The smaller the angle,
the higher the cosine similarity is, and thus the similarity. Suppose and are two items in the
, and (· ) is a function that returns the features associated with an entity in the . Hence
(, ) is a function that returns 1 if entity is associated with feature , else 0. The Cosine
Vector Similarity has been already formulated for as follows [
∑︀∈()∪() (,)· (,)
Katz centrality [
() is the set of the top- shortest paths between items and . This is the first novel similarity metric tested in this work. Note that the shortest path has a larger implication in multi-hops experiments; results on these have been reported in .
Exclusivity-based semantic relatedness [
Suppose a predicate of type between two items and , directed from to . The exclusivity of predicate is the probability of selecting, with a uniform random distribution, a predicate ′ of type among the predicates of type that exit resource and enter node , such that predicate ′ is exactly the predicate : paths between them. ) =
1 |→− *| + |*→− | − 1 where |→− *|
|*→− →− is in |→− *|
and in |*→− | denotes the number of relations of type ∈ that enter resource . Since the relation |, 1 is subtracted from the denominator. The exclusivity score denotes the cardinality of relations of type ∈ that exit resource , and is defined as: for a predicate falls inside the (0, 1] interval. The value 1 denotes the extreme case in which the predicate is the only relation of its type for both and .
Given a path through , = →1−
2 →− 2 , . . . , with ∈ ∓ , the weight of the path relatedness measure is therefore defined as follows:
∈ (0, 1], can be introduced. The overall exclusivity-based () (, ) =
∑︁ ℎ()ℎ() ∈ This is the second novel similarity metric tested in this work.
Overview of shilling attack strategies and their profile composition for adversaries’ goal of pushing a Selection Random Random Random Random Semantics-aware Semantics-aware Semantics-aware Semantics-aware (∑︀|∈| |ℐ|)/2
Filler Items (ℐ ) Number Items ∑︀∈ |ℐ| ∑︀∈|||ℐ| − 1 ||
− 1 ∅ ∅ ∑︀∈ |ℐ| − 1 (∑︀|∈| |ℐ|)/2
|| ∑︀∈ |ℐ| − 1 ∑︀∈|||ℐ| − 1 ∑︀∈|||ℐ| − 1 ||
Rating ((, 2)) ℐ − ℐ (( , 2)) ((,
2)) ((, 2)) ℐ − ℐ (( , 2)) ((, 2))
ℐ ℐ − ℐ ℐ − ℐ ℐ − ℐ ℐ − ℐ ℐ − ℐ ℐ − ℐ ℐ − ℐ − ℐ ℐ − ℐ − ℐ (4) (5) ℐ (6)
target item (ℐ ).
Attack Type
Random [
|| Number Items
Selected Items (ℐ)
Rating ∅ ∅ ∅ ∅ ∅ ∑︀∈ |ℐ| − 1
|| ∑︀∈ |ℐ| − 1
|| (∑︀∈ |ℐ|)/2 − 1 || if < else + 1 and maximum rating value. function generates one integer (i.e., rating) from a discrete uniform distribution. where ( , ) are the dataset average rating and rating variance, ( , ) are the filler item ℐ rating average and variance, and and are the minimum Given a Recommendation Problem, a Shilling Profile () is a rating profile partitioned = ℐ + ℐ + ℐ + ℐ items without any ratings. where ℐ denotes the selected item set containing items identified by the attacker to maximize the efectiveness of the attack, ℐ is the filler item set, containing a set of randomly selected items to which rating scores are assigned to make them imperceptible. ℐ is the target item, for which the recommendation model will make a prediction, aimed to be maximal (for push attack) or minimum (for nuke attack). Finally, ℐ is the unrated item set, holding a number of
Note that ℐ and ℐ are chosen depending on the attack strategy, and the attack size is the number of injected fake user profiles. Throughout this paper, we use = |ℐ | to represent the ifller size, = |ℐ| the selected item set size and = |ℐ∅| to show the size of unrated items. Table 1 summarizes the main parameters involved in the implementation of most prominent shilling attacks against rating-based CF models. For instance, it can be seen that ℎ attacks are the extension of state-of-the-art shilling attacks, with the diference that selection of the ifller item set ( ℐ ) is chosen semantically, not randomly.
Semantics-aware Random Attack is an extension of the baseline Random Attack [
Semantics-aware Average Attack is an informed attack strategy that extends the
AverageBots attack [
Semantics-aware BandWagon Attack is a low-knowledge attack that extends the standard BandWagon attack [62]. We leave unchanged the injection of the selected items (ℐ), which are the most popular ones and on which we associate the maximum possible rating (see Table 1). However, similarly to the previous two semantic attack extensions, we complete ℐ by taking into account the semantic similarity/relatedness between the target item ℐ and the rest of the catalog.
We tested the proposed approaches on two datasets. The first is LibraryThing [
The second is Yahoo!Movies which is a recommendation dataset released by research.yahoo.com with ratings collected up to November 2003. The dataset also provides mappings to the MovieLens and EachMovie catalogs. The recorded interactions consist of ratings ranging from 1 to 5.
Both datasets have a mapping between the items in the catalogs and DBpedia knowledge-base entities. In particular, we use the mappings publicly available at https://github.com/sisinflab/ LinkedDatasets. Table 2 reports the statistics of both datasets.
Dataset LibraryThing
Yahoo!Movies
Dataset LibraryThing Yahoo!Movies 4.1.1. Feature Extraction
Once the items are semantically reconciled with DBpedia entities, we remove the noisy
features whose triples contain one of the following predicates: owl:sameAs, dbo:thumbnail,
foaf:depiction, prov:wasDerivedFrom, foaf:isPrimaryTopicOf. The feature
denoising procedure follows the methodology proposed in [
In this work, we test our attack proposal (see Section 3.3) against four baseline collaborative RSs.
Two neighborhood-based: User-kNN, on which we [
We evaluate the attack performance using @ . The metric describes the average presence of target items in the top- recommendation lists generated for all the users after the attack. Since we will experiment with the case of push attacks, it follows that the adversary’s goal is to increase/maximize the HR of the attacked/targeted items.
We perform 180 experiments for each dataset, totaling 720 experiments. Following the
evaluation procedure used in [
RQ1: What is the impact of relatedness-based measures and publicly available semantic information? Let us consider the experiments on LibraryThing. We can observe that the adoption of graph-based relatedness generally leads to an attack eficacy improvement over the baseline, which adopts the cosine similarity metric. For instance, the random attack largely benefits from the topological information. The same happens for Yahoo!Movies too in Table 5. Indeed, HR for < User-NN, Random, Categorical, Katz> is 10% better than the baseline, i.e., 0.3725 vs. 0.3512. Beyond random attacks, we can observe some general trends also for informed attacks. In detail, Table 4 (LibraryThing), we note that categorical information improves both UserNN and Item-NN. It is worth noticing that the same consideration does not hold for latent factor-based models. MF and NeuMF suit better cosine vector similarity. This phenomenon is probably due to the significant diference in how the two recommendation families exploit the additional information.
Finally, we can focus on the BandWagon attack. In that case, the attack already exploits
the most influential knowledge source for collaborative filtering algorithms: popularity. It
follows that the integration with other knowledge sources, e.g., , does not provide any
significant improvement. However, the influence of popularity is so high in this attack that
the final recommendation lists are subject to a strong popularity bias [
Another aspect that we want to underline is that increasing the number of fake profiles injected into the systems unleashes the potential of diferent semantic knowledge types. Let us take as an example the <LibraryThing, Average, MF>. With 1% injected fake profiles, we observe the best results with Factual knowledge and Katz centrality. With 2%, the best results are with Factual knowledge and cosine similarity. Finally, with 5%, the best results come with Ontological knowledge and cosine similarity. This behavior suggests that the graph-based similarities have a big impact even in a very sparse scenario. In contrast, with the increase of fake profiles, the cosine similarity starts leveraging interesting correlations. On the other dimension, the factual information is massive by nature, and it is crucial in sparse scenarios. However, when the number of fake profiles increases, the knowledge at a higher level of abstraction (Categorical and Ontological) finds its way to improve the attack eficacy further.
RQ2: What is the most impactful type of semantic information?
gorical knowledge. The experiments on LibraryThing show that Exclusivity is probably the relatedness that best suits this information type. However, the results are not that clear for the Yahoo!Movies dataset. This behavior suggests that semantic information type and relatedness are not the only members of the equation. Indeed, the extension and the quality of the item descriptions seem to have a role. Afterward, we focus on Ontological information. Here, we can draw a general consideration since, for both datasets, it is the cosine similarity metric that leads to the best results. Lastly, Factual information respects all the general remarks we have drawn before showing that relatedness is a better source of adversaries’ knowledge to perform more efective attacks.
In detail, we found that with low-knowledge attacks, the best relatedness is Exclusivity for LibraryThing and Katz for Yahoo!Movies. With informed attacks, the best relatedness metric is the cosine similarity. However, for the sake of electing a similarity that better suits Factual information, we can note that Exclusivity generally leads to better results with LibraryThing.
RQ3: What are the most vulnerable recommendation models> Since the neighborhood-based models directly exploit a similarity to compute the recommendation lists, they are the privileged victim models to efectively alter the recommendation performance. Slightly more robust are latent factor models on which the new semantic attacks will still produce an improvement in the attacker’s performance. Finally, the most robust model is NeuMF. This result is probably due to the nonlinearity of NeuMF that helps the model avoid learning from the pretended profiles. In detail, the neural network may learn more sophisticated correlations that the other models do not capture. We believe that this ability deserves specific further investigation since it may lead to developing a new line of research on Deep Learning-based semantics-aware attacks that might exploit non-linear item-item similarities to build more impactful attack methods.
In this work, we verified how the adoption of stronger semantic similarity measures of structured and freely accessible knowledge can further improve malicious agents’ ability to attack a recommendation platform. Starting from the state-of-the-art semantics-aware shilling attacks (SAShA), this work investigated the impact of graph-based metrics (Katz centrality and Exclusivity-based relatedness) and semantic information type. As a result, we verified that: (1) the adoption of structured knowledge generally improves by a large margin the attacker’s performance, (2) the graph-based metrics can eficiently deal with very sparse scenarios capturing similarities that are otherwise imperceptible, (3) the type of semantic information to feed the attacking system with has a significant function in enhancing the adversaries’ efectiveness, (4) neural models are the sole recommendation techniques to be more robust to semantic attacks. The latter finding suggests that there is still room for improvements in the semantics-aware attacks investigating Deep Learning-based semantic attacks. and Web Data Mining, WSDM 2011, Hong Kong, China, February 9-12, 2011, 2011, pp. 635–644. [16] Y. Deldjoo, M. F. Dacrema, M. G. Constantin, H. Eghbal-zadeh, S. Cereda, M. Schedl, B. Ionescu, P. Cremonesi, Movie genome: alleviating new item cold start in movie recommendation, User Model. User-Adapt. Interact. 29 (2019) 291–343. [17] V. W. Anelli, V. Bellini, T. Di Noia, W. L. Bruna, P. Tomeo, E. Di Sciascio, An analysis on time- and session-aware diversification in recommender systems, in: UMAP, ACM, 2017, pp. 270–274. [18] Q. Guo, F. Zhuang, C. Qin, H. Zhu, X. Xie, H. Xiong, Q. He, A survey on knowledge graph-based recommender systems, IEEE Transactions on Knowledge & Data Engineering (5555) 1–1. doi:10.1109/TKDE.2020.3028705. [19] I. Fernández-Tobías, I. Cantador, P. Tomeo, V. W. Anelli, T. D. Noia, Addressing the user cold start with cross-domain collaborative filtering: exploiting item metadata in matrix factorization, User Model. User Adapt. Interact. 29 (2019) 443–486. URL: https: //doi.org/10.1007/s11257-018-9217-6. doi:10.1007/s11257-018-9217-6. [20] Y. Huo, D. F. Wong, L. M. Ni, L. S. Chao, J. Zhang, Knowledge modeling via contextualized representations for lstm-based personalized exercise recommendation, Inf. Sci. 523 (2020) 266–278. URL: https://doi.org/10.1016/j.ins.2020.03.014. doi:10.1016/j.ins.2020.03. 014. [21] M. Hildebrandt, S. S. Sunder, S. Mogoreanu, M. Joblin, A. Mehta, I. Thon, V. Tresp, A recommender system for complex real-world applications with nonlinear dependencies and knowledge graph context, in: ESWC, volume 11503 of Lecture Notes in Computer Science, Springer, 2019, pp. 179–193. [22] V. W. Anelli, T. Di Noia, 2nd workshop on knowledge-aware and conversational recommender systems - kars, in: CIKM, ACM, 2019, pp. 3001–3002. [23] V. W. Anelli, P. Basile, D. G. Bridge, T. D. Noia, P. Lops, C. Musto, F. Narducci, M. Zanker, Knowledge-aware and conversational recommender systems, in: S. Pera, M. D. Ekstrand, X. Amatriain, J. O’Donovan (Eds.), Proceedings of the 12th ACM Conference on Recommender Systems, RecSys 2018, Vancouver, BC, Canada, October 2-7, 2018, ACM, 2018, pp. 521–522. URL: https://doi.org/10.1145/3240323.3240338. doi:10.1145/3240323. 3240338. [24] E. Palumbo, D. Monti, G. Rizzo, R. Troncy, E. Baralis, entity2rec: Property-specific knowledge graph embeddings for item recommendation, Expert Syst. Appl. 151 (2020) 113235.
URL: https://doi.org/10.1016/j.eswa.2020.113235. doi:10.1016/j.eswa.2020.113235. [25] J. Li, Z. Xu, Y. Tang, B. Zhao, H. Tian, Deep hybrid knowledge graph embedding for top-n recommendation, in: G. Wang, X. Lin, J. A. Hendler, W. Song, Z. Xu, G. Liu (Eds.), Web Information Systems and Applications - 17th International Conference, WISA 2020, Guangzhou, China, September 23-25, 2020, Proceedings, volume 12432 of Lecture Notes in Computer Science, Springer, 2020, pp. 59–70. URL: https://doi.org/10.1007/978-3-030-60029-7_6. doi:10.1007/978-3-030-60029-7\_6. [26] M. Nayyeri, S. Vahdati, X. Zhou, H. S. Yazdi, J. Lehmann, Embedding-based recommendations on scholarly knowledge graphs, in: A. Harth, S. Kirrane, A. N. Ngomo, H. Paulheim, A. Rula, A. L. Gentile, P. Haase, M. Cochez (Eds.), The Semantic Web - 17th International Conference, ESWC 2020, Heraklion, Crete, Greece, May 31-June 4, 2020, Proceedings, September 5-7, 2012, ACM, 2012, pp. 1–8. URL: https://doi.org/10.1145/2362499.2362501. doi:10.1145/2362499.2362501. [53] X. Yu, X. Ren, Y. Sun, Q. Gu, B. Sturt, U. Khandelwal, B. Norick, J. Han, Personalized entity recommendation: a heterogeneous information network approach, in: WSDM, ACM, 2014, pp. 283–292. [54] L. Gao, H. Yang, J. Wu, C. Zhou, W. Lu, Y. Hu, Recommendation with multi-source heterogeneous information, in: IJCAI, ijcai.org, 2018, pp. 3378–3384. [55] H. Wang, F. Zhang, X. Xie, M. Guo, DKN: deep knowledge-aware network for news recommendation, in: WWW, ACM, 2018, pp. 1835–1844. [56] T. Di Noia, C. Magarelli, A. Maurino, M. Palmonari, A. Rula, Using ontology-based data summarization to develop semantics-aware recommender systems, in: ESWC, volume 10843 of Lecture Notes in Computer Science, Springer, 2018, pp. 128–144. [57] M. P. O’Mahony, N. J. Hurley, N. Kushmerick, G. C. M. Silvestre, Collaborative recommendation: A robustness analysis, ACM Trans. Internet Techn. 4 (2004) 344–377. [58] C. C. Aggarwal, Attack-resistant recommender systems, in: Recommender Systems,
Springer, 2016, pp. 385–410. [59] R. Bhaumik, C. Williams, B. Mobasher, R. Burke, Securing collaborative filtering against malicious attacks through anomaly detection, in: Proceedings of the 4th Workshop on Intelligent Techniques for Web Personalization (ITWP’06), Boston, volume 6, 2006, p. 10. [60] B. Mobasher, R. Burke, R. Bhaumik, C. Williams, Efective attack models for shilling item-based collaborative filtering systems, in: Proceedings of the WebKDD Workshop, Citeseer, 2005, pp. 13–23. [61] T. D. Noia, D. Malitesta, F. A. Merra, Taamr: Targeted adversarial attack against multimedia recommender systems, in: DSN Workshops, IEEE, 2020, pp. 1–8. [62] M. P. O’Mahony, N. J. Hurley, G. C. M. Silvestre, Recommender systems: Attack types and strategies, in: AAAI, AAAI Press / The MIT Press, 2005, pp. 334–339. [63] Y. Deldjoo, T. D. Noia, F. A. Merra, Assessing the impact of a user-item collaborative attack on class of users, in: ImpactRS@RecSys, volume 2462 of CEUR Workshop Proceedings, CEUR-WS.org, 2019. [64] Y. Deldjoo, T. D. Noia, E. D. Sciascio, F. A. Merra, How dataset characteristics afect the robustness of collaborative recommendation models, in: Proceedings of the 43rd International ACM SIGIR conference on research and development in Information Retrieval, SIGIR 2020, Virtual Event, China, July 25-30, 2020, ACM, 2020, pp. 951–960. URL: https: //doi.org/10.1145/3397271.3401046. doi:10.1145/3397271.3401046. [65] J. Cao, Z. Wu, B. Mao, Y. Zhang, Shilling attack detection utilizing semi-supervised learning method for collaborative recommender system, World Wide Web 16 (2013) 729–748. [66] W. Zhou, J. Wen, Q. Xiong, M. Gao, J. Zeng, Svm-tia a shilling attack detection method based on svm and target item analysis in recommender systems, Neurocomputing 210 (2016) 197–205. [67] W. Zhou, J. Wen, Q. Qu, J. Zeng, T. Cheng, Shilling attack detection for recommender systems based on credibility of group users and rating time series, PloS one 13 (2018) e0196533. [68] M. Aktukmak, Y. Yilmaz, I. Uysal, Quick and accurate attack detection in recommender systems through user attributes, in: RecSys, ACM, 2019, pp. 348–352.
The subsequent analysis focuses on the impact of the 1-hop and 2-hops of the exploration.
Analogously to 1-hop definition insection 3.1, we built 2nd-hop features. By continuing the exploration of we retrieve the triples →− ′ ′, where is the object of a 1st-hop triple and the subject of the next triple. The double-hop predicate is denoted by ′ and the object is referred as (′). Therefore, the overall feature set is defined as 2- - = {⟨, , ′, ′⟩ | ⟨, , , ′, ′⟩ ∈ with ∈ }. Given the current definition, 2nd-hop features also contain heterogeneous predicates (see the previous classification of diferent kinds of statements). To make it possible to analyze the impact of the kind of semantic information, we consider a 2nd-hop feature as Factual if and only if both relations ( , and ′) are Factual. The same holds for the other types of encoded information. In the attacks employing double-hop (2H) features, the strategies evolve as described below: • Categorical-2H, we pick up the features with either dcterms:subject or skos:broader properties; • Ontological-2H, we select the features containing either rdf-schema:subClassOf or owl:equivalentClass properties; • Factual-2H, we use the features not selected in the previous two classes. Note that we did not place any domain-specific categorical/ontological features in the respective lists. To provide a domain-agnostic evaluation, we have treated them as factual features. Table 6 shows the average variation of attack eficacy passing from the adoption of single-hop extracted features to the double-hop extraction for LibraryThing and Yahoo!Movies.
Analyzing the results of attacks on Yahoo!Movies in Table 6, the first and foremost consideration we can draw is that graph-based relatedness measures seem to have no positive impact when exploiting a double-hop exploration. However, it can be observed that those relatedness metrics already achieved impressive results with the first-hop exploration. Hence, further improving the performance is somehow challenging. Indeed, in most cases, we can observe a minimal variation in the double-hop performance. However, in some cases, the attacks witness a more significant decrease, probably due to the injection of some noisy and Variation of Hit Ratio () when using the features extracted from the second hop concerning the first hop for both the LibraryThing and Yahoo!Movies datasets.
NeuMF
Attack Categorical loosely related second-hop features. In general, given the high performance achieved with a single-hop exploration, it seems that it is not worth exploring the second-hop, and thus increasing the computational complexity and introducing the new challenge of loosely-related second-hop features. Beyond graph-based relatedness, we observe that cosine vector similarity almost always shows an improvement when considering second-hop features (particularly with Ontological and Factual information). Finally, we have to observe that, even here, the NeuMF model does not benefit from this new information.
Table 6 also shows the average attack eficacy variation for
the previously described behaviors are even more evident. In detail, we note that the cosine similarity takes advantage of the second-hop information. In this case, we can also observe Katz’s improvement, suggesting that this metric did not have unleashed its full potential with only the first-hop features. Finally, in some cases, the second-hop information also improves informed attacks (reaching a peak of 53% improvement for <Average, Factual, Exclusivity>), confirming a less evident trend we found with Yahoo!Movies.