Recommendation system attack detection sample data generation method and device

Abstract

The application relates to a recommendation system attack detection sample data generation method and device. The method comprises the following steps: obtaining a real user score matrix in a data set of a recommendation system; generating a false user score matrix corresponding to the real user score matrix through a generator according to the real user score matrix; mixing the false user score matrix and the real user score matrix to obtain a mixed user score matrix; simulating attacks on a plurality of recommended items through a simulated recommendation system attack discriminator according to the mixed user score matrix to obtain an attack loss; and generating an attack detection sample based on the attack loss and the mixed user score matrix. The method can support accurate detection of the attack resistance of a recommendation system.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a method, apparatus, computer device, storage medium, and computer program product for generating sample data for recommender system attack detection. Background Technology

[0002] Recommendation systems primarily address how users can efficiently obtain the information they need when faced with information overload and no clear user requirements. They model users' interests by analyzing their past behavior and proactively recommending information that users are interested in or need. However, many information producers employ methods to attack recommendation systems. Attackers can generate fake user data and inject it into the target recommendation system to attack several potential target products, thereby increasing the exposure of their own information to more consumers.

[0003] Due to the imbalance of training samples, recommender system models suffer from biases in multiple dimensions, making them vulnerable to attacks. Therefore, it is necessary to test the resilience of recommender systems against attacks.

[0004] However, the current method for detecting the attack resistance of recommendation systems is generally to directly test historical attack data. Due to the small sample size, it cannot support accurate detection of the attack resistance of recommendation systems. Summary of the Invention

[0005] Therefore, it is necessary to provide a method, apparatus, computer device, computer-readable storage medium, and computer program product for generating sample data for recommender system attack detection that supports accurate detection of the recommender system's resistance to attack, in order to address the aforementioned technical problems.

[0006] Firstly, this application provides a method for generating sample data for detecting attacks on recommendation systems. The method includes:

[0007] Obtain the real user rating matrix from the dataset of the recommendation system, wherein the real user rating matrix includes the real rating user identifiers and the rated items;

[0008] Based on the real user rating matrix, a fake user rating matrix corresponding to the real user rating matrix is ​​generated by a generator.

[0009] The fake user rating matrix and the real user rating matrix are mixed to obtain a hybrid user rating matrix;

[0010] Based on the hybrid user rating matrix, multiple recommended items are simulated for attack using an attack discriminator that simulates the recommendation system, and the attack loss is obtained. The attack loss characterizes the difference between the attack results of the hybrid user rating matrix and the real user rating matrix.

[0011] Attack detection samples are generated based on the attack loss and the hybrid user rating matrix.

[0012] In one embodiment, the step of simulating attacks on multiple recommended items using a simulated attack discriminator of a recommendation system based on a hybrid user rating matrix to obtain the attack loss includes:

[0013] Based on the hybrid user rating matrix, the attack loss is obtained by performing simultaneous and step-by-step simulated attacks on multiple recommended items using an attack discriminator that simulates the recommender system.

[0014] In one embodiment, the generator includes a basic information generator, a preference generation integrator, and a distributed learner;

[0015] The step of generating a fake user rating matrix corresponding to the real user rating matrix using a generator includes:

[0016] Based on the real user information in the dataset, fake user information is generated through the basic information generator;

[0017] Calculate the similarity between the real user information and the fake user information, and obtain a scoring matrix of the real user information with the highest similarity ranking. The similarity ranking is based on the similarity from largest to smallest.

[0018] Based on the rating matrix of real user information ranked first by the preset similarity, the fake user rating matrix is ​​obtained through the preference generation integrator;

[0019] Based on the fake user rating matrix, the distributed learner obtains the fake user rating matrix corresponding to the real user rating matrix.

[0020] In one embodiment, obtaining the fake user rating matrix through the preference generation integrator based on the rating matrix of the top-ranked real user information according to the preset similarity includes:

[0021] The preference generator of the preference generator reduces the dimensionality of the scoring matrix of the top-ranked real user information with the preset similarity.

[0022] Based on the rating matrix of real user information ranked first by preset similarity after dimensionality reduction and the similarity, obtain the rating matrix of fake users;

[0023] Increase the dimensions of the fake user rating matrix to the same dimensions as the real user rating matrix.

[0024] In one embodiment, the simulated attack on multiple recommended items using an attack detector that simulates the recommendation system includes:

[0025] Simulated attacks were conducted on multiple recommended items simultaneously using an attack detector that simulates the recommendation system, and the attack losses of all recommended items were obtained.

[0026] The generation of attack detection samples based on the attack loss and the hybrid user rating matrix includes:

[0027] Based on the attack losses, determine whether the recommended ranking of the recommended item is within the preset recommended ranking range;

[0028] If so, then attack detection samples are generated based on the hybrid user rating matrix;

[0029] If not, return to the generator to continue training and generating the fake user rating matrix.

[0030] In one embodiment, the simulated attack on multiple recommended items using an attack detector that simulates the recommendation system includes:

[0031] By simulating the attack discriminator of the recommendation system, multiple recommended items are subjected to step-by-step simulated attacks to obtain the attack loss for each recommended item;

[0032] The generation of attack detection samples based on the attack loss and the hybrid user rating matrix includes:

[0033] Based on the attack losses, determine whether the recommended ranking of the recommended item is within the preset recommended ranking range;

[0034] If so, then attack detection samples are generated based on the hybrid user rating matrix;

[0035] If not, return to the generator to continue training and generating the fake user rating matrix.

[0036] Secondly, this application also provides a device for generating sample data for recommender system attack detection. The device includes:

[0037] The dataset acquisition module is used to acquire the real user rating matrix in the dataset of the recommendation system. The real user rating matrix includes the real rating user identifiers and the rating items.

[0038] The fake user rating matrix generation module is used to generate a fake user rating matrix corresponding to the real user rating matrix through a generator based on the real user rating matrix.

[0039] A hybrid user rating matrix acquisition module is used to mix the fake user rating matrix and the real user rating matrix to obtain a hybrid user rating matrix;

[0040] The attack loss acquisition module is used to simulate attacks on multiple recommended items by using an attack discriminator of a simulated recommendation system based on a hybrid user rating matrix to obtain the attack loss, which represents the difference between the attack results of the hybrid user rating matrix and the real user rating matrix.

[0041] An attack detection sample generation module is used to generate attack detection samples based on the attack loss and the hybrid user rating matrix.

[0042] Thirdly, this application also provides a computer device. The computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to perform the following steps:

[0043] Obtain the real user rating matrix from the dataset of the recommendation system, wherein the real user rating matrix includes the real rating user identifiers and the rated items;

[0044] Based on the real user rating matrix, a fake user rating matrix corresponding to the real user rating matrix is ​​generated by a generator.

[0045] The fake user rating matrix and the real user rating matrix are mixed to obtain a hybrid user rating matrix;

[0046] Based on the hybrid user rating matrix, multiple recommended items are simulated for attack using an attack discriminator that simulates the recommendation system, and the attack loss is obtained. The attack loss characterizes the difference between the attack results of the hybrid user rating matrix and the real user rating matrix.

[0047] Attack detection samples are generated based on the attack loss and the hybrid user rating matrix.

[0048] Fourthly, this application also provides a computer-readable storage medium. The computer-readable storage medium stores a computer program thereon, which, when executed by a processor, performs the following steps:

[0049] Obtain the real user rating matrix from the dataset of the recommendation system, wherein the real user rating matrix includes the real rating user identifiers and the rated items;

[0050] Based on the real user rating matrix, a fake user rating matrix corresponding to the real user rating matrix is ​​generated by a generator.

[0051] The fake user rating matrix and the real user rating matrix are mixed to obtain a hybrid user rating matrix;

[0052] Based on the hybrid user rating matrix, multiple recommended items are simulated for attack using an attack discriminator that simulates the recommendation system, and the attack loss is obtained. The attack loss characterizes the difference between the attack results of the hybrid user rating matrix and the real user rating matrix.

[0053] Attack detection samples are generated based on the attack loss and the hybrid user rating matrix.

[0054] Fifthly, this application also provides a computer program product. The computer program product includes a computer program that, when executed by a processor, performs the following steps:

[0055] Obtain the real user rating matrix from the dataset of the recommendation system, wherein the real user rating matrix includes the real rating user identifiers and the rated items;

[0056] Based on the real user rating matrix, a fake user rating matrix corresponding to the real user rating matrix is ​​generated by a generator.

[0057] The fake user rating matrix and the real user rating matrix are mixed to obtain a hybrid user rating matrix;

[0058] Based on the hybrid user rating matrix, multiple recommended items are simulated for attack using an attack discriminator that simulates the recommendation system, and the attack loss is obtained. The attack loss characterizes the difference between the attack results of the hybrid user rating matrix and the real user rating matrix.

[0059] Attack detection samples are generated based on the attack loss and the hybrid user rating matrix.

[0060] The aforementioned method, apparatus, computer equipment, storage medium, and computer program product for generating attack detection sample data for recommendation systems involve: acquiring a centralized real user rating matrix from the recommendation system's dataset, which includes real user identifiers and rated items; generating a fake user rating matrix corresponding to the real user rating matrix using a generator; mixing the fake and real user rating matrices to obtain a hybrid user rating matrix; performing simulated attacks on multiple recommendation items using a simulated attack discriminator of the recommendation system to obtain an attack loss, which characterizes the difference between the attack results of the hybrid and real user rating matrices; and generating attack detection samples based on the attack loss and the hybrid user rating matrix. In this scheme, a fake user rating matrix is ​​generated by a generator, and the fake and real user rating matrices are mixed to enrich the rating matrix data. Multiple simulated attacks are performed on multiple recommendation items using a simulated attack discriminator of the recommendation system. The attack detection samples are then further filtered based on the attack loss to select those with better attack performance, thus enabling accurate detection of the recommendation system's attack resistance capabilities. Attached Figure Description

[0061] Figure 1 This is an application environment diagram of a method for generating sample data for recommending system attack detection in one embodiment.

[0062] Figure 2 This is a flowchart illustrating a method for generating sample data for attack detection in a recommendation system, as shown in one embodiment.

[0063] Figure 3 This is a flowchart illustrating a method for generating sample data for recommending system attack detection in another embodiment;

[0064] Figure 4 This is a structural block diagram of a device for generating sample data for attack detection in a recommendation system, as shown in one embodiment.

[0065] Figure 5 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0066] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0067] The method for generating sample data for attack detection in recommendation systems provided in this application can be applied to, for example... Figure 1In the application environment shown, terminal 102 communicates with server 104 via a network. A data storage system can store the data that server 104 needs to process. The data storage system can be integrated onto server 104 or placed on a cloud or other network server. Terminal 102 obtains an attack detection sample data generation request and sends it to server 104. Server 104 obtains the request, then retrieves the real user rating matrix from the recommendation system's dataset. Based on the real user rating matrix, a generator produces a fake user rating matrix corresponding to the real user rating matrix. The fake user rating matrix and the real user rating matrix are mixed to obtain a hybrid user rating matrix. Based on the hybrid user rating matrix, a simulated attack is performed on multiple recommendation items using a simulated attack discriminator of the recommendation system to obtain the attack loss. Based on the attack loss and the hybrid user rating matrix, an attack detection sample is generated. Terminal 102 can be, but is not limited to, various personal computers, laptops, smartphones, tablets, etc. Server 104 can be implemented using a standalone server or a server cluster composed of multiple servers.

[0068] In one embodiment, such as Figure 2 As shown, a method for generating sample data for attack detection in a recommendation system is provided, which can be applied to... Figure 1 Taking server 104 as an example, the following steps are included:

[0069] S100, Obtain the real user rating matrix in the dataset of the recommender system.

[0070] The dataset includes basic user information such as age, gender, occupation, postal code address, and rating matrix.

[0071] Specifically, the rating matrix in the recommender system dataset is obtained. This rating matrix is ​​a real user rating matrix, which includes the identifiers of real rating users and the items they rated. Let represent the rating matrix for the recommender system RS, where Representing real users who provide ratings. Representing the items being rated, among which Representative on the project The set of users who provide ratings.

[0072] S200: Based on the real user rating matrix, a generator produces a fake user rating matrix that corresponds to the real user rating matrix.

[0073] The fake user rating matrix is ​​a rating matrix similar to the real user rating matrix, which is injected into the target recommendation system.

[0074] Specifically, the generator's goal is to generate a fake user rating matrix that is similar to the real user rating matrix, inject this fake user rating matrix into the real data, and then attack the target recommendation system. The generator network can be represented by the following formula:

[0075]

[0076] The generator network consists of a convolutional neural network and a backward-facing feedforward neural network. Each layer includes corresponding weights and offsets. The generator network includes multiple hidden layers, and the size of each hidden layer, i.e., its dimension, is 1 / 4 of the size of the previous layer. The convolutional neural network extracts features of the user's basic information to generate preference information. Then, the backward-facing feedforward neural network increases the dimension of the reduced preference information to the dimension of the input matrix, making the input real user rating matrix similar to the output fake user rating matrix.

[0077] S300, mix the fake user rating matrix and the real user rating matrix to obtain a mixed user rating matrix.

[0078] The hybrid user rating matrix is ​​a rating matrix obtained by mixing the fake user rating matrix with the real user rating matrix. The hybrid user rating matrix contains both fake and real user rating information and is used to attack the recommendation system in order to test the system's attack resistance.

[0079] Specifically, the fake user rating matrix obtained through generator training is mixed with the real user rating matrix, and the resulting mixed user rating matrix is ​​used to attack the recommendation system.

[0080] S400, based on the hybrid user rating matrix, simulates attacks on multiple recommended items using an attack discriminator that simulates a recommendation system, and obtains the attack loss.

[0081] Simulation attacks are used because it is impossible to attack the real recommendation system multiple times, so attacks are launched against alternative models of the recommendation system to achieve the same attack effect.

[0082] Specifically, the fake user rating matrix generated by the generator is passed through a authenticity discriminator to distinguish between real and fake user rating information. The authenticity discriminator is a binary classification network that treats the user rating information generated by the generator as negative samples and the real user rating information as positive samples, thus differentiating the real user rating matrix from the fake ones. and the fake user rating matrix generated by the generator The input is fed into the authenticity detector to identify whether fake user ratings are more similar to genuine user ratings. This leads to a minimax game between the generator and the authenticity detector. In each round of the minimax competition, each generator and the authenticity detector attacks to strengthen itself and defeat the other. After being identified by the authenticity detector, the mixed user rating matrix is ​​generated. Injected into a simulated recommendation system, the system's attack detector performs simulated attacks on multiple recommended items to generate predicted scores. The attack loss is obtained by analyzing and processing the data. Each attack discriminator records whether the attack was successful, i.e., whether all attack targets are in the top k recommended rankings. The following formula is used as the attack discriminator loss:

[0083]

[0084] Where i represents the i-th recommended item targeted in this simulated attack, and T represents the set of recommended items targeted in the attack. This represents the fake users generated by the generator, where w represents the weight coefficient and R represents the fake user. Ideal attack score for recommended item i This indicates that the simulated recommendation system targets fake users. The predicted score output by combining the recommended item i with the recommended item i.

[0085] If the success rate of this attack is more than 80% of the training epochs, then the training is successful, the attack is effective, and the trained samples can be used to attack the real recommendation system to obtain more aggressive detection samples.

[0086] The purpose of a authenticity discriminator is to distinguish between genuine and fake user ratings. Ideally, the discriminator should be able to differentiate between all negative and positive samples, as expressed by the following formula:

[0087]

[0088] The following formula is used as the authenticity discrimination loss. By optimizing this loss, the discriminator and the generator continuously engage in a game:

[0089]

[0090] Where G represents the generator and E represents the mathematical expectation.

[0091] S500 generates attack detection samples based on attack loss and a hybrid user rating matrix.

[0092] Among them, the attack detection sample is a sample used to detect the attack resistance capability of the target recommendation system.

[0093] Specifically, if the attack loss obtained through simulated attacks is large, the generator is returned to continue training to produce more aggressive detection samples. If the attack loss is small, it is determined whether all attack targets are in the top k recommended rankings. If so, attack detection samples are obtained based on the mixed user rating matrix.

[0094] In the aforementioned method for generating attack detection sample data for a recommendation system, the real user rating matrix in the dataset of the recommendation system is obtained. Based on the real user rating matrix, a fake user rating matrix corresponding to the real user rating matrix is ​​generated by a generator. The fake user rating matrix and the real user rating matrix are mixed to obtain a mixed user rating matrix. Based on the mixed user rating matrix, a simulated attack is performed on multiple recommendation items using an attack discriminator of the simulated recommendation system to obtain the attack loss. Based on the attack loss and the mixed user rating matrix, attack detection samples are generated. This method can perform multiple simulated attacks on multiple recommendation items using an attack discriminator of the simulated recommendation system. The attack detection samples are then further filtered based on the attack loss to select the attack detection samples with better attack performance.

[0095] In one embodiment, based on a hybrid user rating matrix, a simulated attack is performed on multiple recommended items using an attack discriminator that simulates the recommender system, resulting in an attack loss including:

[0096] Based on the hybrid user rating matrix, the attack loss is obtained by performing simultaneous and step-by-step simulated attacks on multiple recommended items using an attack discriminator that simulates the recommender system.

[0097] Specifically, simulation attacks include two attack modes: synchronous simulation attacks and step-by-step simulation attacks. Synchronous simulation attacks require calculating the attack loss of all targets after each attack, while step-by-step simulation attacks require calculating the attack loss of each target after each attack.

[0098] In this embodiment, the attack identification device of the simulated recommendation system is used to perform synchronous and step-by-step simulated attacks on multiple recommended items to obtain the attack loss, and the effectiveness of the attack can be determined based on the attack loss.

[0099] In one embodiment, such as Figure 3 As shown, S200 includes:

[0100] S220: Based on real user information in the dataset, generate fake user information using a basic information generator.

[0101] S240, calculate the similarity between real user information and fake user information, and obtain the score matrix of real user information with the highest preset similarity ranking.

[0102] S260: Based on the rating matrix of real user information ranked first in the preset similarity, obtain the rating matrix of fake users through the preference generation integrator.

[0103] S280: Based on the fake user rating matrix, obtain the fake user rating matrix corresponding to the real user rating matrix through a distributed learner.

[0104] Specifically, the generator includes a basic information generator, a preference generation integrator, and a distributed learner. The basic information generator first generates discretized fake user basic information, and then calculates the similarity between the generated fake basic information and the real user information. The similarity calculation formula is as follows:

[0105]

[0106]

[0107] x and y represent the attributes of fake users and real users, respectively. The Euclidean distance between the two users is given. A larger Euclidean distance indicates lower similarity, and a smaller Euclidean distance indicates higher similarity. The process involves finding the three most similar real users to the fake user and generating a rating matrix for each of these three users. , rating matrix The similarity scores are input into the preference generation integrator to obtain the fake user rating matrix.

[0108] The generator outputs a fake user rating matrix, which is then input into a distribution learner to make the fake user rating matrix more similar to the real user rating matrix. This is achieved by introducing parameters. This leads to a false rating matrix. The distribution P(X) that more closely approximates the true rating matrix; for ease of understanding, the parameters... To satisfy the formula:

[0109]

[0110] in, The rating information is false. This represents the distribution of all fake rating matrices generated by the generator network. Representing the distribution of all true rating matrices, KL divergence is a metric used to measure the similarity between two probability distributions. A larger KL divergence indicates a greater difference in probability distributions and a lower matching degree, as shown in the formula:

[0111]

[0112] Where q(x) represents the probability distribution function of the false rating matrix, and p(x) represents the probability distribution function of the true rating matrix.

[0113] The generator aims to generate a cluster of fake samples with higher similarity, so it needs to calculate the... Minimize parameters This makes the generated fake samples more realistic. The formulas for the distribution of generated samples and the distribution of input samples are as follows:

[0114]

[0115] in, , It is a prior distribution, As input, it is then fed into the neural network G to obtain... In this way, the generating distribution is constructed. , Defined by network parameters, the indicator function I represents 1 when the condition within the brackets [] is true, and 0 otherwise. This is to ensure the distribution of the generated false rating matrix... Distribution with the true rating matrix To achieve the closest possible approximation, a generation loss was designed to tune and optimize the generator network G and its parameters. Thus achieving Fitting The effect is to improve the realism of the samples generated by the generator through this generation loss:

[0116]

[0117] in, Indicates fake users The rating matrix for item v.

[0118] In this embodiment, based on real user information in the dataset, a basic information generator generates fake user information. The similarity between the real and fake user information is calculated, and a rating matrix of the top-ranked real user information with a preset similarity score is obtained. Based on this rating matrix, a preference generation integrator generates a fake user rating matrix. Finally, a distribution learner obtains a fake user rating matrix corresponding to the real user rating matrix. This allows the generator to generate a fake user rating matrix that is more similar to the real user rating matrix.

[0119] In one embodiment, obtaining a fake user rating matrix by using a preference generation integrator, based on a rating matrix of real user information ranked top by similarity according to a preset criteria, includes:

[0120] The preference generator of the preference generator reduces the dimensionality of the rating matrix of real user information ranked first in the preset similarity; based on the rating matrix of real user information ranked first in the preset similarity after dimensionality reduction and the similarity, a fake user rating matrix is ​​obtained; the dimensionality of the fake user rating matrix is ​​increased to the same dimension as the real user rating matrix.

[0121] Specifically, the preference generation integrator includes a preference generator and an integrator. The preference generator is composed of a convolutional neural network that processes the input rating matrix. Dimensionality reduction is performed to understand the degree of preference of each user for each item in the input rating matrix. The resulting user rating matrix is ​​then compared with the similarity score. The process involves calculating the arithmetic product, summing the three products, and dividing by the sum of the three ratings to obtain the fake user rating matrix. This fake user rating matrix is ​​then fed into an integrator, which consists of a backward-facing feedforward neural network. The integrator improves the dimensionality-reduced fake user rating matrix to a level comparable to the real user rating matrix. The same dimensions yield the same output results. .

[0122] In this embodiment, the preference generator of the preference generator reduces the dimensionality of the rating matrix of the real user information ranked first in the preset similarity. Based on the rating matrix of the real user information ranked first in the preset similarity after dimensionality reduction and the similarity, a fake user rating matrix is ​​obtained. The dimension of the fake user rating matrix is ​​increased to the same dimension as the real user rating matrix, so that a fake user rating matrix with the same dimension as the real user rating matrix can be obtained, which is convenient for mixing the fake user rating matrix and the real user rating matrix.

[0123] In one embodiment, simulating an attack on multiple recommended items by simulating an attack detector of a recommendation system includes:

[0124] Simulated attacks are performed on multiple recommended items simultaneously using a simulated attack discriminator of the recommendation system to obtain the attack loss for all recommended items. Based on the attack loss and the hybrid user rating matrix, attack detection samples are generated, including: determining whether the recommended item's ranking is within a preset ranking range based on the attack loss; if so, generating attack detection samples based on the hybrid user rating matrix; if not, returning to the generator to continue training and generating a fake user rating matrix.

[0125] Specifically, the synchronous simulation attack involves simultaneously simulating attacks on multiple recommended items by mimicking the attack discriminator of the recommendation system. After each attack, the attack loss for all recommended items is obtained, and the attack loss is shown in the following formula:

[0126]

[0127] Where num represents the total number of recommended projects to be attacked simultaneously in a synchronous simulation attack.

[0128] For synchronous simulation attacks, there are three possible outcomes: First, all targets are successfully attacked and appear in the top k recommended rankings. Second, only some targets are successfully attacked and still appear in the top k recommended rankings. Third, none of the targets are successfully attacked. An attack is considered successful only if all targets appear in the top k recommended rankings. If the attack loss of all recommended items obtained through synchronous simulation attacks is significant, the generator is returned for further training to produce more aggressive detection samples. If the attack loss of all recommended items is small, it is determined whether all recommended items are in the top k recommended rankings. If so, attack detection samples are obtained based on the mixed user rating matrix.

[0129] In this embodiment, an attack detection sample is generated by simultaneously simulating attacks on multiple recommended items using an attack detection detector of a simulated recommendation system. The attack loss of all recommended items is obtained. Based on the attack loss and a hybrid user rating matrix, an attack detection sample is generated. This includes: determining whether the recommendation ranking of a recommended item is within a preset recommendation ranking range based on the attack loss; if so, generating an attack detection sample based on the hybrid user rating matrix; otherwise, returning to the generator to continue training and generating a fake user rating matrix. The attack loss of all recommended items obtained through synchronous simulation attacks can be used to determine whether the attack on all recommended items is effective.

[0130] In one embodiment, simulating an attack on multiple recommended items by simulating an attack detector of a recommendation system includes:

[0131] The attack detection system of the simulated recommendation system is used to simulate attacks on multiple recommended items step by step to obtain the attack loss for each recommended item. Based on the attack loss and the hybrid user rating matrix, attack detection samples are generated, including: determining whether the recommendation ranking of the recommended item is within the preset recommendation ranking range based on the attack loss; if so, generating attack detection samples based on the hybrid user rating matrix; if not, returning to the generator to continue training to generate a fake user rating matrix.

[0132] Specifically, step-by-step simulation involves simulating attacks on multiple recommended items step-by-step using the attacker's discriminator of the recommendation system, according to the formula above. The attack loss for each recommended item is calculated. The attack losses of each recommended item are compared, and several recommended items with smaller attack losses are selected. It is then checked whether the recommended item is among the top k. If so, attack detection samples are obtained based on the mixed user rating matrix, and recommended items with larger losses are returned to the generator for further training.

[0133] In this embodiment, an attack detection sample is generated by performing a step-by-step simulated attack on multiple recommended items using an attack detection detector of a simulated recommendation system. The attack loss for each recommended item is obtained. Based on the attack loss and a hybrid user rating matrix, an attack detection sample is generated. This includes: determining whether the recommended item's ranking is within a preset recommended ranking range based on the attack loss; if so, generating an attack detection sample based on the hybrid user rating matrix; otherwise, returning to the generator to continue training and generating a fake user rating matrix. The attack loss for each recommended item obtained through the step-by-step simulated attack can be used to determine whether the attack on each recommended item is effective.

[0134] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0135] Based on the same inventive concept, this application also provides an attack detection sample data generation apparatus for implementing the above-described method for generating attack detection sample data for recommendation systems. The solution provided by this apparatus is similar to the implementation described in the above method. Therefore, the specific limitations in one or more embodiments of the attack detection sample data generation apparatus provided below can be found in the limitations of the method for generating attack detection sample data for recommendation systems described above, and will not be repeated here.

[0136] In one embodiment, such as Figure 4 As shown, a device for generating sample data for attack detection in a recommendation system is provided, comprising: a dataset acquisition module 100, a fake user rating matrix generation module 200, a hybrid user rating matrix acquisition module 300, an attack loss acquisition module 400, and an attack detection sample generation module 500, wherein:

[0137] The dataset acquisition module 100 is used to acquire the real user rating matrix in the dataset of the recommender system. The real user rating matrix includes the real rating user identifiers and the rating items.

[0138] The fake user rating matrix generation module 200 is used to generate a fake user rating matrix corresponding to the real user rating matrix through a generator based on the real user rating matrix.

[0139] The mixed user rating matrix acquisition module 300 is used to mix the fake user rating matrix and the real user rating matrix to obtain a mixed user rating matrix.

[0140] The attack loss acquisition module 400 is used to simulate attacks on multiple recommended items by a simulated attack discriminator of a recommendation system based on a hybrid user rating matrix, and obtain the attack loss. The attack loss characterizes the difference between the attack results of the hybrid user rating matrix and the real user rating matrix.

[0141] The attack detection sample generation module 500 is used to generate attack detection samples based on the attack loss and the hybrid user rating matrix.

[0142] In one embodiment, the attack loss acquisition module 400 is further configured to obtain the attack loss by performing synchronous and step-by-step simulation attacks on multiple recommended items using a simulated attack discriminator of a recommendation system based on a mixed user rating matrix.

[0143] In one embodiment, the fake user rating matrix generation module 200 is further configured to use a generator including a basic information generator, a preference generation integrator, and a distribution learner; generating a fake user rating matrix corresponding to the real user rating matrix through the generator based on the real user rating matrix includes: generating fake user information based on real user information in the dataset using the basic information generator; calculating the similarity between the real user information and the fake user information, obtaining the rating matrix of the real user information with the highest preset similarity ranking, wherein the similarity ranking is based on the similarity from largest to smallest; obtaining the fake user rating matrix based on the rating matrix of the real user information with the highest preset similarity ranking through the preference generation integrator; and obtaining the fake user rating matrix corresponding to the real user rating matrix through the distribution learner based on the fake user rating matrix.

[0144] In one embodiment, the fake user rating matrix generation module 200 is further configured to reduce the dimensionality of the rating matrix of the real user information ranked first in the preset similarity by using the preference generator of the preference generator integrator; obtain the fake user rating matrix based on the rating matrix of the real user information ranked first in the preset similarity after dimensionality reduction and the similarity; and increase the dimensionality of the fake user rating matrix to the same dimension as the real user rating matrix.

[0145] In one embodiment, the attack loss acquisition module 400 is further configured to simultaneously simulate attacks on multiple recommended items using an attack discriminator of a simulated recommendation system, and acquire the attack loss of all recommended items; generating attack detection samples based on the attack loss, the real user rating matrix, and the hybrid user rating matrix includes: determining whether the recommendation ranking of a recommended item is within a preset recommendation ranking range based on the attack loss; if so, generating attack detection samples based on the real user rating matrix and the hybrid user rating matrix; if not, returning to the generator to continue training and generating a fake user rating matrix.

[0146] In one embodiment, the attack loss acquisition module 400 is further configured to simulate attacks on multiple recommended items step by step using an attack discriminator of a simulated recommendation system, and acquire the attack loss for each recommended item; generating attack detection samples based on the attack loss, the real user rating matrix, and the hybrid user rating matrix includes: determining whether the recommendation ranking of the recommended item is within a preset recommendation ranking range based on the attack loss; if so, generating attack detection samples based on the real user rating matrix and the hybrid user rating matrix; if not, returning to the generator to continue training and generating a fake user rating matrix.

[0147] Each module in the aforementioned recommendation system attack detection sample data generation device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the corresponding operations of each module.

[0148] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 5 As shown, the computer device includes a processor, memory, and a network interface connected via a system bus. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The database stores recommendation system data. The network interface communicates with external terminals via a network connection. When executed by the processor, the computer program implements a method for generating sample data for recommender system attack detection.

[0149] Those skilled in the art will understand that Figure 5The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0150] In one embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the following steps:

[0151] Obtain the real user rating matrix from the dataset of the recommender system. The real user rating matrix includes the real rating user identifiers and rated items. Based on the real user rating matrix, generate a fake user rating matrix corresponding to the real user rating matrix using a generator. Mix the fake user rating matrix and the real user rating matrix to obtain a hybrid user rating matrix. Based on the hybrid user rating matrix, simulate an attack on multiple recommended items using an attack discriminator of the recommender system to obtain an attack loss. The attack loss represents the difference between the attack results of the hybrid user rating matrix and the real user rating matrix. Based on the attack loss and the hybrid user rating matrix, generate attack detection samples.

[0152] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0153] Based on the hybrid user rating matrix, the attack loss is obtained by performing simultaneous and step-by-step simulated attacks on multiple recommended items using an attack discriminator that simulates the recommender system.

[0154] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0155] Based on real user information in the dataset, fake user information is generated using a basic information generator. The similarity between real and fake user information is calculated, and a rating matrix of the top-ranked real user information with the highest similarity is obtained. The similarity ranking is based on the similarity from highest to lowest. Based on the rating matrix of the top-ranked real user information with the highest similarity, a preference generator integrator is used to obtain a fake user rating matrix. Based on the fake user rating matrix, a distribution learner is used to obtain a fake user rating matrix corresponding to the real user rating matrix.

[0156] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0157] The preference generator in the preference generator reduces the dimensionality of the rating matrix of real user information ranked first in the preset similarity; based on the rating matrix of real user information ranked first in the preset similarity and the similarity after dimensionality reduction, the rating matrix of fake users is obtained; the dimensionality of the fake user rating matrix is ​​increased to the same dimension as the real user rating matrix.

[0158] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0159] Simulated attacks are performed on multiple recommended items simultaneously using a simulated attack discriminator of the recommendation system to obtain the attack loss for all recommended items. Based on the attack loss and the hybrid user rating matrix, attack detection samples are generated, including: determining whether the recommended item's ranking is within a preset ranking range based on the attack loss; if so, generating attack detection samples based on the hybrid user rating matrix; if not, returning to the generator to continue training and generating a fake user rating matrix.

[0160] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0161] The attack detection system of the simulated recommendation system is used to simulate attacks on multiple recommended items step by step to obtain the attack loss for each recommended item. Based on the attack loss and the hybrid user rating matrix, attack detection samples are generated, including: determining whether the recommendation ranking of the recommended item is within the preset recommendation ranking range based on the attack loss; if so, generating attack detection samples based on the hybrid user rating matrix; if not, returning to the generator to continue training to generate a fake user rating matrix.

[0162] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, the computer program performing the following steps when executed by a processor:

[0163] Obtain the real user rating matrix from the dataset of the recommender system. The real user rating matrix includes the real rating user identifiers and rated items. Based on the real user rating matrix, generate a fake user rating matrix corresponding to the real user rating matrix using a generator. Mix the fake user rating matrix and the real user rating matrix to obtain a hybrid user rating matrix. Based on the hybrid user rating matrix, simulate an attack on multiple recommended items using an attack discriminator of the recommender system to obtain an attack loss. The attack loss represents the difference between the attack results of the hybrid user rating matrix and the real user rating matrix. Based on the attack loss and the hybrid user rating matrix, generate attack detection samples.

[0164] In one embodiment, when the computer program is executed by a processor, it further performs the following steps:

[0165] Based on the hybrid user rating matrix, the attack loss is obtained by performing simultaneous and step-by-step simulated attacks on multiple recommended items using an attack discriminator that simulates the recommender system.

[0166] In one embodiment, when the computer program is executed by a processor, it further performs the following steps:

[0167] Based on real user information in the dataset, fake user information is generated using a basic information generator. The similarity between real and fake user information is calculated, and a rating matrix of the top-ranked real user information with the highest similarity is obtained. The similarity ranking is based on the similarity from highest to lowest. Based on the rating matrix of the top-ranked real user information with the highest similarity, a preference generator integrator is used to obtain a fake user rating matrix. Based on the fake user rating matrix, a distribution learner is used to obtain a fake user rating matrix corresponding to the real user rating matrix.

[0168] In one embodiment, when the computer program is executed by a processor, it further performs the following steps:

[0169] The preference generator in the preference generator reduces the dimensionality of the rating matrix of real user information ranked first in the preset similarity; based on the rating matrix of real user information ranked first in the preset similarity and the similarity after dimensionality reduction, the rating matrix of fake users is obtained; the dimensionality of the fake user rating matrix is ​​increased to the same dimension as the real user rating matrix.

[0170] In one embodiment, when the computer program is executed by a processor, it further performs the following steps:

[0171] Simulated attacks are performed on multiple recommended items simultaneously using a simulated attack discriminator of the recommendation system to obtain the attack loss for all recommended items. Based on the attack loss and the hybrid user rating matrix, attack detection samples are generated, including: determining whether the recommendation ranking of the recommended item is within the preset recommendation ranking range based on the attack loss; if so, the hybrid user rating matrix is ​​used to generate attack detection samples; if not, the generator is returned to continue training to generate a fake user rating matrix.

[0172] In one embodiment, when the computer program is executed by a processor, it further performs the following steps:

[0173] The attack detection system of the simulated recommendation system is used to conduct step-by-step simulated attacks on multiple recommended items to obtain the attack loss for each recommended item. Based on the attack loss, the real user rating matrix, and the hybrid user rating matrix, attack detection samples are generated, including: determining whether the recommendation ranking of the recommended item is within the preset recommendation ranking range based on the attack loss; if so, generating attack detection samples based on the real user rating matrix and the hybrid user rating matrix; if not, returning to the generator to continue training to generate a fake user rating matrix.

[0174] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, performs the following steps:

[0175] Obtain the real user rating matrix from the dataset of the recommender system. The real user rating matrix includes the real rating user identifiers and rated items. Based on the real user rating matrix, generate a fake user rating matrix corresponding to the real user rating matrix using a generator. Mix the fake user rating matrix and the real user rating matrix to obtain a hybrid user rating matrix. Based on the hybrid user rating matrix, simulate an attack on multiple recommended items using an attack discriminator of the recommender system to obtain an attack loss. The attack loss represents the difference between the attack results of the hybrid user rating matrix and the real user rating matrix. Based on the attack loss and the hybrid user rating matrix, generate attack detection samples.

[0176] In one embodiment, when the computer program is executed by a processor, it further performs the following steps:

[0177] Based on the hybrid user rating matrix, the attack loss is obtained by performing simultaneous and step-by-step simulated attacks on multiple recommended items using an attack discriminator that simulates the recommender system.

[0178] In one embodiment, when the computer program is executed by a processor, it further performs the following steps:

[0179] Based on real user information in the dataset, fake user information is generated using a basic information generator. The similarity between real and fake user information is calculated, and a rating matrix of the top-ranked real user information with the highest similarity is obtained. The similarity ranking is based on the similarity from highest to lowest. Based on the rating matrix of the top-ranked real user information with the highest similarity, a preference generator integrator is used to obtain a fake user rating matrix. Based on the fake user rating matrix, a distribution learner is used to obtain a fake user rating matrix corresponding to the real user rating matrix.

[0180] In one embodiment, when the computer program is executed by a processor, it further performs the following steps:

[0181] The preference generator in the preference generator reduces the dimensionality of the rating matrix of real user information ranked first in the preset similarity; based on the rating matrix of real user information ranked first in the preset similarity and the similarity after dimensionality reduction, the rating matrix of fake users is obtained; the dimensionality of the fake user rating matrix is ​​increased to the same dimension as the real user rating matrix.

[0182] In one embodiment, when the computer program is executed by a processor, it further performs the following steps:

[0183] Simulated attacks are performed on multiple recommended items simultaneously using a simulated attack discriminator of the recommendation system to obtain the attack loss for all recommended items. Based on the attack loss and the hybrid user rating matrix, attack detection samples are generated, including: determining whether the recommended item's ranking is within a preset ranking range based on the attack loss; if so, generating attack detection samples based on the hybrid user rating matrix; if not, returning to the generator to continue training and generating a fake user rating matrix.

[0184] In one embodiment, when the computer program is executed by a processor, it further performs the following steps:

[0185] The attack detection system of the simulated recommendation system is used to simulate attacks on multiple recommended items step by step to obtain the attack loss for each recommended item. Based on the attack loss and the hybrid user rating matrix, attack detection samples are generated, including: determining whether the recommendation ranking of the recommended item is within the preset recommendation ranking range based on the attack loss; if so, generating attack detection samples based on the hybrid user rating matrix; if not, returning to the generator to continue training to generate a fake user rating matrix.

[0186] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties.

[0187] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments described above. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0188] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0189] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A method for generating sample data for attack detection in a recommendation system, characterized in that, The method includes: Obtain the real user rating matrix from the dataset of the recommendation system, wherein the real user rating matrix includes the real rating user identifiers and the rated items; Based on the real user information in the dataset, fake user information is generated using a basic information generator; Calculate the similarity between the real user information and the fake user information, and obtain a scoring matrix of the real user information with the highest similarity ranking. The similarity ranking is based on the similarity from largest to smallest. Based on the rating matrix of real user information ranked first by the preset similarity, a fake user rating matrix is ​​obtained through a preference generation integrator. Based on the fake user rating matrix, a fake user rating matrix corresponding to the real user rating matrix is ​​obtained through a distributed learner; The fake user rating matrix and the real user rating matrix are mixed to obtain a hybrid user rating matrix; Based on the hybrid user rating matrix, multiple recommended items are simulated for attack using an attack discriminator that simulates the recommendation system, and the attack loss is obtained. The attack loss characterizes the difference between the attack results of the hybrid user rating matrix and the real user rating matrix. Attack detection samples are generated based on the attack loss and the hybrid user rating matrix.

2. The method according to claim 1, characterized in that, The method involves simulating attacks on multiple recommended items using a simulated attack discriminator of a recommendation system based on a hybrid user rating matrix, resulting in attack losses including: Based on the hybrid user rating matrix, the attack loss is obtained by performing simultaneous and step-by-step simulated attacks on multiple recommended items using an attack discriminator that simulates the recommender system.

3. The method according to claim 1, characterized in that, The step of obtaining a fake user rating matrix through the preference generation integrator, based on the rating matrix of the top-ranked real user information according to the preset similarity, includes: The preference generator of the preference generator reduces the dimensionality of the scoring matrix of the top-ranked real user information with the preset similarity. Based on the rating matrix of real user information ranked first by preset similarity after dimensionality reduction and the similarity, obtain the rating matrix of fake users; Increase the dimensions of the fake user rating matrix to the same dimensions as the real user rating matrix.

4. The method according to claim 1, characterized in that, The simulated attack on multiple recommended items using an attack detector that simulates the recommendation system includes: Simulated attacks were conducted on multiple recommended items simultaneously using an attack detector that simulates the recommendation system, and the attack losses of all recommended items were obtained. The generation of attack detection samples based on the attack loss and the hybrid user rating matrix includes: Based on the attack losses, determine whether the recommended ranking of the recommended item is within the preset recommended ranking range; If so, then attack detection samples are generated based on the hybrid user rating matrix; If not, return to the generator to continue training and generating the fake user rating matrix.

5. The method according to claim 1, characterized in that, The simulated attack on multiple recommended items using an attack detector that simulates the recommendation system includes: By simulating the attack discriminator of the recommendation system, multiple recommended items are subjected to step-by-step simulated attacks to obtain the attack loss for each recommended item; The generation of attack detection samples based on the attack loss and the hybrid user rating matrix includes: Based on the attack losses, determine whether the recommended ranking of the recommended item is within the preset recommended ranking range; If so, then attack detection samples are generated based on the hybrid user rating matrix; If not, return to the generator to continue training and generating the fake user rating matrix.

6. A device for generating sample data for attack detection in a recommendation system, characterized in that, The device includes: The dataset acquisition module is used to acquire the real user rating matrix in the dataset of the recommendation system. The real user rating matrix includes the real rating user identifiers and the rating items. A fake user rating matrix generation module is used to generate fake user information based on real user information in the dataset using a basic information generator; calculate the similarity between the real user information and the fake user information to obtain a rating matrix of the real user information with the highest preset similarity ranking, where the similarity ranking is based on the similarity from largest to smallest; obtain a fake user rating matrix based on the rating matrix of the real user information with the highest preset similarity ranking using a preference generation integrator; and obtain a fake user rating matrix corresponding to the real user rating matrix based on the fake user rating matrix using a distribution learner. A hybrid user rating matrix acquisition module is used to mix the fake user rating matrix and the real user rating matrix to obtain a hybrid user rating matrix; The attack loss acquisition module is used to simulate attacks on multiple recommended items by using an attack discriminator of a simulated recommendation system based on a hybrid user rating matrix to obtain the attack loss, which represents the difference between the attack results of the hybrid user rating matrix and the real user rating matrix. An attack detection sample generation module is used to generate attack detection samples based on the attack loss and the hybrid user rating matrix.

7. The apparatus according to claim 6, characterized in that, The attack loss acquisition module is also used to: based on the mixed user rating matrix, perform synchronous and step-by-step simulation attacks on multiple recommended items using an attack discriminator that simulates a recommendation system, and obtain the attack loss.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 5.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 5.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 5.

Images