Recommendation system optimization method and system based on shilling attack simulation

Abstract

The invention discloses a recommendation system optimization method and system based on shilling attack simulation. The recommendation system optimization method comprises the steps that part of information of a target data set is acquired from a homepage of a recommendation system; inputting partial information of the obtained target data set into the optimized generator to obtain a false user configuration file; carrying out shilling attack on a recommendation system by utilizing the false user configuration file; according to the performance of the recommendation system during the shilling attack, the recommendation system is optimized, and the method and the system can improve the optimization effect of the recommendation system.

Description

Technical Field

[0001] The invention belongs to the field of recommendation system security simulation experiments, and relates to a recommendation system optimization method and system based on shilling attack simulation. Background Art

[0002] The development of recommendation systems can be traced back to the research fields of information filtering and information retrieval. They are designed to solve the problem of information overload and provide users with personalized information services. Recommendation systems use various algorithms and models to predict items or services that users may be interested in based on information such as user preferences, historical behaviors, and social networks. Common recommendation algorithms include collaborative filtering, content-based recommendation, matrix decomposition, and deep learning. As an important information filtering tool, recommendation systems have been widely used in e-commerce, social media, and other fields. However, recommendation systems also face security issues, including shilling attacks. This attack refers to malicious users manipulating the recommendation system to inject false user preferences or evaluation information into the system to influence the recommendation results, thereby obtaining improper benefits or undermining the fairness and accuracy of the system. In order to improve the robustness of the recommendation system, many scholars are currently studying shilling attacks in order to achieve self-knowledge and enemy-knowledge.

[0003] Shilling attack is an act of manipulating the recommendation system, with the purpose of disrupting the recommendation results by injecting fake users or ratings. The attacker may use multiple fake accounts or collude with others to artificially increase or decrease the ranking of specific products or services. This attack may cause the accuracy and credibility of the recommendation system to be damaged, affecting users' purchasing decisions and experience.

[0004] Shilling strategies have attracted widespread attention due to their diversity and adaptability to different application scenarios, but they share some common flaws. First, these attacks usually only affect a single target item, either increasing its popularity or reducing its attention. The original intention of shilling research is not only to launch attacks on recommendation systems, but more importantly to enhance the robustness of recommendation systems by identifying and responding to attacks. However, if the attack is limited to a single target item, it will be detrimental to improving the overall training efficiency of the recommendation system and reducing the cost of implementing attacks. Secondly, the currently implemented shilling strategies face the problem of poor concealment. When creating fake user profiles, mainstream shilling methods usually only focus on the two links of "generation" and "injection", which leads to the fact that fake profiles are often placed in batches in similar locations, and the similarity between these fake configurations is high. In addition, in the process of generating fake user profiles, attackers often ignore the construction of profile preferences. The generated fake users lack strong interests or hobbies in specific fields and only show random consumption behaviors. These factors work together to cause significant differences between the generated fake users and real users, which are easily identified and marked as unreasonable by existing detection algorithms. Therefore, this method of generating fake user profiles that lack clever disguises faces significant challenges in improving stealth. At the same time, existing shilling faces the problem of poor attack effectiveness. This is mainly because the diversity of various shilling strategies and targets leads to significant differences in their effects on different recommendation systems. For example, random attacks and average attacks are more suitable for user-based recommendation systems, while focused attacks and segment attacks are more suitable for item-based recommendation systems. When these attack strategies are applied to recommendation systems that are not suitable for their specific types, their effects are generally poor. This mismatch between the strategy and the target system type highlights the importance of considering the specific architecture and characteristics of the recommendation system when designing the attack method, so the recommendation system cannot be effectively optimized to reduce the effectiveness of the shilling attack. Summary of the invention

[0005] The purpose of the present invention is to overcome the shortcomings of the above-mentioned prior art and provide a recommendation system optimization method and system based on shilling attack simulation, which can improve the optimization effect of the recommendation system.

[0006] In a first aspect, the recommendation system optimization method based on shilling attack simulation of the present invention comprises:

[0007] Get some information about the target dataset from the recommendation system’s homepage;

[0008] Inputting part of the information of the acquired target data set into the optimized generator to obtain a false user profile;

[0009] Utilizing the fake user profile to conduct a shilling attack on the recommendation system;

[0010] The recommendation system is optimized according to its performance during shilling attacks.

[0011] Furthermore, part of the information in the target data set includes popular items on the homepage of the recommendation system and information about their buyers.

[0012] Furthermore, before inputting the acquired partial information of the target data set into the trained generator, the method further includes:

[0013] Get some information samples of the target dataset from the recommendation system homepage;

[0014] Inputting the partial information sample into the generator to obtain a false user profile sample of the target data set;

[0015] Get a sample of real user profiles;

[0016] Mixing the fake user profile sample and the real user profile sample and inputting them into the trained authenticity discriminator, and calculating the generation loss of the authenticity discriminator;

[0017] Mixing the fake user profile sample and the real user profile sample to obtain mixed data, using the mixed data to attack the proxy model in the recommendation system, and calculating the loss during the attack;

[0018] The generator is optimized according to the generation loss of the authenticity discriminator and the calculated loss during the attack process to obtain an optimized generator.

[0019] Furthermore, the authenticity discriminator generates a loss Loss G for:

[0020]

[0021] Among them, D(G(z i )) represents the discriminator D's response to the data G(z i ) output.

[0022] Furthermore, the loss function of the authenticity discriminator during training is:

[0023]

[0024] Among them, Num represents the total number of real samples and false samples, x i represents the i-th sample, l i represents the label of the current sample, D(x i ) represents the authenticity discriminator for the current sample x i Output.

[0025] Furthermore, the process of using mixed data to attack the proxy model in the recommendation system is as follows:

[0026] The mixed data is used to attack the proxy model in the recommendation system in a synchronous attack mode or a step-by-step attack mode.

[0027] Furthermore, the loss during the attack in the synchronous attack mode is:

[0028]

[0029] Among them, f(u, i) represents the score of the current target item i∈T in the recommendation list of user u, and f(u, n) represents the score of the non-target item in the recommendation list of user u.

[0030] Furthermore, the loss during the attack process in the step-by-step attack mode is:

[0031]

[0032] Among them, f(u, i) represents the score of the current target item i∈T in the recommendation list of user u, and f(u, n) represents the score of the non-target item in the recommendation list of user u.

[0033] In a second aspect, the recommendation system optimization system based on shilling attack simulation of the present invention comprises:

[0034] The first acquisition module is used to obtain partial information of the target data set from the homepage of the recommendation system;

[0035] A first generating module, configured to input part of the information of the acquired target data set into an optimized generator to obtain a false user profile;

[0036] A first attack module, used to perform a shilling attack on the recommendation system using the fake user profile;

[0037] The optimization module is used to optimize the recommendation system according to its performance during shilling attacks.

[0038] Furthermore, it also includes:

[0039] The second acquisition module is used to obtain partial information samples of the target data set from the recommendation system homepage;

[0040] A second generating module, used for inputting the partial information sample into a generator to obtain a false user profile sample of a target data set;

[0041] The third acquisition module is used to obtain a sample of a real user profile;

[0042] an identification module, configured to mix the fake user profile sample and the real user profile sample and input the mixed sample into the trained authenticity discriminator, and calculate the generation loss of the authenticity discriminator;

[0043] A second attack module is used to mix the false user profile sample and the real user profile sample to obtain mixed data, use the mixed data to attack the proxy model in the recommendation system, and calculate the loss during the attack process;

[0044] The optimization module is used to optimize the generator according to the generation loss of the authenticity discriminator and the loss in the attack process calculated to obtain an optimized generator.

[0045] The present invention has the following beneficial effects:

[0046] In the specific operation of the recommendation system optimization method and system based on shilling attack simulation described in the present invention, part of the information of the obtained target data set is input into the optimized generator to obtain a false user profile. The false user profile is generated by the optimized generator, which can avoid the problems of low efficiency, poor concealment, poor attack effect and limited application scope existing in traditional shilling attacks, reveal the security vulnerabilities of the recommendation system, and provide strong data support and improvement direction for in-depth understanding of the vulnerability of the recommendation system, thereby enhancing its security.

[0047] Furthermore, the generator and the authenticity discriminator are used to construct an adversarial generative network to improve the effect of generator optimization. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] The accompanying drawings constituting a part of the present invention are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the accompanying drawings:

[0049] Figure 1 is a flow chart of the method of the present invention;

[0050] Figure 2 It is a system structure diagram of the present invention. DETAILED DESCRIPTION

[0051] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all of the embodiments. The components of the embodiments of the present invention described and shown in the drawings here can usually be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present invention provided in the drawings is not intended to limit the scope of the claimed invention, but merely represents selected embodiments of the present invention. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0052] Various structural schematic diagrams of the embodiments disclosed in the present invention are shown in the accompanying drawings. These figures are not drawn to scale, and some details are magnified and some details may be omitted for the purpose of clear expression. The shapes of various regions and layers shown in the figures and the relative sizes and positional relationships therebetween are only exemplary, and may deviate in practice due to manufacturing tolerances or technical limitations, and those skilled in the art may additionally design regions / layers with different shapes, sizes, and relative positions according to actual needs.

[0053] As is known, a graph encoder is a neural network model used to process graph data, such as social networks, user-item relationship graphs in recommendation systems, etc. It can effectively capture the structural information of graph data and the complex relationships between nodes, providing support for subsequent feature learning and graph analysis. Graph encoders are often used in recommendation systems to understand and encode complex user-item relationship networks. Through graph encoders, recommendation systems can analyze user interaction behaviors, social relationships and other information, thereby extracting users' implicit features and interests, and providing support for personalized recommendations.

[0054] Sequence Encoder is a neural network model used to process sequence data, such as natural language text, time series data, etc. It can convert sequence data into high-dimensional semantic representation, capture the grammatical and semantic information in the sequence, and provide support for subsequent sequence modeling and prediction tasks. Sequence encoders are often used in recommendation systems to analyze user behavior sequences, such as user purchase history, browsing history, etc. Through sequence encoders, recommendation systems can capture the evolution and regularity of user behavior, predict users' future behavioral tendencies, and thus make more accurate personalized recommendations.

[0055] An autoencoder is an unsupervised learning neural network model used to learn a compact representation (encoding) of data and reconstruct the original input data. It consists of two parts: an encoder and a decoder. The encoder maps the input data to a low-dimensional representation space, while the decoder reconstructs the low-dimensional representation into the original input data. Autoencoders have the following characteristics and advantages: (1) Unsupervised learning: no labeled data is required, and feature representation can be learned directly from the data; (2) Data compression: it can learn a compact representation of data and effectively reduce the dimension of the data; (3) Feature extraction: it can learn meaningful features of the data, which is helpful for subsequent data analysis and pattern recognition tasks. Autoencoders are widely used in image processing, speech recognition, natural language processing and other fields. In recommendation systems, autoencoders can be used to learn the representation of users and items, thereby improving the effect of personalized recommendations. With the continuous development of deep learning technology, autoencoders are increasingly widely used in various fields. They can effectively learn the feature representation of data and provide strong support for tasks such as data mining, pattern recognition and recommendation systems.

[0056] Surrogate Model refers to a model used in the field of computer science to simulate, replace or represent other entities or processes. In the recommendation system, the surrogate model can be used to simulate the user's behavior, preferences or interests to help the recommendation system understand the user more accurately and provide personalized recommendation services. Surrogate models are usually built based on statistical models, machine learning algorithms or other mathematical models. Their goal is to model users based on existing data or knowledge to predict their future behavior or preferences. Surrogate models can be in various forms such as content-based models, collaborative filtering models, and deep learning models. With the continuous development of big data and artificial intelligence technologies, the application prospects of surrogate models in recommendation systems are becoming more and more broad. In the future, with the continuous innovation and optimization of algorithms and models, surrogate models will play an increasingly important role and provide more personalized and accurate recommendation services for recommendation systems.

[0057] Generative Adversarial Network (GAN) is a deep learning model that consists of two adversarial neural networks, the generator and the discriminator. The two networks learn together through adversarial training, and the goal of the generator is to generate fake data with realism to deceive the discriminator as much as possible. To this end, the generator receives random noise as input and maps it to a data space similar to real data to generate fake data. The generator continuously optimizes its generation ability by minimizing the difference between the generated data and the real data. The goal of the discriminator is to accurately distinguish between the fake data generated by the generator and the real data. It receives real data and fake data generated by the generator as input and tries to distinguish them. The discriminator continuously improves its discrimination ability by maximizing the correct identification of the difference between real data and fake data. The training process of GAN is a zero-sum game, with a competitive and cooperative relationship between the generator and the discriminator. During the training process, the generator and the discriminator are constantly updated alternately until a dynamic equilibrium state is reached, so that the fake data generated by the generator is realistic enough that the discriminator cannot accurately distinguish between real and fake data. Generative adversarial networks have achieved great success in image generation, style transfer, speech synthesis and other fields, and are also widely used in recommendation systems to generate realistic user preferences or product recommendations. The introduction of GAN provides new ideas and methods for personalized recommendations and user experience in recommendation systems.

[0058] The present invention aims to simulate and analyze possible shilling attack behaviors in a recommendation system, thereby improving the security and stability of the recommendation system. The present invention makes full use of the characteristics of the shared attributes of bipartite graphs between recommendation system datasets, and is particularly suitable for recommendation system datasets with restricted access rights. Specifically, first, a data loader is created through a generator, and the data loader deeply integrates a graph encoder and a sequence encoder. When facing a recommendation system dataset with restricted access rights, the data loader can perform deep learning on the public dataset and accurately grasp its topological structure. Subsequently, combined with the limited data that can be obtained, the data loader effectively generates highly realistic forged samples, i.e., simulated false user profiles. Then, these simulated false user profiles and real user profiles are input together into an authenticity discriminator composed of an autoencoder to perform data authenticity distinction training. Through repeated training iterations, the generator and the authenticity discriminator constantly challenge and surpass each other, thereby jointly improving their performance. Finally, the simulated false user information obtained through training is mixed with the real user data and input into an attack simulator composed of a proxy model to perform a simulation experiment of a shilling attack. This step is to test and evaluate the performance of the recommendation system when facing potential shilling attacks, so as to provide a strong experimental basis and improvement direction for the security protection strategy of the system. The present invention not only constructs a new shilling attack simulation experimental method, but also realizes the effective use of restricted data sets and the generation of highly realistic forged samples through deep learning technology, bringing innovative solutions to the security testing and protection of recommendation systems.

[0059] Specifically, refer to Figure 1 The recommendation system optimization method based on shilling attack simulation includes the following steps:

[0060] 1) Load the source dataset and build a user-item bipartite graph.

[0061] A data loader for the generator is constructed, which consists of a graph encoder and a sequence encoder. The graph encoder is based on a graph neural network (GNN) and is used to capture the complex relationships and features between nodes, thereby providing accurate graph structure information; the sequence encoder is based on a long short-term memory network (LSTM) and processes the sequence data of nodes in the graph to obtain rich contextual information.

[0062] 11) The core goal of the graph encoder is to learn the node representation H based on a given graph G and node features X. For each node v, its node representation is h v ,h v Update by formula (1):

[0063]

[0064] in, is the representation of node u at the kth layer, N(v) is the set of neighbor nodes of node v, AGGREGATE (k) () is used to aggregate the information of the neighboring nodes of the current node to learn the characteristics of the adjacent nodes; UPDATE (k) It is responsible for updating the representation of the node at the kth layer, specifically:

[0065]

[0066] Among them, MLP (k) is the k-th layer of the multilayer perceptron, used to learn the nonlinear combination of node representations, ε (k) is a learnable parameter used to adjust the importance of the node's own features and its neighbor's features. The purpose of formula (2) is that the representation of a node should not only contain its own information, but also the information of its neighbor nodes, so as to generate a higher quality feature representation.

[0067] 12) For the sequence encoder part in the data loader, first determine the secondary neighbor node sequence of the seed node, and then process the sequence. FakePro-GAN uses LSTM to process it, and the resulting sequence is:

[0068] h seq =LSTM(SPLICING({h v :v∈Seq(s)})), (3)

[0069] Among them, Seq(s) represents all secondary and primary neighbor sequences starting from node s, and SPLICING() represents the operation of splicing sequences.

[0070] The overall data loader is shown by formula (4):

[0071] H fin =α·H gnn +(1-α)·H seq , (4)

[0072] Among them, α is a weight parameter used to adjust the relative importance of the graph encoder and the sequence encoder in the final presentation.

[0073] 2) Entering the generator sample generation stage, FakePro-GAN collects partial information of the target dataset through sampling, which includes popular items and their buyers information that are easily obtained from the recommendation system homepage. Although the complete datasets of many recommendation systems are not public, this partial information is often available. After using this data for model training, the collected data is input into the pre-trained data loader to generate fake user profiles of the target dataset.

[0074] 21) To improve the deceptiveness of the generated user profiles, FakePro-GAN uses mean square error loss (MSE) as an indicator to measure the similarity between the generated data and the real data. By optimizing MSE, the generator can more accurately imitate the behavior and attributes of the real user profile, thereby enhancing the effectiveness and concealment of the attack. MSE is expressed as:

[0075]

[0076] Among them, y i and represent real data and generated data respectively.

[0077] 22) Set the generation loss, which is used to interact with the authenticity discriminator to achieve the purpose of generating more realistic data. The loss is expressed as:

[0078]

[0079] Among them, D(G(z i )) represents the authenticity discriminator D for the data G(z i ) output.

[0080] 3) Input the real user profile and the fake user profile into the autoencoder to determine whether the current sample is real or fake, and return the obtained result to the generator.

[0081] 31) The loss of the authenticity discriminator is designed, as shown in formula (8). This design further optimizes the performance of the authenticity discriminator and ensures high accuracy and effectiveness in making judgments.

[0082]

[0083] Among them, Num represents the total number of real samples and false samples, x i represents the i-th sample, l i Represents the label of the current sample. For the real sample, l i The value of is 1, otherwise, l i The value of D(x i) indicates that the discriminator is i The output of is the probability prediction that the current sample is a true sample.

[0084] 32) The goal of the authenticity discriminator is to identify the disguised real data most accurately. Therefore, the authenticity discriminator and the generation loss in the generator are in an opposing state. The authenticity discriminator and the generator form an adversarial generation network, which constitutes a game problem, namely:

[0085]

[0086] 4) Repeat steps 1) to 3).

[0087] 5) Mixing the real user profile with the fake user profile generated by the generator to obtain mixed data, and using the mixed data to attack the proxy model. The loss generated during the attack is used to further optimize the generator, with the goal of enabling the generator to generate more aggressive fake samples.

[0088] 51) Two main attack modes are adopted, namely, synchronous attack mode and step-by-step attack mode. In the synchronous attack mode, the ranking information of all targets will be collected and analyzed after each attack, and the attack loss will be calculated based on this information; in the step-by-step attack mode, the focus will be on the lowest-ranked target after each attack, and the loss will be calculated based on the situation of the target, so that the attack can be more focused on improving the ranking of a specific target.

[0089] 52) In order to enhance the effectiveness of these attack strategies, we innovated the loss function design and introduced ranking loss. Ranking loss directly optimizes the ranking of the target to improve the training effect of the generator, thereby enhancing the attack accuracy and effect of the fake samples. This method of directly optimizing the ranking helps to adjust the attack strategy more accurately and ensure the effectiveness of the attack. The ranking loss is expressed as:

[0090]

[0091] Among them, f(u, i) represents the score of the current target item i∈T in the recommendation list of user u, and f(u, n) represents the score of the non-target item in the recommendation list of user u, so as to encourage the ranking of the target item to exceed the non-target item.

[0092] 53) For the step-by-step attack, the attack loss is expressed as:

[0093]

[0094] In each attack, the step-by-step attack selects the last-ranked target item, calculates its loss, and re-inputs it into the generator. When the offensive trainer records that the number of successful attacks has reached 80% of the total number of trainings, the trained data is used to attack the real recommendation system.

[0095] 6) Repeat steps 1) to 5) to obtain the optimized generator;

[0096] 7) Obtaining partial information of the target data set from the homepage of the recommendation system, inputting the obtained partial information of the target data set into the optimized generator to obtain a false user profile, using the false user profile to perform a shilling attack on the recommendation system, and optimizing the recommendation system according to the performance of the recommendation system during the shilling attack.

[0097] Based on GAN, the present invention proposes an innovative shilling attack simulation method for recommendation systems, wherein the GAN includes a generator and an authenticity discriminator, and the method is particularly suitable for limited sample situations. By combining with advanced technologies such as graph encoders, sequence encoders, autoencoders, and proxy models, the present invention effectively solves the problems of low efficiency, poor concealment, poor attack effect, and limited application scope that are common in traditional shilling attacks, which not only improves the simulation efficiency and concealment of the attack, but also significantly enhances the attack effect, providing a more accurate and efficient experimental means for the security research of recommendation systems.

[0098] Embodiment 2

[0099] refer to Figure 2 The recommendation system optimization system based on shilling attack simulation of the present invention comprises:

[0100] The first acquisition module is used to obtain partial information of the target data set from the homepage of the recommendation system;

[0101] A first generating module, configured to input part of the information of the acquired target data set into an optimized generator to obtain a false user profile;

[0102] A first attack module, used to perform a shilling attack on the recommendation system using the fake user profile;

[0103] The first optimization module is used to optimize the recommendation system according to the performance of the recommendation system when performing a shilling attack.

[0104] As an embodiment of the present invention, it also includes:

[0105] The second acquisition module is used to obtain partial information samples of the target data set from the recommendation system homepage;

[0106] A second generating module, used for inputting the partial information sample into a generator to obtain a false user profile sample of a target data set;

[0107] The third acquisition module is used to obtain a sample of a real user profile;

[0108] an identification module, configured to mix the fake user profile sample and the real user profile sample and input the mixed sample into the trained authenticity discriminator, and calculate the generation loss of the authenticity discriminator;

[0109] A second attack module is used to mix the false user profile sample and the real user profile sample to obtain mixed data, use the mixed data to attack the proxy model in the recommendation system, and calculate the loss during the attack process;

[0110] The second optimization module is used to optimize the generator according to the generation loss of the authenticity identifier and the calculated loss in the attack process to obtain an optimized generator.

[0111] As an embodiment of the present invention, the generation loss Loss of the authenticity identifier G for:

[0112]

[0113] Among them, D(G(z i )) represents the discriminator D's response to the data G(z i ) output.

[0114] As an implementation mode of the present invention, the loss function of the authenticity discriminator during training is:

[0115]

[0116] Among them, Num represents the total number of real samples and false samples, x i represents the i-th sample, l i represents the label of the current sample, D(x i ) represents the authenticity discriminator for the current sample x i Output.

[0117] As an implementation mode of the present invention, the process of using mixed data to attack the proxy model in the recommendation system is as follows:

[0118] The mixed data is used to attack the proxy model in the recommendation system in a synchronous attack mode or a step-by-step attack mode.

[0119] As an implementation mode of the present invention, the loss during the attack process in the synchronous attack mode is:

[0120]

[0121] Among them, f(u, i) represents the score of the current target item i∈T in the recommendation list of user u, and f(u, n) represents the score of the non-target item in the recommendation list of user u.

[0122] As an implementation mode of the present invention, the loss during the attack process in the step-by-step attack mode is:

[0123]

[0124] Among them, f(u, i) represents the score of the current target item i∈T in the recommendation list of user u, and f(u, n) represents the score of the non-target item in the recommendation list of user u.

[0125] Embodiment 3

[0126] A computer device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the steps of implementing the recommendation system optimization method based on shilling attack simulation include: obtaining partial information of a target data set from the homepage of the recommendation system; inputting the obtained partial information of the target data set into the optimized generator to obtain a false user profile; using the false user profile to perform a shilling attack on the recommendation system; optimizing the recommendation system according to the performance of the recommendation system during the shilling attack. The memory may include a memory, such as a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk memory, etc. The processor, the network interface, and the memory are interconnected through an internal bus, and the internal bus may be an industrial standard architecture bus, a peripheral component interconnection standard bus, an extended industrial standard architecture bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. The memory is used to store programs. Specifically, the program may include a program code, and the program code includes computer operation instructions. The memory may include a memory and a non-volatile memory, and provide instructions and data to the processor.

[0127] Embodiment 4

[0128] A computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of implementing the recommendation system optimization method based on shilling attack simulation include: obtaining partial information of a target data set from the homepage of the recommendation system; inputting the obtained partial information of the target data set into the optimized generator to obtain a false user profile; using the false user profile to perform a shilling attack on the recommendation system; optimizing the recommendation system according to the performance of the recommendation system when performing a shilling attack. Specifically, the computer-readable storage medium includes, but is not limited to, volatile memory and / or non-volatile memory. The volatile memory may include random access memory (RAM) and / or cache memory (cache), etc. The non-volatile memory may include a read-only memory (ROM), a hard disk, a flash memory, an optical disk, a magnetic disk, etc.

[0129] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0130] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0131] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0132] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0133] Those skilled in the art will readily appreciate other embodiments of the present invention after considering the specification and disclosure of the invention. This application is intended to cover any variations, uses or adaptations of the present invention that follow the general principles of the present invention and include common knowledge or customary techniques in the art that are not disclosed by the present invention. The specification and examples are to be considered exemplary only, and the true scope and spirit of the present invention are indicated by the following claims.

[0134] It should be understood that the present invention is not limited to the exact construction that has been described above and shown in the drawings and that various modifications and changes may be made without departing from the scope thereof. The scope of the present invention is limited only by the appended claims.

[0135] The above description is only a preferred embodiment of the present invention and does not limit the present invention in any way. Any simple modification, change and equivalent structural change made to the above embodiment based on the technical essence of the present invention still falls within the protection scope of the technical solution of the present invention.

Claims

1. A recommendation system optimization method based on shilling attack simulation, characterized in that: include: Get some information about the target dataset from the recommendation system’s homepage; Inputting part of the information of the acquired target data set into the optimized generator to obtain a false user profile; Utilizing the fake user profile to conduct a shilling attack on the recommendation system; The recommendation system is optimized according to its performance during shilling attacks.

2. The recommendation system optimization method based on shilling attack simulation according to claim 1 is characterized in that: Part of the target data set includes popular items on the recommendation system homepage and their purchaser information.

3. The recommendation system optimization method based on shilling attack simulation according to claim 1, characterized in that: Before inputting the acquired partial information of the target data set into the trained generator, the method further includes: Get some information samples of the target dataset from the recommendation system homepage; Inputting the partial information sample into the generator to obtain a false user profile sample of the target data set; Get a sample of real user profiles; Mixing the fake user profile sample and the real user profile sample and inputting them into the trained authenticity discriminator, and calculating the generation loss of the authenticity discriminator; Mixing the fake user profile sample and the real user profile sample to obtain mixed data, using the mixed data to attack the proxy model in the recommendation system, and calculating the loss during the attack; The generator is optimized according to the generation loss of the authenticity discriminator and the calculated loss during the attack process to obtain an optimized generator.

4. The recommendation system optimization method based on shilling attack simulation according to claim 3 is characterized in that: The authenticity discriminator generates a loss Loss G for: Among them, D(G(z i )) represents the discriminator D's response to the data G(z i ) output.

5. The recommendation system optimization method based on shilling attack simulation according to claim 3 is characterized in that: The loss function of the authenticity discriminator during training is: Among them, Num represents the total number of real samples and false samples, x i represents the i-th sample, l i represents the label of the current sample, D(x i ) represents the authenticity discriminator for the current sample x i Output.

6. The recommendation system optimization method based on shilling attack simulation according to claim 3 is characterized in that: The process of using mixed data to attack the proxy model in the recommendation system is as follows: The mixed data is used to attack the proxy model in the recommendation system in a synchronous attack mode or a step-by-step attack mode.

7. The recommendation system optimization method based on shilling attack simulation according to claim 6 is characterized in that: The loss during the attack in the synchronous attack mode is: Among them, f(u, i) represents the score of the current target item i∈T in the recommendation list of user u, and f(u, n) represents the score of the non-target item in the recommendation list of user u.

8. The recommendation system optimization method based on shilling attack simulation according to claim 6, characterized in that: The loss during the attack in the step-by-step attack mode is: Among them, f(u, i) represents the score of the current target item i∈T in the recommendation list of user u, and f(u, n) represents the score of the non-target item in the recommendation list of user u.

9. A recommendation system optimization system based on shilling attack simulation, characterized in that: include: The first acquisition module is used to obtain partial information of the target data set from the homepage of the recommendation system; A first generating module, configured to input part of the information of the acquired target data set into an optimized generator to obtain a false user profile; A first attack module, used to perform a shilling attack on the recommendation system using the fake user profile; The optimization module is used to optimize the recommendation system according to its performance during shilling attacks.

10. The recommendation system optimization system based on shilling attack simulation according to claim 9, characterized in that: Also includes: The second acquisition module is used to obtain partial information samples of the target data set from the recommendation system homepage; A second generating module, used for inputting the partial information sample into a generator to obtain a false user profile sample of a target data set; The third acquisition module is used to obtain a sample of a real user profile; an identification module, configured to mix the fake user profile sample and the real user profile sample and input the mixed sample into the trained authenticity discriminator, and calculate the generation loss of the authenticity discriminator; A second attack module is used to mix the false user profile sample and the real user profile sample to obtain mixed data, use the mixed data to attack the proxy model in the recommendation system, and calculate the loss during the attack process; The optimization module is used to optimize the generator according to the generation loss of the authenticity discriminator and the loss in the attack process calculated to obtain an optimized generator.

Images