Recommendation system-oriented high-concealment poisoning attack detection method and application

Abstract

The invention discloses a recommendation system-oriented high-concealment poisoning attack detection method and application, and the method comprises the following steps: S1, user behavior and relationship modeling: constructing a user feature vector and symbiotic relationship graph, and describing user scoring behavior preference and a co-occurrence relationship; s2, importance pre-screening: based on similarity measurement and importance modeling of score distribution, filtering out normal users weakly related to potential attack users; s3, cross-graph relation decoupling: carrying out key relation extraction and dynamic and static relation separation on the user relation graph, and obtaining high-quality relation representation through a cross-graph fusion mechanism; and S4, double-hyper-sphere cooperative detection: normal user representation is restrained by using a concentric hyper-sphere shell, and abnormal user detection is realized through the degree of deviation from the boundary. According to the method, high-concealment poisoning attacks can be effectively detected in a real recommendation system environment, the detection accuracy is remarkably improved, the false alarm rate is reduced, and the method has good practicability and robustness.

Description

Technical Field

[0001] This invention relates to the fields of artificial intelligence and network security technology, and in particular to a highly covert poisoning attack detection method and its application for recommendation systems. Background Technology

[0002] Recommendation systems, as an important application in the field of artificial intelligence, have been widely deployed in e-commerce, finance, education, news and information and other scenarios.

[0003] Its core function is to improve user experience, enhance user stickiness, and increase business conversion rate by modeling user preferences to achieve personalized recommendations.

[0004] For example, in e-commerce platforms, recommendation systems can push potentially interesting products to users; in the financial sector, recommendation systems can guide users to choose investment products; and in online education, recommendation systems help users discover suitable courses and learning resources.

[0005] However, the openness and reliance on user interaction data of recommender systems make them vulnerable to malicious attacks, especially poisoning attacks. Poisoning attacks inject false user behavior data to alter the output of the recommender model, aiming to boost the ranking of a target product or suppress competitors. Such attacks not only damage the fairness and credibility of the recommender system but also lead to a decline in user experience and losses for the platform.

[0006] As attack methods continue to evolve, poisoning attacks have gradually developed from simple rating manipulation in the early stages to more intelligent and covert attack methods. Among them, high-concealed poisoning attacks (HCPA) pose the most serious threat to recommendation systems.

[0007] To address the security issues of recommender systems, academia and industry have proposed various detection and defense methods.

[0008] Traditional detection methods mainly include: methods based on statistical feature analysis, methods based on hidden features, and anomaly detection methods based on relationship graphs.

[0009] For example, methods based on user behavior statistics can identify attacking users with abnormal rating distributions, methods based on latent features use deep learning models to extract users' latent features for anomaly detection, and methods based on relationship graphs can mine potential attack groups through the co-occurrence relationships between users.

[0010] These methods have proven effective in dealing with early traditional poisoning attacks.

[0011] However, as attack strategies continue to evolve, existing methods are gradually revealing their limitations.

[0012] Researchers currently face the following main challenges in dealing with highly covert poisoning attacks:

[0013] (1) Enhanced attack concealment:

[0014] Highly covert poisoning attacks simulate the rating behavior of normal users, making them statistically difficult to distinguish from real users, thus rendering traditional detection methods based on behavioral statistics ineffective.

[0015] (2) Features are difficult to describe:

[0016] Existing methods rely on single-dimensional or coarse-grained features, which cannot fully capture the differences between attackers' dynamic behavior and static preferences, thus reducing detection effectiveness.

[0017] (3) High false alarm rate:

[0018] While some detection methods based on hidden features improve the detection rate, they are often accompanied by a high false alarm rate, which can easily misidentify normal users as attackers and affect the reliability of practical applications.

[0019] (4) Lack of prior knowledge:

[0020] In real-world scenarios, recommendation systems often lack prior annotations of attack behaviors, making it difficult to widely apply detection methods based on supervised learning.

[0021] (5) Insufficient adaptability to actual environment:

[0022] Many detection methods perform well in experimental environments, but perform poorly in real-world, large-scale recommender system environments, failing to meet the requirements for efficiency and scalability.

[0023] Therefore, in order to solve the problems existing in the prior art, it is an urgent technical problem for those skilled in the art to provide a method for effectively identifying highly covert poisoning attacks in recommendation systems while ensuring a low false alarm rate. Summary of the Invention

[0024] In view of this, the present invention provides a method and application for detecting highly covert poisoning attacks in recommendation systems. Through a multi-stage detection and feature decoupling process, it achieves high-precision identification of highly covert poisoning attacks, overcoming the problems of low detection rate, high false alarm rate and difficulty in adapting to real-world environments of existing methods.

[0025] To solve the above-mentioned technical problems, the present invention adopts the following technical solution:

[0026] A highly covert poisoning attack detection method for recommendation systems includes the following steps:

[0027] S1. User Behavior and Relationship Modeling:

[0028] Construct user feature vectors and co-occurrence relationship graphs to describe user rating behavior preferences and co-occurrence relationships;

[0029] S2. Importance Pre-screening:

[0030] Based on similarity measurement and importance modeling of rating distribution, normal users with weak correlation to potential attack users are filtered out.

[0031] S3. Decoupling cross-graph relationships:

[0032] The system extracts key relationships from the user relationship graph, separates dynamic and static relationships, and obtains high-quality relationship representations through a cross-graph fusion mechanism.

[0033] S4. Dual-supersphere collaborative detection:

[0034] By using concentric hyperspherical shells to constrain normal user representations, abnormal user detection is achieved by assessing the degree of deviation from the boundary.

[0035] Preferably, in step S1, user activity is extracted. Average score Preference for popular items Preference for niche items and rating distribution bias Features are used to form a set of user node features.

[0036] Preferably, a user symbiotic relationship graph is constructed based on the co-occurrence of user ratings for items. If two users have at least one threshold number ( If the item rating is the same as the item rating, then a weighted edge relationship is established between them, with the edge weight being... This allows us to capture potential behavioral connections between users.

[0037] Preferably, in step S2, the similarity calculation uses kernel density estimation based on the rating distribution and Wasserstein distance metric.

[0038] Preferably, in step S2, firstly, a user rating distribution function is generated based on the kernel density estimation method, and the distribution difference between users P and Q is calculated using the Wasserstein distance;

[0039] The Wasserstein distance is defined as follows:

[0040] ;

[0041] Subsequently, a similarity matrix was constructed, and the average similarity of each user was extracted. Maximum similarity with minimum similarity Features are used, and an autoencoder combined with group consistency loss is used for training to obtain the user's importance score;

[0042] Finally, the user set was filtered out based on importance scores, eliminating normal users who were less relevant to potential attackers.

[0043] Preferably, in step S3, the cross-graph relationship decoupling step includes three sub-processes;

[0044] S3.1. Key Relationship Extraction:

[0045] The existence probability of edges is estimated by using a variational graph autoencoder, important relation edges are extracted and redundant relations are removed, and a key subgraph is constructed.

[0046] The process is represented as follows:

[0047] ;

[0048] S3.2. Separation of dynamic and static relationships:

[0049] Based on time series modeling, dynamic consistency constraints are applied to user relationships, distinguishing between dynamic relationships that evolve over time and static relationships that remain stable.

[0050] The process is as follows:

[0051] ;

[0052] S3.3. Cross-graph relationship fusion:

[0053] We employ graph convolution and attention mechanisms to jointly model key relationships, dynamic relationships, and static relationships, and retain the unique information and task relevance of each subgraph through the mutual information maximization method.

[0054] Its loss function is expressed as:

[0055] .

[0056] Preferably, in step S3, the key relationship extraction is performed by calculating the edge existence probability through a variational graph autoencoder, and the separation of dynamic and static relationships is achieved through time series consistency constraints.

[0057] Preferably, in step S4, firstly, orthogonal projection is performed on the user embedded features to eliminate feature redundancy;

[0058] Then, two concentric hyperspherical shells are set up, with the inner radius used to constrain the lower bound of normal users and the outer radius used to constrain the upper bound of normal users;

[0059] The anomaly scoring function process is represented as:

[0060] ;

[0061] If a user's statement falls outside the hypersphere's range, it is considered an abnormal user.

[0062] Preferably, in step S4, the dual hypersphere collaborative detection adopts an orthogonal projection and concentric hypersphere constraint mechanism to determine normal and abnormal users based on the range of inner and outer radii.

[0063] An application of a highly covert poisoning attack detection method for recommendation systems in a recommendation model based on collaborative filtering, contrastive learning, and graph neural networks.

[0064] The present invention achieves the following technical effects compared to the prior art:

[0065] (1) Alleviating the problem of data imbalance:

[0066] This invention effectively filters out irrelevant and normal users through importance pre-screening, reducing noise interference in the attack detection process;

[0067] (2) Enhance the ability to express features:

[0068] This invention achieves the separation and fusion of multi-dimensional relationships through cross-graph relationship decoupling, thereby enhancing the ability to characterize highly covert attack behaviors.

[0069] (3) Reduce false alarm rate:

[0070] The dual-supersphere collaborative detection mechanism of this invention forms a stable constraint on normal users, effectively avoiding misjudgment of boundary users;

[0071] (4) Adapt to the real environment:

[0072] The method of this invention does not rely on prior knowledge of the attack sample, can be run unsupervised in actual recommendation systems, and has good adaptability and scalability;

[0073] (5) Experimental verification of validity:

[0074] Experiments on multiple real datasets (such as MovieLens and Douban) show that the detection rate of the method of this invention is improved by more than 12% on average compared with the baseline method, the false alarm rate is reduced by more than 2%, and the robustness and interpretability are significantly enhanced.

[0075] (6) Safety and reliability:

[0076] This invention combines multiple modules such as user relationship modeling, importance pre-screening, cross-graph relationship decoupling, and dual hypersphere collaborative detection. It can effectively identify highly covert poisoning attack users while maintaining a low false alarm rate, providing strong technical support for the security and reliability of recommendation systems. Attached Figure Description

[0077] Figure 1 This is a flowchart illustrating a preferred embodiment of a highly covert poisoning attack detection method for recommendation systems according to the present invention.

[0078] Figure 2 This is a system structure diagram of a preferred embodiment of a highly covert poisoning attack detection method for recommendation systems according to the present invention. Detailed Implementation

[0079] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0080] This invention discloses a highly covert poisoning attack detection method for recommendation systems, comprising the following steps:

[0081] S1. In a recommender system environment, first obtain the user's rating records for items, and construct a user feature vector, which specifically includes the following metrics:

[0082] User activity level: defined as the sum of the number of user ratings, used to characterize the user's level of activity in the system;

[0083] ;

[0084] Average rating: This is the average rating given by users to all rated items, reflecting the overall rating tendency of users.

[0085] ;

[0086] Popular item preferences: Calculate the average rating of users for the top 10% of popular items in the system;

[0087] ;

[0088] Niche Item Preference: Calculate the average rating of users for the bottom 10% of niche items in the system;

[0089] ;

[0090] Rating distribution bias: The difference between the user rating distribution and the overall rating distribution is measured by the Kullback-Leibler divergence.

[0091] ;

[0092] Based on this, a user symbiotic relationship diagram is established.

[0093] When two users have at least one threshold number When both items have ratings, an edge is established between them, and the weight of the edge is defined as the number of items that have the same rating.

[0094] This allows us to obtain a network of potential symbiotic relationships among users, providing graph structure support for subsequent detection.

[0095] S2. Considering that highly covert poisoning attacks often hide their characteristics by simulating normal user behavior, this invention adds an importance pre-screening mechanism before detection:

[0096] The user rating sequence is modeled based on kernel density estimation (KDE) to obtain the user rating distribution function;

[0097]

[0098] The Wasserstein distance was used to calculate the differences between different user rating distributions, resulting in a similarity matrix among users;

[0099] ;

[0100] Three types of similarity features are extracted for each user: average similarity. Maximum similarity Minimum similarity ;

[0101] The above features are input into the autoencoder model, and group consistency loss is introduced to enable the model to cluster users whose distribution is similar to that of the attacking users, thereby forming an importance score.

[0102] The consistency loss function is as follows:

[0103] ;

[0104] Sort users by importance score and set a dropout ratio. Only users with the highest rankings are retained, while weakly relevant users are removed to reduce interference from subsequent detection. This process can be represented as:

[0105] ;

[0106] S3. Perform multi-level relationship modeling and decoupling on the pre-screened user set:

[0107] Key Relationship Extraction:

[0108] Variational graph autoencoder (VGAE) is used to estimate the existence probability of edges, generate key relationship masks, and filter out low-weight or noisy edges.

[0109] The process is represented as:

[0110] ;

[0111] Separation of dynamic and static relationships: Decomposing the interaction relationships between users based on time-series rating data;

[0112] The process is represented as:

[0113] ;

[0114] Dynamic relationships reflect users' rating co-occurrence patterns in the short term, while static relationships reflect long-term stable preference relationships; dynamic consistency constraints ensure the smoothness of temporally adjacent relationships.

[0115] Cross-graph relationship fusion:

[0116] We employ Graph Convolutional Neural Networks (GCN) and attention mechanisms to jointly model dynamic and static subgraphs, and leverage mutual information to maximize the preservation of the uniqueness and task relevance of each subgraph, thereby generating high-quality fused graph representations.

[0117] Its loss function is expressed as:

[0118] ;

[0119] S4. After obtaining the user embedding representation of the fused graph, a dual-hypersphere detection mechanism is introduced:

[0120] First, orthogonal projection is performed on the user embedding to eliminate redundant correlations between different dimensions;

[0121] Construct two concentric hyperspherical shells and define their inner radii. With outer radius This distributes normal users between the two;

[0122] The process is represented as:

[0123] ;

[0124] If a user's represented point falls outside the hypersphere, it is determined to be an abnormal user; if it falls within the range, it is determined to be a normal user.

[0125] By adjusting the radius threshold, the detection rate and false alarm rate can be balanced.

[0126] The above description is merely a preferred embodiment of the present invention and does not constitute any limitation on the technical scope of the present invention. Therefore, any minor modifications, equivalent changes, and alterations made to the above embodiments based on the technical essence of the present invention shall still fall within the scope of the technical solution of the present invention.

Claims

1. A highly covert poisoning attack detection method for recommendation systems, characterized in that, Includes the following steps: S1. User Behavior and Relationship Modeling: Construct user feature vectors and co-occurrence relationship graphs to describe user rating behavior preferences and co-occurrence relationships; S2. Importance Pre-screening: Based on similarity measurement and importance modeling of rating distribution, normal users with weak correlation to potential attack users are filtered out. S3. Decoupling cross-graph relationships: The system extracts key relationships from the user relationship graph, separates dynamic and static relationships, and obtains high-quality relationship representations through a cross-graph fusion mechanism. S4. Dual-supersphere collaborative detection: By using concentric hyperspherical shells to constrain normal user representations, abnormal user detection is achieved by assessing the degree of deviation from the boundary.

2. The highly covert poisoning attack detection method for recommendation systems according to claim 1, characterized in that, In step S1, user activity is extracted. Average score Preference for popular items Preference for niche items and rating distribution bias Features are used to form a set of user node features.

3. The highly covert poisoning attack detection method for recommendation systems according to claim 2, characterized in that, Construct a user symbiotic relationship graph based on the co-occurrence of user ratings for items. If two users have at least one threshold number ( If the item rating is the same as the item rating, then a weighted edge relationship is established between them, with the edge weight being... This allows us to capture potential behavioral connections between users.

4. The highly covert poisoning attack detection method for recommendation systems according to claim 1, characterized in that, In step S2, similarity calculation uses kernel density estimation based on the rating distribution and Wasserstein distance metric.

5. The highly covert poisoning attack detection method for recommendation systems according to claim 1, characterized in that, In step S2, firstly, a user rating distribution function is generated based on the kernel density estimation method, and the distribution difference between users P and Q is calculated using the Wasserstein distance; The Wasserstein distance is defined as follows: ; Subsequently, a similarity matrix was constructed, and the average similarity of each user was extracted. Maximum similarity with minimum similarity Features are used, and an autoencoder combined with group consistency loss is used for training to obtain the user's importance score; Finally, the user set was filtered out based on importance scores, eliminating normal users who were less relevant to potential attackers.

6. The highly covert poisoning attack detection method for recommendation systems according to claim 1, characterized in that, In step S3, the cross-graph relationship decoupling step includes three sub-processes; S3.

1. Key Relationship Extraction: The existence probability of edges is estimated by using a variational graph autoencoder, important relation edges are extracted and redundant relations are removed, and a key subgraph is constructed. The process is represented as follows: ; S3.

2. Separation of dynamic and static relationships: Based on time series modeling, dynamic consistency constraints are applied to user relationships, distinguishing between dynamic relationships that evolve over time and static relationships that remain stable. The process is as follows: ; S3.

3. Cross-graph relationship fusion: We employ graph convolution and attention mechanisms to jointly model key relationships, dynamic relationships, and static relationships, and retain the unique information and task relevance of each subgraph through the mutual information maximization method. Its loss function is expressed as: 。 7. The highly covert poisoning attack detection method for recommendation systems according to claim 1, characterized in that, In step S3, key relationship extraction is achieved by calculating the edge existence probability through a variational graph autoencoder, and the separation of dynamic and static relationships is achieved through time series consistency constraints.

8. The highly covert poisoning attack detection method for recommendation systems according to claim 1, characterized in that, In step S4, firstly, orthogonal projection is performed on the user embedded features to eliminate feature redundancy; Then, two concentric hyperspherical shells are set up, with the inner radius used to constrain the lower bound of normal users and the outer radius used to constrain the upper bound of normal users; The anomaly scoring function process is represented as: ； If a user's statement falls outside the hypersphere's range, it is considered an abnormal user.

9. A highly covert poisoning attack detection method for recommendation systems according to claim 1, characterized in that, In step S4, the dual hypersphere collaborative detection adopts an orthogonal projection and concentric hypersphere constraint mechanism to determine normal and abnormal users based on the range of inner and outer radii.

10. The application of the highly covert poisoning attack detection method for recommendation systems according to claims 1-9 in recommendation models based on collaborative filtering, contrastive learning and graph neural networks.

Images