Poisoning Attacks to Graph-Based Recommender Systems
Poisoning Attacks to Graph-Based Recommender Systems
复制标题
DOI：
10.1145/3274694.3274706
复制
发表时间：
2018-09
期刊：
影响因子：
--
通讯作者：
Minghong Fang;Guolei Yang;N. Gong;Jia Liu
中科院分区：
文献类型：
--
作者：
Minghong Fang;Guolei Yang;N. Gong;Jia Liu
推荐系统是许多Web服务的重要组成部分，用于帮助用户定位与其兴趣相匹配的项目。几项研究表明，推荐系统容易受到中毒攻击，即攻击者向推荐系统注入虚假数据，使系统根据攻击者的意愿提供推荐。然而，这些中毒攻击对于推荐算法是不可知的，或者对于不是基于图的推荐系统(例如，基于关联规则或基于矩阵分解的推荐系统)是优化的。与基于关联规则和基于矩阵分解的推荐系统一样，基于图的推荐系统也在实践中部署，例如eBay、华为应用商店(中国的一个大型应用商店)。然而，如何为基于图的推荐系统设计优化的中毒攻击仍然是一个悬而未决的问题。在这项工作中，我们对基于图的推荐系统的中毒攻击进行了系统的研究。我们认为攻击者的目标是将目标项目推荐给尽可能多的用户。为了实现这一目标，我们的a“ack向推荐系统注入了精心设计的评分分数的虚假用户。由于资源有限，为了避免被发现，我们假设可以注入到系统中的虚假用户数量是有界的。关键的挑战是如何为虚假用户分配评分，以便将目标项目推荐给尽可能多的正常用户。为了应对这一挑战，我们将中毒攻击描述为一个优化问题，求解该优化问题确定了虚假用户的评分。我们还提出了解决优化问题的方法。我们在白盒(推荐算法及其参数已知)、灰盒(推荐算法已知但参数未知)和黑盒(推荐算法未知)环境下对我们的攻击进行了评估，并与已有的攻击进行了比较。结果表明，我们的攻击是有效的，并且优于现有的基于图的推荐系统的攻击。例如，当1%的用户被注入虚假用户时，我们的攻击可以在某些场景下使目标项目推荐给正常用户580倍以上。
Recommender system is an important component of many web services to help users locate items that match their interests. Several studies showed that recommender systems are vulnerable to poisoning attacks, in which an attacker injects fake data to a recommender system such that the system makes recommendations as the attacker desires. However, these poisoning attacks are either agnostic to recommendation algorithms or optimized to recommender systems (e.g., association-rule-based or matrix-factorization-based recommender systems) that are not graph-based. Like association-rule-based and matrix-factorization-based recommender systems, graph-based recommender system is also deployed in practice, e.g., eBay, Huawei App Store (a big app store in China). However, how to design optimized poisoning attacks for graph-based recommender systems is still an open problem. In this work, we perform a systematic study on poisoning attacks to graph-based recommender systems. We consider an attacker's goal is to promote a target item to be recommended to as many users as possible. To achieve this goal, our a"acks inject fake users with carefully crafted rating scores to the recommender system. Due to limited resources and to avoid detection, we assume the number of fake users that can be injected into the system is bounded. The key challenge is how to assign rating scores to the fake users such that the target item is recommended to as many normal users as possible. To address the challenge, we formulate the poisoning attacks as an optimization problem, solving which determines the rating scores for the fake users. We also propose techniques to solve the optimization problem. We evaluate our attacks and compare them with existing attacks under white-box (recommendation algorithm and its parameters are known), gray-box (recommendation algorithm is known but its parameters are unknown), and blackbox (recommendation algorithm is unknown) settings using two real-world datasets. Our results show that our attack is effective and outperforms existing attacks for graph-based recommender systems. For instance, when 1% of users are injected fake users, our attack can make a target item recommended to 580 times more normal users in certain scenarios.