A Novel Kalman Filter Based Shilling Attack Detection Algorithm

Wenguang Zheng; Xin Liu; Xu Jiao; Yingyuan Xiao; Zihao Ling

REVIEW 5 major objections 7 minor 16 references

A Novel Kalman Filter Based Shilling Attack Detection Algorithm

T0 review · 5 major / 7 minor · reviewed 2026-08-14 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A Kalman filter that compares predicted and actual rating sums can locate shilling attacks and trace them to the users who launched them.

desk verdict A genuine new pairing of recursive smoothing with a two-deviation rule for shilling-attack detection, but the empirical case is weaker than the abstract claims: no attack-free control, thresholds tuned on the test curves, and the 'Kalman filter' is essentially a rolling average. read the letter →

arxiv 1908.06968 v1 pith:3WNGXLB6 submitted 2019-08-18 cs.CR cs.IR

Xin Liu , Yingyuan Xiao , Xu Jiao , Wenguang Zheng , Zihao Ling This is my paper · ORCID

classification cs.CRcs.IR

keywords collaborativefilteringshillingattackdetectionKalmanfilteranomalyrecommendersystemsconfidenceinterval

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that a time-aware Kalman-filter model can detect shilling attacks in collaborative filtering recommenders more accurately than feature-based classifiers. The idea is that genuine users rate steadily, so a sudden, concentrated injection of fake profiles will make the observed sum of ratings in a time block deviate from the model's predicted sum. RDAKF, the proposed filter, computes two deviations per block—the total deviation $v$ and the deviation per rating $v_A$—and declares an attack only when both exceed confidence-interval thresholds. Suspicious ratings in the flagged window are then reduced to extreme ratings, and the users behind them are reported as attackers. On the experimental setup used, the paper reports higher precision and recall than KNN, Bayes, and SVM-based baselines.

What carries the argument

RDAKF (Rating Detection Adapted Kalman Filter) is a state-estimation filter that tracks the running sum of ratings over time blocks instead of a user preference vector. In the prediction step, after $n_A$ ratings have been processed, the predicted sum for the next block of size $n_P$ is $\hat{x}=x\,(n_A+n_P)/n_A$, with predicted uncertainty $\hat{P}=P+q$. In the update step, the observation $z$ is the actual sum of ratings in the current block, the Kalman gain $K_g=\hat{P}/(\hat{P}+r)$ blends the prediction with the observation, and the state and uncertainty are updated to $x^+=\hat{x}+K_g(z-\hat{x})$ and $P^+=(1-K_g)\hat{P}$. Deviations are computed as $v=(x+z)-\hat{x}$ and $v_A=v/n_P$; thresholds come from confidence-interval estimates of these deviations on a training set. The double-exceedance rule—both $v$ and $v_A$ beyond their thresholds—is what triggers an attack declaration.

What would settle it

Apply RDAKF to an attack-free rating log that contains natural bursts of genuine ratings (for example, many users rating a newly released item in the same block) and count how often both $v$ and $v_A$ cross the 99% and 90% confidence thresholds; a non-negligible false-positive rate would show the double-exceedance rule cannot separate attacks from normal bursts.

Watch

Extended reading notes

Core claim

The central discovery is that a shilling attack reveals itself through a temporary break in a recommender's rating stream rather than through the shape of user profiles. When the Kalman-filter prediction of the sum of ratings in a time block is compared with the actual sum, an attack window is where both the total deviation $v$ and the per-rating average deviation $v_A$ exceed trained confidence thresholds. Under the paper's stability assumption, that double exceedance is the signature of injected profiles, and filtering the flagged window for extreme ratings (maximum for a push attack, minimum for a nuke attack) recovers the attackers. The paper reports that this approach outperforms KNN, Bayes, and improved SVM baselines in precision and recall on the tested attack types, with the limitation that bandwagon attacks, which include a selected item, degrade detection performance.

Load-bearing premise

The load-bearing premise is that genuine users' rating behavior is basically stable across time blocks and attacks are injected centrally in a short period, so when both total and average deviations exceed confidence thresholds the system must be under attack.

Editorial extensions

If this is right

Because the method compares block-level rating sums rather than user feature vectors, detection can be applied to new data without retraining a user classifier; only the deviation thresholds need to be trained.
Higher attack size raises precision, and the paper's experiments keep precision above 0.8 for random and average attacks at a filler size of 5%.
Bandwagon attacks, which include a selected item, produce lower precision and recall than random or average attacks, so the presence of selected items is a recognized weak point.
If attackers give the target item a non-extreme rating, the post-processing step will discard that rating, so the method will miss the attacking users even if the attack window is correctly flagged.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The same block-sum deviation logic could be applied to other aggregate signals on platforms—clicks, views, likes—where fake activity is injected in bursts, making RDAKF a generic burst-anomaly detector rather than a recommender-specific one.
Running the filter online is natural: each block updates the state, so the method could flag attacks in near real time if block size is small; the paper itself does not discuss streaming deployment.
A testable boundary case is a distributed attack that spreads fake profiles over many time blocks: both deviations would be diluted, and the concentrated-in-time premise predicts the method would miss it.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Quick take: the novel part is real but narrow. Running a recursive estimator over time-block rating sums and flagging an attack window only when both total and average deviation exceed confidence thresholds is not something I see in the cited prior work. As a detector design, that is a sensible new combination. The paper is also easy to follow, the workflow is clearly laid out, and the authors deserve credit for comparing against three baselines and honestly acknowledging the bandwagon-attack weakness.

Now the soft spots. Eq. (16) with q=r=1 collapses the Kalman update to a count-scaled recursive average. That may still be a useful heuristic detector, but it is not a substantive Kalman estimation story, and the initial state P0 is simply not specified. More important, there is no attack-free control anywhere in the experiments. The core premise is that genuine rating behavior is 'basically stable', but the pipeline is never run on an attack-free version of the same test set to measure false alarms. That gap matters because v_A = v/n_P is nonlinear: a short block with a few extreme legitimate ratings looks exactly like an attack burst. The joint threshold therefore has no calibrated false-positive rate. The confidence-interval logic is also shaky because successive deviations are autocorrelated — the predicted state accumulates all past ratings — which violates the independence assumption behind those intervals.

Then there is the threshold selection. The 99% and 90% confidence levels are chosen after inspecting the test precision/recall curves, so the reported performance is partly optimized on the same data used for evaluation. No error bars or repeated trials are reported, and the closest time-interval detection methods from the earlier literature are not included in the comparison. The abstract's 'much better than traditional methods' is more than the experiments support, especially since the paper's own bandwagon results are not strong.

None of this convinces me the idea is dead. The two-deviation rule is reasonable, and an attack-free false-alarm experiment plus threshold selection on a held-out split could make the central claim solid. As it stands, this is a promising workshop-level paper whose abstract oversells the evidence. The right audience is people working on time-series anomaly detection for recommender security, not the broader CF community. I would send it to peer review, expecting heavy revision; a serious referee would spot the missing control immediately, and fixing that would turn this into a useful subfield contribution.

Referee Report

5 major / 7 minor

Summary. The paper proposes a Kalman-filter-based shilling attack detection method (RDAKF). Ratings are aggregated into time blocks; a Kalman-style recursion predicts the cumulative rating sum, and the residual between the predicted and actual sum is used to define a total deviation v and an average deviation v_A = v/n_P. Thresholds for both deviations are derived from confidence-interval estimation on training deviations. An attack window is declared only when both deviations exceed their thresholds, and users who gave extreme ratings in that window are flagged as attackers. Experiments on the MovieLens 100K dataset inject push attacks (random, average, bandwagon) at various sizes and report precision/recall, comparing against KNN, Bayes, and improved SVM baselines. The central claim is that the proposed method achieves substantially better detection performance than traditional methods.

Significance. If validated, the approach would offer a lightweight, item-centric, time-aware alternative to user-profile-based shilling detection, exploiting the observation that injected profiles arrive in short bursts. The method is simple and has the practical virtue of not requiring per-user feature engineering. The paper also ships a concrete algorithmic pipeline (prediction, deviation, thresholding, post-processing) that is easy to reproduce. However, the reported evidence is not yet sufficient to support the abstract's claim of 'much better detection performance': there is no attack-free control, the threshold levels are selected using the test data, and the statistical justification for the confidence intervals is not established for the recursive residuals actually used. The strengths are the clear formulation of the two-deviation decision rule and the item-centric perspective, but these are undermined by the validation gaps.

major comments (5)

[V.C (with IV.D)] The central evaluation is missing an attack-free control. Section V.A states that the original data is treated as genuine user data and attacks are injected into the test set; all precision/recall numbers in Figures 2-10 measure detection against those injected profiles. The decision rule in IV.D only fires when both v and v_A exceed thresholds, so the false-positive rate on ordinary, attack-free data is never measured. Since v_A = v/n_P (Eq. 23) is a nonlinear rescaling, a short block containing a few extreme genuine ratings can produce a large v_A, while a large block of ordinary ratings can produce a large v; the joint threshold therefore has no calibrated false-positive rate without a control. Without such a control, the reported high precision could be an artifact of thresholds that catch only the deliberately injected burst, and the paper's core premise that genuine rating behavior is 'basically stable' is not actually evidenced.
[V.A and V.C.2 (Figs. 4-7)] The confidence levels that determine the detection thresholds appear to be selected after inspecting the detection results on the same test data. Section V.A reports 'Total deviation selects 99% confidence and average deviation selects 90% confidence,' and Section V.C.2 explains the choice by comparing precision/recall curves in Figures 4-7 for combinations such as Tol 95%/Avg 90%, Tol 99%/Avg 85%, etc. These figures are generated on the attacked test sets, so the threshold choice is fitted to the evaluation data. The manuscript should specify a fully training-only threshold selection procedure (e.g., held-out validation) and then report performance on a test set not used in any threshold choice; otherwise the reported precision/recall are optimistically biased.
[III.C and IV.E] The confidence-interval argument does not apply to the deviations as defined. Section III.C justifies interval estimation by the central limit theorem for sample means, but v and v_A are not sample means: they are residuals of a recursive filter. Because the predicted sum x̂ in Eq. (16) accumulates all past ratings, successive deviations are autocorrelated, violating the independence assumption behind the z-based confidence limits in Eqs. (13)-(14). Applying the resulting upper bounds as per-sample thresholds in IV.E therefore does not give the stated 99% or 90% coverage. The paper should either justify the distribution of the deviations empirically (e.g., with histograms and autocorrelation checks on attack-free training data) or replace the confidence-interval calibration with an empirical quantile calibration, and should report the achieved false-alarm rate.
[IV.C] The model parameters q and r, and the initial state, are set by assertion rather than estimation. The text says 'we assume that q and r in (17) and (18) are 1,' following the standard-normal assumption of the earlier recommendation model. However, the deviations used for thresholding depend on the filter behavior, and no sensitivity analysis is reported for q, r, P0, or the initial n_A. The initial values of P and n_A at the start of the training and test phases are never specified, although Eq. (16) and the update step (21) depend on them, especially in the first few time blocks. The paper should state the initialization and report how the results vary with q and r; otherwise the claimed robustness is not established.
[IV.A] The load-bearing assumption that genuine users' rating behavior is 'basically stable' over time is asserted but never tested. The entire detection logic treats any period with both deviations abnormal as an attack, but natural rating bursts, seasonal popularity, or item-specific life-cycle effects could produce exactly that pattern. The item classification in III.D partially acknowledges heterogeneity across items, yet the detection model pools ratings without accounting for item type or block-level variation. A minimal test would be to run the full pipeline on attack-free test data and report the false-alarm rate and the distribution of v and v_A; this is the same missing control noted above but deserves emphasis because it is the empirical basis for the paper's central premise.

minor comments (7)

[Abstract and Keywords] There is a typo in the abstract ('In t his paper') and a misspelling in the keywords ('dectection' should be 'detection').
[IV.C, Eq. (16)] The text says '[(n_A + n_P)/n_P] is equivalent to F_t,' but the ratio as written is (n_A + n_P)/n_A in Eq. (16); please clarify which expression is intended and define all variables consistently.
[IV.D, Eq. (22)] Eq. (22) defines y = x + z, but x is the state (predicted sum) while z is the observation for the current block; the notation is confusing because y is then compared with x̂, and the roles of x, y, and z should be made explicit in the text.
[V.A] The description of the training set is vague: 'We used 100 items including 5328 deviations as training set for training.' It is unclear how these 100 items were selected, how the 5328 deviations arise, and how the training set relates to the 54 four-day time blocks and to the test set; please specify the exact split.
[Figures 2 and 3] The horizontal axes of Figures 2 and 3 are inconsistent: Figure 2 covers attack sizes 0-20% while Figure 3 covers 0-5%, making it difficult to compare precision and recall across the same conditions; please use a common attack-size range.
[Figure 7] The y-axis label in Figure 7 is 'Rcall' (missing 'e'); please correct the label.
[V.C.2] The text says 'the higher the confidence level of the total deviation, the higher the precision' and 'the recall is almost the same,' but Figure 7 shows noticeable recall variation across combinations; please qualify this statement with the actual ranges shown.

Circularity Check

1 steps flagged · score 4.0 of 10

Reported performance is partly selection-on-test: confidence thresholds are chosen from the same attack-injected test curves that are later reported as the method's precision/recall.

fitted input called prediction [Section V.C.2 (Impact of Confidence Levels), after Figs. 4-7; threshold values set in Section V.A]
"Based on the above comparison, for the confidence level of the total deviation, the higher the confidence level, the higher the precision. The recall is almost the same, so we choose a 99% confidence level."

Figures 4-7 plot precision/recall for alternative confidence-level pairs, computed on the same attack-injected test data whose final precision/recall is later reported in Section V.C.3. The 99% total and 90% average thresholds are chosen by inspecting these curves, i.e., the decision thresholds are selected using the evaluation labels. Reporting the performance of the selected configuration on the same test set is therefore not an independent prediction: the claimed 'much better detection performance' is partly a result of model selection on the test set, not a fixed method's out-of-sample accuracy. The selection is discrete and the Kalman deviations are still computed from a separate training set, so this is partial, not total, circularity.

full rationale

There is no full derivation-level circularity: the Kalman prediction/update equations (16)-(21) are standard, the deviations (22)-(23) compare predicted and actual rating sums, and the thresholds are in principle trained from a separate deviation training set. There is no load-bearing self-citation chain or imported uniqueness theorem. The main circularity concern is methodological: the confidence levels (99% total, 90% average) are selected after inspecting precision/recall curves on the same attack-injected test set used for the final comparisons, so the reported superiority over KNN, Bayes, and SVM is partly optimized on the evaluation data. Additionally, the paper never reports an attack-free false-alarm rate, so the core premise that genuine rating behavior is 'basically stable' (Section IV.A) is asserted rather than tested; that is a correctness risk rather than a circularity. On balance, one partial selection-on-test circularity raises the score to 4, but the detector retains independent content in its Kalman-based deviation mechanism and threshold training procedure.

Assumptions & free parameters 5 free parameters · 5 assumptions · 0 invented entities

The model depends on a small number of hand-set constants and strong assumptions about rating behavior. The most consequential choices are the noise standard deviations q and r set to 1, the 4-day time block length, and the 99%/90% confidence levels selected after inspecting test curves. The stability-of-genuine-rating and compressed-attack-time assumptions justify treating deviation bursts as attacks. No new entities are introduced.

free parameters (5)

time_block_length_days = 4
The dataset is divided into 4-day blocks, 54 parts over 215 days, with no sensitivity analysis reported.
q = 1
Process noise standard deviation in Eq. (17); assumed to be 1, matching standard normal noise, without estimation.
r = 1
Measurement noise standard deviation in Eq. (18); assumed to be 1, without estimation.
total_deviation_confidence = 0.99
Confidence level for the total deviation threshold; selected after inspecting Figures 4 and 7.
average_deviation_confidence = 0.90
Confidence level for the average deviation threshold; selected because 85% and 95% had drawbacks in Figures 5-7.

assumptions (5)

domain assumption Genuine user rating behavior is basically stable over time.
Section IV.A; if genuine rating streams have natural bursts, the method flags normal periods as attacks.
domain assumption Attacks are injected centrally in a short period of time.
Section IV.A; the entire time-window anomaly approach depends on this temporal concentration.
domain assumption Deviations between predicted and observed rating sums are approximately normal, so z-based confidence upper bounds are valid thresholds.
Section III.C and Section IV.E; the method applies a z-interval formula to individual deviations, not to sample means.
domain assumption Attackers rate the target item with the extreme score, and non-extreme ratings in a suspicious period are genuine.
Section IV.F; post-processing removes non-extreme ratings before labeling users.
ad hoc to paper Kalman noise parameters q and r equal 1.
Section IV.C: 'we assume that q and r in (17) and (18) are 1'; no estimation or sensitivity analysis.

how reviews work

0 comments

Cite this review

Pith. "Pith review of A Novel Kalman Filter Based Shilling Attack Detection Algorithm." pith.science (2026). https://pith.science/paper/3WNGXLB6

@misc{pith2026190806968,
  author       = {Pith},
  title        = {Pith review of: A Novel Kalman Filter Based Shilling Attack Detection Algorithm},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/3WNGXLB6}},
  note         = {Machine review of arXiv:1908.06968}
}

read the original abstract

Collaborative filtering has been widely used in recommendation systems to recommend items that users might like. However, collaborative filtering based recommendation systems are vulnerable to shilling attacks. Malicious users tend to increase or decrease the recommended frequency of target items by injecting fake profiles. In this paper, we propose a Kalman filter-based attack detection model, which statistically analyzes the difference between the actual rating and the predicted rating calculated by this model to find the potential abnormal time period. The Kalman filter filters out suspicious ratings based on the abnormal time period and identifies suspicious users based on the source of these ratings. The experimental results show that our method performs much better detection performance for the shilling attack than the traditional methods.

Figures

Figures reproduced from arXiv: 1908.06968 by the authors.

**Figure 3.** Recall of different attack models when the attack size varies and filler size is 5% 2) Impact of Confidence Levels The choice of confidence level will affect the precision and recall. If the confidence level is high, then the range it accepts will expand. It means that a larger deviation can be accepted. The deviation caused by some attacks may not be detected, that is, the recall is reduced. However, due to the inc… view at source ↗

**Figure 2.** shows the precision of our approach under different attack sizes. It can be seen that as the size of the attack increases, the precision of the detection algorithm is increased and the precision remains above 0.8. However, compared to the other two attacks, the algorithm has a poor effect on the low attack size of bandwagon attack. It can be seen that our algorithm has more misclassification in bandwagon attack. Ban… view at source ↗

Figures from the paper (5 more)

**Figure 4.** Figure 4: shows the detection effect of the confidence levels for the different total deviations when the confidence level of the average deviation is 90%. It can be seen that the higher the confidence level of the total deviation, the higher the accuracy when the confidence lev…

**Figure 7.** Figure 7: is the recall rate of the five combinations mentioned above. Based on the above comparison, for the confidence level of the total deviation, the higher the confidence level, the higher the precision. The recall is almost the same, so we choose a 99% confidence level. F…

**Figure 6.** Figure 6: The effect of different confidence levels of average deviation on detection (bandwagon attack) [PITH_FULL_IMAGE:figures/full_fig_p007_6.png]

**Figure 9.** Figure 9: Precision of different detection algorithms on bandwagon attack with a filler size of 5% [PITH_FULL_IMAGE:figures/full_fig_p008_9.png]

**Figure 10.** Figure 10: is the recall comparison of the three algorithms in the average attack. Our algorithm shows the best performance. The improved SVM algorithm has reached a very high precision level due to the addition of the target item analysis strategy. However, this strategy is mai…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

16 extracted references · 16 canonical work pages

[1]

Preventing shilling attacks in online recommender systems,

P. A. Chirita, W. Nejdl, and C. Zamfir, "Preventing shilling attacks in online recommender systems," in ACM International Workshop on Web Information and Data Management, 2005, pp. 67–74

work page 2005
[2]

Classification features for attack detection in collaborative recommender systems,

R. Burke, B. Mobasher, C. Williams, and R. Bhaumik, "Classification features for attack detection in collaborative recommender systems, " in ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, 2006, pp. 542–547

work page 2006
[3]

Defending recommender systems: detection of profile injection attacks ,

C. A. Williams, B. Mobasher, and R. Burke, "Defending recommender systems: detection of profile injection attacks ," Service Oriented Computing and Applications, vol. 1, no. 3, pp. 157-170, 2007

work page 2007
[4]

Unsupervised shilling d etection for collaborative filtering ,

B. Mehta, "Unsupervised shilling d etection for collaborative filtering ," Proceedings of the 22nd national conference on Artificial intelligence, vol. 2, pp. 1402-1407, 2007

work page 2007
[5]

Unsupervised detection of shilling attack for recommender system based on feature subset,

F. Peng, X . Zeng, H . Deng, and L. Liu , "Unsupervised detection of shilling attack for recommender system based on feature subset," Computer Engineering, vol. 40, no. 5, pp. 109-114, 2014

work page 2014
[6]

Graph-based detection of shilling attacks in recommender systems ,

Z. Zhang, and S R. Kulkarni , "Graph-based detection of shilling attacks in recommender systems ," in 2013 IEEE International Workshop on Machine Learning for Signal Processing, IEEE 2013, Southampton, UK, September, 2013, pp. 1-6

work page 2013
[7]

Semi-SAD: applying semi - supervised learning to shilling attack detection,

Z. Wu , J. Cao, B. Mao, and Y. Wang , "Semi-SAD: applying semi - supervised learning to shilling attack detection," Proceedings of the fifth ACM conference on Recommender systems, ACM 2011, Chicago, USA, October, 2011, pp. 289-292

work page 2011
[8]

Semi-supervised shilling attacks detection method based on SVM-KNN,

C. Lv, and W. Wang, "Semi-supervised shilling attacks detection method based on SVM-KNN," Computer Engineering and Applications, vol. 49, no. 22, pp. 7-10, 2013

work page 2013

Show all 16 references

[9]

Detection of abnormal item based on time intervals for recommender systems,

M. Gao, Q. Yuan, B. Ling, and Q. Xiong, "Detection of abnormal item based on time intervals for recommender systems," The Scientific World Journal, vol. 2014, pp. 1-8, 2014

2014
[10]

Detecting abnormal profiles in collaborative filtering recommender systems ,

Z. Yang, and Z . Cai, "Detecting abnormal profiles in collaborative filtering recommender systems ," Journal of Intelligent I nformation Systems, vol. 48, no. 3, pp. 499-518, 2017

2017
[11]

Shilling attack detection in collaborative recommender systems using a meta learning strategy,

W. Bhebe, and O. P. Kogeda, "Shilling attack detection in collaborative recommender systems using a meta learning strategy," 2015 International 0.25 0.4 0.55 0.7 0.85 1 0% 5% 10% 15% 20% Precision Attack Size Our Approach KNN Bayes Improved SVM 0 0.2 0.4 0.6 0.8 1 0.0% 5.0% 10...

2015
[12]

SVM-TIA a shilling attack detection method based on SVM and target item analysis in recommender systems,

W. Zhou, J. Wen, Q. Xiong, M. Gao, and J. Zeng, "SVM-TIA a shilling attack detection method based on SVM and target item analysis in recommender systems," Neurocomputing ,vol. 210, pp. 197-205, 2016

2016
[13]

Collaborative recommendation: A robustness analysis ,

M. O'Mahony, N. Hurley, N. Kushmerick, and G. Silvestre, "Collaborative recommendation: A robustness analysis ," ACM Transactions on Internet Technology, vol. 4, no. 4, pp. 344-377, 2004

2004
[14]

Toward trustworthy recommender systems: An analysis of attack models and algorithm robustness,

B. Mobasher, R. Burke , R. Bhaumik, and C. Williams, "Toward trustworthy recommender systems: An analysis of attack models and algorithm robustness," ACM Transactions on Internet Technology, vol. 7, no. 4, pp. 23-60, 2007

2007
[15]

Recommendation system based on prediction of user preference changes ,

K. Inuzuka, T. Hayashi, and T. Takagi, "Recommendation system based on prediction of user preference changes ," 2016 IEEE/WIC/ACM International Conference on Web Intelligence (WI) , Omaha, USA, October, 2016, pp. 192-199

2016
[16]

Profile injection attack detection for securing collaborative recommender systems ,

C. Williams, and B . Mobasher, "Profile injection attack detection for securing collaborative recommender systems ," DePaul University CTI Technical Report, 2006, pp. 1-47

2006

Pith tools

Reviewed August 14, 2026 · model on record in the stance chip above.

[1] [1]

Preventing shilling attacks in online recommender systems,

P. A. Chirita, W. Nejdl, and C. Zamfir, "Preventing shilling attacks in online recommender systems," in ACM International Workshop on Web Information and Data Management, 2005, pp. 67–74

work page 2005

[2] [2]

Classification features for attack detection in collaborative recommender systems,

R. Burke, B. Mobasher, C. Williams, and R. Bhaumik, "Classification features for attack detection in collaborative recommender systems, " in ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, 2006, pp. 542–547

work page 2006

[3] [3]

Defending recommender systems: detection of profile injection attacks ,

C. A. Williams, B. Mobasher, and R. Burke, "Defending recommender systems: detection of profile injection attacks ," Service Oriented Computing and Applications, vol. 1, no. 3, pp. 157-170, 2007

work page 2007

[4] [4]

Unsupervised shilling d etection for collaborative filtering ,

B. Mehta, "Unsupervised shilling d etection for collaborative filtering ," Proceedings of the 22nd national conference on Artificial intelligence, vol. 2, pp. 1402-1407, 2007

work page 2007

[5] [5]

Unsupervised detection of shilling attack for recommender system based on feature subset,

F. Peng, X . Zeng, H . Deng, and L. Liu , "Unsupervised detection of shilling attack for recommender system based on feature subset," Computer Engineering, vol. 40, no. 5, pp. 109-114, 2014

work page 2014

[6] [6]

Graph-based detection of shilling attacks in recommender systems ,

Z. Zhang, and S R. Kulkarni , "Graph-based detection of shilling attacks in recommender systems ," in 2013 IEEE International Workshop on Machine Learning for Signal Processing, IEEE 2013, Southampton, UK, September, 2013, pp. 1-6

work page 2013

[7] [7]

Semi-SAD: applying semi - supervised learning to shilling attack detection,

Z. Wu , J. Cao, B. Mao, and Y. Wang , "Semi-SAD: applying semi - supervised learning to shilling attack detection," Proceedings of the fifth ACM conference on Recommender systems, ACM 2011, Chicago, USA, October, 2011, pp. 289-292

work page 2011

[8] [8]

Semi-supervised shilling attacks detection method based on SVM-KNN,

C. Lv, and W. Wang, "Semi-supervised shilling attacks detection method based on SVM-KNN," Computer Engineering and Applications, vol. 49, no. 22, pp. 7-10, 2013

work page 2013