{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,11,20]],"date-time":"2025-11-20T06:15:09Z","timestamp":1763619309653,"version":"3.45.0"},"reference-count":43,"publisher":"MDPI AG","issue":"11","license":[{"start":{"date-parts":[[2025,11,18]],"date-time":"2025-11-18T00:00:00Z","timestamp":1763424000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Information"],"abstract":"<jats:p>Graph-based Recommender Systems (GRSs) model complex user\u2013item relationships. They offer improved accuracy and personalization in recommendations compared to traditional models. However, GRSs also face severe challenges from novel poisoning attacks. Attackers often manipulate GRS graph structures by injecting attack users and their interaction data. This leads to misleading recommendations. Existing detection methods lack the ability to identify such attacks targeting graph-based systems. To address this, we propose AutoDAP, a novel autoencoder-based detection method for poisoning attacks in GRSs. AutoDAP first extracts key statistical features from user interaction data. It fuses them with original interaction information. Then, an autoencoder architecture processes this data. The encoder extracts deep features and connects to an output layer for classification prediction probabilities. The decoder reconstructs graph structure features. By jointly optimizing classification and reconstruction losses, AutoDAP effectively integrates supervised and unsupervised signals. This enhances the detection of attack users. Evaluations on the MovieLens-10M dataset against various poisoning attacks, and on the Amazon dataset with real attack data, demonstrate AutoDAP\u2019s superiority. It outperforms several representative baseline methods in both simulated (MovieLens) and real-world (Amazon) attack scenarios, demonstrating its effectiveness and robustness.<\/jats:p>","DOI":"10.3390\/info16111004","type":"journal-article","created":{"date-parts":[[2025,11,18]],"date-time":"2025-11-18T16:49:51Z","timestamp":1763484591000},"page":"1004","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["Autoencoder-Based Poisoning Attack Detection in Graph Recommender Systems"],"prefix":"10.3390","volume":"16","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-5649-579X","authenticated-orcid":false,"given":"Quanqiang","family":"Zhou","sequence":"first","affiliation":[{"name":"School of Information and Control Engineering, Qingdao University of Technology, Qingdao 266520, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Xi","family":"Zhao","sequence":"additional","affiliation":[{"name":"School of Information and Control Engineering, Qingdao University of Technology, Qingdao 266520, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Xiaoyue","family":"Zhang","sequence":"additional","affiliation":[{"name":"School of Information and Control Engineering, Qingdao University of Technology, Qingdao 266520, China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"1968","published-online":{"date-parts":[[2025,11,18]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","unstructured":"Sheng, Z., and Wei, L. (2025). HS-SocialRec: A Study on Boosting Social Recommendations with Hard Negative Sampling in LightGCN. Information, 16.","DOI":"10.3390\/info16050422"},{"key":"ref_2","doi-asserted-by":"crossref","unstructured":"Huang, J., Xie, Z., Zhang, H., Yang, B., Di, C., and Huang, R. (2024). Enhancing Knowledge-Aware Recommendation with Dual-Graph Contrastive Learning. Information, 15.","DOI":"10.20944\/preprints202407.0778.v1"},{"key":"ref_3","first-page":"3","article-title":"Manipulating Recommender Systems: A Survey of Poisoning Attacks and Countermeasures","volume":"57","author":"Nguyen","year":"2024","journal-title":"ACM Comput. Surv."},{"key":"ref_4","unstructured":"Feldman, S., Uretsky, M., Najork, M., and Wills, C. (2004, January 17\u201320). Shilling Recommender Systems for Fun and Profit. Proceedings of the 13th International Conference on World Wide Web, New York, NY, USA."},{"key":"ref_5","doi-asserted-by":"crossref","first-page":"362","DOI":"10.1109\/TCSS.2024.3465008","article-title":"Shilling Attacks and Fake Reviews Injection: Principles, Models, and Datasets","volume":"12","author":"Nawara","year":"2024","journal-title":"IEEE Trans. Comput. Soc. Syst."},{"key":"ref_6","unstructured":"Setten, M.V., McNee, S.M., Konstan, J.A., Terveen, L., Ardissono, L., Herlocker, J., Smyth, B., and Nijholt, A. (2005). Identifying Attack Models for Secure Recommendation. Beyond Personalization, IUI\u201905. Available online: http:\/\/www.grouplens.org\/beyond2005\/papers.html."},{"key":"ref_7","unstructured":"Caballero, J., and Gu, G. (2018, January 3\u20137). Poisoning Attacks to Graph-Based Recommender Systems. Proceedings of the 34th Annual Computer Security Applications Conference, San Juan, PR, USA."},{"key":"ref_8","first-page":"58","article-title":"Poisoning GNN-based Recommender Systems with Generative Surrogate-based Attacks","volume":"41","author":"Nguyen","year":"2023","journal-title":"ACM Trans. Inf. Syst."},{"key":"ref_9","unstructured":"Frommholz, I., Hopfgartner, F., Lee, M., Oakes, M., Lalmas, M., Zhang, M., and Santos, R. (2023, January 21\u201325). Targeted Shilling Attacks on GNN-based Recommender Systems. Proceedings of the 32nd ACM International Conference on Information and Knowledge Management, Birmingham, UK."},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"124476","DOI":"10.1016\/j.eswa.2024.124476","article-title":"Stealthy Attack on Graph Recommendation System","volume":"255","author":"Ma","year":"2024","journal-title":"Expert Syst. Appl."},{"key":"ref_11","unstructured":"Bonifati, A., and Lee, D. (2005, January 4). Preventing Shilling Attacks in Online Recommender Systems. Proceedings of the 7th Annual ACM International Workshop on Web Information and Data Management, New York, NY, USA."},{"key":"ref_12","doi-asserted-by":"crossref","unstructured":"Mehta, B., Hofmann, T., and Fankhauser, P. (2007, January 28\u201331). Lies and propaganda: Detecting Spam Users in Collaborative Filtering. Proceedings of the 12th International Conference on Intelligent User Interfaces, Honolulu, HI, USA.","DOI":"10.1145\/1216295.1216307"},{"key":"ref_13","unstructured":"Yang, Q., and Wooldridge, M. (2015, January 25\u201331). Catch the Black Sheep: Unified Framework for Shilling Attack Detection Based on Fraudulent Action Propagation. Proceedings of the 24th International Conference on Artificial Intelligence, Buenos Aires, Argentina. Available online: https:\/\/dl.acm.org\/doi\/10.5555\/2832581.2832585."},{"key":"ref_14","doi-asserted-by":"crossref","first-page":"146","DOI":"10.1016\/j.knosys.2018.02.032","article-title":"UD-HMM: An Unsupervised Method for Shilling Attack Detection Based on Hidden Markov Model and Hierarchical Clustering","volume":"148","author":"Zhang","year":"2018","journal-title":"Knowl.-Based Syst."},{"key":"ref_15","doi-asserted-by":"crossref","first-page":"1375","DOI":"10.1109\/TKDE.2019.2946247","article-title":"BS-SC: An Unsupervised Approach for Detecting Shilling Profiles in Collaborative Recommender Systems","volume":"33","author":"Cai","year":"2019","journal-title":"IEEE Trans. Knowl. Data Eng."},{"key":"ref_16","doi-asserted-by":"crossref","first-page":"1411","DOI":"10.3233\/IDA-230575","article-title":"Unsupervised Contaminated User Profile Identification Against Shilling Attack in Recommender System","volume":"28","author":"Zhang","year":"2024","journal-title":"Intell. Data Anal."},{"key":"ref_17","doi-asserted-by":"crossref","first-page":"157","DOI":"10.1007\/s11761-007-0013-0","article-title":"Defending Recommender Systems: Detection of Profile Injection Attacks","volume":"1","author":"Williams","year":"2007","journal-title":"Serv. Oriented Comput. Appl."},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"197","DOI":"10.1016\/j.neucom.2015.12.137","article-title":"SVM-TIA A Shilling Attack Detection Method Based On SVM and Target Item Analysis in Recommender Systems","volume":"210","author":"Zhou","year":"2016","journal-title":"Neurocomputing"},{"key":"ref_19","doi-asserted-by":"crossref","first-page":"2600","DOI":"10.1587\/transinf.2015EDP7500","article-title":"Shilling Attack Detection in Recommender Systems Via Selecting Patterns Analysis","volume":"99","author":"Li","year":"2016","journal-title":"IEICE Trans. Inf. Syst."},{"key":"ref_20","doi-asserted-by":"crossref","first-page":"499","DOI":"10.1111\/coin.12579","article-title":"A Novel Classification-based Shilling Attack Detection Approach for Multi-criteria Recommender Systems","volume":"39","author":"Kaya","year":"2023","journal-title":"Comput. Intell."},{"key":"ref_21","first-page":"212","article-title":"Enhancing Recommendation Systems with Skew Deviation Bias for Shilling Attack Detection","volume":"18","author":"Gambhir","year":"2025","journal-title":"Recent Adv. Electr. Electron. Eng."},{"key":"ref_22","unstructured":"Yang, Q., Agarwal, D., and Pei, J. (2012, January 12\u201316). HySAD: A Semi-Supervised Hybrid Shilling Attack Detector for Trustworthy Product Recommendation. Proceedings of the 18th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, Beijing, China."},{"key":"ref_23","doi-asserted-by":"crossref","first-page":"102390","DOI":"10.1016\/j.cose.2021.102390","article-title":"Semi-supervised Recommendation Attack Detection Based on Co-Forest","volume":"109","author":"Zhou","year":"2021","journal-title":"Comput. Secur."},{"key":"ref_24","doi-asserted-by":"crossref","first-page":"949","DOI":"10.1093\/comjnl\/bxy008","article-title":"A Shilling Attack Detector Based on Convolutional Neural Network for Collaborative Recommender System in Social Aware Network","volume":"61","author":"Tong","year":"2018","journal-title":"Comput. J."},{"key":"ref_25","first-page":"102493","article-title":"Recommendation Attack Detection Based on Deep Learning","volume":"52","author":"Zhou","year":"2020","journal-title":"J. Inf. Secur. Appl."},{"key":"ref_26","doi-asserted-by":"crossref","unstructured":"Ebrahimian, M., and Kashef, R. (2020). Detecting Shilling Attacks Using Hybrid Deep Learning Models. Symmetry, 12.","DOI":"10.3390\/sym12111805"},{"key":"ref_27","first-page":"103051","article-title":"Fusing Hypergraph Spectral Features for Shilling Attack Detection","volume":"63","author":"Li","year":"2021","journal-title":"J. Inf. Secur. Appl."},{"key":"ref_28","doi-asserted-by":"crossref","first-page":"104030","DOI":"10.1016\/j.cose.2024.104030","article-title":"A Recommendation Attack Detection Approach Integrating CNN with Bagging","volume":"146","author":"Zhou","year":"2024","journal-title":"Comput. Secur."},{"key":"ref_29","doi-asserted-by":"crossref","first-page":"340","DOI":"10.1007\/s10489-025-06254-2","article-title":"User Similarity-based Graph Convolutional Neural Network for Shilling Attack Detection","volume":"55","author":"Zhang","year":"2025","journal-title":"Appl. Intell."},{"key":"ref_30","first-page":"3371","article-title":"Stacked Denoising Autoencoders: Learning Useful Representations In a Deep Network with a Local Denoising Criterion","volume":"11","author":"Vincent","year":"2010","journal-title":"J. Mach. Learn. Res."},{"key":"ref_31","doi-asserted-by":"crossref","first-page":"110176","DOI":"10.1016\/j.asoc.2023.110176","article-title":"A Comprehensive Survey on Design and Application of Autoencoder in Deep Learning","volume":"138","author":"Li","year":"2023","journal-title":"Appl. Soft Comput."},{"key":"ref_32","doi-asserted-by":"crossref","first-page":"105301","DOI":"10.1109\/ACCESS.2020.2999155","article-title":"Mixing Autoencoder with Classifier: Conceptual Data Visualization","volume":"8","author":"Hartono","year":"2020","journal-title":"IEEE Access"},{"key":"ref_33","doi-asserted-by":"crossref","first-page":"2079","DOI":"10.1007\/s10844-025-00976-y","article-title":"Cross-distillation-based approach for detecting poisoning attacks in recommender systems","volume":"63","author":"Wang","year":"2025","journal-title":"J. Intell. Inf. Syst."},{"key":"ref_34","doi-asserted-by":"crossref","unstructured":"Sarridis, I., and Kotropoulos, C. (2021, January 23\u201327). Neural Factorization Applied to Interaction Matrix for Recommendation. Proceedings of the 2021 29th European Signal Processing Conference (EUSIPCO), Dublin, Ireland.","DOI":"10.23919\/EUSIPCO54536.2021.9615972"},{"key":"ref_35","doi-asserted-by":"crossref","unstructured":"Fei, N., Gao, Y., Lu, Z., and Xiang, T. (2021, January 10\u201317). Z-Score Normalization, Hubness, and Few-Shot Learning. Proceedings of the IEEE\/CVF International Conference on Computer Vision (ICCV), Montreal, QC, Canada. Available online: https:\/\/ieeexplore.ieee.org\/document\/9710829.","DOI":"10.1109\/ICCV48922.2021.00021"},{"key":"ref_36","unstructured":"Tolstikhin, I.O., Houlsby, N., Kolesnikov, A., Beyer, L., Zhai, X., Unterthiner, T., Yung, J., Steiner, A., Keysers, D., and Uszkoreit, J. (2021). MLP-mixer: An All-MLP Architecture for Vision. Advances in Neural Information Processing Systems, Curran Associates, Inc.. Available online: https:\/\/proceedings.neurips.cc\/paper_files\/paper\/2021\/file\/cba0a4ee5ccd02fda0fe3f9a3e7b89fe-Paper.pdf."},{"key":"ref_37","unstructured":"Zhang, Z., and Sabuncu, M. (2018). Generalized Cross Entropy Loss for Training Deep Neural Networks with Noisy Labels. Advances in Neural Information Processing Systems, Curran Associates, Inc.. Available online: https:\/\/proceedings.neurips.cc\/paper_files\/paper\/2018\/file\/f2925f97bc13ad2852a7a551802feea0-Paper.pdf."},{"key":"ref_38","unstructured":"Kosson, A., Messmer, B., and Jaggi, M. (2024). Rotational Equilibrium: How Weight Decay Balances Learning Across Neural Networks. arXiv."},{"key":"ref_39","doi-asserted-by":"crossref","first-page":"e623","DOI":"10.7717\/peerj-cs.623","article-title":"The Coefficient of Determination R-squared Is More Informative Than SMAPE, MAE, MAPE, MSE and RMSE in Regression Analysis Evaluation","volume":"7","author":"Chicco","year":"2021","journal-title":"PeerJ Comput. Sci."},{"key":"ref_40","first-page":"19","article-title":"The MovieLens Datasets: History and Context","volume":"5","author":"Harper","year":"2015","journal-title":"ACM Trans. Interact. Intell. Systems."},{"key":"ref_41","unstructured":"He, Q., Lyengar, A., Nejdl, W., Pei, J., and Rastogi, R. (November, January 27). Uncovering Collusive Spammers in Chinese Review Websites. Proceedings of the 22nd ACM International Conference on Information & Knowledge Management, San Francisco, CA, USA."},{"key":"ref_42","first-page":"281","article-title":"Random Search for Hyper-parameter Optimization","volume":"13","author":"Bergstra","year":"2012","journal-title":"J. Mach. Learn. Res."},{"key":"ref_43","doi-asserted-by":"crossref","unstructured":"Sarvade, V.P., Kulkarni, S.A., and Raj, C.V. (2025). A Hybrid Classical-Quantum Neural Network Model for DDoS Attack Detection in Software-Defined Vehicular Networks. Information, 16.","DOI":"10.3390\/info16090722"}],"container-title":["Information"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2078-2489\/16\/11\/1004\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,11,20]],"date-time":"2025-11-20T05:32:17Z","timestamp":1763616737000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2078-2489\/16\/11\/1004"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,11,18]]},"references-count":43,"journal-issue":{"issue":"11","published-online":{"date-parts":[[2025,11]]}},"alternative-id":["info16111004"],"URL":"https:\/\/doi.org\/10.3390\/info16111004","relation":{},"ISSN":["2078-2489"],"issn-type":[{"type":"electronic","value":"2078-2489"}],"subject":[],"published":{"date-parts":[[2025,11,18]]}}}