A privacy preserving recommendation and fraud detection method based on graph convolution

1.   Introduction

Human society has entered the era of big data, experiencing a massive growth in data at the level of Zettabytes (ZB) annually. Recommendation systems have become a powerful tool for helping users filter useful information from massive data and solving the problem of information overload. Collaborative filtering, expert-based, and rule-based recommendations are typical methods used for providing recommendations.

Currently, with the rapid development of various learning methods including deep learning and federated learning ^[1,2], research combining with learning approaches is in full swing, and gains success in many fields such Internet of Things (IoT) ^[3,4,5] and Industrial IOT (IIOT) ^[6], edge computing ^[7,8,9,10] and recommendation systems etc. As a typical deep learning technique, graph convolution overcomes the limitations of manually selecting sample features and excels in capturing the link relationship between users and items, it has been successfully applied in recommendation systems.

Most existing recommendation systems provide recommendation service based on users' preferences which are analyzed by users' rating data and other information. While users enjoy the personalized recommendation services, they also face the risks of privacy leakage to a large extent. For example, link relationship between certain user and an item is formed when the user rates the item, adversaries may use techniques such as reverse inference to obtain the graph structure and link information. From a graph perspective, many privacy-preserving recommendation methods currently focus on protecting the nodes and their attributes but tend to neglect the graph's link relationships (edges).

Further, due to the lack of trust between users and the recommendation system, as well as collusion between merchants and the recommendation system, it is difficult to ensure the authenticity of rating data source. The recommendation system may recommend an item that is intentionally highly rated by fraudsters. For example, certain merchants hire a large number of fraudsters to write false positive reviews for themselves in order to improve their rating, and even delete and modify the rating data used for recommendation. This makes it difficult for the recommendation system to effectively verify and control the quality of the data provided by users, and further reduces users' trust and the accuracy of the recommendation system. Currently, researchers have developed several methods for fraud detection ^[11,12], with most focusing on fraud detection in financial settings. For instance, Wang et al. ^[13] employed multi-view data to alleviate the issue of insufficient labeled data, utilizing both semi-supervised and supervised learning for fraud detection. Fraud detection in recommendation systems presents different characteristics than financial fraud detection. For instance, fraud attacks in recommendation systems are becoming increasingly common and simple to execute. Developing a sturdy recommendation system that considers fraud attacks remains an ongoing challenge.

Therefore, constructing a recommendation system that takes into account both the preservation of user privacy and fraud detection holds significant value.

To address the aforementioned issues, a Privacy Preserving Recommendation and Fraud Detection method based on Graph Convolution (PPRFD-GC) is proposed in this paper. The PPRFD-GC method operates under the assumption that a trusted data collector is accountable for collecting user rating data and generating the original graph of rating data. Taking the original graph as the input, a semi-honest recommendation system provides both recommendation service and fraud detection service. The main contributions of this paper can be summarized as follows:

1) To provide effective recommendation in condition of preserving graph structure and link privacy of users, a privacy-preserving recommendation algorithm utilizing the centralized differential privacy and Differentially Private Graph Generative Adversarial Networks (DPGGAN) model ^[14] is designed. The given algorithm firstly adopts decoder/encoder framework to generate the synthesized graph satisfying edge differential privacy, then applies graph based matrix completion technique for rating prediction. The given algorithm alleviates the problem of data sparsity and achieves a better balance between privacy preservation and data utility.

2) To solve the problem of fraud data and improve the robustness of recommendation system, a fraud detection algorithm based on AdaBoost is presented to detect possible fraudsters. The designed algorithm firstly calculates user's Mean Square Error (MSE) of rating prediction and generates dense representation of the user. Taking dense representation as the input, the fraud detection classifier is trained to detect whether certain user is a fraudster or not. Finally, the loss functions of above two algorithms are linearly combined to form the final loss function of the PPRFD-GC method.

3) Experiments were conducted on actual datasets from Yelp and Amazon, and the findings exhibit the efficacy of the proposed method.

The paper is structured as follows. In Section 2, related work is discussed. Section 3 provides a review of preliminary knowledge about graph convolution and differential privacy. The design of the PPRFD-GC method is presented in Section 4. In Section 5, the results of experiments conducted on two real datasets are analyzed. Finally, Section 6 concludes the paper.

2.   Related work

2.1.   Graph-based recommendation and fraud detection

Recommendation systems possess strong graph structure properties, for example, user-items can form a bipartite graph or be used as heterogeneous graphs. Further, users can form a social network among themselves. Therefore, some research have applied Graph Neural Network (GNN) to recommendation system. He et al. ^[15] proposed a new lightweight Graph Convolutional Network (GCN) model for collaborative filtering, which contained only the neighborhood aggregation component of graph convolution, specifying the aggregation function in traditional GCN as a simple weighting and aggregator to ensure good feature representation performance. Mao et al. ^[16] proposed the simplified GCN model named UltraGCN for collaborative filtering. Instead of using explicit message passing, the proposed model omits feature transformation and nonlinear activation, and directly approximated the limit of infinite-layer graph convolution through constraint loss. Yu et al. ^[17] proposed a multi-channel hypergraph convolutional network, which compensated the aggregation loss of multi-channel embeddings in the network with self-supervised learning and leveraged comprehensive high-order user relations to enhance social recommendation.

In the field of fraud detection, graphs are constructed based on business scenarios and then combined with GNN to detect fraud. Liu et al. ^[18] considered the problem of fraud detection in graphs as an unbalanced node classification task, and proposed a Pick and Choose Graph Neural Network (PC-GNN) to resolve the class imbalance problem on graphs in fraud detection. To address the identification of fraud requests, Shen et al. ^[19] proposed an evolutionary privacy-preserving learning schema for edge computing based IoT data sharing problem. The schema introduces evolutionary game theory and constructs a payoff matrix to represent the mutual communication between IoT devices and edge nodes, then achieves the evolution of the privacy preserving strategy of edge nodes through the game theory. Zhang et al. ^[20] proposed a user representation learning GCN framework named GraphRfi for robust recommendation and fraud detection. In its end-to-end learning process, the recommendation component and the fraudster detection component mutually enhance by passing parameters to each other.

2.2.   Differentially private recommendation methods

Differential privacy is a privacy preservation method based on data perturbance and rigorous mathematical proof. Zheng et al. ^[21] proposed a model of a decentralized GNN for privacy-preserving recommendations named DGREC. The proposed model constructed local inner-item graph as well as the global user graph for each user, and securely shared the gradient computed locally using a mechanism of local differential privacy (LDP), achieving strong privacy protection for user data. Wu et al. ^[22] had proposed a GNN-based privacy preserving federated learning recommendation framework. In the framework, each client employed LDP to preserve local gradients and uploaded them to a central server for aggregation. To protect the items that interacted with the user, a random sampling method was used to generate anonymous pseudo-interaction items and participate in embedding generation. To achieve a trade-off between recommendation quality and privacy protection against inference attacks, Xiao et al. ^[23] proposed a deep reinforcement learning (RL) based user profile perturbation for recommendation systems. The scheme uses differential privacy to perturb user profiles and uses an evaluated neural network (NN) and a target neural network to select the privacy budget, achieving a balance between user privacy protection and recommendation quality. To address the privacy leakage issue in Collaborative Filtering (CF) recommendation systems, Chen et al. ^[24] proposed a differentially private CF recommendation system based on K-Means clustering, called KDPCF. KDPCF clusters the dataset into categories using K-Means clustering and efficiently selects neighbors for recommendation using the exponential mechanism.

From above analysis, most current research focus on either non-privacy preserving/privacy preserving recommendation issue or fraud detection problem. There are few research work taking these two issues together into consideration.

3.   Preliminaries

3.1.   Graph convolutional networks

Graph Convolutional Networks (GCN) ^[25] is a type of graph neural network that utilizes convolutional operations for representation learning. GCN's layer-by-layer update formula is obtained from the embedded aggregation of the node itself and its neighboring nodes followed by a non-linear transformation. The convolution in GCN differs from the commonly used convolution in deep learning. It pertains to the aggregation of data for a node and its neighbors in a non-Euclidean domain.

Spectral-based graph convolution methods define operators for each layer by using the convolution theorem. The convolution kernel is applied to aggregate information between nodes in the input signal. Multiple layers of neural networks are stacked using a particular non-linear activation function.

For a graph $G{\text{ = (}}V, E)$, where $V$ is the set of nodes and $E$ represents the set of edges. The formula of GCN can be defined as follows:

where ${H^l}$ is the embedded representation of the $l$ layer, $A$ denotes the adjacency matrix, and $f$ represents an activation function. Specifically, it can be realized in GCN by the following formula:

where $D$ represents the degree matrix, $\sigma$ denotes a nonlinear activation function, such as Leaky ReLU; ${W^l}$ stands for the parameter matrix of the $l$ layer, $\hat A$ is the adjacency matrix with self-loop.

3.2.   Edge differential privacy

Differential privacy is a privacy protection technology proposed by Dwork ^[17]. In simple terms, differential privacy adds controllable noise to the original dataset, allowing the noisy dataset to retain the original statistical attributes without disclosing sensitive information.

Definition 1 (Edge Differential Privacy ^[14]). Given two neighboring graphs $G{\text{ = (}}V, E{\text{)}}$ and $G'{\text{ = (}}V'{\text{, }}E'{\text{)}}$, where $V{\text{ = }}V'$ and $E' = E - {E_x}:\left| {{E_x}} \right| = k$ (i.e., the two edge sets differ by k edges), and there is a randomized algorithm $M$, ${P_M}$ represents the set comprising all possible outputs of $M$. For any subset of ${P_M}$, if $M$ satisfies:

Then $M$ is said to satisfy $(\varepsilon, \delta)$ -edge differential privacy. Where $\Pr [\cdot]$ denotes the probability of the event, $\varepsilon$ is the privacy budget and $\delta$ represents a probability of failure.

Theorem 1 (Sequential Combination). Supposing there is a set of random algorithms $\{ {M_1}, {M_2}, ..., {M_n}\}$, each ${M_i}(1 \leqslant i \leqslant n)$ satisfies ${\varepsilon _i}$ -differential privacy on the dataset $D$. Then, the set of ${M_i}$ sequence privacy mechanisms provides $(\sum\nolimits_{i = 1}^n {{\varepsilon _i}})$ -differential privacy.

Theorem 2 (Parallel Combination). Supposing the dataset $D$ can be divided into a series of independent and non-overlapped subsets $\{ {D_1}, {D_2}, ..., {D_n}\}$ and there is a set of random algorithms $\{ {M_1}, {M_2}, ..., {M_n}\}$. If each ${M_i}(1 \leqslant i \leqslant n)$ satisfies ${\varepsilon _i}$ -differential privacy on ${D_i}(1 \leqslant i \leqslant n)$, the set of randomized algorithms can provide ${\text{max\{ }}{\varepsilon _i}{\text{\} }}$ -differential privacy on the dataset $D$.

Theorem 3 (Post-Processing ^[26]). Supposing an randomized algorithm $M$ satisfies $\varepsilon$ -differential privacy, and let $f$ be an arbitrary mapping from the set of possible outputs of $M$ to an arbitrary set, then $f \circ M$ achieves $\varepsilon$ -differential privacy.

4.   The PPRFD-GC method

4.1.   Framework

Aiming at the possible risks of privacy disclosure and the problems of fraudulent data for recommendation system, a Privacy Preserving Recommendation and Fraud Detection method based on Graph Convolution (PPRFD-GC) is proposed in the paper, and the framework of the proposed method is depicted in Figure 1. In the framework, there exists a trustworthy third-party data aggregator and a semi-honest recommendation system. The trusted data aggregator generates the original graph $G(V, E)$ according to the collected users' rating data, where $V = U \cup It$ is the set of vertices, $U$ is the set of users and $It$ is the set of items, $E$ is the set of edges which reflects the links between the users and the items. Taking the original graph $G$ as input, the recommendation system realizes rating prediction and fraud detection service based on GCN.

The PPRFD-GC method consists of two main algorithms: the Graph Complete Convolution Network with edge differential privacy (GCCN-EDP) and the Fraud Detection Classification based on AdaBoost (FDC-AB).

To preserve the link privacy of users and improve the recommendation efficiency of graph convolution, the GCCN-EDP algorithm firstly follows the concept of the DPGGAN model proposed by Yang et al. ^[14] and central differential privacy for generating the synthesized graph, which consists of a GCN-based graph encoder, a GCN-based discriminator and a Feedforward Neural Network (FNN) based decoder. The GCN-based graph encoder guides the learning of a fully connected FNN-based adjacency matrix decoder, which can be trained to directly reconstruct a graph with similar links as in the original graph. Further, Gaussian noise is added to the gradients of the decoder to preserve the link privacy. Next, the GCCN-EDP algorithm uses graph based matrix completion technique to carry out rating prediction, which includes two components: enclosing subgraph extraction and graph-level Graph Neural Network (GNN). The first component extracts enclosing subgraphs and labels the nodes in the subgraphs, then these subgraphs are fed to the graph level GNN for training and rating prediction.

According to sociological theory, ratings made by normal users have greater stability and predictability compared to those made by fraudsters, who tend to make multiple extreme ratings. The FDC-AB algorithm is designed to detect fraudsters based on the AdaBoost. For a user $u$, the FDC-AB algorithm firstly calculates MSE of rating prediction of $u$, and then generates dense representation ${\text{h}}_u^{\text{*}}$ of $u$. Taking ${\text{h}}_u^{\text{*}}$ as the input, the fraud detection classifier is trained to detect whether $u$ is a fraudster or not. Finally, the loss function of the GCCN-EDP algorithm is linearly combined with the loss function of the FDC-AB algorithm to form the final loss function of the PPRFD-GC method.

4.2.   GCCN-EDP algorithm

The GCCN-EDP algorithm comprises two phases: synthesized graph construction and graph based rating matrix completion.

During the synthesized graph construction phase, the GCCN-EDP algorithm adheres to the principles of the DPGGAN mode to perturb the original graph $G$. As a result, a synthesized graph $G'$ is generated that satisfies edge differential privacy. Notably, both $G'$ and $G$ have the same number of vertices, degrees and triangles, but it is hard to deduce whether an edge in $G'$ is also present in $G$.

Supposing ${\mathbf{A}}$ is the adjacency matrix of graph $G$, and ${\mathbf{X}}$ represents the one-hot node identity matrix. The GCN-based graph encoder guides the learning of the FNN-based adjacency matrix decoder, which can be trained to directly reconstruct a graph $G'$ with similar links as in the original graph $G$.

The latent representation ${\mathbf{Z}}$ of ${\mathbf{A}}$ is defined as follows:

where $N$ is the number of vertices, ${\mu _i}$ is the mean vector, ${\sigma _i}$ is the standard deviation vector.

The GCN-based graph encoder adopts a two-layer GCN model while ${{g} _ \bullet }({\mathbf{X}}, {\mathbf{A}}) = {\mathbf{\tilde A}}{Re} {LU} ({\mathbf{\tilde AX}}{W_0}){W_1}$, ${{g} _\mu }$ and ${{g} _\sigma }$ form the encoder and share the first-layer parameters ${W_0}$. ${\mathbf{\tilde A}} = {D^{ - \frac{1}{2}}}{\mathbf{A}}{D^{ - \frac{1}{2}}}$ is the symmetrically normalized adjacency matrix of $G$, and $D$ is the degree matrix.

To generate the synthesized graph $G'$, a reconstructed adjacency matrix ${{\mathbf{A}}^{'}}$ is computed from ${\mathbf{Z}}$ by the FNN-based decoder as follows:

where $\sigma (z) = 1/(1 + {e^{ - z}})$, ${\mathbf{f}}$ is a two-layer FNN appended to ${\mathbf{Z}}$ before the logistic sigmoid function, and it is helpful for generating the edges in $G'$.

In the phase of graph based rating matrix completion, to train the graph convolution model, the GCCN-EDP algorithm adopts the idea of inductive matrix completion proposed by Zhang et al. ^[27], and extracts h-hop enclosing subgraphs of the rating matrix of the synthesized graph $G'$. These subgraphs are then mapped to their corresponding ratings, to achieve the function of rating matrix completion. This phase consists of two components: enclosing subgraph extraction, graph-level GNN training.

In the component of enclosing subgraph extraction, the GCCN-EDP algorithm firstly extracts an h hops enclosing subgraph around nodes $u$ and $v$ of $G'$ for each observed rating ${r_{u, v}}$. The h-hop enclosing subgraph includes nodes $u$, $v$ and their neighbors within h hops, which contains rich graphical structural information about rating ${r_{u, v}}$. The basic concept of the enclosing subgraph is simple and intuitive: if item ${v_0}$ is liked by a user ${u_0}$, it is possible that it will also be liked by a user ${u_1}$, who shares similar preferences with ${u_0}$. A Breadth First Search (BFS) algorithm can be used for enclosing subgraph extraction, and more details are omitted due to space limitation.

Before feeding these enclosing subgraphs to the GNN, each node in a subgraph is assigned with an integer label, marking the different role of each node in the subgraph. Initially, the target user $u$ and target item $v$ are assigned labels 0 and 1, respectively. For the remaining nodes in the enclosing subgraph, we determine their labels according to at which hop they are included in the subgraph. A label of $2i$ is assigned to a node of user type if it is present in the i-th hop, while a label of $2i + 1$ is assigned to a node of item type if it is present in the i-th hop. The purpose of node labeling is to distinguish the target node from context nodes, enabling the GNN to create inferred relationships and forecast ratings among varying users and items. The one-hot encoding of these node labels will be considered as the initial node feature ${W_0}$ of the enclosing subgraphs when sending these subgraphs to the GNN.

In the component of graph-level GNN training, the GNN contains two sub-components: message passing layers that extract a feature vector for each node in the subgraph, and a pooling layer to summarize a subgraph representation from node features.

To learn different graph patterns in a subgraph according to edge types, the message layer passing function used by the GCCN-EDP algorithm is defined as follows:

where ${\text{x}}_i^l$ and ${\text{x}}_j^l$ denote the feature vectors of nodes $i$ and $j$ at a given layer $l$, and ${{\text{N}}_{\text{r}}}(u)$ is the neighbor set of node $u$, where each node has a connection to $u$ with an edge type $r$. $W_0^l$ and $W_r^l$ are matrices of learnable parameters. $\{ W_r^l|r \in \Re \}$ represents the parameter matrices of different edge types between nodes, and $\Re$ is the set of all possible ratings. The various edge patterns within the graph can be introduced into the GCN model using the message passing function described above.

To enhance the efficiency of message aggregation, the GCCN-EDP algorithm computes the power average of multiple embeddings to serve as the final representation ${{\text{h}}_i}$ of node $i$ :

where $L$ represents the number of message passing layers.

To pool the node representations into a graph-level feature vector, the GCCN-EDP algorithm adopts a pooling layer. The pooling layer concatenates the final representations of both the target user and the target item as the graph representation, and then a Multi-Layer Perceptron (MLP) layer is utilized to output the predicted rating, as exhibited in the following two formulas, respectively:

where ${{\text{h}}_u}$ and ${\text{h}}{}_v$ are the final representations of the target user $u$ and the target item $v$, respectively; ${\hat r_{u, v}}$ represents the predicted rating, and $w$ and $W$ are two parameter matrices of MLP, which to map the graph representation $g$ to the rating ${\hat r_{u, v}}$.

4.3.   FDC-AB algorithm

The FDC-AB algorithm mainly adopts AdaBoost framework for fraudster detection. AdaBoost utilizes multiple weak classifiers for cascade operation, resulting in high classification accuracy. Additionally, AdaBoost differs from other bagging algorithms, including the Random Forest algorithm, by fully considering the weight of each weak classifier.

To detect whether a user $u$ is fraudster or not, the FDC-AB algorithm firstly computes the MSE of rating prediction of $u$ and generates dense representation ${\text{h}}_u^{\text{*}}$ of $u$, then fraud detection classifier is trained.

For a user $u$, the root MSE ${\mathbb{E}_u}$ of all rating items ${S_v}(u)$ can be calculated as follows:

where ${r_{u, v}}$ represents the observed rating in the dataset and ${\hat r_{u, v}}$ represents the predicted rating calculated according to Eq (7).

Thus, we cascade the previously derived final user representation ${{\text{h}}_u}$ with ${\mathbb{E}_u}$ to produce a fraud-detecting user representation ${\text{h}}_u^{'}$. To achieve full distinguishability of the decision tree, ${\text{h}}_u^{'}$ is passed through a fully connected layer resulting in a dense representation ${\text{h}}_u^{\text{*}}$, as depicted by the following two formulas:

where ${W_{z'}}$ and ${b_{z'}}$ denote the weight and bias terms, respectively.

At the beginning of model training, the FDC-AB algorithm assigns the equal weight to each weak classifier. Training a weak classifier and if its classification result is correct, its corresponding weight should be reduced when constructing the next training set. Otherwise, its corresponding weight should be increased. This step is iterated until the end of the training process. Eventually, all the weak classifiers obtained are merged to form a strong classifier. In the final objective function, a weak classifier with smaller classification error rate has larger weight, so as to achieve fraud detection classification. In the classifier, the fraud identity label of a user $u$ is labeled as ${y_u}$, $u$ is recognized as a fraudster when ${y_u} = 1$, otherwise ${y_u} = 0$.

Supposing there are $K$ decision trees, each one is a standard binary tree structure, and a decision tree ${T_k}(1 \leqslant k \leqslant K)$ contains two types of nodes: prediction nodes (leaf nodes) and decision nodes (non-leaf nodes). For a prediction node ${n_p} \in LS$ ($LS$ is the set of leaf nodes), there exists a probability distribution ${\ell _{{p_y}}}$ of label ${y_u}$. For a decision node ${n_q} \in NLS$ ($NLS$ is the set of non-leaf nodes), there exists a decision function ${f_q}({\text{h}}_u^*; \theta)$ which decides whether to assign the received ${\text{h}}_u^*$ to the left subtree or not, where $\theta$ is a parameter term. The decision function ${f_q}({\text{h}}_u^*; \theta)$ generates a ground truth label, which is defined as follows:

Hence, the classification probability of the decision tree ${T_k}$ about user $u$ is:

where ${\ell _{{p_y}}}$ is the probability of label $y$ on the prediction node ${n_p}$, $\mathop {{f_q}}\limits^\_ ({\text{h}}_u^*; \theta){\text{ = }}1 - {f_q}({h} _u^*; \theta)$, ${\Gamma _{{\text{left}}}}$ indicates whether to visit the left subtree or not, with ${\Gamma _{{\text{left}}}}{\text{ = }}1$ for left subtree and ${\Gamma _{{\text{left}}}}{\text{ = 0}}$ for right subtree.

For the decision tree ${T_k}$, its error rate ${e_k}$ on the training set is defined as follows:

where $TN$ represents the size of the training set, ${w_{k, i}}$ denotes the weight factor of training sample ${x_i}$, which has an initial value of ${w_{1, i}} = 1/TN$.

After obtaining ${e_k}$ of the decision tree ${T_k}$, the decision weight ${\alpha _k}$ for the corresponding weak classifier can be calculated and the weight distribution of ${x_i}$ can be updated:

where ${Z_k}$ denotes the normalization constant that satisfies ${Z_k}{\text{ = }}2\sqrt {{{\text{e}}_k}(1 - {{\text{e}}_k})}$.

Finally, these individual weak classifiers can be combined to form the strong classifier according to their weights

Consequently, the classification probability ${y_u}$ of user $u$ is given as follows:

4.4.   Execution flow of the PPRFD-GC method

The loss function of the GCCN-EDP algorithm adopts the squared error to predict the loss, using the probability of classification as the normal user multiplied by the squared error term. And the loss function of the FDC-AB algorithm uses the Cross Entropy Loss function. Finally, these two loss functions are linearly combined to form the final loss function of the PPRFD-GC method. These three loss functions are respectively defined as follows:

where $|E'|$ and $|U|$ are the number of edges and the number of users of the synthesized graph $G'$, $edge(u, v) \in E'$ means there exists an edge between user $u$ and item $v$, and $\lambda$ is a hyperparameter to balance the effects of the two components.

The pseudo-code of the PPRFD-GC method is shown in the Algorithm 1.

From the perspective of privacy analysis, we briefly prove that the PPRFD-GC method satisfies $(\varepsilon, \delta)$ -edge differential privacy.

The PPRFD-GC method contains two algorithms: GCCN-EDP and FDC-AB. The GCCN-EDP algorithm consists of two phases. In the first phase, it follows the concept of the DPGGAN model, and applies the DP-SGD algorithm to generate the synthesized graph with the addition of Gaussian noise. This phase does not modify the DP-SGD algorithm, and thus satisfies $(\varepsilon, \delta)$ -edge differential privacy. The specific proof process can be referred to the literature ^[14]. The second phase of the GCCN-EDP algorithm and the FDC-AB algorithm both rely on the synthesized graph of the first stage, and according to the post-processing theorem of differential privacy, the second stage of the GCCN-EDP algorithm and the FDC-AB algorithm also satisfy the $(\varepsilon, \delta)$ -edge differential privacy. Therefore, the PPRFD-GC method satisfies $(\varepsilon, \delta)$ -edge differential privacy.

5.   Experiments

5.1.   Experimental settings

We implemented the proposed method in Python programming language (version 3.6.9) and TensorFlow (version 1.6.0), and conducted experiments on a machine with Intel (R) i7-10700KF/3.8 GHz/64 GB hardware configuration and a 64-bit Windows 10 operating system.

Our experimental study utilized two real datasets, Yelp ^[28] and Amazon ^[29], which differentiate normal users from fraudsters with the help of labels. Table 1 outlines the statistics of the two datasets.

5.2.   Experimental results

To evaluate the accuracy and robustness of the proposed method, we applied two metrics commonly used in recommendation system: Mean Absolute Error (MAE) and Root Mean Square Error (RMSE). A greater degree of accuracy in the recommendation system is reflected by lower values for these two metrics. Furthermore, the accuracy of ratings is affected by the presence of fraudster.

MAE: the mean value of the absolute error, indicating the average distance between the predicted value of the model and the true value of the sample. MAE is defined as follows:

RMSE: measures the square root of the average squared difference between the estimated values and the actual values of a dataset. RMSE is used to measure the deviation of the estimated value from the true value and defined as below:

To validate the effectiveness of the PPRFD-GC method, the proposed method is compared with the following methods:

PPRFD-GC2: the non-privacy-preserving version of the PPRFD-GC method;

DP-GCMC: a framework for message-passing graph autoencoders based on bipartite interaction graph ^[30], with a differentially private version of GCMC that adds Laplace noise during gradient descent process.

DP-GraphRec: a framework for social recommendation based on GNN ^[31], in which the user-item interaction module is used in the experiments, with a differentially private version of GraphRec that adds Laplace noise during gradient descent process.

The PPRFD-GC method follows specific parameters: the GCCN-EDP algorithm incorporates a three-layer graph neural network connection with a hidden layer size of 100. The model parameters are initialized using a Gaussian distribution and updated through the Adaptive Moment Estimation (Adam) algorithm. The optimization value interval for both $\alpha$ and $\beta$ is set at [10^-4, 10], and the depth of the decision tree in the FDC-AB algorithm is set at 3.

In this section, two comparative experiments are conducted. The first experiment selects the real data of the original dataset to form the training dataset, and then inserts different percentages of the fraudulent data of the original dataset into the training dataset for comparison. The second experiment inserts artificially constructed fake data into the training set and makes comparisons under fixed privacy budget. Specifically, hate attacks and random attacks are chosen to populate the training dataset. Hate attacks are used to generate as many rating extremes as possible and they are inserted into the dataset. While random attacks generate ratings randomly and insert them into the dataset. The experiments adopt a five-fold cross-validation strategy to test the accuracy of the above methods and take the average as the result.

5.2.1.   Result analysis of the first experiment

In this experiment, the privacy budgets of all three differentially private methods are set to $\varepsilon {\text{ = }}1$. Figure 2 illustrates the experimental results on the Yelp dataset. The trend in two metrics, MAE and RMSE, of the PPRFD-GC method is slightly lower than that of the other two methods as the proportion of fraudulent data increases, and the non-privacy preserving baseline method, PPRFD-GC2, performs best. Overall, edge differential privacy has a minimal negative impact on data utility. The PPRFD-GC method surpasses the other two privacy-preserving methods, with an average improvement in MAE of 1.9% and 4.2% over DP-GCMC and DP-GraphRec, respectively; and an average improvement in RMSE of 2.8% and 3.0% over DP-GCMC and DP-GraphRec, respectively.

Figure 3 shows the experimental results on the Amazon dataset, where the PPRFD-GC method still outperforms the other two privacy-preserving methods, with an average MAE improvement of 4.6% and 6.4% over DP-GCMC and DP-GraphRec, respectively; and an average RMSE improvement of 2.3% and 4.4% over DP-GCMC and DP-GraphRec, respectively.

Further, it can also be clearly seen from Figures 2 and 3 that the trend line of each method basically keep a slightly upward trend. But with the rapid increase of fraud data, for the DP-GCMC method, the MAE value of Amazon and RMSE values of both Yelp and Amazon decrease. The DP-GraphRec method shows similar but minor phenomenon. And the proposed method shows a better resistance to fraudulent data.

Figures 4 and 5 illustrate the MAE and RMSE trends of the four methods on the Yelp dataset, after inserting different proportions of artificially constructed fake data. From the figures, the PPRFD-GC method achieves better protection against random attacks and hate attacks. With the increase of inserted fake data, the PPRFD-GC method outperforms the other two privacy-preserving methods in both MAE and RMSE. Additionally, the proposed method exhibits less fluctuation for these two metrics compared to the other two privacy-preserving methods. With the rapid increase of fake data, the RMSE value of proposed method is slightly lower than that of the PPRFD-GC2 method.

Figures 6 and 7 show the trends in MAE values and RMSE values of the four methods on the Amazon dataset after inserting different proportions of artificially constructed fake data. Similar to the results on the Yelp dataset, the PPRFD-GC method outperforms the other two privacy-preserving methods in both MAE and RMSE, and the fluctuation of the proposed method for these two metrics is lower than that of the other two privacy-preserving methods. Moreover, the performance of proposed method on Amazon dataset is very close to that of the PPRFD-GC2 method.

The findings of the two aforementioned experiments demonstrate that the proposed method is successful in mitigating recommendation distortion caused by fraudulent data while simultaneously maintaining satisfactory recommendation accuracy levels.

5.2.2.   Ablation study

Here, we provide an ablation study that demonstrates the effectiveness of respective parts in the PPRFD-GC method. We compare the proposed method with three weaken versions, including: 1) replacing the two layer FNN-based decoder by a two layer GCN-based decoder in the GCCN-EDP algorithm; 2) replacing the graph based matrix completion by F-EAE ^[32] in the GCCN-EDP algorithm, and F-EAE is also a commonly used matrix completion technique which uses exchangeable matrix layers to perform inductive matrix completion; 3) replacing the group of weaker classifiers in the AdaBoost by a group of decision trees of random forest (RF) in the FDC-AB algorithm.

Two groups of comparative experiments are performed. The first group of experiments compares MAE value of above four versions of the proposed method while the second one compares RMSE value. In these two experiments, privacy budget $\varepsilon$ is fixed to 1 and percentage of fraudulent data is set to 0.2, 0.4 and 0.6. The experimental results of the ablation study are reported in Tables 2 and 3, respectively.

As shown in Tables 2 and 3, the original GCCN-EDP method always achieves the best performance. The performance of the first weaken version is very slightly lower than the original one, since FNN is more effective for static data than GCN. The performance of the second weaken version is medium, implying graph based matrix completion technique is suitable for our scenario. And the performance of the last weaken version is the worst, which may imply that assigning the same weight to each decision tree is not a good strategy.

6.   Conclusions

To solve the risk of privacy leakage and the problem of fraud detection faced by the recommendation system, the PPRFD-GC method consisting of two algorithms: GCCN-EDP and FDC-AB, is proposed in the paper. According to users' rating data, the GCCN-EDP algorithm firstly construct a synthesized graph which satisfies edge differential privacy, then adopts graph based matrix completion technique for GNN based rating prediction. The FDC-AB algorithm is designed to detect fraudsters based on AdaBoost. By calculating the MSE of user's rating prediction and generating the dense representation of user as the input of the fraud detection classifier, a user can be classified into a fraudster or a normal user. Finally, the loss functions of these two algorithms are linearly combined to form the final loss function of the PPRFD-GC method.

In the future, we plan to continue the research in the following aspects: 1) The GCCN-EDP algorithm mainly takes users' rating data into consideration for constructing a single layer graph. To improve recommendation quality, more useful information such as social interactions should be utilized. The adoption of multiplex graph for GNN-based recommendation should be our future attention because each layer of the graph may contain different type of information; 2) The fraud detection part of the proposed method is currently applicable to offline/static scenarios. But most real-world networks evolve and fraudsters leverage their dynamics to evade detection, thus the design of our fraud detection solution should consider employing a time-evolving network structure to continuously track suspicious activities across different time-based snapshots.

Use of AI tools declaration

The authors declare they have not used Artificial Intelligence (AI) tools in the creation of this article.

Acknowledgments

This research was funded by "Key Research and Development Program of Shaanxi Province", grant number 2021GY-090.

Conflict of interest

The authors declare there is no conflict of interest.