Attack profiles are ineffective if they do not appear in the neighborhoods of authentic users. By avoiding similarity as a criterion for neighbour selection, the recommendation algorithm can be made robust to attacks where the attack profiles are
designed to have high similarity with authentic users. In [23] it is argued that the
goal of neighbour selection is to select the most useful neighbours on which to base
the prediction. While similarity is one measure of usefulness, the notion of neighbour utility can be extended to include other performance measures. A selection
criterion is proposed based on a notion of inverse popularity. It is shown that, with
this selection strategy, the same overall system performance in terms of MAE is
maintained. Moreover, cost-effective attacks that depend on popular items to build
highly influential profiles are rendered much less effective.
In [31], a robust algorithm is presented based on association rule mining. Considering each user profile as a transaction, it is possible to use the Apriori algorithm
to generate association rules for groups of commonly liked items. The support of
an item set X ⊂ I is the fraction of user profiles that contain this item set. An association rule is an expression of the form X ⇒ Y (σr, αr), where σr is the support of
X ∪ Y and αr is the confidence for the rule, defined as σ (X ∪ Y )/σ (X). The algorithm finds a recommendation for a user u by searching for the highest confidence
association rules, such that X ⊆ Pu is a subset of the user profile and Y contains
some item i that is unrated by u. If there is not enough support for a particular item,
that item will never appear in any frequent item set and will never be recommended.
This algorithm proves robust to the average attack. For attack sizes below 15%, only
0.1% of users are recommended an attacked item by the association rule algorithm,
compared to 80 − 100% of users for the kNN algorithm. The trade-off is that coverage of the association rule algorithm is reduced in comparison to kNN. However,
the algorithm is not robust against the segment attack.