DSybil: Optimal Sybil-Resistance for Recommendation Systems Haifeng Yu National University of Singapore Chenwei Shi National University of Singapore Michael Kaminsky Intel Research Pittsburgh Phillip B.
Download
Report
Transcript DSybil: Optimal Sybil-Resistance for Recommendation Systems Haifeng Yu National University of Singapore Chenwei Shi National University of Singapore Michael Kaminsky Intel Research Pittsburgh Phillip B.
DSybil: Optimal Sybil-Resistance
for Recommendation Systems
Haifeng Yu
National University of Singapore
Chenwei Shi
National University of Singapore
Michael Kaminsky
Intel Research Pittsburgh
Phillip B. Gibbons
Intel Research Pittsburgh
Feng Xiao
National University of Singapore
Attacks on Recommendation Systems
Netflix, Amazon, Razor,
Digg, YouTube, …
Attacker may cast
misleading votes
To be more effective
Bribe other users
Compromise other users
Ultimate form: Sybil
attack
Haifeng Yu, National University of Singapore
2
Sybil Attack
honest
automated
sybil attack
for $147
malicious
launch
sybil
attack
“Post at random intervals to make
it look like real people”
“Supports multiple random proxies
to make posts look like they came
from visitors across the world”
“Multithreaded comment blaster
with account rotation”
…
Haifeng Yu, National University of Singapore
3
Background: Defending Against Sybil Attack
Sybil defense widely considered challenging: >1000 papers
acknowledging sybil attack, most without having a solution
Tie identities to human beings based on credentials
(e.g., passport)
Privacy concerns, etc.
Resource challenges
Vulnerable to attacks from botnets
Social-network-based defense
SybilGuard [SIGCOMM’06], SybilLimit [Oakland’08], SybilInfer
[NDSS’09], SumUp [NSDI’09]
Better guarantees
Haifeng Yu, National University of Singapore
4
Rec Systems Are More Vulnerable
# sybil identities we can tolerate
(n identities total)
Byzantine
consensus
n/3
DHT
n/4
…
…
Recommendation n/500
systems
On an avg Digg
object, only 1 out
of every 500
honest users vote
n/500 sybil
identities are
sufficient to outvote the honest
voters
Haifeng Yu, National University of Singapore
5
Social-network-based Defenses Not
Sufficiently Strong For Rec Systems
Lower bound on all social-network-based
approaches
Applicable to SybilGuard, SybilLimit, SybilInfer,
SumUp, etc…
Compromising a degree-10 node creates 10 sybil
identities
To create n/500 sybil identities: Compromise 1 node
out of every 5000 honest nodes is sufficient
Haifeng Yu, National University of Singapore
6
Alternative: Leverage History and Trust
Ancient idea: Adjust “trust” to an identity based
on its historical behavior
Numerous heuristics proposed -- target a few
fixed attack strategies
No guarantees beyond the few strategies targeted
Attacker is intelligent and will adapt arms race
Haifeng Yu, National University of Singapore
7
Our Results
DSybil: A novel defense mechanism
Based on feedback and trust
Loss (# of bad recommendations) is provably
O( D log M ) even under worst-case attack
D : Dimension of the objects (< 10 in Digg)
M : Max # of sybil identities voting on each obj
We prove that DSybil’s loss is optimal
Experimental results (from 1-year Digg trace):
High-quality recommendation under potential sybil
attack (with optimal strategy) from million-node botnet
Haifeng Yu, National University of Singapore
8
Outline
Background and our contribution
Trust-based approaches – The obvious, the
subtle, and the challenge
Main component of DSybil: DSybil’s
recommendation algorithm
Experimental results
Haifeng Yu, National University of Singapore
9
Subtle Aspects of Using Trust
1. How to identify “correct” but “non-helpful” votes?
Vote for a good object that already has many votes -this additional vote is “non-helpful”
Sybil identities may gain trust for free
Determine the “contribution amount” by voting order
does not work – see paper
gain
trust for
my vote: this obj is good!
free
sybil
A good object
identity
Haifeng Yu, National University of Singapore
10
Subtle Aspects of Using Trust
2. How to assign initial trust to new identities?
Positive initial trust for all: Invites whitewashing
“Trial period of 5 votes” not effective
Cast 5 “correct” votes and then cheat
3. How exactly to grow trust?
Multiplicatively? Additively?
4. How exactly to make recommendations?
Pick obj with most votes? Probabilistically? How
about negative votes?
…..
Haifeng Yu, National University of Singapore
11
The Central Challenge
Numerous design choices -- fundamental
tension between
Giving trust to honest identities
Not giving trust to sybil identities casting “correct”
votes (who may cause damage later)
Impossible to explore all design alternatives
Our approach: Directly design an optimal algorithm
Needs to strike the optimal balance
Haifeng Yu, National University of Singapore
12
DSybil’s Key Insights
voting behavior of
honest users
Heavy-tail distribution
Exist very active users
who cast many votes
% of users
casting x votes
Key #1: Leverage typical
all log-scale
# votes cast (on
various objs)
Key #2: If user is already getting “enough help”,
then do not give out more trust
Enables us to strike an optimal balance
Haifeng Yu, National University of Singapore
13
System Model and Attack Model
Objects to be recommended are either good or
bad (e.g., Digg)
DSybil is personalized
Each user may have different subjective opinions
Different users may get different recommendations
From now on, always with respect to a user Alice
Run by either Alice or a central server
Haifeng Yu, National University of Singapore
14
System Model and Attack Model
2 good objs
2 bad objs
DSybil does not know which are good
Each round has a pool of objects
DSybil recommends one object for Alice to consume
Alice provide feedbacks after consumption
DSybil adjust trust based on feedback
See paper for generalizations…
Haifeng Yu, National University of Singapore
15
System Model and Attack Model
2 good objs
E
F
H
2 bad objs
G
H
Other identities have cast votes
DSybil only use positive votes
We prove that using negative votes will not help…
Each identity cast at most one vote/object
At most M (e.g. 1010) sybil identities voting on
each object
Haifeng Yu, National University of Singapore
16
DSybil Rec Algorithm: Classifying Objects
2 good objs
E : 0.2
F : 0.2
H: 0.2
total : 0.4
total : 0.2
2 bad objs
G: 0.2
total : 0.2
H: 0.2
total : 0.2
Reminder: Trust is always with respect to Alice
(how much Alice “trusts” the given identity)
Each identity starts with initial trust 0.2 -- Fix
later…
An object is overwhelming if total trust ≥ C
C = 1.0
Haifeng Yu, National University of Singapore
17
trustRounds
to E: 0.2 without
0.2
Overwhelming Objects
trust to F: 0.2
0.2objs
2 good
trust to G: 0.2
0.2
2 bad
objs
E : 0.2
F : 0.2
H: 0.2
total : 0.4
total : 0.2
G: 0.2
total : 0.2
H: 0.2
total : 0.2
1. Recommend: Uniformly random obj
Recommend
objafter
with largest
total trust would
2.
Adjust trust
feedback:
result
linear
logarithmic)
loss…
Ifinobj
bad,(instead
multiply of
trust
of voters by
0≤<1
If obj good, multiply trust of voters by > 1
Additive increase would result in linear
(instead of logarithmic) loss…
Haifeng Yu, National University of Singapore
18
Defining Guides and Dimension
Guides: Honest users with same/similar “opinion”
with Alice
Never/seldom votes for bad objects
Dimension: # of guides needed to “cover” large fraction
(e.g., 60%) of the good objects -- Called critical guides
X
X
Z
Y
W
DSybil does not know who are the guides
(critical
guides)
or what
the =dimension
Dimension
= 2; Critical
guides
{X, Y} or {X,isW}
Haifeng Yu, National University of Singapore
19
Key #1: Leverage Small Dimension
Dimension is typically small in practice – results
later…
Small dimension Will encounter critical guides
frequently when picking random objects
Trust to critical guides quickly grow to C
This will result in overwhelming objects…
Haifeng Yu, National University of Singapore
20
trust
to E: 1.0
1.0
Rounds
with
Overwhelming
trust to
H: 0.2obj
0.2
1 good
E : 1.0
H: 0.2
total : 1.2
Objects
2 bad objs
G: 0.2
H: 0.2
total : 0.4
F : 1.0
total : 1.0
1. Recommend: Arbitrary overwhelming obj
Will confiscate sufficient trust if object is bad…
2. Adjust trust after feedback:
If obj bad, multiply trust of the voters by 0 ≤ < 1
If obj good, no additional trust given out
Haifeng Yu, National University of Singapore
21
Key #2: Identify Whether Help is Sufficient
Consumes good overwhelming object = Alice
already has “sufficient help”
Thus do not give out additional trust
Prevent sybil identities from getting trust “for free”
May hurt honest identities (But remember this is
optimal…)
Haifeng Yu, National University of Singapore
22
Omitted Details
No “free” initial trust given out when Alice is
getting “sufficient help”
Proof for O( D log M ) loss even under worstcase attack
Optimality
Alternative designs/tweaks
Most will break optimality
Haifeng Yu, National University of Singapore
23
Results on Dimension
One-year Digg dataset with half-million users
Pessimistically assuming guides are only 2% of the honest users
-- see paper for other settings…
To cover 60% of good objs, need only 3 guides
Robustness:
Remove the previous 3 guides – 5 guides to cover 60%
Remove top 100 heaviest voters – 5 guides needed to cover 60%
See paper for more…
Relates to heavy-tail distribution of votes cast by
individual users – see paper
Exist very active users who cast many votes
Similar heavy-tail distribution observed in 4 other datasets
Haifeng Yu, National University of Singapore
24
Results on Loss (Based on Digg Dataset)
Attack capacity: Max 10 billion sybil voters on any obj
In Digg, avg # honest voters on each obj is only ~1,000
Fraction of bad recommendations (under worst-case
attack): 12%
Growing defense: 5% if user has used DSybil for a
week before attack starts
If attack starts at random point, applies to 51/52 = 98%
users
1-minute computational puzzle per week
10 billion identities needs a million-node botnet
Haifeng Yu, National University of Singapore
25
Conclusion
Defending against sybil attacks is challenging
It is even harder in the context of rec systems
DSybil: Provable and optimal O( D log M ) loss
Almost no previous approaches provide provable
guarantees against worst-case attack
DSybil key insights:
Leverage small dimension of the voting pattern
Carefully identify when help is already “sufficient”
Haifeng Yu, National University of Singapore
26
Haifeng Yu, National University of Singapore
27
Which
object to
pick?
Haifeng Yu, National University of Singapore
28
Central Question Answered by This Work
Can trust sufficiently diminish the influence of
sybil identities in recommendation systems?
Aim for provable guarantees under all attack strategies
(including worst-case attack from intelligent attacker)
Short answer: YES!
Haifeng Yu, National University of Singapore
29
Our Results
DSybil: A novel defense mechanism
Growing defense: If the user has used DSybil for
some time before the attack starts, loss will be even
smaller
Experimental results (from one-year trace of Digg):
High-quality recommendation even under potential
sybil attack (with optimal strategy) from a millionnode botnet
Haifeng Yu, National University of Singapore
30