A Formal Model to Analyze and Compare Reputation Systems for Distributed Networks

A primary difficulty in preventing malicious activity in distributed networks is that nodes do not have fixed classi fications. A node’s behavior can fluctuate between generating wa nted and unwanted interactions temporally or vary depending on t he action involved. To help alleviate this reputation systemshave been proposed. However, a formal model which encompasses the prior systems and allows direct comparison has not been forthcoming. We introduce a formal model which encapsulates many prior systems and allows one to determine many importan t properties of the systems. For example, we are able to derive the necessary and sufficient conditions for a reputation systemto bound the successful unwanted interactions a node can gener ate in its lifetime. We then show that by bounding the unwanted interactions yield a system which maintains anO(1) expected unwanted interactions received per node. To our knowledge t hese techniques have not been previously shown. We, also, determ ine the probability of success for a generic routing algorithm.With these tools, we compare the effectiveness of some represent ative deterministic and probabilistic reputation systems. We then show how to modify these prior systems to improve their effectiveness, and, when possible, how they can be changed to bound the successful unwanted interactions. Our evaluations of the p rior trust and routing schemes match our analysis. Our work has many applications, e.g. preventing spams in a social or dist ributed networks, or in designing a system which is secure against De nial of Service (DoS) attacks. I. I NTRODUCTION & RELATED WORK A primary difficulty in preventing malicious activity in distributed networks is that nodes do not have a fixed classifications. A node’s behavior may fluctuate temporally, or may vary depending on the action involved. For example, a node may become infected with a virus and, possibly, even be unaware of the infection. A node which initiates wanted interactions might not be willing to forward message for oth er nodes. Reputation systems have been proposed to provide security and robustness in dynamic distributed networks. There have been a lot of work on reputation systems, some focus on a particular component of reputation systems [1], [ 2], [3], some build more complete reputation systems, c.f. [4], [5], [6]. However, a formal model which encapsulates these systems has been lacking, and so analysis has been limited to the singular system. The lack of a model makes it very difficul t to determine which reputation system component should be used (or even what the components are). There is also a lack of formal methods to determine the bounds of these systems. This makes it difficult to determine the benefits and limitati ons of various systems. In this paper, we introduce a formal model which encapsulates many prior systems. This formal model identifies the core components in reputation systems and details the requirements of each. Using the formal model we are able to directly compare the prior systems, and to derive the bounds of various schemes. Importantly, our formal model separate tr ust structures for different actions, which is essential for de signing robust systems. We derive the requirements for a reputation systems to bound the successful unwanted interactions a node can generate in its lifetime. Counter-intuitively, we show that a s ystem which uses a deterministic dropping mechanism cannot provide a bound, and that systems utilizing a probabilistic dropping mechanism can. We also show how to modify some prior reputation systems to achieve bounding. Importantly , once the unwanted interactions are bounded, the expected number of unwanted interactions received per node is no longer linear with respect to the fraction of malicious node s in the network, instead it isO(1). To our knowledge, these bounding conditions and insights have not been shown before . We are also able to determine a generic probability of success formula forany routing scheme for distributed reputation systems. We show two examples of how to apply our formula to derive the probability of successful routing; we conside r a shortest path algorithm used by [4] and a routing that combin es trust with distance and degree [6]. We apply our formal model to compare some representative prior systems, notably: 1) a Credit Based (CR) system [4] (deterministic), 2) the Counter-Based (CB) system [1], [2] (probabilistic), 3) the Forgetting Factor (FF) system [3] ( probabilistic), and 4) our KarmaNet (KN) system [6] (probabilist ic). Surprisingly, we find that a system introduced in [7], which utilized a remembering factor, collapses to the FF system [3 ]. We derive many important system properties, and determine which can bound the successful unwanted interactions a node can generate in its lifetime. We then modify the prior system s to improve their ability to effectively operate, and for tho se that can, we give them the ability to bound the successful unwanted interactions. We also show how to modify them to remove the incentives for whitewashing. Finally, we perform extensive simulations to compare the benefits and limitations of four representative reputation systems. In all cases, the simulation matches our theory and predicted results. We show that CR cannot bound, but adapts reasonably well to changes in behavior; the CB system is not ble to dynamically adapt to changes in a node’s behavior; the FF system can never completely cutoff malicious nodes; and that KN can adapt to dynamic network well, modified CB and full version of KN can provide bounds on unwanted interactions a node can generate and receive. II. T HE FORMAL MODEL In this section we introduce a formal model for a generic reputation systems which encompasses most prior distribut ed reputation systems. First, we give an overview of the underlying components and then we describe each component in detail. We show the components of a generic reputation system for our formal model in Figure 1. The dataflow is drawn using dashed lines, and the entity relationship is drawn with soli d lines. Let G = (V,E) be the graph used for communication, N = |V| be the size of the graph, and s, . , v, u, . , w be a communication path with the source ( s) attempting to communicate with the destination ( w). u makes use of a reputation system described in Figure 1 in order to decide if s should be allowed to communicate with w. Figure 1 is portrayed fromu’s perspective. Note that v need not be distinct from s. Furthermore,u does not need to know the identity of the source ( s), only the prior hop. This implies that the model can be used in anonymous networks. We will maintain the notationsu, v, s, andw as in Figure 1 throughout the paper. We use the terminteraction to denote a communication attempt between a source and a destination. An unwanted interaction is a communication that was successfully propagated to the destination, but was undesired by the recipien t. In contrast, awanted interactionis desired by the recipient. We use the termoutcome(o) to denote the quality of the interaction. Theoutcome propagationis a feedback mechanism to the reputation system. If the interaction fails, i.e . was disallowed by some node on the communication path, then the source can generate an outcome to inform the communication path of the failure. Otherwise, the interaction succeeded, an the destination can generate the outcome to inform the rever s communication path. There are two inputs to this system: interaction and outcome. At a minimum the interaction must specify the previous hop (v), the destination ( w), and the action ( a). Action denotes the activity engaged by the previous hop ( v); for example, the previous hop could beinitiating an interaction orforwarding an interaction for another node. TMS Tracking Strategy Recommendation Scheme