# H2O: Secure Interactions in IoT via Behavioral Fingerprinting
## 4 Behavioral Fingerprint for Reliability
### Object-to-Object Interaction  
In this section, we describe how the reliability of an object is assessed by leveraging object-to-object interactions. In order to detail all the steps of this part of our approach, we preliminary define a redundancy parameter \(r\), that is a positive integer representing a minimum consensus level to suitably estimate the reliability of an object. Moreover, given the set of neighbors of \(n_{i}\), namely \(\Gamma(n_{i})\), we denote by \(R(n_{i})\subseteq\Gamma(n_{i})\) the set of nodes which have been tested by \(n_{i}\) and whose identity is monitored (either directly or through delegation strategies) by comparing the current interactions with their behavioral fingerprints. As stated before, we assume that there exists a _safe starting phase_ in which neither fraudulent access nor physical damage to legitimate nodes can be performed. During this phase the machine learning algorithms, described in Section 4, can be trained to produce the fingerprints for each objects. In a subsequent non-safe phase, objects can leverage such models referring to other nodes which they usually communicate with. Periodically, a node \(n_{i}\) can test one of its neighbors (whose behavior has been modeled during the _safe starting phase_), to assess whether it has been corrupted or hacked. Let us denote with \(n_{j}\in\Gamma(n_{i})\) the node to be tested. To do this, \(n_{i}\) exploits the behavioral fingerprinting model providing data extracted from a set of transactions done with \(n_{j}\), as input. The output of the model is a normalized fingerprint rate, represented as \(fr(n_{i},n_{j})\), whose values range in \((0,1)\). In order to assume \(n_{j}\) reliable, the fingerprint rate must be greater than a give assurance threshold \(0<1-\epsilon\leq 1\); in other words, the fingerprint rate should be such that \(1-\epsilon\leq fr(n_{i},n_{j})\leq 1\) to consider \(n_{j}\) still reliable. After this check, \(n_{i}\) stores \(fr(n_{i},n_{j})\) in a internal table for future transactions. Now, let us suppose that the node \(n_{j}\) wants to interact with \(n_{z}\), but it has not met \(n_{z}\) during the _safe starting phase_. In this case, no information about the reliability of \(n_{z}\) is available, directly. To address this situation, our approach adopts a strategy based on the consensus of a suitable portion of the neighbors of \(n_{j}\) to compute a derived fingerprint rate. In particular, let \(\Delta(n_{j},n_{z})=\{n_{x}\mid n_{x}\in\Gamma(n_{j})\cap\Gamma(n_{z})\wedge n _{z}\in R(n_{x})\}\) be the set of objects belonging to both the neighbors of \(n_{j}\) and \(n_{z}\), which have computed a normalized fingerprint rate for \(n_{z}\). The derived fingerprint rate for \(n_{z}\) can be computed by \(n_{j}\) as follows:  
\[dr(n_{j},n_{z})=\frac{\sum_{n_{x}\in\Delta(n_{j},n_{z})}fr(n_{x},n_{z})}{ \left|\Delta(n_{j},n_{z})\right|} \tag{3}\]  
At this point, \(n_{z}\) can be considered reliable by \(n_{j}\) if the following conditions are true: _(i)_\(dr(n_{j},n_{z})\geq 1-\epsilon\) and _(ii)_\(\left|\Delta(n_{j},n_{z})\right|\geq r\). Therefore generalizing the above reasoning, in order to be reliable for \(n_{j}\), a node \(n_{z}\) has to match one of the following set of conditions:  
* _(i)_\(n_{z}\in R(n_{j})\) and _(ii)_\(fr(n_{i},n_{z})\geq 1-\epsilon\); that is, \(n_{j}\) holds a fingerprint model of \(n_{z}\) and the normalized fingerprint rate is distant from the maximum value no more than a certain threshold \(\epsilon\);
* _(i)_\(\left|\Delta(n_{j},n_{z})\right|\geq r\) and _(ii)_\(dr(n_{j},n_{z})\geq 1-\epsilon\), that is at least \(r\) nodes in \(\Gamma(n_{j})\) should have tested \(n_{z}\) and expressed a positive check (greater than or equal to \(1-\epsilon\)). We call this last property \(r\)-redundancy. It is based on the assumption that multiple confirmation of the reliability of a node can be considered sufficient to trust the behavior of that node [19]. Obviously, the higher the value of \(r\), the higher the reliability about the object behavior.