## 3 Our Approach
### Dynamic Attestation Based on the Node's Risk Level  
In LRMA, the verifier adopts an adaptive attestation scheme to adjust the rate for conducting attestations based on the risk level on each node. **Definition 1**. : _The risk level of each node is defined as the sum of its attestation failures in recent \(n_{r}\) slots._  
According to Definition 1, the risk value of node \(i\) at the \(p\)-th slot is defined as follows:  
\[R_{i}=\left\{ \begin{array}{ll}\sum\limits_{i=1}^{n_{r}}F_{i,p-i+1}&(p>n_{r}) \\ \sum\limits_{i=1}^{p}F_{i,p-i+1}&(p\leq n_{r})\end{array} \right. \tag{1}\]  
where \(F_{i,p}\) is the number of attestation failures on node \(i\) at the \(p\)-th slot. In our scheme, the risk value of each node is evaluated by a controller. Every attestation failure will lead to an increased risk value. A larger risk value for nodes means a higher probability that nodes are compromised. The risk value of each node will be dynamically updated based on the freshly-updated information. The attestation frequency performed by the verifier depends on the risk value of nodes. The node with a higher risk value (_i.e._, the node has a higher probability of being compromised) will have a higher rate to be attested, while the node with a lower risk value will have a lower rate to be attested. In this way, the total number of attestations can be reduced. Determining the rate for carrying out the attestations on remote nodes consists of the following steps:  
* Step 1: initialization: Before the network is deployed, the verifier will initialize the risk value on each node. The risk value on each node is set to zero before the first attestation (_i.e._, the node has not been compromised). Therefore, we have: \[R_{i}=0,\qquad i=1,\ldots,N\] (2) where \(R_{i}\) means the risk value of node \(i\). * Step 2: attestation interval generation: The verifier validates nodes with different attestation rates, which are determined by the risk values of the nodes. It is worth noting that the attestation rate is proportional to the security risk of nodes. Therefore, nodes with a high risk value will be verified more frequently by using a higher rate. Then, the \(p\)-th attestation interval on node \(i\) can be represented as follows: \[T_{i}^{p}=\frac{R_{i}^{p}+\varphi}{\bar{R}^{p}+\varphi}\cdot T\cdot\beta\qquad i =1,\ldots,N\] (3) where \(T\) is the unit time, \(N\) is the number of nodes in the network, \(R_{i}^{p}\) is the risk value of node \(i\) at the \(p\)-th attestation interval, \(\bar{R}^{p}\) is the average risk value of all nodes at the \(p\)-th attestation interval, \(\beta\) is the scaling factor for the attestation interval and \(\varphi\) is a constant that controls the updated step or convergence speed of the attestation interval \(T_{i}^{p}\). Then, the attestation time is selected randomly in the \(p\)-th interval by, \[t_{i}=\sum\limits_{j=1}^{p-1}T_{i}^{j}+t_{random},\qquad t_{random}\in[0,T_{i} ^{p}]\] (4)where \(t_{random}\) is the random time in period \(T_{i}\) and \(T_{i}^{p}\) is the \(p\)-th attestation interval on node \(i\). * Step 3: update: After each attestation process, the verifier will update the risk value of the node based on the attestation result. If the attestation fails, the counter of attestation failures \(F_{i,p}\) will increase by one, as well as the risk value \(R_{i}\). After a time slot, the risk value will be updated, as well. The risk value will be updated based on summarizing the counters of attestation failures in recent \(n_{r}\) slots.