## 3 Our Approach
### Trust-based Decision Framework  
We follow the definitions and beliefs of [PERSON] _et al._ in [PERSON] et al. (2016) concerning the distinction between trust and reputation. Trust is the degree of belief about the future behavior of other entities. Trust is subjective and it is based on past experiences. Reputation, on the other hand, is the global perception of an entity's behavior, and it is based on the trust that others hold on that entity. It is mostly objective and it has some influence in the evolution of trust in every node. To consider a data item to be valid we use two consistency tests. The data item is said to be s-consistent or consistent with the spatial redundancy if it is consistent with the data provided by the majority of sensors that provide measurements of the same variable. For example, for a presence event from a PIR detector to be valid, the majority of nodes monitoring the same area should also detect presence. In this evaluation every sensor is weighted with the trust value the receiving node has about the source node. A second way to discard bad data is to evaluate each data item against temporal data redundancy. Each routing element stores a limited set of previous values for each variable directly routed through itself. The data item is said to be t-consistent if the variation against previous data is normal for that variable. For example, if a temperature value changes drastically and it is not maintained during some time, maybe a routing element has been attacked. Both properties, s-consistency and t-consistency, are dependent on the variable being measured. To model trust and reputation in our agent system, every node in the network maintains a trust table with entries for every relevant neighbor node. When a new node is discovered, the initial trust value is 0. Whenever a new message containing a new measurement of the external variable v arrives, trust on node i is recalculated as follows:  
\[d_{v}(t)=A_{v}(\{\tau_{i}(t-1),d_{vi}(t)\})\] \[\tau_{i}(t)=T(\tau_{i}(t-1),d_{v}(t),\overline{H_{vi}})\]  
where \(d_{v}(t)\) is the value of the variable \(v\) built from neighbor measures and the previous trust value (\(\tau_{i}(t-1)\)). \(\tau_{i}(t)\) symbolize the trust value of the evaluating node on node \(i\). \(\overline{H_{vi}}\) represents all the data values of the variable \(v\) provided by node \(i\) that are stored in this node (history is usually truncated to reduce memory requirements). \(A_{v}\) is an aggregation function that depends on the variable being measured, and it does not take into account data coming from a node with negative or zero trust value. \(T\) is also an aggregation function with these properties:  
* If \(\tau_{i}(t-1)\) is negative, the data item is discarded and no further processing is done for this message (repeated inconsistencies may lead to negative values of trust). * If the new data element \(d_{vi}(t)\) is s-inconsistent and t-inconsistent, it is stored in the local history (discarding the oldest value), but it is not taken into account for trust recalculation. * If it is s-inconsistent with other sensors' data but t-consistent with previous values of the same sensor, trust on sensor i decreases. * If it is s-consistent and t-consistent and current trust is positive, trust increases. As can be seen, trust computation condenses historical information, and therefore it is bad, as we lose redundancy. On the other hand, resources are tightly constrained and we have to reduce storage requirements to a minimum. To avoid some attacks, temporal disappearance means loss of positive trust (not negative). Whenever it appears again, it will get a 0 trust value. There is a second method to feed trust values back from redundancy analysis: reputation messages from the servers. From time to time, nodes communicate their trust tables to the servers. This is done at the routing level by adding this trust information to messages that are being sent to the same destination.