# Modeling Dynamic Trust and Risk Evaluation Based on High-Order Moments

Authors: Yan Gao; Zhiyong Dai; Wenfen Liu
Journal: Mathematical Problems in Engineering
 (2015)

---

## Abstract

This paper proposes a dynamic trust and risk evaluation model based on high-order moments. The credibility of an entity is measured with trust degree and risk value comprehensively. Firstly, considering the dynamic and time decay characters of trust, a time attenuation function is defined, and direct trust is further expressed. Subsequently, in order to improve the accuracy of feedback trust, a filter mechanism is constructed to eliminate the false feedback, combining coefficient of skewness with hypothesis test. More importantly, the weights of direct trust and feedback trust are derived subjectively and adaptively with the moments and frequency of direct interactions. Furthermore, risk is evaluated with direct risk and feedback risk, which are obtained by mainly using coefficient of variation and coefficient of kurtosis. Risk value can be used to measure the stability of providing services. Simulation results show that the proposed model not only has high accuracy, but also resists effectively collusive attacks and strategic malicious behaviors.


---

## Body

## 1. Introduction

With the rapid development of network technology, peer-to-peer networks have been widely applied in a variety of distributed application systems, such as P2P file sharing, electronic commerce [1], and cloud computing, which make Internet applications simpler and more efficient. However, to guarantee the security and credibility of these network application environments is very difficult due to the openness, anonymity, and high dynamic. Therefore, there are very serious technical challenges to provide the safe and reliable services. Trust management has become a kind of effective technology of “soft security” in solving the existing network security issues related to trust [2].In recent years, trust relationships under different application conditions have been analyzed [3], and many scholars have established trust models to study dynamical trust relationship with different mathematical methods and tools [4], which typically have EigenTrust [5], PeerTrust [6], PowerTrust [7], GossipTrust [8], and so on.At present, the weighted average method is used to quantify trust in most of the literatures. Li et al. [9] presented trust management in large-scale P2P networks, where direct trust and feedback trust were computed considering time decay and distance attenuation, respectively, and the corresponding weights can be adjusted adaptively. On this basis, [10] analyzed five factors related to trust relationship, history, availability, feedback, motivation, and risk, and constructed a trust model based on the idea of multisource information fusion, in which their weights were assigned by WMA-OWA algorithms. Xue et al. [11] put forward a robust reputation system for structured P2P networks; the reputation managers were only responsible for local information, rather than global reputation, which can resist effectively collusion attack. In addition, by distinguishing the abilities of providing service and recommending, it makes trust quantification more accurate and reliable.Except for the weighted average method, trust models are presented using probability and statistical methods. Wang et al. [12] proposed a robust linear Markov (RLM) reputation model with Kalman aggregation method through prediction variance, which is against malicious attacks by using EM algorithm to calibrate the dynamic parameters autonomously. Ayday and Fekri [13] attribute the reputation management problem to an inference problem of calculating the marginal distribution and present a centralized iterative method using the factor graph and belief propagation. Considering that trust is a dynamic process related to the context, Liu and Datta [14] established a context aware trust model using hidden Markov chain, in which the interaction results are the states of the Markov chain and the characteristics of context information are viewed as the observation sequence. The experiment shows that this model has lower positive false and negative false rates.Although much new progress has been made in the existing researches, there are still some problems, which mainly are reflected in the following respects. First, dynamic is the biggest challenge in the evaluation and forecasting of trust relationship, due to the fact that trust relationship changes dynamically over time and has the time attenuation character in which interaction information further from current time has the weaker influence to trust relationship. Therefore, how to depict the time decay precisely and improve the accuracy and dynamic adaptation is a very difficult job. Secondly, false feedback filter is prerequisite to guarantee the correctness of feedback trust. At present, attacks against trust systems emerge endlessly in [15, 16]; malicious entities may provide false interaction information about a target entity to the requestor. The existing models only identify and defend simple attacks and fraud but lack protection mechanisms against complex attacks such as collusion, spying, and strategic attacks, which leads to the poor security and robustness. Further, in constructing quantitative models with weighted average methods, it is key to set the corresponding weight of direct trust and feedback trust. The existing setting methods are with strong subjectivity, less flexibility, and difficulty in being adjusted dynamically, which leads to lack adaptability and affect the trust decision ultimately. Lastly, risk evaluation is viewed as an objective preference to trust computation. The researches on trust at present often ignore the impact of risk, which makes trust computation not fully reflect the credibility of the entity behavior.According to the above problems, this paper models behavior trust and risk evaluation using high-order moments. First of all, a time attenuation function is defined to characterize dynamic and time decay of trust more flexibly. Based on this, the direct trust is computed combined with the moments and frequency of direct interactions between entities. Subsequently, before calculating feedback trust, feedback interaction information is filtered through establishing a statistical model with standard coefficient of skewness and hypothesis testing, eliminating the false feedback. Then the feedback trust is calculated with the time attenuation function. Next, according to the basic principles, considering the number and moments of direct interactions, we give a weight setting method which is adaptive and dynamically adjusted as the interaction continues. On this basis, in order to fully study its ability to provide service, the stability of target entity behavior is measured by analyzing the discrete and sharp degree with coefficient of variation and standard coefficient of kurtosis of two samples: direct interactions and real feedback information. Further, risk evaluation model is given with the weighted average method. To measure the ability of the target entity, the values of trust and risk evaluation are both taken into account so as to make a trust decision.The remainder of this paper is organized as follows. Section2 presents a trust quantitative model through computing direct trust, feedback trust, and their own weight, respectively. A risk evaluation model is established in Section 3 by measuring direct risk and feedback risk comprehensively. Section 4 discusses the accuracy, dynamic, and robustness of the proposed model under several attacks and compares it with related work in simulation experiments. Finally, the summary analysis carries on.


## 2. A Quantitative Model for Trust

This section mainly gives the computational expressions of direct trust and feedback trust, and then total trust is ultimately quantified with the weighted average method. Set entityi and j as any service requester and service provider, respectively. Denote Ti,jt to be the total trust of entity i for j at the moment t; then it can be calculated as follows:
(1)Ti,jt=ω1×DTi,jt+ω2×FTi,jt,
where DTi,jt represents the direct trust computed with the direct interactions between the two entities and FTi,jt is the feedback trust obtained through the interactions between other entities and entity j. ω1,ω2∈0,1 is the weight of DTi,jt and FTi,jt, respectively, and ω1+ω2=1. The following are the computation methods of DTi,jt, FTi,jt, and ω1. For the sake of simplicity, every (t) in (1) is omitted hereinafter.As we know, trust has the characteristics of time decay; that is, the interactions results farther from the current time have the weaker influence on the current trust value. Consequently, those interactions only in a certain period close to the current time are necessary to be analyzed so as to obtain the current trust degree. GivenΔt0<Δt≤t and l,l*=t/Δt, the time range in which these interactions are considered is specified as
(2)uΔt,t=l*Δt,t⋃∑h=ul*-1hΔt,h+1Δt,
where u=max⁡l*-l,0. For convenience, set
(3)Δth=hΔt,u≤h≤l*t,h=l*+1,
and Λh=Δth,Δth+1, u≤h≤l*.


### 2.1. Direct Trust Computing

For anyu≤h≤l*, assume that there were Nh interactions in the interval Λh between entity i and j, denoted by
(4)Ωi,jh=rd,h1,rd,h2,…,rd,hNh,
where rd,hc∈0,1 is the satisfaction degree of entity i at the cth interaction, 1≤c≤Nh. Then
(5)DTi,jh=1Ωi,jh∑c=1Nhrd,hc.Based on (5), DTi,j can be represented as DTi,j=fDTi,ju,…,DTi,jl*, where f· is a function with l*-u+1 variables. Accordingly, the key is to determine f· in order to obtain DTi,j. Considering the dynamic and time decay of trust, a time attenuation function is first introduced before f· is given.Definition 1 (time attenuation function).
Consider(6)αδt*=12+1et-t*δ+1,0≤t*<t,
where the parameter δ>0 is used to adjust the attenuation speed.Through analysis, it is known that1/2<αδt*≤1 and αδt* is a strictly monotonously increasing function of t*. The function αδ is specified in Figure 1.Figure 1
Time attenuation functionαδ.From Figure1, the rates of descending differ with different δ. As a result, the relative influence of interactions in each interval Λh is distinguished. Additionally, the selection that αδt*>0.5 is adopted mainly for the purpose of meeting the requirements of weight setting presented in Section 2.3.Combining the direct interactionsDi,jh,u≤h≤l* with time attenuation function (6), the computation expression for direct trust DTi,j is as follows.Definition 2 (direct trustDTi,j).
For anyu≤h≤l*, define fΛh,DTi,jh=αδΔth+1·DTi,jh/∑h=ul*αδΔth+1ρ, ρ>1, and then
(7)DTi,j=∑h=ul*fΛh,DTi,jh=∑h=ul*αδΔth+1·DTi,jh∑h=ul*αδΔth+1ρ.
SetDTi,jh=0.5 if Ωi,jh=ϕ. For any u≤h≤l*, due to αδΔth+1<αδΔth+1ρ and DTi,jh∈0,1, 0≤DTi,j≤1. Specially, if ρ=1 in (7), it is similar to the expression for direct trust in [9]. It is worth mentioning that an entity is able to choose the appropriate parameter ρ according to its own situation, which more reflects the personalization character of trust.


### 2.2. Feedback Trust Computing

After entityi receives the interactions about j recommended from several entities, it is necessary to filter this information, eliminate the false interaction information, and retain the true ones, which is a precondition to correctly compute the feedback trust FTi,j. The storage and distribution of interaction information, filter mechanism, and feedback trust are introduced in the following.


#### 2.2.1. Storage and Distribution of Feedback Information

This model adopts the storage and distribution means based on DHT for the interaction information of any entity. In order to more effectively resist malicious attacks, overlay network is used similar to DHTON presented in [11]; that is, all the interactions about j are stored in several managers and each manager is responsible only for storage and distribution of local interactions.The Chord network is first described. In a Chord network, every entity is represented by aW-bit identifier and all entities are lined in the Chord circle in the clockwise direction. Set C=v:0≤v<2W and denote Cexist by entity set in the Chord circle; then Cexist⊂C. We might set Cexist=v1,v2,…,vCexist, 0≤v1<v2<⋯<vCexist<2W. Hence, there exists z1≤z≤Cexist to make j=vz and C except that j is divided into W subsets:
(8)Ck=j+2k-1mod⁡2W,…,j+2k-1mod⁡2W,1≤k≤W.
For any 1≤k≤W, define
(9)Cexistk=Cexist∩Ck.
When Cexistk≠ϕ, the entity in the front in the clockwise direction is just the finger entity of Cexistk, which is responsible for the storage and distribution of interaction information between j and all the entities in Cexistk. Set U=k:1≤k≤W,Cexistk≠ϕ and η=η1,η2,…,ηU, ητ∈U, η1<η2<⋯<ηU, 1≤τ≤U; then the set of all managers of entity j is VΣ=vz+1,vz+1+Σ1,…,vz+1+ΣU-1, where Σm=∑τ=1mCexistητ. Entity i needs to send requests to the entities in VΣ to obtain the interaction information about j.There is not distinction between direct trust and feedback trust in the algorithm of computing trust in [11] where the direct interactions between i andj are not separated from all of the feedback information. However, considering that their own experience is often more inclined in the trust relationship, it is necessary to differentiate the two. For 1≤τ≤U and Σ0=0, denote Ωτ by the interaction information from the manager vz+1+Στ-1; then the set of interactions used to compute feedback trust is ΩF=⋃τ=1UΩτ∖Ωi, where Ωi is the interactions between i and j.


#### 2.2.2. False Feedback Filter

According to the time instant of each interaction,ΩF is divided into l*-u+1 groups. For any u≤h≤l*, denote
(10)ΩFh=rF,h1,rF,h2,…,rF,hBh,
where Bh and rF,hb are the number of feedback interactions and satisfaction degree at the bth interaction in the interval Λh, respectively, 1≤b≤Bh. Therefore, ΩF=⋃h=ul*ΩFh.In each time intervalΛh, if the ability of providing service of entity j is regarded as a random variable Yh whose value range is 0,1, the feedback interactions ΩFh are just the samples. Assume the providing service ability of entityj is stable in each interval, and then the samples should approximately obey the normal distribution without the presence of attacks. If the attacks want to affect the computing result of trust degree on the whole, it is vital for malicious entities to return most false interactions to the requester. This false feedback is over high (collusive boost) or too low (collusive defaming), and its corresponding interaction moments should be close to the present moment. Through the above analysis, it can be judged that when there exists collusive defaming (boost) attack, the shape characteristics of the samples will be clearly to the left (right).In order to filter the false feedback effectively, standard coefficient of skewness and hypothesis testing are used to analyze the feedback information. In statistics, coefficient of skewness is a measurement to reflect the skewness condition of sample distribution, including the degree and direction of skewness.Definition 3 (standard coefficient of skewness [17]).
Supposex1,x2,…,xn are the samples from population X and x-=1/n∑l=1nxl and s2=1/n-1∑l=1nxl-x-2 are the sample mean and variance, respectively; then
(11)Sk=16n∑l=1nxl-x-s3
is the standard coefficient of skewness. Sk=0 states that the sample distribution is symmetrical; Sk>0 means that the distribution has a positive skewness; otherwise, the sample distribution has a negative skewness. The larger the absolute value of Sk, the higher the degree of skewness.The false feedback filter method is given using Definition3 and hypothesis testing in the following. Based on Definition 3, the standard coefficient of skewness of the samples rF,hb,1≤b≤Bh is computed as
(12)Skh=16Βh∑b=1BhrF,hb-r-F,hsF,h3,
where r-F,h=1/Bh∑b=1BhrF,hb, sF,h2=1/Bh-1∑b=1BhrF,hb-r-F,h2.Set a threshold valueΓ1>0. After Skh is obtained by (12), if Skh>Γ1, it can be judged that there is false feedback in the samples. Moreover, for any 1≤b≤Bh, we get the following.Case 1.
It is whenSkh<-Γ1,rF,hb is regarded as false feedback and will be eliminated from ΩFh if and only if rF,hb∈0,r-F,h-sF,h.Case 2.
WhenSkh>Γ1, if rF,hb∈r-F,h+sF,h,1, the feedback rF,hb will be eliminated from ΩFh.


#### 2.2.3. Feedback Trust

For anyu≤h≤l*, after the false data in each set ΩFh are eliminated, denote ΩHFh by all of the honest feedback, and then ΩHFh⊆ΩFh. The following is the computing expression for feedback trust.Definition 4 (feedback trustFTi,j).
Using the real feedback interactionsΩHFh,u≤h≤l* and time attenuation function (6), the computing expression for FTi,j is
(13)FTi,j=∑h=ul*αδΔth+1FTi,jh∑h=ul*αδΔth+1ρ,
where FTi,jh=1/ΩHFh∑r∈ΩHFhr.


### 2.3. Weight Setting Method

To calculate the total trust with weighted average method, the weight setting needs to follow the following two principles at least:(i)
the weight of direct trust should be not less than the weight of feedback trust; that is to say,ω1≥0.5;(ii)
lowering the weightω2 properly can reduce the negative impact of malicious feedback and improve the accuracy so as to obtain good performance [18].Based on the above principles, a theorem is first proven before the computing method of the weights is derived.Theorem 5.
For anyu≤h≤l*, set gh=∑h=ul*αδΔth+1/∑h=ul*αδΔth+1ρ, ρ>1; then gh is a strictly monotonously increasing function of variable h and 0.5<gh<1.Proof.
For anyu≤h≤l*, αh is short for αδΔth+1 for convenience.
For anyu≤h≤l*, 1/2<αh<1, and 1/2<αu<⋯<αl*<1 from Definition 1,
(14)gh=∑h=ul*αh∑h=ul*αhρ>1l*-u+1∑h=ul*αh>0.5.
And, for any ρ>1, αh<αhρ; hence,
(15)gh=∑h=ul*αh∑h=ul*αhρ<∑h=ul*αh∑h=ul*αh=1.
In addition, for any u+1≤h≤l*,
(16)gh-gh-1=∑k=uhαk∑k=uhαkρ-∑k=uh-1αk∑k=uh-1αkρ=∑k=uh-1αk+αh∑k=uh-1αkρ+αhρ-∑k=uh-1αk∑k=uh-1αkρ=∑k=uh-1αk+αh×∑k=uh-1αkρ-∑k=uh-1αk×∑k=uh-1αkρ+αhρ∑k=uhαkρ×∑k=uh-1αkρ=αh×∑k=uh-1αkρ-αhρ×∑k=uh-1αk∑k=uhαkρ×∑k=uh-1αkρ=αhρ×∑k=uh-1αh1-1/ρ×αkρ-∑k=uh-1αkρ×αk1-1/ρ∑k=uhαkρ×∑k=uh-1αkρ=αhρ×∑k=uh-1αkρ×αh1-1/ρ-αk1-1/ρ∑k=uhαkρ×∑k=uh-1αkρ>0.
For anyu≤k≤h-1,αh>αk, that is,  αh1-1/ρ-αk1-1/ρ>0, gh-gh-1>0. Therefore, gh is a strictly monotonously increasing function of variable h.Based on the principles of the weight setting, combining the conclusion of Theorem5 with the moments and frequency of the direct interactions, the weights w1 and w2 are derived as follows:
(17)ω1=∑h=ul*αδΔth+1∑h=ul*αδΔth+1ρ,ω2=1-∑h=ul*αδΔth+1∑h=ul*αδΔth+1ρ.From Theorem5, ω1>0.5 and ω1 is significantly greater than 0.5 with the increase in the direct interactions; that is, ω2 is reduced as much as possible. Particularly, the weights can be updated as the interaction continues, and then they can be adjusted dynamically and adaptively.To sum up, substituting (7), (13), and (17) into (1), we can obtain the total trust:
(18)Ti,j=ω1×DTi,j+ω2×FTi,j=∑h=ul*αδΔth+1∑h=ul*αδΔth+1ρ×∑h=ul*αδΔth+1·DTi,jh∑h=ul*αδΔth+1ρ+1-∑h=ul*αδΔth+1∑h=ul*αδΔth+1ρ×∑h=ul*αδΔth+1FTi,jh∑h=ul*αδΔth+1ρ.


## 2.1. Direct Trust Computing

For anyu≤h≤l*, assume that there were Nh interactions in the interval Λh between entity i and j, denoted by
(4)Ωi,jh=rd,h1,rd,h2,…,rd,hNh,
where rd,hc∈0,1 is the satisfaction degree of entity i at the cth interaction, 1≤c≤Nh. Then
(5)DTi,jh=1Ωi,jh∑c=1Nhrd,hc.Based on (5), DTi,j can be represented as DTi,j=fDTi,ju,…,DTi,jl*, where f· is a function with l*-u+1 variables. Accordingly, the key is to determine f· in order to obtain DTi,j. Considering the dynamic and time decay of trust, a time attenuation function is first introduced before f· is given.Definition 1 (time attenuation function).
Consider(6)αδt*=12+1et-t*δ+1,0≤t*<t,
where the parameter δ>0 is used to adjust the attenuation speed.Through analysis, it is known that1/2<αδt*≤1 and αδt* is a strictly monotonously increasing function of t*. The function αδ is specified in Figure 1.Figure 1
Time attenuation functionαδ.From Figure1, the rates of descending differ with different δ. As a result, the relative influence of interactions in each interval Λh is distinguished. Additionally, the selection that αδt*>0.5 is adopted mainly for the purpose of meeting the requirements of weight setting presented in Section 2.3.Combining the direct interactionsDi,jh,u≤h≤l* with time attenuation function (6), the computation expression for direct trust DTi,j is as follows.Definition 2 (direct trustDTi,j).
For anyu≤h≤l*, define fΛh,DTi,jh=αδΔth+1·DTi,jh/∑h=ul*αδΔth+1ρ, ρ>1, and then
(7)DTi,j=∑h=ul*fΛh,DTi,jh=∑h=ul*αδΔth+1·DTi,jh∑h=ul*αδΔth+1ρ.
SetDTi,jh=0.5 if Ωi,jh=ϕ. For any u≤h≤l*, due to αδΔth+1<αδΔth+1ρ and DTi,jh∈0,1, 0≤DTi,j≤1. Specially, if ρ=1 in (7), it is similar to the expression for direct trust in [9]. It is worth mentioning that an entity is able to choose the appropriate parameter ρ according to its own situation, which more reflects the personalization character of trust.


## 2.2. Feedback Trust Computing

After entityi receives the interactions about j recommended from several entities, it is necessary to filter this information, eliminate the false interaction information, and retain the true ones, which is a precondition to correctly compute the feedback trust FTi,j. The storage and distribution of interaction information, filter mechanism, and feedback trust are introduced in the following.


### 2.2.1. Storage and Distribution of Feedback Information

This model adopts the storage and distribution means based on DHT for the interaction information of any entity. In order to more effectively resist malicious attacks, overlay network is used similar to DHTON presented in [11]; that is, all the interactions about j are stored in several managers and each manager is responsible only for storage and distribution of local interactions.The Chord network is first described. In a Chord network, every entity is represented by aW-bit identifier and all entities are lined in the Chord circle in the clockwise direction. Set C=v:0≤v<2W and denote Cexist by entity set in the Chord circle; then Cexist⊂C. We might set Cexist=v1,v2,…,vCexist, 0≤v1<v2<⋯<vCexist<2W. Hence, there exists z1≤z≤Cexist to make j=vz and C except that j is divided into W subsets:
(8)Ck=j+2k-1mod⁡2W,…,j+2k-1mod⁡2W,1≤k≤W.
For any 1≤k≤W, define
(9)Cexistk=Cexist∩Ck.
When Cexistk≠ϕ, the entity in the front in the clockwise direction is just the finger entity of Cexistk, which is responsible for the storage and distribution of interaction information between j and all the entities in Cexistk. Set U=k:1≤k≤W,Cexistk≠ϕ and η=η1,η2,…,ηU, ητ∈U, η1<η2<⋯<ηU, 1≤τ≤U; then the set of all managers of entity j is VΣ=vz+1,vz+1+Σ1,…,vz+1+ΣU-1, where Σm=∑τ=1mCexistητ. Entity i needs to send requests to the entities in VΣ to obtain the interaction information about j.There is not distinction between direct trust and feedback trust in the algorithm of computing trust in [11] where the direct interactions between i andj are not separated from all of the feedback information. However, considering that their own experience is often more inclined in the trust relationship, it is necessary to differentiate the two. For 1≤τ≤U and Σ0=0, denote Ωτ by the interaction information from the manager vz+1+Στ-1; then the set of interactions used to compute feedback trust is ΩF=⋃τ=1UΩτ∖Ωi, where Ωi is the interactions between i and j.


### 2.2.2. False Feedback Filter

According to the time instant of each interaction,ΩF is divided into l*-u+1 groups. For any u≤h≤l*, denote
(10)ΩFh=rF,h1,rF,h2,…,rF,hBh,
where Bh and rF,hb are the number of feedback interactions and satisfaction degree at the bth interaction in the interval Λh, respectively, 1≤b≤Bh. Therefore, ΩF=⋃h=ul*ΩFh.In each time intervalΛh, if the ability of providing service of entity j is regarded as a random variable Yh whose value range is 0,1, the feedback interactions ΩFh are just the samples. Assume the providing service ability of entityj is stable in each interval, and then the samples should approximately obey the normal distribution without the presence of attacks. If the attacks want to affect the computing result of trust degree on the whole, it is vital for malicious entities to return most false interactions to the requester. This false feedback is over high (collusive boost) or too low (collusive defaming), and its corresponding interaction moments should be close to the present moment. Through the above analysis, it can be judged that when there exists collusive defaming (boost) attack, the shape characteristics of the samples will be clearly to the left (right).In order to filter the false feedback effectively, standard coefficient of skewness and hypothesis testing are used to analyze the feedback information. In statistics, coefficient of skewness is a measurement to reflect the skewness condition of sample distribution, including the degree and direction of skewness.Definition 3 (standard coefficient of skewness [17]).
Supposex1,x2,…,xn are the samples from population X and x-=1/n∑l=1nxl and s2=1/n-1∑l=1nxl-x-2 are the sample mean and variance, respectively; then
(11)Sk=16n∑l=1nxl-x-s3
is the standard coefficient of skewness. Sk=0 states that the sample distribution is symmetrical; Sk>0 means that the distribution has a positive skewness; otherwise, the sample distribution has a negative skewness. The larger the absolute value of Sk, the higher the degree of skewness.The false feedback filter method is given using Definition3 and hypothesis testing in the following. Based on Definition 3, the standard coefficient of skewness of the samples rF,hb,1≤b≤Bh is computed as
(12)Skh=16Βh∑b=1BhrF,hb-r-F,hsF,h3,
where r-F,h=1/Bh∑b=1BhrF,hb, sF,h2=1/Bh-1∑b=1BhrF,hb-r-F,h2.Set a threshold valueΓ1>0. After Skh is obtained by (12), if Skh>Γ1, it can be judged that there is false feedback in the samples. Moreover, for any 1≤b≤Bh, we get the following.Case 1.
It is whenSkh<-Γ1,rF,hb is regarded as false feedback and will be eliminated from ΩFh if and only if rF,hb∈0,r-F,h-sF,h.Case 2.
WhenSkh>Γ1, if rF,hb∈r-F,h+sF,h,1, the feedback rF,hb will be eliminated from ΩFh.


### 2.2.3. Feedback Trust

For anyu≤h≤l*, after the false data in each set ΩFh are eliminated, denote ΩHFh by all of the honest feedback, and then ΩHFh⊆ΩFh. The following is the computing expression for feedback trust.Definition 4 (feedback trustFTi,j).
Using the real feedback interactionsΩHFh,u≤h≤l* and time attenuation function (6), the computing expression for FTi,j is
(13)FTi,j=∑h=ul*αδΔth+1FTi,jh∑h=ul*αδΔth+1ρ,
where FTi,jh=1/ΩHFh∑r∈ΩHFhr.


## 2.2.1. Storage and Distribution of Feedback Information

This model adopts the storage and distribution means based on DHT for the interaction information of any entity. In order to more effectively resist malicious attacks, overlay network is used similar to DHTON presented in [11]; that is, all the interactions about j are stored in several managers and each manager is responsible only for storage and distribution of local interactions.The Chord network is first described. In a Chord network, every entity is represented by aW-bit identifier and all entities are lined in the Chord circle in the clockwise direction. Set C=v:0≤v<2W and denote Cexist by entity set in the Chord circle; then Cexist⊂C. We might set Cexist=v1,v2,…,vCexist, 0≤v1<v2<⋯<vCexist<2W. Hence, there exists z1≤z≤Cexist to make j=vz and C except that j is divided into W subsets:
(8)Ck=j+2k-1mod⁡2W,…,j+2k-1mod⁡2W,1≤k≤W.
For any 1≤k≤W, define
(9)Cexistk=Cexist∩Ck.
When Cexistk≠ϕ, the entity in the front in the clockwise direction is just the finger entity of Cexistk, which is responsible for the storage and distribution of interaction information between j and all the entities in Cexistk. Set U=k:1≤k≤W,Cexistk≠ϕ and η=η1,η2,…,ηU, ητ∈U, η1<η2<⋯<ηU, 1≤τ≤U; then the set of all managers of entity j is VΣ=vz+1,vz+1+Σ1,…,vz+1+ΣU-1, where Σm=∑τ=1mCexistητ. Entity i needs to send requests to the entities in VΣ to obtain the interaction information about j.There is not distinction between direct trust and feedback trust in the algorithm of computing trust in [11] where the direct interactions between i andj are not separated from all of the feedback information. However, considering that their own experience is often more inclined in the trust relationship, it is necessary to differentiate the two. For 1≤τ≤U and Σ0=0, denote Ωτ by the interaction information from the manager vz+1+Στ-1; then the set of interactions used to compute feedback trust is ΩF=⋃τ=1UΩτ∖Ωi, where Ωi is the interactions between i and j.


## 2.2.2. False Feedback Filter

According to the time instant of each interaction,ΩF is divided into l*-u+1 groups. For any u≤h≤l*, denote
(10)ΩFh=rF,h1,rF,h2,…,rF,hBh,
where Bh and rF,hb are the number of feedback interactions and satisfaction degree at the bth interaction in the interval Λh, respectively, 1≤b≤Bh. Therefore, ΩF=⋃h=ul*ΩFh.In each time intervalΛh, if the ability of providing service of entity j is regarded as a random variable Yh whose value range is 0,1, the feedback interactions ΩFh are just the samples. Assume the providing service ability of entityj is stable in each interval, and then the samples should approximately obey the normal distribution without the presence of attacks. If the attacks want to affect the computing result of trust degree on the whole, it is vital for malicious entities to return most false interactions to the requester. This false feedback is over high (collusive boost) or too low (collusive defaming), and its corresponding interaction moments should be close to the present moment. Through the above analysis, it can be judged that when there exists collusive defaming (boost) attack, the shape characteristics of the samples will be clearly to the left (right).In order to filter the false feedback effectively, standard coefficient of skewness and hypothesis testing are used to analyze the feedback information. In statistics, coefficient of skewness is a measurement to reflect the skewness condition of sample distribution, including the degree and direction of skewness.Definition 3 (standard coefficient of skewness [17]).
Supposex1,x2,…,xn are the samples from population X and x-=1/n∑l=1nxl and s2=1/n-1∑l=1nxl-x-2 are the sample mean and variance, respectively; then
(11)Sk=16n∑l=1nxl-x-s3
is the standard coefficient of skewness. Sk=0 states that the sample distribution is symmetrical; Sk>0 means that the distribution has a positive skewness; otherwise, the sample distribution has a negative skewness. The larger the absolute value of Sk, the higher the degree of skewness.The false feedback filter method is given using Definition3 and hypothesis testing in the following. Based on Definition 3, the standard coefficient of skewness of the samples rF,hb,1≤b≤Bh is computed as
(12)Skh=16Βh∑b=1BhrF,hb-r-F,hsF,h3,
where r-F,h=1/Bh∑b=1BhrF,hb, sF,h2=1/Bh-1∑b=1BhrF,hb-r-F,h2.Set a threshold valueΓ1>0. After Skh is obtained by (12), if Skh>Γ1, it can be judged that there is false feedback in the samples. Moreover, for any 1≤b≤Bh, we get the following.Case 1.
It is whenSkh<-Γ1,rF,hb is regarded as false feedback and will be eliminated from ΩFh if and only if rF,hb∈0,r-F,h-sF,h.Case 2.
WhenSkh>Γ1, if rF,hb∈r-F,h+sF,h,1, the feedback rF,hb will be eliminated from ΩFh.


## 2.2.3. Feedback Trust

For anyu≤h≤l*, after the false data in each set ΩFh are eliminated, denote ΩHFh by all of the honest feedback, and then ΩHFh⊆ΩFh. The following is the computing expression for feedback trust.Definition 4 (feedback trustFTi,j).
Using the real feedback interactionsΩHFh,u≤h≤l* and time attenuation function (6), the computing expression for FTi,j is
(13)FTi,j=∑h=ul*αδΔth+1FTi,jh∑h=ul*αδΔth+1ρ,
where FTi,jh=1/ΩHFh∑r∈ΩHFhr.


## 2.3. Weight Setting Method

To calculate the total trust with weighted average method, the weight setting needs to follow the following two principles at least:(i)
the weight of direct trust should be not less than the weight of feedback trust; that is to say,ω1≥0.5;(ii)
lowering the weightω2 properly can reduce the negative impact of malicious feedback and improve the accuracy so as to obtain good performance [18].Based on the above principles, a theorem is first proven before the computing method of the weights is derived.Theorem 5.
For anyu≤h≤l*, set gh=∑h=ul*αδΔth+1/∑h=ul*αδΔth+1ρ, ρ>1; then gh is a strictly monotonously increasing function of variable h and 0.5<gh<1.Proof.
For anyu≤h≤l*, αh is short for αδΔth+1 for convenience.
For anyu≤h≤l*, 1/2<αh<1, and 1/2<αu<⋯<αl*<1 from Definition 1,
(14)gh=∑h=ul*αh∑h=ul*αhρ>1l*-u+1∑h=ul*αh>0.5.
And, for any ρ>1, αh<αhρ; hence,
(15)gh=∑h=ul*αh∑h=ul*αhρ<∑h=ul*αh∑h=ul*αh=1.
In addition, for any u+1≤h≤l*,
(16)gh-gh-1=∑k=uhαk∑k=uhαkρ-∑k=uh-1αk∑k=uh-1αkρ=∑k=uh-1αk+αh∑k=uh-1αkρ+αhρ-∑k=uh-1αk∑k=uh-1αkρ=∑k=uh-1αk+αh×∑k=uh-1αkρ-∑k=uh-1αk×∑k=uh-1αkρ+αhρ∑k=uhαkρ×∑k=uh-1αkρ=αh×∑k=uh-1αkρ-αhρ×∑k=uh-1αk∑k=uhαkρ×∑k=uh-1αkρ=αhρ×∑k=uh-1αh1-1/ρ×αkρ-∑k=uh-1αkρ×αk1-1/ρ∑k=uhαkρ×∑k=uh-1αkρ=αhρ×∑k=uh-1αkρ×αh1-1/ρ-αk1-1/ρ∑k=uhαkρ×∑k=uh-1αkρ>0.
For anyu≤k≤h-1,αh>αk, that is,  αh1-1/ρ-αk1-1/ρ>0, gh-gh-1>0. Therefore, gh is a strictly monotonously increasing function of variable h.Based on the principles of the weight setting, combining the conclusion of Theorem5 with the moments and frequency of the direct interactions, the weights w1 and w2 are derived as follows:
(17)ω1=∑h=ul*αδΔth+1∑h=ul*αδΔth+1ρ,ω2=1-∑h=ul*αδΔth+1∑h=ul*αδΔth+1ρ.From Theorem5, ω1>0.5 and ω1 is significantly greater than 0.5 with the increase in the direct interactions; that is, ω2 is reduced as much as possible. Particularly, the weights can be updated as the interaction continues, and then they can be adjusted dynamically and adaptively.To sum up, substituting (7), (13), and (17) into (1), we can obtain the total trust:
(18)Ti,j=ω1×DTi,j+ω2×FTi,j=∑h=ul*αδΔth+1∑h=ul*αδΔth+1ρ×∑h=ul*αδΔth+1·DTi,jh∑h=ul*αδΔth+1ρ+1-∑h=ul*αδΔth+1∑h=ul*αδΔth+1ρ×∑h=ul*αδΔth+1FTi,jh∑h=ul*αδΔth+1ρ.


## 3. Risk Evaluation Model

In the open and dynamical network environment, trust and risk are the important factors to make security decisions. Trust computing can provide guidance for safety decision-making and risk evaluation is an objective reference for trust computation [19]. The existing researches on trust often ignore the impact of risk, which makes trust computation not fully reflect the credibility of entity behavior.In this paper, we use the stability of providing this service of entityj to represent the risk value. The higher the stability, the smaller the risk. The stability can be measured by analyzing the dispersion and sharpness of two samples: the direct interactions Ωd=Ωi,jh,u≤h≤l* and honest feedback ΩHF=ΩHFh,u≤h≤l*. In statistics, the coefficient of variation and coefficient of kurtosis can indicate the two statistical characteristics. Therefore, the coefficient of variation and coefficient of kurtosis are used to establish a risk quantification model in the following and it is comprehensively measured with direct risk and feedback risk.Definition 6 (coefficient of variance [17]).
SetCv=s/x- as the coefficient of variance of x1,x2,…,xn, where x- and s are the same as given in Definition 3.
Although the coefficient of variance can measure the dispersion degree of the sample, two samples with the same coefficient of variance have different kurtosis in many cases. Therefore, the standard coefficient of kurtosis is further used to reflect the sharpness of the sampling distributions.Definition 7 (standard coefficient of kurtosis [17]).
Denote(19)Kur=n241n∑k=1nxk-x-s4-3
to be the standard coefficient of kurtosis of the sample x1,x2,…,xn, where x- and s are the same as those in Definition 3. Kur=0 shows that the sharpness degree of the sample distribution is equivalent to the normal distribution. Kur>0 and Kur<0 mean the sharpness degree of the sample distribution is higher and lower than the normal distribution, respectively.Using Definitions6 and 7, the coefficient of variance and standard coefficient of kurtosis of two samples Ωd and ΩHF are computed. The coefficients of variance of the two samples are
(20)C1=sD/DT¯,C2=sH/FTH¯,
where
(21)DT¯=1Ωd∑r∈Ωdr,sD2=1Ωd∑r∈Ωdr-DT¯2,FTH¯=1ΩHF∑r∈ΩHFr,sH2=1ΩHF∑r∈ΩHFr-FTH¯2.
And the standard coefficients of kurtosis of the two samples are
(22)Kur1=Ωd241Ωd∑r∈Ωdr-DT¯sD4-3,Kur2=ΩHF241ΩHF∑r∈ΩHFr-FTH¯sH4-3.The larger the coefficient of variation, the higher the dispersion degree of a sample, which shows that the ability of providing service is more unstable. The larger the standard coefficient of kurtosis, the higher the concentration degree, which shows that the ability of providing service is more stable. Therefore, the larger the coefficient of variance, the lower the coefficient of kurtosis, and the risk of selectingj as a target entity to provide service is higher.The two coefficients of kurtosisKurll=1,2 range in -∞,+∞. Because the risk value is a monotonously decreasing function of the coefficient of kurtosis, the relationship between the two can be calculated as follows:
(23)ΘKurl=1-1πarctanKurl+π2.
From the properties of arctanx, ΘKurl∈0,1 and, when Kurl=0, ΘKurl=0.5.For the two coefficients of varianceCll=1,2, the risk value is a monotonously increasing function about the coefficient of variance:
(24)ΨCl=1-e-Cl.
From (24), ΨCl∈0,1.Based on the above analysis, the direct riskRkD and feedback risk RkF are computed, respectively, by
(25)RkD=12ΘKur1+ΨC1,RkF=12ΘKur2+ΨC2.
To sum up the risk value is given using (25):
(26)Rki,j=ω1RkD+1-ω1RkF=ω12·ΘKur1+ΨC1+12-ω12·ΘKur2+ΨC2.
Substituting (17), (23), and (24) into (26), the risk value Rki,j is obtained.In conclusion, the credibility of entityj is measured with a two-dimensional vector Ti,j,Rki,j.


## 4. Simulation and Performance Analysis

We make the simulation to analyze the performance of the proposed model based on Peersim, a popular simulator of the P2P network. In the network, there are 2000 entities and 10000 kinds of services, in which 8000 are normal, 1000 are fake, and the remainders are vicious. We first use the RMS error to measure the accuracy of the proposed model. Subsequently, the dynamic is verified as the behavior of an entity changes over time. Furthermore, the percentage of successful interactions and the pass ratio of malicious services are adopted to analyze the performance of resisting the collusive attack and strategic malicious attacks.


### 4.1. Evaluation of Accuracy

We verify the accuracy through computing the root-mean-square (RMS) of the aggregated total trust of all entities [11]. The RMS error can be used to evaluate the effectiveness of the proposed model against various malicious behaviors. The smaller the RMS error, the higher the accuracy. The RMS error is given as follows:
(27)RMSerror=∑k=1NeTk′-Tk/Tk′2Ne,
where Ne is the total number of entities and Tk and Tk′ are the evaluated and actual total trust of entity k, respectively.It can be observed that the RMS error of our model is lower than the DHTrust and PowerTrust in Figure2. This result emerges mainly due to three aspects. One is that we distinguish the direct trust and feedback trust and their weights in the proposed model are flexible and personalized. Another important point is the filtering mechanism proposed in Section 2.2.2, which eliminates the fake feedback so as to guarantee the correctness of the available feedback interactions. Moreover, different from only considering the trust degree, the trust and risk values are used comprehensively to reduce the RMS error.Figure 2
RMS errors with different percentages of malicious entities.


### 4.2. Evaluation of Dynamic

The experiment is conducted to verify the dynamic of the proposed model. Assume that the behavior of an entity changes as time evolves. It can provide good services in the first 5 time intervals. Subsequently, it becomes unstable and provides honest services with probabilities of 0.9 and 0.8 from the 6th to 10th time interval and from 11th to 15th time interval, respectively. Next, it returns the good state. Trust degree of the entity changes as specified in Figure3.Figure 3
The trust degree of a dynamical entity.When the entity changes from good to bad, trust degree descends quickly and, after 2 time intervals, the evaluated trust degree can reflect the real situation. However, trust degree grows slowly if it varies from bad to good and it takes almost 5 intervals to reach the real value. This phenomenon shows that it is necessary to take a long time to accumulate trust degree and it can be viewed as the punishment for the unstable behaviours before.


### 4.3. Analysis of Collusive Attacks

In the existing attack models, collusive attack is generally considered as the biggest threat aiming at the trust systems. This attack model mainly includes full collusion and spies. In the “full collusion” model, all entities of a malicious collective provide bogus services and create false positive feedback recommendation to all the other entities of the collectives. In the model “spies,” the malicious collective is divided into two groups: spies and malicious. The spies provide honest services to obtain a high reputation and simultaneously give false positive feedback to the malicious part of the collective. In order to analyze the performance of the proposed model to resist the collusive attack, two measurement indexes are first given as follows.Definition 8.
SetMRn as the service request times of malicious entities and PCn the pass count among these malicious requests in the nth simulation cycle; the pass ratio of malicious service is defined as PRn=PCn/MRn. It represents the ability to identify such malicious entities.Definition 9.
SetTIn as the total number of interactions and SIn the successful interactions in the nth simulation cycle; the ratio of successful interactions is SRn=TIn/SIn.To measure the effect of collusive malicious entities, it is assumed that the percentages of malicious ones are 10% and 20%, respectively, half of which are spies. In this simulation experiment, 300 cycles are conducted and there are several services in every cycle. The comparisons of the proposed model with DHTrust and EigenTrust are detailed in Figures4 and 5.Pass ratio of malicious services.
(a)
(b)The ratio of successful services.
(a)
(b)The left parts of Figures4 and 5 represent the PRn and SRn corresponding to the three trust models when the percentage of malicious entities is 10%, and the PRn and SRn are reflected in the right parts when the percentage is 20%. From the above graphs, the PRns and SRns of the proposed model are distinctly lower and higher than DHTrust and EigenTrust, respectively. In the proposed model, PRn is almost less than 0.1 until n>250 and it tends to 0.05 as the interactions continue. Accordingly, SRn floats around 0.95. A similar situation exists when the percentage is 20%. Such a result is obtained mainly due to the filtering mechanism in the proposed model. Because the filtering method is based on the statistics characteristics of several feedback entities, it is very effective to identify the malicious entities so as to resist the collusive attacks. And the experiment results precisely illustrate this point.


### 4.4. Analysis of Strategic Malicious Behaviors

The performance of the proposed model when strategic malicious entities exist in the network is analyzed in this subsection. Such malicious entities can be divided into two kinds in general. One kind is to promote trust degree with small deals and provide the fake services or malicious attacks for the big deals. The other is to provide the normal service when its credibility is low and give the fake services or malicious attacks after trust is improved.In this experiment, we assume that the percentages of strategic malicious entities are 10%, 20%, and 30% and each half of such entities takes the two strategies, respectively.The curves in Figure6 show the changes of SRn when the percentages are 10%, 20%, and 30% in order, respectively. It can be found that SRn becomes greater than 0.95 after a few cycles and the asymptotic values do not have much difference as the interactions continue. This result reflects that the correctness of the proposed model is very high even in the presence of strategic malicious entities.Figure 6
The ratio of successful services.


## 4.1. Evaluation of Accuracy

We verify the accuracy through computing the root-mean-square (RMS) of the aggregated total trust of all entities [11]. The RMS error can be used to evaluate the effectiveness of the proposed model against various malicious behaviors. The smaller the RMS error, the higher the accuracy. The RMS error is given as follows:
(27)RMSerror=∑k=1NeTk′-Tk/Tk′2Ne,
where Ne is the total number of entities and Tk and Tk′ are the evaluated and actual total trust of entity k, respectively.It can be observed that the RMS error of our model is lower than the DHTrust and PowerTrust in Figure2. This result emerges mainly due to three aspects. One is that we distinguish the direct trust and feedback trust and their weights in the proposed model are flexible and personalized. Another important point is the filtering mechanism proposed in Section 2.2.2, which eliminates the fake feedback so as to guarantee the correctness of the available feedback interactions. Moreover, different from only considering the trust degree, the trust and risk values are used comprehensively to reduce the RMS error.Figure 2
RMS errors with different percentages of malicious entities.


## 4.2. Evaluation of Dynamic

The experiment is conducted to verify the dynamic of the proposed model. Assume that the behavior of an entity changes as time evolves. It can provide good services in the first 5 time intervals. Subsequently, it becomes unstable and provides honest services with probabilities of 0.9 and 0.8 from the 6th to 10th time interval and from 11th to 15th time interval, respectively. Next, it returns the good state. Trust degree of the entity changes as specified in Figure3.Figure 3
The trust degree of a dynamical entity.When the entity changes from good to bad, trust degree descends quickly and, after 2 time intervals, the evaluated trust degree can reflect the real situation. However, trust degree grows slowly if it varies from bad to good and it takes almost 5 intervals to reach the real value. This phenomenon shows that it is necessary to take a long time to accumulate trust degree and it can be viewed as the punishment for the unstable behaviours before.


## 4.3. Analysis of Collusive Attacks

In the existing attack models, collusive attack is generally considered as the biggest threat aiming at the trust systems. This attack model mainly includes full collusion and spies. In the “full collusion” model, all entities of a malicious collective provide bogus services and create false positive feedback recommendation to all the other entities of the collectives. In the model “spies,” the malicious collective is divided into two groups: spies and malicious. The spies provide honest services to obtain a high reputation and simultaneously give false positive feedback to the malicious part of the collective. In order to analyze the performance of the proposed model to resist the collusive attack, two measurement indexes are first given as follows.Definition 8.
SetMRn as the service request times of malicious entities and PCn the pass count among these malicious requests in the nth simulation cycle; the pass ratio of malicious service is defined as PRn=PCn/MRn. It represents the ability to identify such malicious entities.Definition 9.
SetTIn as the total number of interactions and SIn the successful interactions in the nth simulation cycle; the ratio of successful interactions is SRn=TIn/SIn.To measure the effect of collusive malicious entities, it is assumed that the percentages of malicious ones are 10% and 20%, respectively, half of which are spies. In this simulation experiment, 300 cycles are conducted and there are several services in every cycle. The comparisons of the proposed model with DHTrust and EigenTrust are detailed in Figures4 and 5.Pass ratio of malicious services.
(a)
(b)The ratio of successful services.
(a)
(b)The left parts of Figures4 and 5 represent the PRn and SRn corresponding to the three trust models when the percentage of malicious entities is 10%, and the PRn and SRn are reflected in the right parts when the percentage is 20%. From the above graphs, the PRns and SRns of the proposed model are distinctly lower and higher than DHTrust and EigenTrust, respectively. In the proposed model, PRn is almost less than 0.1 until n>250 and it tends to 0.05 as the interactions continue. Accordingly, SRn floats around 0.95. A similar situation exists when the percentage is 20%. Such a result is obtained mainly due to the filtering mechanism in the proposed model. Because the filtering method is based on the statistics characteristics of several feedback entities, it is very effective to identify the malicious entities so as to resist the collusive attacks. And the experiment results precisely illustrate this point.


## 4.4. Analysis of Strategic Malicious Behaviors

The performance of the proposed model when strategic malicious entities exist in the network is analyzed in this subsection. Such malicious entities can be divided into two kinds in general. One kind is to promote trust degree with small deals and provide the fake services or malicious attacks for the big deals. The other is to provide the normal service when its credibility is low and give the fake services or malicious attacks after trust is improved.In this experiment, we assume that the percentages of strategic malicious entities are 10%, 20%, and 30% and each half of such entities takes the two strategies, respectively.The curves in Figure6 show the changes of SRn when the percentages are 10%, 20%, and 30% in order, respectively. It can be found that SRn becomes greater than 0.95 after a few cycles and the asymptotic values do not have much difference as the interactions continue. This result reflects that the correctness of the proposed model is very high even in the presence of strategic malicious entities.Figure 6
The ratio of successful services.


## 5. Conclusions

In this paper, a dynamic trust and risk quantitative model is established. The credibility of an entity is measured by two indicators: total trust and risk value. Total trust is obtained with the weighted average method through considering direct interactions and feedback information comprehensively. In order to ensure the accuracy, a feedback filter model about feedback information based on coefficient of skewness and hypothesis test is proposed. Additionally, the weights allocation mechanism is adaptive. Furthermore, risk value is used to describe the stability of providing services, which is modeled with coefficient of variation and coefficient of kurtosis. Through simulation experiments, it is verified that the proposed model makes significant improvement in accuracy and dynamic and then it is robust to collusive malicious attacks and strategic malicious attacks.



---

*Source: 789820-2015-02-22.xml*