1. A Trust Evaluation Framework in Distributed Networks: Vulnerability Analysis and Defense Against Attacks
IEEE Infocom 2006

2. Background Trust Distributed computer networks
– A well studied concept in sociology and psychology.
Distributed computer networks
– Ad hoc network, sensor networks and P2P network
– Rely on collaboration among network participants.
To secure distributed networks
– Traditional: data integrity,confidentiality, authentication, etc
– New non-cryptography based security approach:trust evaluation.
Traditional schemes aim to secure ad hoc routing protocols focus on preventing attackers from entering the network through secure key distribution/authentication and secure neighbor discovery. Those schemes, however, are not effective in situations where malicious nodes have gained access to the network, or some nodes in the network have been compromised.
Trust function:
Provide an incentive for good behavior.
Provide a prediction of one’s future behavior.
Detect malicious and selfish entities.

3. Outline Trust Evaluation Foundation Attacks and Protection
– Trust concept, notation, metric, models
Attacks and Protection
– Bad-mouthing; on-off; conflicting-behavior; etc.
Trust management system and its applications in Ad hoc networks.
– Secure routing; Malicious node detection

4. Trust Concept in Computer Networks
The most appropriate interpretation of trust in computer networks is belief.
– One entity believes that the other entity will act in a certain way, or believes that the network will operate in a certain way.

5. Trust Notation and Metrics
Notation of of Trust relationship:
– {Subject:agent,action}
– The subject trusts the agent to perform an action.
Subject - usually represents one entity; can be a group of entities;
Agent - one entity, a group of entities, or even the network;
Action - an action performed (or a property possessed) by the agent.
Case 1: If the subject believes that the agent will perform the action for sure, subject “trust” the agent to perform the action. no uncertainty;
Case 2: If the subject believes that the agent will not perform the action for sure, subject “trust” the agent not to perform the action. no uncertainty;
Case 3: If the subject has no idea of whether the agent will perform the action or not, subject does not have trust in the agent. Highest uncertainty.
What is the physical meaning of these trust values?
Uncertainty ↔ Trustworthiness

6. Entropy-based Trust Metric
Trust value (T):measures uncertainty and is a function of entropy.
p :the probability with which the agent will perform the action in the subject’s point of view
p ↔ T: one-to-one mapping

7. Trust Models Estimate trust value based on direct observation
Estimate trust value based on recommendations (third parties’ opinion) – Trust propagation.
Concatenation trust propagation
Multipath trust propagation
Trust model: calculate trust via trust propagation

8. Axioms of Trust Propagation
Axiom 1: Concatenation propagation of trust does not increase trust.
Axiom 2: Multipath propagation of trust does not reduce trust.
Axiom 3: Trust based on multiple recommendations from a single source should not be higher than that from independent sources.
Trust models should satisfy all the axioms.
Trust models are not unique.
Action-r is to make recommendation of other nodes about performing action.
The value of Rab is positive

9. Entropy-based model Concatenation trust propagation
Multipath trust propagation

10. Probability-based model
S positive and F negative feedback
Pr(observation|P = p)=B(S + 1; F + 1).
Beta(7,2)

11. Probability-based model
Concatenation trust propagation

12. Probability-based model
Multipath Propagation

13. Outline Trust Evaluation Foundation Attacks and Protection
– Trust concept, notation, metric, models
Attacks and Protection
– Bad-mouthing; on-off; conflicting-behavior; etc.
Trust management system and its applications in Ad hoc networks.
– Secure routing; malicious node detection

14. Bad Mouthing Attack
Malicious nodes providing dishonest recommendations
– Frame up good entities
– Boost trust values of malicious peers
Defense: Recommendation Trust
– The action trust and recommendation trust records are maintained separately.
Assign low weight to the recommendations from the nodes with low recommendation trust.
Attacks and Protection
Trust evaluation is an attractive target for attackers.
Attackers’ goals
– Damage the network, e.g. reduce performance
– Keep their own trust value above a certain threshold.
– Cause inaccurate trust records.
good nodes have low trust value
bad nodes have high trust value
– Discourage cooperation

15. On-off Attack Time-domain inconsistence attack
Dynamic Property of Trust:
– The observation made long time ago should not carry the same weight as those made recently.
– Forgetting Factor β (0 < β ≤ 1)
actions at time t1 K actions at time t2
A simple scenario:
– Stage 1: Behave well for 100 times
– Stage 2: Behave badly for 100 times,
– Stage 3: Stop doing anything for sometime
– Stage 4: Behave well again.

16. On-off Attack
When the system does not forget, i.e. β = 1, this attacker has positive trust value in stage (2). That is, this attacker can have good trust values even after he has performed many bad actions. When using a large forgetting factor, the trust value may not represent the latest status of the entity.
When using a small forgetting factor β = 0.001, the attacker’s trust value drops rapidly after it starts behaving badly in stage (2). However, it can regain trust by simply waiting in stage (3) while the system will forget his bad behaviors
quickly.
Large β : trust value cannot keep up with users’ current status;
Small β :Attackers can recover trust values by waiting.

17. On-off Attack-- Defense
Solution: dynamic forgetting
– When trust value is high, forget faster;When trust value is low, forget slower.
Trust value can keep up with the entity’s current status after the entity turns bad.
An entity can recover its trust value after some bad behaviors, but this recovery requires many good actions.

18. Conflicting Behavior Attack
User-domain inconsistence.
The attackers behave well to one group of users and behave badly to another group of users.
These two groups develop conflicting opinions about the malicious users.
T{A : X, action} = T1 (high)
T{B: X, action} = T2 (low)
– B provides recommendation about X to A
– A compares B’s recommendation and A’s own experience
– A will assign low recommendation trust to B.
Two groups will not trust the recommendations from each others.

19. Conflicting Behavior Attack
Group A: user 1,4-10
Group B: user 11-20
Attackers: 2,3

20. Other Attacks Sybil Attack: Newcomer Attack
– Malicious node creates several faked IDs, then faked IDs can share or even take the blame, which should be given the malicious node.
– Defense: Authentication
Newcomer Attack
– Malicious nodes can easily remove their bad history and significantly reduce the effectiveness of trust management.
– Defense: access control policy and authentication

21. Outline Trust Evaluation Foundation Attacks and Protection
– Trust concept, notation, metric, models
Attacks and Protection
– Bad-mouthing; on-off; conflicting-behavior; etc.
Trust management system and its applications in Ad hoc networks.
– Secure routing; malicious node detection

22. Communication Procedure
Find multiple routes to the destination.
Find the packet-forwarding trust worthiness of the nodes on the routes
Selects a trustworthy route to transmit data.
After the transmission, updates the trust record based on its observation of route quality.

23. Effects of Trust Management
First, network throughput can be significantly degraded by malicious attackers.
Second, after using trust management, the network performance can be recovered because it enables the route selection process to avoid less trustworthy node.
Third, when the simulation time increases, trust management can bring the performance close to that in the scenario where no attackers are presented, since more and more accurate trust records are built over time.
Trust evaluation can improve network throughput because the malicious node has less chance to be on the route, and can be detected.

24. Effects of Trust Management
MDP
FAR
Recommendation mechanism improves the performance of malicious node detection.

25. Bad Mouthing Attack
Bad mouthing attck has little effects to the throughput.

26. Bad Mouthing Attack
Using recommendation trust in malicious node detection significantly improves detection rate.

27. On-off Attack
When the same packet deliver ratio is achieved, the adaptive forgetting scheme results in the lowest trust value of malicious users.

28. Conflicting-behavior Attack
R1:no recs to subgroup A, and honest to subgroup B
R2:no recs to subgroup A, and no recs to subgroup B
R3:bad recs to subgroup A, and no recs to subgroup B
R4:bad recs to subgroup A, and honest to subgroup B
In R1 and R4, attackers can in fact help the network performance; attackers have higher recommendation trust than good nodes.
In R3, malicious nodes always have much lower recommendation trust than good nodes.
In R2, attackers do not help the network by providing honest recommendations and can not be detected easily

29. Conflicting-behavior Attack
When confliction behavior attack presents, using recommendation trust for malicious node detection can reduce detection rate.

31. Discussion What we can learn? Organization and expression
Entropy-based model can partly explain the meaning of trust
Attacks statement and Simulation design
Effective with gray hole and bad mouthing attack

32. Discussion Need improvement
Effective with On-off,confilictin-behavior attack??
Fig 14—Adaptive forgetting improves little
V.D
Other attacks
Error Reporting
Collusions …
Formula Variable errors