CATrust: Context-Aware Trust Management for Service-Oriented Ad Hoc Networks

Transcription

1 1 CATrus: Conex-Aware Trus Managemen for Service-Oriened Ad Hoc Neworks Yaing Wang, Ing-Ray Chen, Jin-Hee Cho, Ananhram Swami, Yen-Cheng Lu, Chang-Tien Lu, Jeffrey J.P. Tsai Absrac We propose a conex-aware rus managemen model called CATrus for service-oriened ad hoc neworks such as peer-o-peer and Inerne of Things neworks wherein a node can be a service requeser or a service provider. The novely of our design lies in he use of logisic regression o dynamically esimae rusworhiness of a service provider based on is service behavior paerns in response o conex environmen changes. We develop a recommendaion filering mechanism o effecively screen ou dishones recommendaions even in exremely hosile environmens in which he majoriy recommenders are dishones. We demonsrae desirable convergence, accuracy, and resiliency properies of CATrus. We also demonsrae ha CATrus ouperforms conemporary peer-o-peer and Inerne of Things rus models in erms of service rus predicion accuracy agains collusion recommendaion aacks. Index Terms Trus, service-oriened ad hoc neworks, logisic regression, recommendaion aacks, saisical analysis. W I. INTRODUCTION ITH he proliferaion of fairly powerful mobile devices and ubiquious wireless echnology, radiional ad hoc neworks now migrae ino a new era wherein a node can provide and receive service from oher nodes i encouners and ineracs wih. This paper proposes a new rus model for service-oriened ad hoc neworks (SOANETs) consising of service providers (SPs) and service requesers (SRs). Peer-o-peer (P2P) neworks [14] [22] [33], Inerne of hings (IoT) sysems [3] [20], and mobile ad hoc neworks (MANETs) [4] [5] [6], especially mobile cloudles [27] are realizaions of SOANETs populaed wih SPs and SRs. One can view a SOANET as an insance of Inerne of Things (IoT) sysems wih a wide range of mobile applicaions including smar-ciy, smar ourism, smar car, smar environmenal monioring, and healhcare [2]. We exemplify a prooypical SOANET applicaion by a dynamic service composiion and binding environmenal monioring applicaion in a smar ciy seing as illusraed in Figure 1 wih muli-objecive opimizaion (MOO) for hree service qualiy crieria: qualiy of informaion, service delay, and service cos [26]. In his smar ciy applicaion here would Yaing Wang, Ing-Ray Chen, Yen-Cheng Lu, and Chang-Tien Lu are wih he Deparmen of Compuer Science, Virginia Tech, Falls Church, VA {yaingw, irchen, kevinlu, clu}@v.edu. *Jin-Hee Cho and Ananhram Swami are wih Compuaional and Informaion Sciences Direcorae, U.S. Army Research Laboraory, Powder Mill Rd. Adelphi, MD {jinhee.cho, Jeffrey J.P. Tsai is wih he Deparmen of Bioinformaics and Biomedical Engineering, Asia Universiy, Taichung, Taiwan jjpsai@gmail.com. be many environmenal sensors embedded in he ciy, including smar phones carried by human beings conscious of environmenal healh, public ransporaion vehicles (buses, axis, rains and park vehicles), ciy ligh lamps, uiliy poles, buildings, and infrasrucures providing environmenal monioring service of air polluans such as CO, NO 2, SO 2, and O 3 in he same proximal locaion. While service delay and service cos are easily measureable physical quaniies, qualiy of informaion is specific o he applicaion domain. In environmenal monioring service, qualiy of informaion is measured by he exen o which he oupu conribues o he ground ruh daa [23]. For SPs providing sensing service, qualiy of informaion is measured by he exen o which he sensing daa conribue o he ground ruh picure [17]. In his SOANET applicaion, a requesed service issued by a SR is firs decomposed ino absrac services each of which is hen bound o a SP seleced by he SR, wih he goal of maximizing he qualiy of informaion while minimizing service cos and service delay. Essenially, service composiion is formulaed as a workflow problem based on he SR s locaion and he availabiliy of SPs around he SR s locaion, while service binding is formulaed as a node-o-service assignmen problem. This applicaion can base on IEEE echnology, allowing node-o-node communicaion for up o 200m covering he monioring area o be surveyed when a SR moves o he environmen. As an environmenal monioring service or sensing service is inherenly locaion based, i is expeced ha a service reques issued will be considered only by SPs providing he required services near he SR's locaion. However no all of hese SPs will be rusworhy, so rus managemen o cope wih misbehaving SPs and recommendaion filering is required o screen ou unrusworhy recommendaions. Figure 1: A Prooypical Environmenal Monioring SOANET Applicaion. In his work, we ake a conex-aware approach for rus managemen, reaing channel condiions, node saus, service payoff, and social disposiion as conex informaion. We use

2 2 he word conex inerchangeably wih conex environmen o refer o hese environmenal and operaional condiions a SP is in. We view rus as he probabiliy ha a SP will provide a saisfacory service in a paricular conex environmen, as expeced by a SR. We noe ha he probabiliy of geing a saisfacory service from a SP can be exended o mean ha he SR is willing o depend on he SP in a given siuaion wih a feeling of relaive securiy, even hough negaive consequences are possible [13]. The novely of our work lies in he use of a robus inference model based on logisic regression o robusly ye accuraely predic how a SP s service qualiy will be in response o conex changes. This allows us o reason abou a node s service behavior paern, given he operaional and environmenal conex informaion as inpu. We name our conex-aware rus managemen proocol CATrus. This paper subsanially exends our conference paper [30] wih a horough analysis of he convergence, accuracy and resiliency properies of our proocol design, a comparaive performance analysis wih wo conemporary P2P/IoT rus proocols, and a novel recommendaion filering echnique o address he case where malicious recommenders form a majoriy. This paper makes he following conribuions: To he bes of our knowledge, we are he firs o propose a conex-aware rus managemen for SOANETs. Similar o exising P2P or IoT rus proocols, we also predic a SP s rusworhiness based on he SP s behavior. The difference lies in our abiliy o associae a SP s service behavior wih conex informaion. The end resul is ha here is one service rus value for each conex environmen, insead of one service rus value for all conex environmens (as in exising proocols). This conex-aware design grealy improves service rus predicion accuracy. We propose a novel recommendaion filering mechanism o effecively screen ou dishones recommendaions even when mos of he recommendaions are dishones. We demonsrae ha CATrus is highly resilien oward collusion recommendaion aacks. CATrus significanly ouperforms conemporary P2P and IoT rus proocols in erms of accuracy and resiliency agains recommendaion aacks. This paper is organized as follows: In Secion II, we survey rus models and rus-based defenses agains malicious aacks, especially collusion recommendaion aacks. We conras and compare exising approaches wih our approach. In Secion III, we discuss he sysem model including service-oriened ad hoc neworks, node service behavior model, hrea model, and performance merics. In Secion IV, we discuss our rus managemen proocol design for CATrus in deail. In Secion V, we analyze he convergence, accuracy and resiliency properies of CATrus. In Secion VI, we perform a comparaive analysis of CATrus agains wo conemporary P2P and IoT rus models, namely, Bea Repuaion [12] and Adapive Trus Managemen [3]. In Secion VII, we discuss he compuaional feasibiliy and applicabiliy issues. Lasly in Secion VIII we conclude he paper and ouline fuure research direcions. II. RELATED WORK We focus our aenion on exising rus managemen models for P2P neworks, IoT neworks, and MANETs since hese sysems are realizaions of SOANETs. Trus proocols based on Bayesian probabiliy are popular because of sound saisical basis. Yu e al. [34] applied Bayesian inference o measure he repuaion of a MANET node assuming ha a node s behavior in each observaion period is idenically and independenly disribued, and follows he binomial disribuion. Therefore, a node s repuaion is deermined by he numbers of posiive and negaive samples observed. Chen e al. [3] considered a Bayesian framework as he underlying model for direc rus assessmen from user saisfacion experiences in IoT sysems. A shorcoming of he above models based on Bayesian probabiliy is ha he rus value is no associaed wih conex since i is jus based on user saisfacion experiences. Belief heory or subjecive logic rus models [11] [13] inroduce uncerainy ino rus calculaion. Balakrishnan e al. [1] developed a subjecive logic based model for a MANET node o evaluae is opinion owards anoher node using evidence-o-opinion mapping operaors. Twigg [24] developed a subjecive logic based rus model for selecing rusworhy nodes for secure rouing in P2P neworks. Fuzzy logic based rus models are also well sudied in he lieraure [29] [32]. Insead of using a binary se, a membership funcion is defined indicaing he degree o which a node is considered rusworhy. Wang and Huang [29] compued he fuzzy rus values of candidae pahs based on node repuaion, bandwidh, and hop coun for roue selecion. Xia e al. [32] applied fuzzy inference rules for rus predicion, considering pas and curren service experiences for predicing he service capabiliy of a ransmier node. One drawback of fuzzy logic-based rus predicion is ha i requires domain expers o do parameer uning and se he fuzzy rules incorporaing he knowledge of he causal relaionship beween he inpu and oupu parameers. Relaive o he works cied above based on Bayesian probabiliy, belief heory, and fuzzy logic, we ake an enirely differen approach. We develop a regression-based rus model uilizing logisic regression o esimae he rusworhiness of a SP in response o conex environmen changes. There is lile work in he lieraure on applying regression for rus compuaion. To dae, i has been used only by [15] [25] for finding he bes weighs o assign o observaions or rus componens. Specifically, Li e al. [15] proposed an auo-regression-based echnique o learn he weighs from hisorical observaions o predic fuure oucomes. Venkaaraman e al. [25] developed a regression-based rus model o learn he opimal weighs of muliple rus merics, where each rus meric is assessed separaely using Bayesian inference. Unlike [15] [25], we do no use regression o learn weighs o be applied o observaions or rus properies. Insead, we apply logisic regression analysis o learn he service behavior paerns of a SP in response o conex environmen changes and consequenly predic he SP s dynamic rus in erms of is service qualiy rus. For his

3 3 reason, we do no consider [15] [25] as baseline cases for performance comparison. We consider Bea Repuaion [12] and Adapive Trus Managemen [3] (boh measuring service qualiy rus) as baseline cases for performance comparison in his paper. Bea Repuaion [12] is he mos popular rus proocol for P2P sysems o-dae. I applies he concep of belief discouning for recommendaion filering. Adapive Trus Managemen [3] is a very recen IoT/P2P rus proocol proven o ouperform oher conemporary IoT/P2P proocols. I applies he concep of collaboraive filering for recommendaion filering and he concep of adapive filering for dynamically adjusing he weighs of direc rus obained hrough self-observaions and indirec rus obained hrough recommendaions o maximize proocol performance. A considerable amoun of work has been done in he area of rus-based defenses agains aacks in P2P neworks, IoT neworks, and MANETs [3] [4] [6] [5] [14] [22] [28] [31] [33]. Chen e al. [4] proposed he concep of rus bias minimizaion by dynamically adjusing he weighs associaed wih direc rus (derived from direc evidence such as local observaions) and indirec rus (derived from indirec evidence such as recommendaions) so as o minimize rus bias. Cho e al. [5] [6] proposed he use of rus hresholds o filer ou unrused recommendaions. EigenTrus [14], PeerTrus [33], and ServiceTrus [22] considered various mehods o aggregae recommender feedbacks weighed by he recommender s rusworhiness based on facors ha affec a recommender s rusworhiness, including ransacion conex, communiy conex, and credibiliy in erms of he rus and personalized similariy beween he rusor and he recommender, ec. o filer ou disrused feedbacks. A common challenge wih he above approaches is ha dynamically uning rus parameers may perform poorly when malicious recommenders form a majoriy, especially if a node does no have enough service experiences wih oher nodes and mus rely on recommendaions for decision making. CATrus leverages a robus saisical kernel o olerae false recommendaions o effecively achieve resiliency agains recommendaion aacks. Furhermore, CATrus filers ou false recommendaions based on a novel hreshold-based filering mechanism such ha if he difference beween he prediced service qualiy rus and he recommended service qualiy rus under he same conex environmen is above a hreshold, hen he recommendaion is filered. We demonsrae ha CATrus significanly ouperforms conemporary P2P/IoT rus models including Bea Repuaion [12] and Adapive Trus Managemen [3], especially when observaions for recommenders are limied. III. SYSTEM MODEL A. Service-Oriened Ad Hoc Neworks We consider locaion-based service requess. Tha is, a SR requess a service, and SPs in he same locaion (wihin radio range) respond o he reques. As illusraed in Figure 1 for he prooypical service composiion and binding environmenal monioring SOANET applicaion, here are muliple SPs compeing for a requesed service in he same proximal locaion. The SR selecs he SP wih he highes rus value, given he curren conex environmen as inpu. The reason we develop CATrus specifically for SOANETs bu no for oher ypes of service ecosysems is ha a SP s service qualiy crieria (such as qualiy of informaion, service delay, and service cos considered in [26]) are inherenly associaed wih rapid conex environmen changes in SOANETs. B. Node Service Behavior Model We consider he noion of conex-sensiive service behavior, i.e., a SP s service behavior may change dynamically, as he SOANET operaional and environmenal condiions change dynamically due o node mobiliy, channel conenion, node saus, and social disposiion oward oher nodes in he sysem. Trus herefore is dynamic because SPs are heerogeneous in erms of capabiliy and aiude, and adap o conex changes. We call an operaional or environmenal condiion ha may affec a SP s service behavior a conex variable. While CATrus can handle any conex variable, we consider profi-awareness, capabiliy-limiaion, and energy-sensiiviy as hree disinc conex variables for he following reasons: (a) a profi-aware SP is more likely o provide qualiy service when he SR offers a higher price [9] [35]; (b) a SP is likely o provide inferior service when i is limied in resources and capabiliy [18]; and (c) a SP is more likely o provide inferior service when he cos of servicing he ask is high [17]. For example, in a congesed environmen he probabiliy of wireless channel conenion and signal inerference will be high, so i will cos more for a SP o execue a service because he SP needs o consume more energy in lisening o he channel and repeaing packe ransmission. The service qualiy provided by a SP is deermined by is service behavior in response o changes in he conex environmen. We call he resuling service qualiy ground ruh service qualiy as i is inrinsically relaed o a SP s service behavior. A malicious node (defined below), however, may provide inferior service for self-ineres even if i is capable of providing saisfacory service. C. Threa Model As every node in a SOANET can be a SP or a SR iself, i wans o be seleced o provide service for profi when i is a SP and wans o find he bes SPs for bes service available when i is a SR. Therefore, by a malicious node we do no refer o a node ha is compromised by enemies and aemps o desroy or disrup he operaion of he sysem. Raher, we refer o a node ha acs for is own benefis and can collude wih oher malicious nodes o monopolize service even if he service i provides is inferior. For convenience, we will use he word bad inerchangeably wih malicious, and he word good inerchangeably wih non-malicious. We assume ha a malicious node as a recommender will perform he following collusion recommendaion aacks: Bad-mouhing aacks: a malicious node can ruin he service rus of a non-malicious node by providing bad recommendaions. I can collude wih oher malicious nodes o ruin he service rus of a good node.

4 4 TABLE I: Behavior of a Malicious Recommender. Trusor Trusee Bad-Mouhing Aack Ballo-Suffing Aack malicious malicious malicious non-malicious non-malicious malicious non-malicious non-malicious TABLE II: Behavior of a Malicious Service Provider. Service Requeser Conflicing Behavior Aack Random Aack malicious non-malicious Ballo-suffing aacks: a malicious node can boos he service rus of anoher malicious node by providing good recommendaions so as o increase he chance of ha malicious node being seleced as a SP. Malicious nodes can collude wih each oher o boos heir service rus values. Table I summarizes he aack behavior of a malicious node as a recommender, depending on he naure of he rusor and rusee nodes. If he rusor SR is non-malicious and he rusee SP is malicious, a malicious recommender will perform ballo-suffing aacks. If he rusor SR is non-malicious and he rusee SP is also non-malicious, a malicious recommender will perform bad-mouhing aacks. We assume ha a malicious node as a SP will perform he following service aacks: Conflicing behavior aacks: a malicious node can selecively provide saisfacory service wihin is service capabiliy for some SRs while providing unsaisfacory service for ohers. We assume ha malicious nodes know each oher, so wih conflicing behavior aacks a malicious node will provide saisfacory service o oher malicious nodes, bu unsaisfacory service o non-malicious nodes. Random aacks: While performing conflicing behavior aacks, a malicious node can perform random aacks, i.e., providing unsaisfacory service o non-malicious nodes only randomly, so as o avoid being labeled as a low service rus node and risk iself no being seleced as a SP by non-malicious SRs in he fuure. Table II summarizes he aack behavior of a malicious SP, depending on he naure of he SR. We will firs analyze he convergence, accuracy and resiliency properies of CATrus agains collusion recommendaion aacks in Secion V. Then we will address how CATrus can deal wih conflicing behavior and random aacks in Secion VII. D. Performance Merics The performance merics for comparaive performance analysis are false negaive probabiliy (P ff ) and false posiive probabiliy (P ff ) defined as follows: False negaive probabiliy (P ff ) is he missing bad service probabiliy. Tha is, i is he condiional probabiliy ha SR i will misidenify SP j as being able o provide saisfacory service, given ha SP j acually provides unsaisfacory service. The erm false negaive is consisen wih ha used in inrusion deecion [22], alhough he arge subjec in inrusion deecion is he node iself (missing a malicious node) raher han he service provided (missing a bad service provided by a node). P ff can be calculaed by: P ff = N c (1) N C N c is he number of cases SR i believes SP j will provide saisfacory service while SP j acually provides unsaisfacory service, and N C is he number of cases SP j will provide unsaisfacory services if seleced. The lower he false negaive rae he beer he performance. False posiive probabiliy (P ff ) is he missing good service probabiliy. Tha is, i is he condiional probabiliy ha SR i will misidenify SP j as being unable o provide saisfacory service, given ha SP j acually provides saisfacory service. Again he erm false posiive is consisen wih ha used in inrusion deecion [19], alhough he arge subjec in inrusion deecion is he node iself (misidenifying a non-malicious node) raher han he service provided (missing a good service provided by a node). P ff can be calculaed by: P ff = N m N m (2) N m is he number of cases SR i believes SP j will no provide saisfacory service while SP j acually provides saisfacory service and N m is he number of cases SP j will provide saisfacory service if seleced. The lower he false posiive rae he beer he performance. IV. CATRUST DESIGN A. Problem Definiion and Design Objecive The cenral idea of CATrus is ha insead of direcly predicing service qualiy, we predic he probabiliy of delivering saisfacory service, i.e., service rus. Our raionale is ha, given several SP candidaes, a SR is able o selec he mos reliable SP wih leas risk. Such risk informaion migh no be sraighforward if we predic service qualiy only. However, wih service rus informaion, we can easily infer he risk associaed wih a decision. For ease of discussion, we lis he symbols used and heir meanings in Table III. A symbol may be associaed wih a special characer o denoe a special meaning, wih (underscore) denoing a vecor, ˆ (ha) denoing an inferred/prediced value, and (ilde) denoing a se of self-observaions and recommendaions. We use i o refer o a SR, j o refer o a SP, and k o refer o a recommender. We assume ransporaion/link failures can be idenified by proocols in lower neworking layers. We assume ha he observaion and assessmen of received service is error-free. Hence, SR i s judgmen of SP j s service qualiy is he acual service qualiy, i.e., s = s j.

5 5 TABLE III: Noaion. Noaion Meaning i Node i normally referring o a service requesor (SR) k Node k normally referring o a recommender j Node j normally referring o a service provider (SP) T j j s service rusworhiness a ime T j s service rusworhiness a ime as prediced by node i s j Acual service qualiy delivered by j a ime s s j as prediced by i s i s self-observaion of service qualiy of j a ime S A vecor of self-observaions and recommendaions received by SR i for service qualiy of SP j a ime S 0 S,, n S, a vecor of S over [ 0,, f ] x m m h conex variable value observed a ime x [x 1,, x M ], a vecor of M conex variable values observed a ime X x 0,, x n, a vecor of x over [ 0,, f ] β j β 1 j,, β M j, a vecor of regression coefficiens for M conex variables i s esimae of β j β The problem a hand is for SR i o predic wheher SP j will perform saisfacorily or no for a requesed service in a paricular conex environmen, given a hisory of evidence. The objecive is o achieve high predicion accuracy in erms of correcly predicing bad service while no missing good service from a SP. Here we noe ha a node, malicious or no, can provide good service or bad service depending on he conex environmen. Wihin a specific ype of service, SR i s observaion s a ime of he service qualiy received from SP j is eiher saisfacory or unsaisfacory. If he service qualiy is saisfacory, hen s =1 and SP j is considered rusworhy; oherwise, s =0 and SP j is considered unrusworhy. Le he operaional and environmenal condiions a ime be characerized by a se of disinc M conex variables x = [x 1,, x M ]. Then, SP j s service rus is he probabiliy ha SP j is capable of providing saisfacory service given conex variable x, i.e., T j Pr (s j = 1). Le k (k i) be a recommender who had prior service experience wih SP j and is asked by SR i o provide is feedback regarding SP j. The recommendaion from node k is in he form of [x, s kj ] specifying he conex x under which he observaion s kj was made. Since k migh launch recommendaion aacks, i migh repor a dishones observaion o i, in which case s kj repored is 1 s kj. Le S = 0 S,, n S, i j, denoe he cumulaive evidence gahered by SR i over [ 0,, f ], including self-observaions and recommendaions. Also le X = x 0,, x n denoe he corresponding conex variable value vecor over [ 0,, f ]. CATrus learns he service behavior paern of SP j based on S and X, and predics he probabiliy ha SP j is rusworhy a ime f+1, given x n+1 as inpu. Suppose ha node j follows service behavior paern β j. Then, our predicion problem is o esimae T n+1 = Pr (s n+1 = 1 x n+1, β ), where β is node i s esimae of β j. Essenially, T n+1 obained above is he service rus of SP j a ime f+1 from SR i s perspecive. B. Trus Compuaion We uilize a sigmoid funcion o link he binary observaion of service qualiy wih conex variables in a coninuous range. More specifically, we uilize robus logisic regression [16] o analyze he relaion beween S and X. While many forms exis for relaing S and X, we adop a linear model for is simpliciy and effeciveness, reaing SP j s behavior paern β j = β j 1,, β j M essenially as a vecor of M regression coefficiens maching he conex variable vecor x = [x 1,, x M ]. Laer in Secion VII, we discuss he feasibiliy of using oher models. We assume observaions are muually independen and ha he order of observaions can be changed. Following he linear model for a classical logisic regression problem, j s service rusworhiness a ime is modeled by: T j = Pr s j = 1 x, β j ) = 1 + exp ( x β j ) 1 (3) Or, equivalenly, following he logi funcion definiion, logi(y) = ln y, we have: 1 y logi T j = x β j (4) The logi funcion defined in (4) is he link funcion in logisic regression for ransforming he predicion from a binary service oucome (0 or 1) o a coninuous oucome upon which linear regression may be conduced. Wih (3), i esimaes j s rus T j based on is esimaed β j. To do so, i needs o esimae β j, bu i only has noisy observaions of he service hisory. We model his by: z = logi T = x β j + ε (5) where T is j s service rusworhiness a ime as prediced by node i, and ε is an independen error erm following he logisic disribuion wih he cumulaive disribuion funcion 1 1+e y, y (, ). A malicious recommender k can modify all unsaisfacory observaions on j o 1 in a ballo-suffing aack, while reversing all saisfacory services o 0 in a bad-mouhing aack. Malicious behaviors resul in ouliers which will lead o inaccurae esimaion. We adop robus logisic regression [16] o replace he error erm ε in (5) wih a noise erm ha follows he sandard -disribuion wih ν 0 degrees of freedom o olerae recommendaion aacks wihou overly sacrificing soluion accuracy. The logisic disribuion is known o resemble he -disribuion in shape bu has heavier ails. We

6 6 se ν 0 = 7 as in [16] o make he -disribuion also possess heavy ails, which increases he abiliy o absorb oulier errors and provides robus esimaes of β j. Afer replacing ε by a sandard -disribuion random variable, denoing x β j as u, and providing a value for he hyper parameer v, z in (5) has he following densiy funcion: f v (z) = (πv) 1 2Γ v+1 2 Γ 1 v (z u) v v+1 2 (6) where Γ is he gamma funcion. We apply Bayesian inference based on he daa augmenaion algorihm wih Markov Chain Mone Carlo (MCMC) [8] [21] o infer β j given hisoric observaions S, as follows: p β j S = p β j z, S p z β j, S dz (7) where z = [z 0,, z n ] is a laen variable se inroduced by he daa augmenaion algorihm in order o consruc known p β j z, S. However, due o he -disribuion for ε, here is no closed-form soluion for p β j z, S. To circumven his, z is approximaed by a scale mixure of Gaussian disribuion, i.e., z ω N(u, ω 1 ) wih ω Γ(ν/2, ν/2) where N(u, ω 1 ) is Gaussian disribuion wih mean u and variance ω 1 and Γ(ν/2, ν/2) is Gamma disribuion wih shape ν/2 and scale ν/2. Le ω = ω 0,, ω n. Then (7) can be rewrien as: p β j S = p β j z, ω, S p z, ω β j, S dω dz Assuming a Gaussian priori o β j wih known mean and variance defined above, he poserior β j z, ω, S will follow a Gaussian disribuion and he poserior ω z, β j will follow a Gamma disribuion [8] [21]. Meanwhile, z β j, S is a runcaed -disribuion, depending on he value of S. We hen apply an ieraive sampling procedure o firs draw a new (z, ω ) and hen produce a new β j from p β j z, ω, S. This process is repeaed ieraively unil he Markov Chain is sabilized. The final β j obained is node i s esimaed β j, i.e., β. Node i can hen compue T +1 by (3), given x +1 and β as inpu. C. Recommendaion Filering The logisic regression model wih -disribuion error enables fairly robus learning of a SP s service behavior paern based on a rusor s self-observaions and he recommenders hisory records. However, for any saisical model, here is a breakpoin. In our case, if he percenage of malicious nodes is (8) oo high, i can hardly differeniae hones from dishones recommendaions, hus resuling in a low accuracy rae. One possible soluion is o seek socially conneced peers (friends) who are mos likely o deliver hones recommendaions. However, he limiaion is ha i depends on he availabiliy of friends in he neighborhood and also i requires friends o have direc service experiences wih he argeed SP, a condiion ha may be difficul o mee in SOANET environmens. We propose a novel hreshold-based recommendaion filering mechanism. The main idea is o compare he SR s predicion of he service rus oward he rusee wih he recommender s repor oward he same rusee under he same conex environmen. Specifically each ime node k, serving as a recommender, propagaes a recommendaion abou node j in he form of x, s kj, node i will apply he curren predicor β wih x given as inpu o compue T. Ideally, if k delivers hones s kj, T should be closer o s kj han o 1 s kj. To filer ou malicious recommendaions, i uses a hreshold parameer T h. If T s kj is larger han T h, s kj is considered modified and consequenly [x, s kj ] is rejeced by i; oherwise, i will be acceped by i and pu in he raining se for updaing β. In case a recommender provides several recommendaions for several disinc conex environmens, he average difference can be firs compued before applying hreshold-based recommendaion filering. The hreshold parameer T h is an imporan parameer whose effec on proocol performance will be analyzed in Secion V. D. Characerisics of Conex Variables Conex variables mus obey he propery ha in similar conex, he service from a SP performs similarly. Therefore, conex variables are inherenly ied o a SP s service behavior and he service qualiy crieria defined by an applicaion. In our example SOANET applicaion [26] illusraed in Figure 1, service qualiy is defined by hree crieria, namely, QoI, service delay, and service cos. Consequenly, energy (which influences QoI [17]), local raffic (which influences service delay), and incenive (which influences service cos [9]) are naural choices for his applicaion. As hese conex variables have clear physical meanings, he range of a conex variable can be defined accordingly. For example, he energy conex variable can be caegorized as [high, medium, low] denoing he energy saus of a SP. The incenive conex variable can be he price paid o a SP upon saisfacory compleing of service, in he range of [minimum price, maximum price]. The local raffic conex variable can be he number of neighbors simulaneously ransmiing packes wih he range of [0, maximum node densiy radio range area]. A range wih a finer granulariy allows CATrus o more accuraely learn a SP s service behavior paern and service qualiy a he expense of compuaional complexiy (see Secion VII.A for a discussion). Anoher propery ha mus be saisfied is ha a conex variable mus be measurable a runime. For he example SOANET applicaion, he energy saus of SP j can be measured by he SR by couning he raio of he number of acknowledgemen packes received from SP j over he oal

7 7 number of ransmied packes from he SR o SP j during he encouner inerval. The incenive o SP j is deermined by he SR iself so i is easily measurable by he SR. The local raffic can be esimaed by he SR based on he collision probabiliy or he packe reransmission probabiliy afer ransmiing a sequence of packes for iniiaing a service reques. V. ANALYSIS OF CONVERGENCE, ACCURACY, AND RESILIENCY PROPERTIES OF CATRUST In his secion, we analyze he convergence, accuracy, and resiliency properies of CATrus agains collusion recommendaion aacks. We firs describe he environmen seup and hen we presen he resuls. Table IV: Parameers and heir Values. Noaion Meaning Defaul Value A Operaional area 800x800 m 2 S Speed [1.0, 2.5] m/s P Pause ime [0, 60] s W Movemen ime [5*60, 15*60] s R Radio range 220 m α Encounering rae 5/hr λ Service reques rae 5/encouner L Lengh of measuremen 24 hr inerval ufi Trus updae inerval 7.2min P ssr Saisfacory service 60% raio p ufi Uni price 1 ν 0 Degree of freedom 7 P b Percenage of bad nodes [10%-70%] T h Recommendaion [0-1] filering hreshold n f Number of nodes 50 n c Number of conex 3 variables n r Number of service records per node αlλ Only one service ype is considered for simpliciy. A node acing as a SR has a service reques rae of λ upon encounering a poenial SP. A node can provide recommendaions only o nodes wih which i has had service experiences. The measuremen ime inerval for daa collecion is L. The rus updae inerval is ufi. We consider hree conex variables in he experimen, namely, energy-sensiiviy (x e ), capabiliy-limiaion (x c ), and profi-awareness ( x f ). The values of conex variables are generaed as follows: x e is measured by he number of neighbors sharing he channel as more energy is consumed for channel conenion and packe reransmission when here are more nodes sharing he channel. x c is measured by he number of service requess o be processed in a SP s queue as high raffic o he SP hinders is processing capabiliy. x f is SP s poenial gain upon saisfacory service compleion. The poenial gain consiss of wo pars: he asked price P ask from a SP, calculaed by muliplying he queue lengh wih he uni price p ufi, and he overpaid price p over by he SR ha represens he overpaying incenive, modeled by a normal disribuion wih mean and variance being 50% and 12.5% of he asked price P ask, respecively. Once x e, x c, x f is generaed, we generae s g (ground ruh service saisfacion) such ha he average saisfacory service raio is P ssr. A SP, wheher malicious or no, has is own P ssr and has specific conex environmen insances under which i can provide saisfacory service wihin is capabiliy. Figure 2 shows a snapsho of s g (ground ruh service saisfacion) vs. x e, x c, x f for a SP wih P ssr = 60%. A. Environmen Seup Table IV liss a se of parameers and heir values/ranges used in our analysis. We simulae a SOANET wih n f nodes and he operaional area being a recangular area A, The radio ransmission range is R, and he mobiliy model is he Random Waypoin mobiliy (RWM) model [10] wihou considering mobiliy dependency among nodes or geography obsacles. Under RWM, every node moves randomly, wih speed S, movemen ime W, and pause ime P defining he movemen paern such ha he average encouner rae beween any wo nodes is approximaely α. We simulae encounering evens (i.e., when nodes are in he same subarea wihin radio range) a which service requess are issued and service qualiy received are recorded, and recommendaions are exchanged. Figure 2: Visualizaion of Synheic Daa. The hosiliy level is described by he percenage of malicious nodes (P b ) whose effec will be analyzed. Malicious nodes are randomly picked and will perform aacks as described in he hrea model. For CATrus, he degree of freedom ν 0 of he -disribuion error is se o 7 (as in [16]) for approximaing he original logisic disribuion error. We analyze he effec of he recommendaion filering hreshold parameer (T h ) on proocol performance.

8 8 (a) P ff vs. ime wihou recommendaion filering (b) P ff vs. ime wihou recommendaion filering (c) P ff vs. ime wih recommendaion filering (d) P ff vs. ime wih recommendaion filering Figure 3: Convergence, Accuracy, and Resiliency Behavior of CATrus for a Malicious Trusee SP. The Top Graphs are wihou Recommendaion Filering. The Boom Graphs are wih Recommendaion Filering. B. Convergence, Accuracy and Resiliency Numerical Resuls We use MATLAB o implemen he algorihm and collec numerical daa for analyzing he convergence, accuracy, and resiliency properies of CATrus agains collusion recommendaion aacks. The performance merics are false negaive probabiliy (P ff ) and false posiive probabiliy (P ff ) described earlier. Each daa poin repored is he average of 100 randomly generaed es cases in a es daa se x e, x c, x p, s g. Specifically, for he case in which s g (ground ruh) is 1 (saisfacory service) and he service rus prediced by CATrus is T, hen P ff = 1 T because 1 T is he belief ha he service provided will be unsaisfacory so i is he missing good service probabiliy. For he case in which s g (ground ruh) is 0 (unsaisfacory service) and he service rus prediced by CATrus is T, hen P ff = T because T is he belief ha he service provided will be saisfacory so i is he missing bad service probabiliy. Figure 3 shows P ff /P ff vs. ime as P b (he percenage of malicious nodes) varies in he range of 0-70%, for a malicious rusee SP randomly picked (wih P ssr =0.6). The op (boom) 2 graphs are wihou (wih) recommendaion filering. Wih recommendaion filering, if he difference beween he prediced service rus and he recommended service rus under he same conex environmen is above a hreshold, hen he recommendaion is filered. We inenionally used he same (and full) scale for all graphs, so we can visually see he sensiiviy of P ff /P ff values wih respec o P b. Firs of all, we see fas convergence behavior in boh cases wihou much sensiiviy o P b. However, wihou recommendaion filering, he predicion accuracy of P ff (see Figure 3(a)) is inversely relaed o P b. The reason is ha wihou recommendaion filering, as P b increases, a SR will receive more and more high bu false service rus recommendaions from more malicious nodes performing ballo-suffing aacks. These malicious rus recommendaions cause he SR o misidenify bad service provided by he malicious node. Second, from Figure 3(c), we observe ha wih recommendaion filering, CATrus is able o effecively filer ou false recommendaions and, as a resul, converges o he same low P ff value for high accuracy evenually. Noe ha he ideal P ff value is 0. Hence, a low P ff value close o 0 afer convergence means high accuracy. This demonsraes ha CATrus wih recommendaion filering is resilien o ballo-suffing aacks, even in exremely hosile environmens. Las, from comparing Figures 3(b) and 3(d), we observe ha recommendaion filering has a relaively small effec on Figure 4: Effec of Recommendaion Filering Threshold T h on max(p ff, P ff ) for a Malicious Trusee SP.

9 9 (a) P ff vs. ime wihou recommendaion filering (b) P ff vs. ime wihou recommendaion filering (c) P ff vs. ime wih recommendaion filering (d) P ff vs. ime wih recommendaion filering Figure 5: Convergence, Accuracy and Resiliency Behavior of CATrus for a Non-malicious Trusee SP. The Top Graphs are wihou Recommendaion Filering. The Boom Graphs are wih Recommendaion Filering. CATrus s predicion accuracy of P ff. The reason is ha ballo-suffing aacks can boos bad services bu canno furher boos already good services provided by a malicious node. Figure 4 analyzes he sensiiviy of CATrus performance wih respec o he recommendaion filering hreshold T h, a design parameer in our rus proocol design. For a service-oriened applicaion, wha maers o he end user is no o miss a good service (i.e., low P ff ) and no o misidenify a bad service as a good service (i.e., low P ff ). In many applicaions, minimizing boh P ff and P ff is desirable. Hence, we use min max (P ff, P ff ) as he performance meric o idenify he bes T h for performance maximizaion. There is a radeoff beween P ff and P ff. Tha is, as he minimum rus hreshold T h increases, he false negaive probabiliy P ff decreases while he false posiive probabiliy P ff increases. We observe from Figure 4 ha here exiss an opimal T h a which max P ff, P ff is minimized, given P b as inpu. For example when P b = 0.3, he opimal value T h is 0.8, bu when P b = 0.4, he opimal value T h is 0.5. This resul suggess ha one should dynamically adjus he filering hreshold T h o adap o changes in hosiliy condiions in order o maximize applicaion performance, i.e., minimizing boh P ff and P ff. Correspondingly, Figure 5 shows P ff /P ff vs. ime as P b varies in he range of 0-70%, for a non-malicious rusee SP wih P ssr =0.6. Here he rusee SP is non-malicious, so malicious nodes will perform bad-mouhing aacks o ruin is service rus, which, as opposie o ballo-suffing aacks, will affec P ff more han P ff. We observe from Figure 5(b) ha wihou recommendaion filering, he predicion accuracy of P ff is indeed inversely relaed o P b. The reason is ha wihou recommendaion filering, as P b increases, a SR will receive more and more low bu false service rus recommendaions from more malicious nodes performing bad-mouhing aacks. These malicious recommendaions cause he SR o misidenify good service provided by he non-malicious SP, which is downgraded due o bad-mouhing aacks. From Figure 5(d), we again observe ha wih recommendaion filering, CATrus is able o effecively filer ou false recommendaions and, as a resul, converges o he same low P ff value evenually as ime progresses. This resul demonsraes ha CATrus wih recommendaion filering is resilien o bad-mouhing aacks. From comparing Figure 5(a) wih Figure 5(c), we observe ha recommendaion filering has a relaively small effec on CATrus s high predicion accuracy of P ff. The reason is ha bad-mouhing aacks (on a non-malicious node) can effecively downgrade good services bu canno downgrade already bad services provided by a non-malicious node. Figure 6: Effec of Recommendaion Filering Threshold T h on max(p ff, P ff ) for a Non-malicious Trusee SP.

10 10 (a) P ff vs. P b for a malicious rusee SP. (b) P ff vs. P b for a malicious rusee SP. Figure 7: Performance Comparison of CATrus vs. Bea Repuaion and Adapive Trus for a Malicious Trusee SP. (a) P ff vs. P b for a non-malicious rusee SP. (b) P ff vs. P b for a non-malicious rusee SP. Figure 8: Performance Comparison of CATrus vs. Bea Repuaion and Adapive Trus for a Non-malicious Trusee SP. Figure 6 analyzes he sensiiviy of CATrus performance wih respec o he recommendaion filering hreshold T h when he rusee SP is non-malicious. We again observe from Figure 6 ha here exiss an opimal T h a which max P ff, P ff is minimized, given P b as inpu. We conclude ha adjusing T h dynamically o maximize applicaion performance is a viable design. Our analysis paves he way for realizing adapive conrol for proocol performance opimizaion. VI. PERFORMANCE COMPARISON In his Secion, we compare proocol performance of CATrus agains Bea Repuaion [12] and Adapive Trus Managemen [3]. For fair comparison, we compare all hree proocols a heir opimizing condiions. See Secion II for a descripion of hese wo baseline schemes and he reasons we selec hem for performance comparison. Figure 7 shows performance comparison in erms of converged P ff /P ff values for a malicious SP wih P ssr =0.6, as P b varies in he range of [0, 70%]. We observe ha while all hree proocols are resilien agains collusion recommendaion aacks, CATrus performs bes by a wide margin. We noice ha because he rusee SP is malicious, P ff will be affeced more han P ff via ballo-suffing aacks in his case. Correspondingly Figure 8 compares performance in erms of converged P ff / P ff values for a non-malicious SP wih P ssr =0.6, as P b varies in he range of [0, 70%]. We again observe ha CATrus ouperforms he oher wo by a wide margin. We noice ha because he rusee SP is non-malicious, P ff will be affeced more han P ff via bad-mouhing aacks in his case. The superioriy of CATrus over Bea Repuaion and Adapive Trus Managemen as demonsraed in Figures 7 and 8 is aribued o he fundamenal difference in rus proocol design logic. CATrus infers a service rus value for each conex environmen based on he rusee node s prediced service behavior in ha conex environmen, while Bea Repuaion or Adapive Trus Managemen jus mainains one service rus variable across all conex environmens. Consequenly, for a malicious rusee SP (as in Figure 7), P ff (missing a malicious node s bad service) ends o converge o he malicious node s average service rus value which is equivalen o he malicious node s saisfacory service raio P ssr = 0.6. For a non-malicious rusee SP (as in Figure 8), P ff (missing a non-malicious node s good service) ends o converge o 1 P ssr = = 0.4. In conras, our CATrus proocol is no bound by he saisfacory service raio. Raher, by learning he rusee node s service behavior, CATrus infers a service rus value as close o he ground ruh service saisfacion as possible in a paricular conex environmen. The associaion of service rus wih conex resuls in high predicion accuracy, simply because he rus value inferred is ied o a specific conex environmen. Bea Repuaion and Adapive Trus Managemen, on he oher hand, can only infer he average rus value across all conex

11 11 environmens as conex informaion is no aken ino consideraion in heir rus proocol design. VII. DISCUSSION A. Compuaion Feasibiliy In his subsecion, we discuss he compuaional feasibiliy for a SOANET node o execue CATrus o learn he behavior paerns of oher nodes (β j s for individual SPs) a runime. Based on our rus propagaion and aggregaion proocol design, a SR sores a new service record of lengh n c + 1 (for n c conex variables and user saisfacion) oward a SP afer having a direc service experience wih he SP. Two nodes encounering each oher exchange heir pas service records oward all oher nodes in he sysem. The memory complexiy per node is linear in O(n f n c n r ), where n f is he number of nodes, n c is he number of conex variables, and n r is he number of service records (as defined in Table IV), because every node needs o sore n r service records (each of size n c ) for each of he oher n f -1 nodes. The communicaion cos complexiy per node is O( n f n c αl ) where α is he encounering rae and L is he lengh of he measuremen inerval, because every node poenially can provide n f -2 service recommendaion records (each of size n c ) oward he oher n f -2 nodes whenever i encouners anoher node. Las, he compuaional complexiy is O(n f k max (n c, n r )), where k is he number of ieraions needed for reaching convergence, because every node needs o updae n r laen variables corresponding o he n r service records and β j of size n c for node j in each ieraion and his compuaional procedure is applied o each of he oher n f -1 nodes in he sysem. In general, n c n r so he compuaional complexiy is O(kn f n r ). Furher, he magniude of k largely depends on he granulariy of conex variable values, e.g., a range of (high, medium, low) for energy is of low granulariy, while a range of [0-10] joule is of high granulariy. By conrolling daa granulariy, k is a small consan relaive o n f or n r, so in pracice he compuaional complexiy of CATrus is jus O(n f n r ). As a comparison, he memory complexiy, message complexiy, and compuaional complexiy for boh Bea Repuaion [12] and Adapive Trus Managemen [3] are O(Cn f ), O(αLCn f ), and O(n f n r ), respecively, where C=2 for Bea Repuaion (2 posiive/negaive service couns) and C=5 for Adapive Trus Managemen (2 posiive/negaive service couns and 3 social similariy liss). We firs observe ha CATrus has he same order of compuaional complexiy O(n f n r ) as Bea Repuaion and Adapive Trus Managemen. Wih n c C (ha is, he number of conex variables is beween 2 o 5), CATrus, Bea Repuaion, and Adapive Trus Managemen have comparable communicaion overhead. Las, CATrus has a higher memory overhead by a facor of n r. In pracice, he memory overhead is lower because one may be ineresed in only he mos recen n r service records (e.g., in he pas hour or day). This memory requiremen can sill be excessive for SOANET nodes wih limied memory space. We refer he readers o a caching design [3] as a possible soluion o miigae his problem. For he experimenal seing specified in Table IV, a node wih a 2.4 GHz i7 CPU wih 8GB RAM ook 2.63s real ime o learn a SP s behavior paern and predic is rus. For a less powerful node, i may ake minues raher han seconds o compue he resul. Forunaely, he compuaional procedure needs o be execued only periodically in he background by a SR afer new observaions are colleced. Before he nex rus updae ime arrives, a SR can simply use learned behavior paerns (β j s for individual SPs) for decision making. B. Dealing wih Conflicing Behavior and Random Aacks In his subsecion, we discuss he applicabiliy of CATrus in environmens wih conflicing behavior and random aacks. Wih conflicing behavior aacks, a malicious SP can selecively provide saisfacory service for some SRs while providing unsaisfacory service for ohers. In general, he relaionship beween a SR and a SP deermines he SP s service behavior oward he SR. This is naurally solved by CATrus since i is based on SR-SP pairing. More specifically, if SP j who is capable of providing good service in a conex environmen provides bad service o SR i, hen SR i will consider SP j s bad service as SP j s service behavior in his conex environmen. In effec, from he perspecive of SR i, SP j s s g (ground ruh service saisfacion) is changed from 1 (saisfacory service) o 0 (unsaisfacory) which is learned by logisic regression. As a resul, SR i will predic unsaisfacory service being provided by SP j even hough SP j is capable of providing saisfacory service in he same conex environmen. Wih random aacks, a malicious node will provide bad service only randomly so as no o risk iself being labeled as a node providing bad service and no being seleced for service. Again random aack can be naurally covered by CATrus since i is based on SR-SP pairing. From he perspecive of SR i who is under random aacks by SP j, SP j s s g (ground ruh service saisfacion) is someimes 1 (saisfacory service) and someimes 0 (unsaisfacory), which is learned by logisic regression. As a resul, SR i will predic someimes saisfacory service and someimes unsaisfacory service being provided by SP j even hough SP j is capable of providing saisfacory service in he same conex environmen. Consequenly, he degree o which he malicious node can disguise iself as a SP providing good service is simply proporional o 1 random aack probabiliy. As long as SP j s random aack probabiliy is no zero, he random aack behavior will be learned by SR i. C. Linear Model vs. Non-linear Model Comparison

12 12 (a) P ff vs. P b for a malicious rusee SP. (b) P ff vs. P b for a malicious rusee SP. Figure 9: Performance Comparison of Linear CATrus vs. Non-Linear CATrus for a Malicious Trusee SP. (a) P ff vs. P b for a non-malicious rusee SP. (b) P ff vs. P b for a non-malicious rusee SP. Figure 10: Performance Comparison of Linear CATrus vs. Non-Linear CATrus for a Non-malicious Trusee SP. In many applicaions, conex variables may no be independen, including covariae relaionship beween service observaions and correlaion beween conex variables. The resuls which we have repored above are based on a simple linear model wih compuaional complexiy of O(n f n r ) (see VII.A) o model he relaion beween conex variables and observaions. In his subsecion, we conduc a comparaive analysis o es if he predicion accuracy may improve furher wih a non-linear model a he expense of added compuaional complexiy. The non-linear model implemened is he muli-layer feedforward neural nework (FNN) algorihm [7] wih n c nodes in he inpu layer and n c 2 nodes in he hidden layer, resuling in compuaional complexiy of O(n f n r n c 3 ) o process n r service records for each of he oher n f -1 nodes. Figures 9 and 10 compare linear CATrus vs. non-linear CATrus performance in erms of converged P ff /P ff values for a malicious rusee SP and a non-malicious rusee SP, respecively, wih P ssr =0.6, as P b varies in he range [0, 70%]. Noe ha he seup is he same as in Figures 7 and 8. Also noe ha regardless of node ype (malicious or non-malicious), he probabiliies of misidenifying a node s bad service and good service are measured by P ff and P ff, respecively. As shown in Figure 9 (for a malicious rusee SP) as P b increases, linear CATrus performs beer han non-linear CATrus in P ff, while non-linear CATrus performs beer han linear CATrus in P ff. Because he rusee SP is malicious in his case, P ff (he probabiliy of he SP s bad service being missed) increases as P b increases via ballo-suffing aacks. We observe ha non-linear CATrus is less resilien o ballo-suffing aacks han linear CATrus. The reason is ha FNN uses mean square error as he objecive funcion known o be sensiive o conaminaed daa [7]. On he oher hand in Figure 10 (for a non-malicious rusee SP) as P b increases, non-linear CATrus performs beer han linear CATrus in P ff, while linear CATrus performs beer han non-linear CATrus in P ff. Because he rusee SP is non-malicious in his case, P ff (he probabiliy of he SP s good service being missed) increases as P b increases via bad-mouhing aacks. We again observe ha non-linear CATrus is less resilien o bad-mouhing aacks han linear CATrus. On he whole here is a virual ie beween he linear and non-linear models. However, he much higher P ff for a malicious rusee SP as P b increases (see Figure 9(a)) and he much higher compuaion complexiy make he non-linear model an undesirable choice for runime execuion. VIII. CONCLUSION We proposed a novel regression-based rus model, CATrus, for evaluaing service rus in service-oriened ad hoc neworks. CATrus assesses each SP in erms of is service behavior paerns in response o conex environmen changes. The ne effec is ha we are able o learn and hen predic is service behavior in a paricular conex environmen, insead of judging is rusworhiness from saisfacory/unsaisfacory

13 13 service hisory across all conex environmens. We also buil a novel hreshold-based recommendaion filering mechanism o effecively filer ou dishones recommendaions. A salien feaure of our model is ha i can accommodae all conex environmen variables deemed criical o a SP s service behavior. We analyzed convergence, accuracy and resiliency properies of CATrus and validaed he heory via simulaion. We conduced sensiiviy analysis of CATrus performance wih respec o key design parameers. We also conduced a comparaive analysis of CATrus wih he Bea repuaion scheme wih belief discouning [12] and Adapive Trus Managemen wih collaboraive filering [3]. Our resuls validaed by simulaion demonsrae ha CATrus ouperforms hese exising approaches in boh he missing good service and missing bad service probabiliies. Finally, we discussed applicabiliy of CATrus in erms of compuaional feasibiliy, dealing wih conflicing behavior aacks and random aacks, and performance characerisics of CATrus implemened wih he linear model vs. he non-linear model. For fuure work, we plan o furher validae CATrus wih real-world daa such as geo-disribued services daa colleced using PlaneLab. We also plan o apply CATrus o user-cenric social P2P/IoT applicaions characerized wih various applicaion-specific QoS and social conex environmen variables o furher demonsrae is uiliy. Lasly, we plan o furher es he resiliency of CATrus agains more complicaed environmenal and operaional scenarios such as noisy environmens and applicaion-specific mobiliy paerns, as well as more sophisicaed aack behaviors such as opporunisic, collusion, and insidious aacks [19]. ACKNOWLEDGMENT This work is suppored in par by he U. S. Army Research Laboraory and he U. S. Army Research Office under conrac number W911NF This research was also parially suppored by he Deparmen of Defense (DoD) hrough he office of he Assisan Secreary of Defense for Research and Engineering (ASD (R&E)). The views and opinions of he auhor(s) do no reflec hose of he DoD or ASD (R&E). REFERENCES [1] V. Balakrishnan, V. Varadharajan, and U. Tupakula, "Subjecive Logic Based Trus Model for Mobile Ad hoc Neworks," in The 4h Inernaional Conference on Securiy and Privacy in Communicaion Neworks, 2008, pp [2] E. Borgia, "The Inerne of Things Vision: Key Feaures, Applicaions and Open Issues," Compuer Communicaions, vol. 54, pp. 1-31, December [3] I.R. Chen, J. Guo, and F. Bao, "Trus Managemen for SOA-based IoT and Is Applicaion o Service Composiion," IEEE Transacions on Services Compuing, 2016, in press. [4] I.R. Chen, J. Guo, F. Bao, and J.H. Cho, "Trus Managemen in Mobile Ad Hoc Neworks for Bias Minimizaion and Applicaion Performance Maximizaion," Ad Hoc Neworks, vol. 19, pp , [5] J.H. Cho, A. Swami, and I.R. Chen, "Modeling and Analysis of Trus Managemen for Cogniive Mission-Driven Group Communicaion Sysems in Mobile Ad Hoc Neworks," in In l. Conf. Compuaional Science and Engineering, 2009, pp [6] J.H. Cho, A. Swami, and I.R. Chen, "Modeling and analysis of Trus Managemen wih Trus Chain Opimizaion in Mobile Ad Hoc Neworks," Journal of Nework and Compuer Applicaions, vol. 35, no. 3, pp , May [7] M.T. El-Melegy, M.H. Essai, and A.A. Ali, "Robus Training of Arificial Feedforward Neural Neworks," in Fondaions of Compuaional Inelligence Volume 1, A.-E. Hassanien e al., Eds.: Springer Berlin Heidelberg, 2009, ch. 9, pp [8] S. Fruhwirh-Schnaer and R. Fruhwirh, "Bayesian Inference in he Mulinomial Logi Model," Ausrian Journal of Saisics, vol. 41, no. 1, pp , [9] H. Gao e al., "A Survey of Incenive Mechanisms for Paricipaory Sensing," IEEE Communicaions Survey & Tuorials, vol. 17, no. 2, pp , [10] D.B. Johnson, D.A. Malz, and J. Broch, "DSR: The Dynamic Source Rouing Proocol for Muli-Hop Wireless Ad Hoc Neworks," in Ad Hoc Neworking, C.E. Perkins, Ed.: Addison-Wesley, 2001, ch. 5, pp [11] A. Jøsang, "A Logic for Uncerain Probabiliies," Inernaional Journal of Uncerainy, Fuzziness and Knowledge-based Sysems, vol. 9, no. 3, pp , [12] A. Jøsang and R. Ismail, "The Bea Repuaion Sysem," in 15h Bled Elecronic Commerce Conf., 2002, pp [13] A. Jøsang, R. Ismail, and C. Boyd, "A Survey of Trus and Repuaion Sysems for Online Service Provision," Decision Suppor Sysems, vol. 43, no. 2, pp , [14] S.D. Kamvar, M.T. Schlosser, and H. Garcia-Molina, "The Eigenrus Algorihm for Repuaion Managemen in P2P Neworks," in 2003 World Wide Web Conf., [15] Z. Li, X. Li, V. Narasimhan, A Nayak, and I Sojmenovic, "Auoregression Models for Trus Managemen in Wireless Ad Hoc Neworks," in IEEE Global Telecommunicaions Conf., 2011, pp [16] C. Liu, "Robi Regression: A Simple Robus Alernaive o Logisic and Probi Regression," in Applied Bayesian Modeling and Causal Inference, A. Gelman and X. L. Meng, Eds. London: Wiley, 2004, ch. 21. [17] C.H. Liu, J. Fan, P. Hui, J. Wu, and K.K. Leung, "Towards QoI and Energy-Efficiency in Paricipaory Crowdsourcing," IEEE Trans. Vehicular Technology, vol. 64, no. 10, pp , [18] M. Mahew and N. Weng, "Qualiy of Informaion and Energy Efficiency Opimizaion for Sensor Neworks via Adapive Sensing and Transmiing," IEEE Sensors Journal, vol. 14, no. 2, pp , [19] R. Michell and I.R. Chen, "Effec of Inrusion Deecion and Response on Reliabiliy of Cyber Physical Sysems," IEEE Trans. Reliabiliy, vol. 62, no. 1, pp , [20] M. Nii, R. Girau, and L. Azori, "Trusworhiness Managemen in he Social Inerne of Things," IEEE Transacions on Knowledge and Daa Managemen, vol. 26, no. 5, pp. 1-11, [21] V. Roy, "Convergence Raes for MCMC Algorihms for a Robus Bayesian Binary Regression Model," Elecronic Journal of Saisics, vol. 6, pp , [22] Z. Su, L. Liu, M. Li, X. Fan, and Y. Zhou, "ServiceTrus: Trus Managemen in Service Provision Neworks.," in IEEE Inernaional Conference on Services Compuing, 2013, pp [23] D.J. Thornley, R. Young, and J. Richardson, "From Mission Specificaion o Qualiy of Informaion Measures Closing he Loop in Miliary Sensor Neworks," in Annual Conf. In'l Technology Alliance, 2008, pp [24] A. Twigg, "A Subjecive Approach o Rouing in P2P and Ad Hoc Neworks," in Trus Managemen, Paddy Nixon and Soirios Terzis, Eds.: Springer Berlin Heidelberg, 2003, pp [25] R. Venkaaraman, M. Pushpalaha, and T. Rama Rao, "Regression-based rus model for mobile ad hoc neworks," Informaion Securiy, IET, vol. 6, no. 3, pp , Sepember [26] Y. Wang, I.R. Chen, J.H. Cho, A. Swami, and K. Chan, "Trus-based Service Composiion and Binding wih Muliple Objecive Opimizaion in Service-Oriened Ad Hoc Neworks," IEEE Transacions on Services Compuing, 2016, in press.

14 14 [27] Y. Wang, I.R. Chen, and D.C. Wang, "A Survey of Mobile Cloud Compuing Applicaions: Perspecives and Challenges," Wireless Personal Communicaions, vol. 80, no. 4, 2015, pp [28] X. Wang e al., "Trus and Independence Aware Decision Fusion in Disribued Neworks," in 2013 IEEE In l. Conf. Pervasive Compuing and Communicaion Workshops, 2013, pp [29] J.L. Wang and S.P. Huang, "Fuzzy Logic Based Repuaion Sysem for Mobile Ad Hoc Neworks," in Knowledge-Based Inelligen Informaion and Engineering Sysems, B. Apolloni, R.J. Howle, and L. Jain, Eds.: Springer Berlin Heidelberg, 2007, vol. 4693, pp [30] Y. Wang e al., "LogiTrus: A Logi Regression-based Trus Model for Mobile Ad Hoc Neworks," in PASSAT, [31] "Wireless LAN Medium Access Conrol (MAC) and Physical Layer (PHY) Specificaions," IEEE Sandard , Jun [32] H. Xia, Z. Jia, L. Ju, and Y. Zhu, "Trus Managemen Model for Mobile Ad Hoc Nework Based on Analyic Hierarchy Process and Fuzzy Theory," IET Wireless Sensor Sysems, vol. 1, no. 4, pp , [33] L. Xiong and L. Liu, "PeerTrus: Supporing Repuaion-Based Trus for Peer-o-Peer Elecronic Communiies," IEEE Trans. Knowledge and Daa Engineering, vol. 16, no. 7, pp , [34] Y. Yu, L. Guo, X. Wang, and C. Liu, "Rouing securiy scheme based on repuaion evaluaion in hierarchical ad hoc neworks," Compuer Nework, vol. 54, no. 9, pp , [35] V.A. Zeihaml, "Consumer Percepions of Price, Qualiy, and Value: A Means-End Model and Synhesis of Evidence," Journal of Markeing, vol. 52, pp. 2-22, AUTHOR BIOGRAPHIES Yaing Wang received her Bachelor degree from Hubei Universiy of Technology, Wuhan, China in She received her PhD degree in Compuer Science from Virginia Tech in Her research ineress include securiy, compuer neworks, wireless neworks, mobile compuing, rus managemen, and reliabiliy and performance analysis. Ing-Ray Chen received he BS degree from he Naional Taiwan Universiy, and he MS and PhD degrees in compuer science from he Universiy of Houson. He is a professor in he Deparmen of Compuer Science a Virginia Tech. His research ineress include mobile compuing, wireless sysems, securiy, rus managemen, and reliabiliy and performance analysis. Dr. Chen currenly serves as an edior for IEEE Communicaions Leers, IEEE Transacions on Nework and Service Managemen, The Compuer Journal, and Securiy and Nework Communicaions. He is a recipien of he IEEE Communicaions Sociey William R. Benne Prize in he field of Communicaions Neworking. Jin-Hee Cho received he BA from he Ewha Womans Universiy, Seoul, Korea and he MS and PhD degrees in compuer science from he Virginia Tech. She is currenly a compuer scienis a he U.S. Army Research Laboraory, Adelphi, Maryland. Her research ineress include nework securiy, rus and risk managemen, cogniive modeling, and nework science. She received he bes paper awards in IEEE TrusCom09 and BRIMS13. She is a recipien of he IEEE Communicaions Sociey William R. Benne Prize in he field of Communicaions Neworking, and a receipien of he Presidenial Early Career Awards for Scieniss and Engineers. Ananhram Swami is wih he U.S. Army Research Laboraory (ARL) as he Army s ST (Senior Research Scienis) for Nework Science. He is an ARL Fellow and Fellow of he IEEE. He has held posiions wih Unocal Corporaion, he Universiy of Souhern California (USC), CS-3 and Malgudi Sysems. He was a Saisical Consulan o he California Loery, developed a MATLAB-based oolbox for non-gaussian signal processing, and has held visiing faculy posiions a INP, Toulouse, and Imperial College, London. He received he B.Tech. degree from IIT-Bombay, he M.S. degree from Rice Universiy, and he Ph.D. degree from USC, all in Elecrical Engineering. His research ineress are in he broad area of nework science wih applicaions in composie acical neworks. Yen-Cheng Lu is a Ph.D. candidae in he Compuer Science Deparmen a Virginia Tech. He received his B.S. in Applied Mahemaics from Naional Sun Ya-Sen Universiy, Taiwan in His research ineress are in he areas of saisical machine learning and daa mining, especially in oulier deecion, spaio-emporal analysis, ex mining, and ransporaion applicaions. Chang-Tien Lu received he MS degree in Compuer Science from Georgia Tech in 1996 and he PhD degree in Compuer Science from he Universiy of Minnesoa in He is a professor in he Deparmen of Compuer Science, Virginia Tech. His research ineress include spaial daabases, daa mining, geographic informaion sysems, and inelligen ransporaion sysems. Dr. Lu served as he Vice Chair of he ACM Special Ineres Group on Spaial Informaion (ACM SIGSPATIAL) from 2011 o Dr. Lu serves as an edior for ACM Transacions on Spaial Algorihms and Sysems. He is a member of IEEE. Jeffrey J.P. Tsai received a Ph.D. degree in Compuer Science from he Norhwesern Universiy, Evanson, Illinois. He is he Presiden of Asia Universiy, Taiwan, and a professor in he Deparmen of Bioinformaics and Biomedical Engineering a Asia Universiy. Dr. Tsai was a Professor of Compuer Science a he Universiy of Illinois, Chicago. His curren research ineress include bioinformaics, ubiquious compuing, services compuing, inrusion deecion, knowledge-based sofware engineering, formal modeling and verificaion, disribued real-ime sysems, and inelligen agens. He was an Associae Edior of he IEEE Transacions on Knowledge and Daa Engineering and is currenly an Associae Edior of he IEEE Transacions on Services Compuing. He is currenly he Co-Edior-in-Chief of he Inernaional Journal on Arificial Inelligence Tools and Book Series on Healh Informaics. Dr. Tsai received an IEEE Technical Achievemen Award and an IEEE Meriorious Service Award from IEEE Compuer Sociey. He is a Fellow of he AAAS, IEEE, and SDPS.