Flow-based reputation: more than just ranking

1.3 MB·English

by  Antonino Simone

Flow-based reputation: more than just ranking
AntoninoSimone,BorisSˇkoric´,NicolaZannone
EindhovenUniversityofTechnology
2
1
0 Abstract
2
ThelastyearshaveseenagrowinginterestincollaborativesystemslikeelectronicmarketplacesandP2P

n filesharingsystemswherepeopleareintendedtointeractwithotherpeople. Thosesystems, however,
a
aresubjecttosecurityandoperationalrisksbecauseoftheiropenanddistributednature. Reputation
J
systems provide a mechanism to reduce such risks by building trust relationships among entities and
5
identifying malicious entities. A popular reputation model is the so called flow-based model. Most
2
existingreputationsystemsbasedonsuchamodelprovideonlyaranking,withoutabsolutereputation

values; this makes it difficult to determine whether entities are actually trustworthy or untrustworthy.
]
Y In addition, those systems ignore a significant part of the available information; as a consequence,
reputation values may not be accurate. In this paper, we present a flow-based reputation metric that
C
givesabsolutevaluesinsteadofmerelyaranking.Ourmetricmakesuseofalltheavailableinformation.
.
s Westudy,bothanalyticallyandnumerically,thepropertiesoftheproposedmetricandtheeffectofattacks
c
onreputationvalues.
[

1
v 1 Introduction
0
2
The advent of the Internet has brought new business opportunities and favored the development of col-
8
laborative environments. In particular, the Internet provides the basis for the development of electronic
1
. communities where strangers interact with each other and possibly do business. However, these interac-
3
tionsinvolverisks. Forinstance,inaneCommercesetting,buyersarevulnerabletorisksduetopotential
0
incompleteormisleadinginformationprovidedbysellers[34]. Similarly,sellersaresubjecttotheriskthat
2
1 thecounterpartyinatransactionwillbeunabletohonoritsfinancialobligations. Tomitigatethoserisks,
: thereistheneedofadecisionsupportsystemthatisabletodeterminethetrustworthinessofcollaborative
v
parties.
i
X Reputationsystemsarewidelyconsideredas‘thesolution’toassesstrustrelationshipsamongusersandto
r identifyandisolatemalicioususers[28]. Reputationsystemsarecurrentlyadoptedincommercialonline
a
applicationssuchasP2Pfilesharing[8],websearch[9],electronicmarketplaces[3,15],andexpertsystems
[2,16]. Reputationisacollectivemeasureoftrustworthinessbasedonaggregatedfeedbackrelatedtopast
experiencesofusers.Thebasicideaistoletusersrateeachotherandtoaggregateratingsaboutagivenuser
to derive a reputation value. This value is then used to assist other users in deciding whether to interact
with that user in the future [21]. In the last years, a number of reputation systems have been proposed
to aggregate ratings and calculating reputation values; each system is based on a particular theoretical
foundation(see[18,21]forasurvey).
Thequalityofareputationsystemisdeterminedbyhowaccuratelythecomputedreputationpredictsthe
futureperformanceofentities[18]. This,however,isdifficulttoachievebecausesomeuserscanattempt
tomanipulatetheirreputationandthereputationofothersfortheirownbenefit. Mostexistingreputation
systemslacktheabilitytodiscriminatehonestratingsfromdishonestyones. Therefore,suchsystemsare
vulnerabletomalicioususerswhoprovideunfairratings[34].
Theissueofdiscriminatinghonestfromdishonestratingsisusuallyaddressedbyreputationsystemsusing
thesocalledflowmodel[21]asthemathematicalfoundation. ExamplesofsuchsystemsareEigenTrust
[23], PageRank [9], SALSA [26], and PeerTrust [34]. What makes them appealing is that reputation is
computed taking into account the feedback of all the users involved in the system, and the feedback is
weightedwithrespecttothereputationoftheuserprovidingthefeedback. Flowmodelsareoftenbased
1
User Ratings User Ratings
Bob positive1 Bob positive100
neutral999 neutral900
negative0 negative0
Charlie positive9 Charlie positive900
neutral991 neutral100
negative0 negative0
David positive0 David positive200
neutral100 neutral600
negative900 negative200
(a) (b)
Figure1: Examplescenarios. 1000ratingsgiventoBob,CharlieandDavid.
onthetheoryofMarkovchains. Thefeedbackprovidedbytheusersisaggregatedandnormalizedinorder
to obtain a Markov chain. Thereby, starting from a vector of initial reputation values, Markov steps are
repeatedlyapplieduntilastablestatehasbeenreached.
Unfortunately, thecurrentstateofaffairsregardingthiskindofreputationmodelisnotverysatisfactory.
Firstofall,thosesystemsonlyprovidearankingofusersratherthananabsolutereputationvalue.Although
thiscanbeacceptableinsomeapplicationslikewebsearch,itisnotinotherslikeelectronicmarketplaces.
For instance, a buyer prefers to do business with an honest seller rather than with the most trustworthy
oneinapoolofdishonestsellers. Inascenariowherehealthcareprovidersarewillingtousedatacreated
by patients [32], the quality of the data provided by a patient cannot be assessed by only looking if he
is more capable than other patients to do good measurements; an absolute quality metric is required. In
addition,mostoftheflow-basedsystemsignoreasignificantpartoftheavailableinformation(e.g.,negative
feedback). Consequently,thereputationvaluesthosesystemsreturnmaybeinaccurate.
To illustrate these points, let us consider an electronic marketplace where users can rate each other after
eachtransaction, asineBay[15]. Here,eachtimeAlicehasatransactionwithanotheruserj (e.g., Bob,
Charlie, David), she may rate the transaction as positive, neutral, or negative. Let us consider scenarios
(a)and(b)inFig.1. FromareputationmetricwewouldexpectthatAlicehasalmostneutralopinionof
BobandCharlieandnegativeopinionofDavidin(a),andpositiveopinionofBobandCharlieandneutral
opinionofCharliein(b). However,ifweapplythereputationmetricproposedin[23]tothesescenarios,
wehavethatinboth(a)and(b)Bobhaslocaltrustvalue10.1,Charlie0.9andDavid0. Theformulasused
tocomputethesevalueswillbepresentedinSection2. Here,wejustwanttopointoutthatthemetricin
[23]isunabletodistinguishbetweencases(a)and(b). Thislackofdistinguishingpowercanberiskyfor
users as it can mislead them in their decision whether to do business with other users. For instance, the
reputation value of Charlie computed using the metric in [23] in (a) can lead users to think that Charlie
is ‘very’ trustworthy while in fact he is not. These reputation values only indicate that Charlie is more
trustworthythanothers(i.e.,arankingwithoutanabsolutescale).
Moreover,itisworthnotingthatin[23]negativeratingsarediscardedinordertoobtainaMarkovchain.
Consequently, it is not possible to distinguish between users that have (strong) negative reputation and
users that have neutral reputation. This can be observed by comparing the ratings received by David in
scenarios(a)and(b)ofFig.1: althoughDavidreceivedalargenumberofnegativeratingsandnopositive
ratingsin(a)andanequalnumberofpositiveandnegativeratingsin(b),hisreputationvalueisequalto0
inbothscenarios.
Lastbutnotleast, thedesignofflow-basedreputationmodelsrequiresincludinganumberofparameters
which intend to guarantee the convergence of computations. However, a comprehensive and exhaustive
study of the impact of such parameters on reputation values and how they can be used to protect the
systemsagainstattackshasnotbeenconductedyet.
Ourcontributions Inthispaper, wepresentareputationmetricthatenhancesexistingflow-basedrep-
utation metrics (see [9, 23, 31]) by providing absolute values instead of merely a ranking, and by not
discardinganyavailableinformation. Computingabsolutereputationvaluesmakesitpossibletoquantify
1In[23]localtrustvaluesindicatetheopinionthatusershaveofotherusersbasedonpastexperiences. Localtrustvaluesarein
therange[0,1].
2
the trustworthiness of users and therefore provides a measure to univocally compare reputations values.
Thisallowsus,forinstance,todistinguishcases(a)and(b)inFig.1. Inthedesignofourreputationmet-
ric,westudytheeffectofself-reference(i.e.,auserwhogivesfeedbacktohimself). Wedemonstratethat
ourconstructionminimizessuchaneffect,leadingtoreputationvaluesthatareclosertointuitiveexpecta-
tions. Weformallyprovethattheproposedreputationmetricalwayshasasolution,andthatthesolutionis
unique. Wealsodiscussseveralmethodsofsolvingthereputationequationnumerically.
Ourmetricdependsonanumberofparameters: apatternmatrix,whichstoresthe(aggregated)feedback
received by the system owner from the users about the interactions they had with other users (hereafter,
thepatternmatrixisalsocalledindirectevidencematrix),astartingreputationvector,whichrepresentsthe
directinformationknowntothesystemowneraboutthetrustworthinessofentitiesinthesystem, andan
interpolationparameterα,whichservesasaweightfordirectversusindirectinformation. Weanalytically
study the impact of changes in the indirect evidence matrix on reputation values. This study allows us
to analyze how someone can attack the reputation system by providing unfair ratings. In particular, we
analyze self-promoting and slandering attacks[18] as well as Sybil attacks[14]. To study self-promoting
(slandering)attacks,weassumethatanattackercanmanipulatereputationvaluesbygivingpositiveratings
to users who gave positive ratings to him (negative ratings to the target) and negative ratings to users
who gave negative ratings to him (positive ratings to the target). We study the effect of Sybil attacks by
modelinganattackerwhosubvertsthereputationsystembyfirstcreatingalargenumberofpseudonymous
entities,andthenusingthemtoinfluencethereputationvalueofatargetuserinasimilarwayasisdone
forself-promotingandslanderingattacks.
Ontheotherhand,weassumethatthestartingreputationvectorandtheweightparameteraredefinedbythe
systemownerandcannotbemodifiedbytheattacker.Wenumericallystudytheimpactoftheseparameters
onreputationvaluesandanalyzehowtheycanbeusedtomitigatetheeffectofabovementionedattacks.
Theanalysisallowsustodrawsomeguidelinesforchoosingthevalueoftheseparameters. Theguidelines
aregeneralandapplytoreputationmetricsthatusesimilarparameters.
Inthisworkwearemainlyinterestedinthestudyofthemathematicalmodelofreputationsystems,rather
thaninthealgorithmimplementingthemathematicalmodel. Therefore,weassumethroughoutthepaper
theexistenceofacentralauthoritywhichcollectsallratingsandcalculatesthereputationofeverypartic-
ipatinguser. Thisassumptionisinlinewiththeapproachproposedin[9]whereasearchenginecollects
information about hyperlinks of several million pages and indexes search results on the basis of such an
information.
The paper is structured as follows. Section 2 provides an overview of reputation systems. Section 3
presents our metric and Section 4 discusses its formal properties. Section 5 discusses several methods
for computing the reputation vector. Section 6 evaluates reputations numerically for a number of attack
scenarios. Section7concludesanddiscussesdirectionsforfuturework.
2 Reputation Systems
Reputationsystemshavebeenproposedasamechanismfordecisionsupportinopencollaborativesystems,
whereentitiesdonotknoweachotherapriori. Reputationisacollectivemeasureoftrustworthinessbuilt
fromuserexperience. Auser’sexperienceconsistsoftheeventsobservedbythatuser. Eventscanbe,for
instance,voicedopinions,thatisopinionsthataremadepublic[31],downloads[23],ortransactions[15].
Userscanratethebehaviorofotherusersonthebasisoftheirexperience. Inparticular,ratingsrepresent
directjudgmentsofthebehaviorofuserswithrespecttotheperspectiveofthejudginguser. Thosepieces
of evidence are aggregated in order to calculate the reputation of users. Reputation gives the extent to
whichthetarget’sbehaviorisgoodorbad[4].
In [18] Hoffman et al. identify three dimensions of reputation systems: formulation (the mathematical
model), calculation (the algorithm implementing the model and actually computing reputation), and dis-
semination(themechanismtodisseminatetheoutcome).Here,wemainlyfocusontheformulationdimen-
sion,andonattacksonthemathematicalmodel. Theformulationofareputationsystemincludesanumber
ofaspects: informationsource,informationtype,temporalaspects,andreputationmetrics. Thesourceof
informationcanbesubjective,i.e.theratingisbasedonsubjectivejudgmentlikein[15,31],orobjective,
i.e.theratingisdeterminedfromformalcriterialikein[9]. Theadvantageofusingobjectiveinformation
3
isthatitscorrectnesscanbeverifiedbyotherentities; however, sometimesitisdifficulttodefineformal
criteriathatfullycaptureentities’opinions. Atthesametime,subjectiveinformationmakesitdifficultto
protectthesystemagainstunfairrating,whichliesatthebasisofself-promotingandslanderingattacks(see
[18]). AtypicalexampleoftheseattacksisthesocalledSybilattack(see[14]),inwhichdifferententities
ormultipleidentitiesheldbythesameentitycolludetopromoteeachother. Anotheraspectofinformation
sources is observability. Here it is important whether the information is directly observed by the entity
calculating the reputation, or it is obtained second-hand or inferred from direct information. We call the
reputationvaluecalculatedfromdirectlyobservedinformationdirectreputation.2 Indirectinformationis
widelyusedinreputationsystemstosupportanotionoftransitivityoftrust(see[9,13,22,23]). Although
trustisnotalwaystransitiveinreallife[11],trustcanbetransitiveundercertainsemanticconstraints[22].
In this paper we assume that ratings have the same trust purpose (i.e., the same semantic content) and
therefore their aggregation is meaningful. We also do not distinguish between functional trust (i.e., the
abilitytomakeajudgmentaboutatransaction)andreferraltrust(i.e.,theabilitytorefertoathirdparty).
As in [23, 34], we assume that a user trusts the opinion of users with whom he had positive transitions,
sinceuserswhoarehonestduringtransactionsarealsolikelytobehonestinreportingtheirratings.
The type of information used by a reputation system has a considerable impact on the types of attack to
which the system is vulnerable. Some reputation systems (see [15, 23]) allow users to specify ternary
ratings(positive, neutral, negative); othersallowonlypositive[9,31]oronlynegativeratings. Although
systemsthatonlyconsiderpositivevaluesarerobusttoslanderingattacks,theyarenotflexibleenoughto
discriminatebetweenhonestandmaliciousentities. Negativereputationsystemsareparticularlyvulnera-
bletowhitewashingattacks[18];entitieswhoreceivealargenumberofnegativeratingscanchangetheir
identityandre-enterthesystemwithafreshreputation[25]. Therefore,oneofourrequirementsforrepu-
tationsystemsisthatentitiesshouldnotbeabletogainanadvantagefromtheirnewcomerstatus. Atthe
sametime,newcomersshouldnotbepenalizedfortheirstatus. Here,thetemporalaspectsofareputation
systemplayafundamentalrole.Forinstance,somesystems(see[9,19,23,31])donotdistinguishbetween
recentandpastbehavior,whereasothersystems(e.g.,see[4,15,24])givemoreweighttorecentbehavior.
Forinstance,in[4]reputationvaluesareupdatedbyaggregatingthepreviousreputationvaluewithafactor
indicatingtheproximityoftherecentscoretothepastreputation,i.e.r(t) =r(t−1)+µ(d ,r(t−1)),where
ij ij ij ij
µisafunctionthatdetermineshowfastthereputationvaluer changesafteraneventwithratingd .
ij ij
Areputationmetricisusedtoaggregateratingsandcomputereputations.Severalcomputationmodelshave
beenused: simplesummationoraverageofratings[3,15,16],Bayesiansystems[20,30],betaprobability
density [32], discrete trust models [10], belief models [1, 19], fuzzy models [7, 29], and flow models
[9,23,26,33,31]. Flowmodelsareparticularlyinterestingastheymakeitpossibletocomputereputation
bytransitiveiterationthroughloopsandarbitrarychainsofentities.Here,wepresentthereputationsystem
proposedin[23]asanexampleofaflow-basedreputationsystem. Eachtimeuserihasatransactionwith
anotheruserj,shemayratethetransactionaspositive(d =1),neutral(d =0),ornegative(d = 1).
ij ij ij
−
Thelocaltrustvalues isdefinedasthesumoftheratingsthatihasgiventoj,
ij
s = d . (1)
ij ij
transactions
(cid:88)
ThisaggregatedfeedbackisthennormalizedinordertoobtainaMarkovchain. Formally,thenormalized
localtrustvaluea isdefinedasfollows
ij
max(s ,0)
ij
a = . (2)
ij
max(s ,0)
k ik
Normalized local trust values can be organized(cid:80)in a matrix [a ] (the so called pattern matrix). In flow
ij
models the reputation vector (the vector containing all reputation values) corresponds to the steady state
vector ofaMarkovchain; onestartswithavectorofinitialreputationvaluesandthenrepeatedlyapplies
theMarkovstepuntilastablestatehasbeenreachedusingthefollowingequation
r(k+1) =αATr(k)+(1 α)p (3)
−
2Directreputationisalsocalledsubjectivereputation[27]orlocaltrustvalue[23].
4
where r is the reputation vector, A is the pattern matrix, p is a vector of initial reputation values, and
α [0,1]isadampingfactor.3
∈
Unfortunately, thecurrentstateofaffairsregardingthiskindofreputationmodelisnotverysatisfactory.
Firstofall, theapproachitselfhasadrawback. IntheMarkovchainapproach, reputationvaluesneedto
benormalizedinthesensethattheyaddupto100%(2). Theproblemisthatsuchreputationvaluescarry
relativeinformationonly. Applying(1)and(2)tothetwoscenariospresentedinFig.1,weobtaininboth
scenarios that Bob has normalized local trust value equal to 0.1, Charlie has 0.9 and David has 0. This
is good enough for ranking, but when an absolute measure is required, the Markov chain approach fails.
Actually, one may expect that Bob and Charlie have a similar reputation value in the first scenario; also
that the reputation value of Bob in the second scenario is greater than the reputation value of Charlie in
thefirstscenario. Inaddition,whenentitieshaveasimilarreputationvalue,itisimpossibletoseewhether
theyarealltrustworthyoralluntrustworthy. Supposeascenario(i)inwhichBobandCharliereceiveten
positiveratingsoutof1000transactionsfromAliceandascenario(ii)inwhichBobandCharliereceive
900positiveratingsoutof1000transactions. Inprinciple,BobandCharlieshouldhaveneutralreputation
in (i) and strongly positive reputation in (ii). However, because of the normalization in (2), from Alice’s
perspectiveBobandCharliehavenormalizedlocaltrustvalueequalto0.5inboth(i)and(ii).
Furthermore,implementationsofflowmodelsignoreasignificantpartoftheavailableinformation: while
ratings are positive, negative or neutral, their aggregation ignores the negative values and maps them to
zero. For instance, EigenTrust [23] takes the sum s of the ratings of all transactions between entities
ij
i and j, and normalizes it with respect to the sum of all the positive ratings given by i (see (2)). As a
consequence,itisnotpossibletodiscriminatebetweenusersthathavebadreputationandusersthathave
neutralreputation. Consider,forexample,thelocaltrustvalueofDavidinthetwoscenariosofFig.1: by
applying(1),weobtain 900in(a)and0in(b). However,afternormalizingusing(2),weobtain0inboth
−
scenarios.
Finally, themetricsbasedonMarkovchainsincludeparameterswhichaimtoguaranteetheconvergence
of computations and to resist malicious coalitions (e.g., the damping factor α and the vector of initial
reputationvaluessin(3)). Unfortunately,theimpactoftheseparametersonreputationvalueshasnotbeen
studiedinsufficientdetail.
3 Our reputation metric
3.1 Reputationmodel
Reputationisacollectivemeasureoftrustworthinessbasedonthejudgmentofacommunity. Theusersin
thecommunitycaninteractwitheachotherandratethecounterpartinthetransactionafterthecompletion
ofthetransaction. Thereputationvalueofagivenuseriscomputedbyaggregatingtheratingsthatother
users in the community gave to that user and reflects the level of trust that they have on the user on the
basisoftheirpastexperience. Intheremainderofthissection, wediscusstheratingsystem, themethod
foraggregatingratings,andthemetricforcalculatingreputationvaluesfromtheaggregatedratings.
Ratingsarecollectedbyacentralauthorityusingaratingsystem. Weadoptaratingsystemwhereratings
are bounded to the corresponding transaction. Ratings can be positive, negative, and neutral; we do not
imposeanyrestrictionontherangeofvaluesofratings.
Thecentralauthorityaggregatesratingsinordertocomputethereputationvaluesofallusersinvolvedin
the system. We assume that aggregated ratings lie in the range [0,1] where 1 means very good, 0 very
bad, and 1 neutral. The restriction to [0,1] does not affect the generality of the model: values lying in a
2
differentinterval(andevenqualitativevalues)caneasilybemappedto[0,1]. Inthisway,alltheavailable
information(includingnegativeratings)canbeusedinthecomputationofreputation.
Anumberoffactorsshouldbetakenintoaccountwhenratingsareaggregated(see[4,31,34]):
theratingsauserreceivesfromotherusers,
•
thetotalnumberofratingsauserreceivesfromotherusers,
•
3Notethatαisdifferentfromthe‘α’inPageRank[9],whosepurposeistomodifythematrix.
5
thecredibilityoftheratingsource,
•
thesizeofthetransaction,and
•
thetimeofthetransaction.
•
Several aggregation methods based on (some of) these factors have been proposed. In [15] ratings are
aggregatedbysummingthepositiveandnegativeratingsthattheuserreceivesfromotherusers. However,
it is well known that methods based only on ratings are flawed [12, 34]. Indeed, a user can increase
his reputation by increasing the transaction volume to cover that fact he is cheating at a certain rate. In
particular, the user can build a good reputation in small transactions and then act dishonestly in large
transactions[17].Topreventthis,anaggregationmethodshouldalsotakeintoaccountotherfactorslikethe
totalnumberofthetransactionsinwhichauserisinvolvedandthesizeofthetransaction.Inaddition,some
existing reputation systems use threshold functions for accurate discrimination between trustworthy and
untrustworthyusers[31]. Inparticular,theratingsprovidedbyauserareconsideredonlyifthecredibility
of the user is greater than a certain threshold. To discriminate between past and recent behavior, some
reputation systems update reputation by aggregating the previous reputation with a factor indicating the
proximityoftherecentratingtothepastreputation[4].
Thefollowingexamplepresentsasimplemethodforaggregatingratingsthatincorporatestheratingsauser
receivesfromotherusers,thetotalnumberofratings,andthecriticalityofthetransactions. Intuitively,the
aggregated ratings are defined as the weighted ratio of the sum of positive and negative ratings averaged
over the total criticality of transactions. In the example, we do not consider the credibility of the rating
source because this factor is used later in (5) to calculate reputation values from aggregated ratings. In
(5), the credibility of a user is given by the reputation of the user. We refer to [4] for an example of a
time-sensitiveaggregationmethod.
Example1 Consider the electronic marketplace scenarios of Fig. 1. Let xy be the set of transactions
V
betweenusersxandy,letq : 1,0, 1 beafunctionthatreturnstheratinggivenbyytoxforthe
xy
transactionandw : NVafun→cti{ontha−ta}ssignsacriticalityvaluetothetransaction. Theaggregated
xy
V →
ratingsA canbecomputedasthesumofindividualratingsweighedwithrespecttothecriticalityofthe
xy
transactionsandthenmappedintotherange[0,1]asfollows
q(v)w(v)
A = 1 + 1v(cid:88)∈Vxy . (4)
xy
2 2 w(v)
v(cid:88)∈Vxy
If we apply (4) to the scenarios of Fig. 1 (and assuming that all transactions have the same criticality
value),weobtainthatthevaluescomputedbyaggregatingtheratingsgivenbyAlicetoBob,Charlie,and
Davidin(a)areequalto0.5005,0.5045,and0.05respectively,whereasscenario(b)gives0.55,0.95,and
0.5respectively. Thesevaluesareclosertowhatonewouldexpectthantheresultsof(2),namely0.1,0.9,
and0forBob,Charlie,andDavidrespectivelyinbothscenarios. (Here1meansverygoodand0bad).
The set of all aggregated ratings A can be organized in a matrix. We refer to Table 1 for the notation
xy
usedhereafter.
Definition1 Fornusers,theaggregatedratingsarecontainedinanirreduciblen nmatrixA,
×
A [0,1] forx=y;
xy
• ∈ (cid:54)
A =0.
xx
•
A represents the aggregated ratings of user x from the perspective of user y. We impose that self-
xy
referencearenotincludedintheaggregation(A = 0forallx). ThischoiceismotivatedinSection3.2,
xx
where we show that a nonzero diagonal has undesirable consequences in a simple toy scenario. In Sec-
tion6.4wepresentnumericalresultsontheeffectofself-reference.
6
Notation Meaning
n Numberofusers.
[n] Theset{1,···,n}.
r∈[0,1]n Columnvectorcontainingallreputations.
s∈[0,1]n The‘starting’reputationvector.
Axy ∈[0,1] Aggregationofratingsofxgivenbyy.
α∈[0,1] Weightoftheindirectevidence.
e Then-componentcolumnvector(1,1,···,1)T.
(cid:96)∈[0,n] The‘norm’eTr.
vi Thei’theigenvectorofA.
λi Thei’theigenvalueofA.
λmax LargesteigenvalueofA.
vmax Eigenvectorcorrespondingtoλmax.
C Then×nconstantmatrixC=eeT.Cij =1;Ck=nk−1C.
Table1: Notation
Tocomputereputation,weemployametricthatisanadaptationofthemetricsin[23,31].Inparticular,we
adopttheequationproposedin[31](see(5)),whichdiffersfromtheoneproposedin[23](see(3))inthe
momentwhenthenormalizationsteptakesplace. In[23]normalizationisdoneonceatthebeginningin
ordertoobtainaMarkovchainusing(2);then,startingfromavectorofinitialreputationvalues,Markov
stepsarerepeatedlyapplieduntilastablestatehasbeenreached. Conversely,in[31]reputationvaluesare
normalizedwithrespecttothesumofallreputationvaluesinthereputationvector( r in(5))atevery
z z
iteration to guarantee that reputation values stay in the range [0,1]. We differ from the metric proposed
(cid:80)
in [31] in the way the indirect evidence matrix A is defined: in [31] A is symmetric (whereas we allow
asymmetry),andA =1(whereaswesetA =0).
xx xx
Weconsiderasystemwithnusers. Thecentralauthoritydeterminesthetrustworthinessofallusersbased
onhisdirectexperiencewiththemandtheaggregatedratings.
Definition2 Lets [0,1]n,withs = 0,bea‘startingvector’containingstartingvaluesassignedtoall
∈ (cid:54)
usersbythecentralauthority. Letα [0,1]beaweightparameterfortheimportanceofindirectvs.direct
∈
evidence. Wedefinethereputationvectorr [0,1]n asafunctionofα,sandAbythefollowingimplicit
∈
equation:
r
y
r =(1 α)s +α A (5)
x x xy
− (cid:96)
y(cid:88)∈[n]
wherewehaveintroducedthenotation(cid:96)= r .
z z
Eq.(5)canbereadasfollows. Ifthecentra(cid:80)lauthoritywantstodeterminethereputationofuserx,itfirst
takesintoaccountthedirectinformationthatithasaboutx. Fromthisitcomputess ,thereputationthat
x
itwouldassigntoxifithadnofurtherinformation. However,italsohastheaggregateddatainA. Itgives
weight1 αtoits‘direct’assignmentsandweightαtothecollectiveresultderivedfromA. Ifitdidnot
−
haveanydirectinformationaboutx,itwouldcomputer asr = (r /(cid:96))A ,i.e.aweightedaverage
x x y y xy
ofthereputationvaluesA withweightsequaltothenormalizedreputationsofalltheusers. Addingthe
xy
(cid:80)
twocontributions,withweightsαand1 α,weendupwith(5),whichhastheformofaweightedaverage
−
overallavailableinformation. Notethat(5)canbeexpressedinvectornotationas
Ar
r=(1 α)s+α , (6)
− eTr
whereestandsforthen-componentcolumnvector(1,1, ,1)T.
···
7
3.2 Discussionofself-references
The quality of a reputation metric is determined by the accuracy of reputation values. Here, we provide
further motivation for our metric and, in particular, for the choice A = 0. We demonstrate that the
xx
reputationvaluescalculatedbyourreputationmetricareclosetotheexpectedvalues.
Theexpressionforr containsatermα(r /(cid:96))A ,theasyetunknownreputationofxmultipliedbyhis
x x xx
‘self-rating’A . Webrieflyinvestigatetheeffectofself-referenceonourreputationmetric. Firstwelook
xx
whathappenswhenthediagonalofAisnotsettozerobuttoζ [0,1].ForlargenandrandomAonedoes
∈
notexpectasignificanteffect,sincethediagonalconsistsofonlynelementsoutofn2. (Seethenumerical
resultsinSection6.4). Weconsiderthefollowingscenario,whichwetailoredtomakethediagonalstand
out: Everybodyagreesthatonlyoneuserisreasonablytrustworthy(letuscallhimuser1). Letε 1be
(cid:28)
a small positive constant. Let σ be a positive constant of order 1. We set A = ε for x / 1,y and
xy
∈ { }
A = b [0,1]forally = 1. Wesets = σεforx = 1. Becauseinthisscenarioalltheusersexcept
1y x
∈ (cid:54) (cid:54)
user1aretreatedequally,(5)yieldsthesamereputationforallusersx=1,whichwewilldenoteasr .
rest
(cid:54)
ζ b b b
ε ζ ε ··· ε s1 r1
A=... ... ... ·.·..· ..., s=σ.ε, r=rre.st. (7)
. .
ε... ··· ·.·..· ζε ζε σ.ε rre.st
 
From a good metric we expect that user 1 has reputation (1 α)s + (ε) and that r is of order
1 rest
− O
ε, preferably r = (1 α)σε + αε. Substitution of (7) into (5) yields, after some algebra, r =
rest 1
−
(1 α)s +αζ+ (ε)andr =ε(1−α)σ+α + (ε2). Clearly,ourexpectationsaremetonlyifζ =0.
− 1 O rest 1−αζ/r1 O
OnecouldarguethatsettingthediagonalofAtozeroisnotenoughtoremoveself-referencescompletely:
inthecomputationofr thenormalizationfactor(cid:96) = eTrstillcontainsr ,i.e.r affectstheweightsfor
x x x
thecomputationofr . Inordertoavoidthis,onecoulddefineanalternativereputationmetrictas
x
t
y
t =(1 α)s +α A . (8)
x x xy
− t
y∈(cid:88)[n]\x z∈[n]\x z
(cid:80)
ForlargenandgeneralA,thedifferencesbetween(8)and(5)aretiny.However,substitutionofthespecial
scenario(7)into(8)givest =(1 α)s +αb+ (ε)andt =(1 α)σε+αε.Whilet isasdesired,
1 1 rest rest
− O −
t isnot.Thereisasignificantdifferencebetweent andthedesiredoutcome(1 α)s + (ε),especially
1 1 1
− O
whenbislarge. Asaspecialcaseconsiders b,asituationwherethecentralauthoritymistrustsuser1,
1
(cid:28)
butalltheuserstrusthim. Theauthoritydoesnotwanthisresultforuser1tobeinfluencedheavilybythe
users,sincetheirreputationsare (ε).
O
WeconcludethatthemetricrworksbestwhenA =0isimposed,andthatrisbetterthanthemetrict.
xx
Here‘better’meansthatitmorecloselymatchesourexpectationsofhowametricshouldbehave.
4 Formal properties
The implicit function (5) can be shown to have a number of desirable properties. In particular, for any
choice of α,s,A allowed by Definitions 1 and 2 there always exists a well defined, unique solution r
∈
[0,1]n. Thisresultisfundamentalincollaborativesystemsinwhichpartiesrelyonthereputationvaluesto
makeadecision.
Inthissection,wefirstintroducesomenotationandlistanumberofusefullemmas. Wediscussthetrivial
solutions for α = 0 and α = 1. Then, we present a proof of existence and uniqueness of the solution r
forthegeneralcase0 < α < 1. Finally,wecomputethederivativeofrwithrespecttoA. Thisprovides
awaytostudythesensitivityofthereputationmetrictomaliciouschangesintheindirectevidencematrix
(Section6.5).
8
4.1 Notationandlemmas
Foravectororamatrix,thenotation‘V 0’meansthatalltheentriesarenonnegative. Forothernotation
≥
werefertoTable1.
Lemma1 Ifrisasolutionof(5)satisfyingr 0,thenr [0,1]n.
≥ ∈
TheproofisgivenintheAppendix.
Lemma2 Forgivenα,s,Aandagiven(cid:96) [0,n],suchthatdet((cid:96)1 αA) = 0,therecanexistatmost
onevectorr Rnthatsatisfies(5)andeTr∈=(cid:96). − (cid:54)
∈
Proof: Let(cid:96)=eTr. Eq.(5)canberewrittenas
α −1
r=u((cid:96)):=(1 α) 1 A s. (9)
− − (cid:96)
(cid:104) (cid:105)
Thisfixesthevectorruniquelyasafunctionofthescalar(cid:96). (cid:3)
Givenasolutionr,Lemma2tellsusthatanontrivialpermutationofrcannotbeasolution.
Lemma3 (Theorem1.7.3inRef.[5])LetM 0beasquarematrix. ThenM hasapositiveeigenvalue
≥
λ whichisequaltothespectralradius. Thereisaneigenvectorv 0associatedwithλ . For
max max max
≥
x>λ itholdsthat(x1 A)−1 0.
max
− ≥
4.2 Thespecialcasesα = 0andα = 1
Thecaseα=0triviallyyieldsr=s. Thecaseα=1ismoreinteresting. Eq.5reducesto
Ar= eTr r. (10)
Thishastheformofaneigenvalueequation. Thema(cid:0)trixA(cid:1) haseigenvectorsv ,andeigenvaluesλ . There
i i
existnsolutionsof(10),namely
v
r(i) =λ i , (11)
ieTv
i
i.e. proportional to the eigenvectors of A. However, the Perron-Frobenius theorem for nonnegative irre-
duciblematrices(seee.g. Ref.[6],Chapter2)tellsusthatonlyoneoftheeigenvectorsgivesanacceptable
reputationvector: v >0. Alltheothereigenvectorshaveatleastonenegativeentry. Weareleftwitha
max
singlesolution,
v
max
Atα=1: r=λ and (cid:96)=λ . (12)
maxeTv max
max
4.3 Thegeneralcase0<α<1;Maintheorems
Multiplying(9)fromtheleftwitheTandthenmultiplyingbyasuitableconstantgives
f((cid:96))=1 where f((cid:96)):=(1 α)eT((cid:96)1 αA)−1s. (13)
− −
Thisequationhelpsustoproveseveralimportantpropertiesofourmetric. First,wedemonstratethat(5)
hasalwaysawelldefined,uniquesolutioninthegeneralcase0<α<1.
Theorem1 Forα,A,sasgiveninDefinitions1and2,thereexistsareputationvectorr [0,1]nsatisfy-
∈
ing(5). Thesolutionisoftheformr=u((cid:96) )withuthefunctiondefinedin(9)and(cid:96) (αλ ,n].
∗ ∗ max
∈
Corollary1 Inthelimitsα 0andα 1,(13)and(9)correctlyreproducethereputationvectorforthe
→ →
specialcasesα=0andα=1.
Theorem2 ThesolutioninTheorem1istheonlysolutionof(5)satisfyingr [0,1]n.
∈
9
TheproofsofTheorems1and2,andCorollary1aregivenintheAppendix.
Thequalityofareputationsystemisdeterminedbyhowaccuratelythecomputedreputationpredictsthe
futureperformanceofentitiesevenwhenattackersattempttomanipulatereputationvalues. Thefollowing
result allows us to study the effect of unfair ratings by analyzing the sensitivity of reputation values to
changesintheindirectevidencematrix.
Theorem3 Forfixedαands,asmallchangeinAaffectsrasfollows:
∂r α −1
x =α (cid:96)1 αA+ AreT r . (14)
y
∂Azy − (cid:96) xz
(cid:104) (cid:105)
(Here[ ]−1standsforelementxzoftheinversematrix.)
···xz
TheproofofTheorem3isgivenintheAppendix.
Theorem 3 gives some direct insight into the effectiveness of attacks. First, we see that the effect of the
attackisproportionaltoα. Furthermore,ifsomeusery wantstoattackthereputationofuserx,themost
obvious attack is to reduce the matrix element A , i.e. (δA) < 0. We see in (14) that the effect is
xy xy
proportionaltor . Hence,theeffectivenessofhisattackisproportionaltohisownreputation. (Ofcourse
y
thisdoesnotcomeasasurprise,butitisgoodtoseeintuitiongettingconfirmed.) Fromthisweseethatit
isadvantageousforhimtoimprovehisownreputationbeforeattackingotherusers’reputations.
Finally, from(14)wecanalsoreadoffalessobviousattackstrategy. Theattackery mayalsoindirectly
attackxbymanipulatingA ,wherez issomeotheruser. Theeffectofthisattackisproportionaltothe
zy
matrixelementE :=[(cid:96)1 αA+αAreT]−1. Inpractice,usery’sattackonxcouldlookasfollows. He
xz − (cid:96) xz
computesE forallz,z = y. Hepicksanumberofusersz whoseE havethehighestmagnitude. For
xz xz
(cid:54)
eachofthem,ifE <0,hecausesapositivechangeinA ,otherwiseanegativechange. Remark: This
xz zy
reasoningappliesforsmallchangesofδA.Inthenumericalexperiments(Section6.5)wetakeaworstcase
approachandallowtheattackertomakebigchangesinA.
5 Computing reputation
From the structure of Lemma 2 and the proof of Theorem 1, we can derive a direct method (Fig. 2) for
computing r from α, s, and A. This algorithm first solves (13) for (cid:96), obtaining a solution (cid:96) > αλ
∗ max
(lines1-3). Theequationf((cid:96))=1isapolynomialequationofdegreen;thisbecomesevidentifwewrite
AasA = QΛQ−1 (withΛthediagonalmatrixcontainingtheeigenvaluesofA,andQthematrixwhose
columnsaretheeigenvectorsv )andmultiply(13)bydet((cid:96) αA):
i
−
n n
((cid:96) αλ )=(1 α) (eTQ) (Q−1s) ((cid:96) αλ ). (15)
i i i j
− − −
i(cid:89)=1 (cid:88)i=1 j∈[(cid:89)n]\{i}
Thehighestorderonthelefthandsideis(cid:96)n,andontheright(cid:96)n−1. Thealgorithmfirstcompletelysolves
the eigensystem of A (lines 1-2) and then solves (15), looking only for the unique solution (cid:96) > αλ
∗ max
(line3).Finally,itsubstitutesthatvalueinto(9)(line4).Theorem1guaranteesthattheoutcomeisavector
in[0,1]n.
1 r(0)=s
1 {λi}=Eigenvalues(A) 2 repeat
2 Q=Eigenvectors(A) 3 r(k+1)= Ar(k)
3 Find(cid:96)∗>αλmaxthatsolves(15) (cid:80)zrz(k)
(cid:104) (cid:105)−1 4 r(k+1)=(1−α)s+αr(k+1)
4 r=(1−α) 1− (cid:96)α∗A s 5 diff =(cid:107)r(k+1)−r(k)(cid:107)1
6 untildiff <δ
Figure2: Directmethod
Figure3: Iterativemethod
Aniterativemethodforsolving(5)ispresentedinFig.3. Thisalgorithmfirstcomputesreputationasthe
weightedaverageofreputationvaluesinA(line3). Then,itcalculatestheaverageoverdirectandindirect
10