Jianqiang Ma
email: jianqiang.ma@nr.no

Habtamu Abie
email: habtamu.abie@nr.no

Torbjørn Skramstad
email: torbjorn@idi.ntnu.no

Mads Nygård

Assessment of the Trustworthiness of Digital Records

It is easy enough to assert the trustworthiness or otherwise of a digital record, but it is far more difficult to present an objective basis for that assertion. A number of recent research efforts have focused on the trustworthiness of a digital record while paying scant attention to the record's evidential value as a measure of and a basis for the assessment of its trustworthiness. In this work, we study a model for the assessment of the trustworthiness of digital records based on their evidential values using the Dempster-Shafer (D-S) theory. The model is divided into three modules, (i) a knowledge-modelling module that models expert knowledge and consequent belief of evidence, (ii) an evidencecombination module that combines evidence from different sources in the face of uncertainty, and (iii) a trustworthiness assessment module that aggregates and integrates evidence, and assesses its trustworthiness. An example is presented to show how the model works.

Introduction

Due to the last century's developments in information technology, electronic documents are replacing paper documents to an ever-increasing degree. This technology enables electronic documents to be easily modified and transferred, which makes life easier for us in our digital businesses, but also makes it easier for malicious elements to compromise or tamper with them, which makes life more difficult for us. On receipt of an electronic document, one's first reaction is to question the document's trustworthiness. Current research into how to reduce the questionability of a document's trustworthiness is conducted in two areas, security and trustworthy repositories.

In the former area, in which most current research is conducted, research is concerned with the development of algorithms [START_REF]Handbook of applied cryptography[END_REF], protocols [START_REF] Rescorla | SSL and TLS: Designing and building secure systems[END_REF], and architectures [START_REF] Gladney | Trustworthy 100-year digital objects: Evidence after every witness is dead[END_REF][START_REF] Gladney | Trustworthy 100-year digital objects: durable encoding for when it's too late to ask[END_REF], whose purpose is to protect the electronic documents from tampering, and to ensure their trustworthiness. Even though the security methods such as digital signature and digital watermarking technology can protect digital records, they are not generally accepted in the area of digital library, as Boudrez [START_REF] Boudrez | Digital singatures and electronic records[END_REF] states, "in general, the international archival community rejects the preservation of encrypted documents". Thus, there is still a need for a method for assessing the trustworthiness of digital records preserved in digital libraries.

In the latter area, the emphasis is on the establishment of digital repositories, the trustworthiness of which is intended to be a guarantee of the trustworthiness of the digital records stored therein [START_REF]Trustworthy repositories audit & certification: Criteria and checklist[END_REF][START_REF]Consultative Committee for Space Data Systems: Reference model for an open archival information system[END_REF]. There is, however, a need to assess the trustworthiness of the digital records themselves, since they do not reside solely in the repository at all times.

Therefore, in this work, we study the trustworthiness of the digital records, using their evidential values as a measure of trustworthiness. Specifically, we look into Evidence-Keeping Metadata (EKM) [START_REF] Ma | Development and validation of requirements for evidential value for assessing trustworthiness of digital records over time[END_REF] related to them. The EKM are a subset of the Recordkeeping Metadata [18], but limited only to the metadata which contain the evidence to proof the trustworthiness or untrustworthiness of a digital record. Note that the digital records we studied here are the records preserved in digital library; EKM of those records are dynamically documented by the digital library system and stored in a secure place. It is assumed that the EKM are not modified. The protection of the digital library system as well as the EKM is not covered in this paper. By combining the evidential values of EKM, the evidential value of a digital record can be deduced and used to assess the trustworthiness of the record. This work is a complement to the research on both security protections and trustworthy digital repositories.

The rest of this paper is organised as follows. First, we briefly describe related work in Section 2. After illustrating the assessment approach and how to apply this approach to the assessment of the trustworthiness of digital records in Section 3 and Section 4, respectively, we present an example to show how the assessment model works in Section 5. After discussing the challenges to the assessment model which we will investigate in our future work in Section 6, we present the conclusion in Section 7.

Related Work

Digital trust has become an increasingly important area of research. Of special importance is the estimation of trustworthiness of information and users. Extensive surveys and overviews of trust in IT (Information Technology) can be found in [START_REF] Blaze | Secure Internet Programming: Issues in Distributed and Mobile Object Systems[END_REF][START_REF] Grandison | A survey of trust in internet applications[END_REF][START_REF] Jøsang | A survey of trust and reputation systems for online service provision[END_REF][START_REF] Trcek | A formal apparatus for modeling trust in computing environments[END_REF]. In this area, an often used methodology for trust management is the exploitation of the D-S theory of evidence [START_REF] Shafer | A Mathematical Theory of Evidence[END_REF] that defines a mathematical theory of evidence based on the belief function and plausible reasoning, which can combine separate evidence to compute the trustworthiness of an event.

There have been many attempts to apply the Dempster-Shafer (D-S) theory to the problem of assessing trustworthiness. Chen and Venkataramanan [START_REF] Chen | Dempster-Shafer theory for intrusion detection in ad hoc networks[END_REF] applied D-S to intrusion detection in ad-hoc networks. They use D-S to combine observations on the trustworthiness of the suspected node from different nodes, and derive a number which shows the trustworthiness of the suspect node. Hu et al. [START_REF] Hu | D-S evidence theory based digital image trustworthiness evaluation model[END_REF] applied D-S to assess the trustworthiness of a digital image. They proposed a list of attributes that a digital image contains, and trained the classifier with 2000 images. Using the classifier in the experiments, their results show that the evaluation model is stable and robust. It is evident from these attempts that the D-S theory offers a mathematical way to combine evidence from multiple observers without the need to know a priori or conditional probabilities as in the Bayesian approach [START_REF] Chen | Dempster-Shafer theory for intrusion detection in ad hoc networks[END_REF]. In this study, we apply D-S to assess the trustworthiness of digital records. To the best of our knowledge, no research has been conducted on the application of D-S to the assessment of the trustworthiness of digital records using their evidential values.

Our Approach

In this research, we adopt the D-S theory for assessing the trustworthiness of digital records for two reasons. First, the D-S theory can combine evidence from different sources, and achieves a degree of belief based on all the available evidence into consideration [START_REF] Dempster | Upper and lower probabilities induced by a multivalued mapping[END_REF][START_REF] Shafer | A Mathematical Theory of Evidence[END_REF]. Second, it can handle uncertainty without requiring a priori or conditional probabilities [START_REF] Chen | Dempster-Shafer theory for intrusion detection in ad hoc networks[END_REF][START_REF] Sentz | Combination of evidence in dempster-shafer theory[END_REF].

In the D-S theory there is a set of mutually exclusive and exhaustive propositions denoted by Γ , called frame of discernment. A power set 2 Γ contains all possible subsets of Γ , as well as the Γ itself and the null set φ. A mapping function from 2 Γ to the interval between 0 and 1 is called the basic belief assignment (or mass function), which requires that:

m(φ) = 0; and Ai⊂Γ m(A i ) = 1 (1)
The mass function m(A) expresses the proportion of evidence that supports the proposition set A, but not any subsets of A. Proposition set A may contain multiple propositions due to lack of information. In this case, the mass function m(A) is the source of uncertainty in the D-S theory. In this work, the evidential values of EKM are initialised by a group of experts. That is because, first, it is often difficult, if not impossible, to find an expert who has professional knowledge of the complete EKM dataset. Second, in order to have more objective results when assessing the trustworthiness of digital records, we request a group of experts, instead of a single expert, to initialise the evidential values of EKM. This is inspired by the research work in the area of instrument development [START_REF] Grant | Selection and use of content experts in instrument development[END_REF][START_REF] Lynn | Determination and quantification of content validity[END_REF] in which a panel of experts are always used in the judgement-qualification stage so as to validate content more objectively. The basic belief assignments are used to capture experts' knowledge of EKM's evidential values, which are assigned to numeric evidential values between 0 and 1 that are converted from linguistic evidential values initialised by experts.

A belief function in the D-S theory as defined in Equation ( 2) is the degree of belief that the proposition set A is true. It gathers all evidence that directly supports A. If proposition set A contains a single proposition, the belief function of A equals its mass function.

bel(A) = Bi⊂A m(B i ) (2)
A plausibility function presents the possibility that proposition set A is not negated. The plausibility function gathers all evidence that support A or do not contradict A. It is defined as:

pls(A) = Bi∩A =φ m(B i ) (3)
bel(A) and pls(A) are the lower bound and upper bound of the proposition set A, respectively. They are related to each other by:

pls(A) = 1 -bel(A) (4)
In this model, the belief function is used to model the quality of EKM that provide evidence that their high-level nodes are either trustworthy or untrustworthy, while the plausibility function is used to model the quality of EKM that provide evidence that their high-level nodes may be either trustworthy or untrustworthy.

Dempster's rule of combination is used to combine the basic belief assignments from different sources. Suppose there are two sources of evidence where the basic belief assignment functions are m 1 and m 2 , respectively. Then, the rule of combination is defined as:

m 12 (A) = m 1 (A) ⊕ m 2 (A) = B∩C=A m 1 (B)m 2 (C) 1 -B∩C=φ m 1 (B)m 2 (C) (5)
The Dempster's rule of combination is used to combine the various assignments from different experts, and the evidence provided by the EKM, so as to assess the trustworthiness of digital records (as will be presented in Section 4). Based on the combined basic belief assignment, the corresponding belief and plausibility of the combined evidence can be obtained.

As described in Section 2, in the area of computer science, the D-S theory of evidence [START_REF] Shafer | A Mathematical Theory of Evidence[END_REF] is an often-used methodology for trust management [START_REF] Trcek | A formal apparatus for modeling trust in computing environments[END_REF]. A survey of its mathematical foundations, applications and computational analysis can be found in [START_REF] Kohlas | Theory of evidence -a survey of its mathematical foundations, applications and computational aspects[END_REF]. Since the D-S theory remains attractive because of its relative flexibility in reflecting uncertainty or lack of complete evidence and giving a convenient numerical procedure for fusing together multiple pieces of evidential data by its rule of combination [START_REF] Chen | Dempster-Shafer theory for intrusion detection in ad hoc networks[END_REF], we use the D-S evidence theory in this paper. Despite the criticisms of the use of Dempster's rule of combination when encountering significant conflicting information [START_REF] Sentz | Combination of evidence in dempster-shafer theory[END_REF][START_REF] Zadeh | A simple view of the dempster-shafer theory of evidence and its implication for the rule of combination[END_REF], it is our considered opinion that it is suited to the assessment of the trustworthiness of digital records using evidential value as a measure of trustworthiness.

In the following section, we explain how the evidential values of EKM are used to assess the trustworthiness of a digital record in detail.

Assessment of the Trustworthiness of a Digital Record Using D-S Theory

In a previous work [START_REF] Ma | Development and validation of requirements for evidential value for assessing trustworthiness of digital records over time[END_REF], we structured EKM of a digital record as a tree based on a proposed life-cycle model. The trustworthiness of the record is assessed from the leaves to the root of the tree, where the final assessment is made. The trustworthiness assessment model is divided into three modules, (i) a knowledge-modelling module that models expert knowledge and consequent belief of evidence, (ii) an evidence-combination module that combines evidence from different sources in the face of uncertainty, and (iii) a trustworthiness assessment module that aggregates and integrates evidence, and assesses its trustworthiness.

The Knowledge-Modelling Module

In order to obtain the evidential values of EKM, a set of experts are selected to provide their knowledge about the quality of all EKM used as evidence to prove the trustworthiness or untrustworthiness of the digital record. The knowledgemodelling module models knowledge from experts to the evidential value of EKM, which will later be used to assess the trustworthiness of the digital record. Each expert assigns a tuple set (EV, H) to EKM. EV ∈ {Extremely High (EH), Very High (VH), High (H), Medium (M), Low (L), Very Low (VL), Extremely Low (EL)}1 , presents the evidential value of EKM assigned by the expert. H is a Boolean value that stands for the "trustworthy hypothesis", if it is true, it means the expert believes that the corresponding EKM provide evidence that their higher-level nodes are trustworthy. For example, if an expert assigns (EH, true) for an EKM, it indicates that the expert thinks these EKM provide strong evidence that their higher-level nodes are trustworthy. The linguistic values can then be mapped to numeric evidential values between 0 and 1. The numeric evidential values can be presented in percentage between 0 and 100%, Table 1 shows an example of the mapping. After this step, the knowledge-modelling module models the experts' knowledge as a tuple set Ψ .

Ψ = {{(N EV 11 , H 11 ), (N EV 12 , H 12 ) . . . (N EV 1n , H 1n )} . . . {(N EV m1 , H m1 ), (N EV m2 , H m2 ), (N EV mn , H mn )}} (6)
where m is the index of EKM, n is the number of experts and N EV is the numeric evidential value. Assume that H ij is true, then, tuple (N EV ij , H ij ) only means expert E j believes that EKM i (a piece of EKM) supports the trustworthiness hypothesis that "its higher-level node is trustworthy" to the extent N EV ij . It does not necessarily mean that expert E j believes EKM i supports the hypothesis that its higher-level node is untrustworthy to the extent 1 -N EV ij .

Note that aspects like what happen when no expert exist to provide the evidential values and the data are coming from a third party source, are not considered while it is a more realistic scenario. In addition, there is concern that some of the experts may be malicious, thus, attacks (such as bad mouthing attack, on-off attack, etc.) may be performed. In the p2p networks area, many defence mechanisms [START_REF] Kamvar | The eigentrust algorithm for reputation management in p2p networks[END_REF][START_REF] Sun | Attacks on trust evaluation in distributed networks[END_REF] have been proposed to detect malicious agents. Those solutions can also be adopted here to detect malicious experts. However, this will not be discussed any further in this paper.

The Evidence-Combination Module

After modelling all the experts' knowledge by the previous module, this module combines the assignments from all experts for each piece of EKM, so as to obtain the assessed evidential value of each piece of EKM.

Suppose the frame of discernment of EKM i is Γ = {T, T }, and N stands for the higher-level node of EKM i , where T is the proposition set that {N is trustworthy}, T is the proposition set that {N is untrustworthy}, and U is the universal set that {N is trustworthy, N is untrustworthy}. The expert E j 's assignment tuple (N EV ij , H ij ) can then be mapped to the basic belief assignment. If H ij = φ, it means that EKM i provides no evidence about the trustworthiness or untrustworthiness of N . Thus, in that case, m ij (T ) and m ij (T ) are equal to 0, and m ij (U ) equals 1 (100%). In other cases, the mapping follows Equations ( 7) and (8) below.

if

H ij = true, then      m ij (T ) = N EV ij m ij (T ) = 0 m ij (U ) = 1 -N EV ij (7) otherwise, if H ij = f alse, then      m ij (T ) = 0 m ij (T ) = N EV ij m ij (U ) = 1 -N EV ij (8)
As we stated at the end of Section 4.1, when H ij is true, it does not mean that expert E j believes EKM i supports T to the extend 1 -N EV ij . Also, it is the same case when H ij is false. Therefore, 1 -N EV ij is assigned to m ij (U ) to show that expert E j is not certain that EKM i supports T or T to the extent 1 -N EV ij .

By applying Dempster's rule of combination to the aggregated probabilities assigned to each piece of EKM by all experts, the evidence-combination module calculates the evidential value of each piece of EKM.

According to the mapping function presented in ( 7) and ( 8), the basic belief (i.e. m ij (T ), m ij (T ), m ij (U )) assigned to each tuple is obtained. Then, using Equation ( 5), the basic beliefs assigned to EKM i by all experts are calculated as follows.

m EKMi (T ) = m i1 (T ) ⊕ m i2 (T ) ⊕ . . . ⊕ m in (T ) m EKMi (T ) = m i1 (T ) ⊕ m i2 (T ) ⊕ . . . ⊕ m in (T ) m EKMi (U ) = m i1 (U ) ⊕ m i2 (U ) ⊕ . . . ⊕ m in (U )
Based on Equation (2), the belief functions of EKM i are:

bel EKMi (T ) = m EKMi (T ); bel EKMi (T ) = m EKMi (T )
The belief function of EKM i presents its evidential value. To the experts' knowledge, the quality of EKM i that provides evidence that its higher-level node is trustworthy is bel EKMi (T ), while the quality of EKM i that provides evidence that its higher-level node is untrustworthy is bel EKMi (T ).

The Trustworthiness Assessment Module

The trustworthiness assessment module assesses the trustworthiness of the digital record by first aggregating the evidential values of EKM to assess the trustworthiness of their corresponding components. It then integrates the trustworthiness of components to assess the record's trustworthiness during each life-cycle phase. Finally, it integrates trustworthiness during life-cycle phases to deduce the trustworthiness of the digital record.

Dempster's rule of combination is also applied here to assess the trustworthiness of the digital record. The basic beliefs assigned to the digital record are arrived at by:

m record (T ) = m creation (T ) ⊕ m modif ication (T ) ⊕ m migration (T ) ⊕ m retrieval (T ) ⊕ m disposal (T ) = m Originator (T ) ⊕ m Creator (T ) ⊕ m CreationAction (T ) ⊕ . . . ⊕ m DisposalExecutor (T ) ⊕ m DisposalAction (T ) = m EKM1 (T ) ⊕ . . . ⊕ m EKMm (T ) m record (T ) = m EKM1 (T ) ⊕ . . . ⊕ m EKMm (T ) m record (U ) = m EKM1 (U ) ⊕ . . . ⊕ m EKMm (U )
Accordingly, the belief and plausibility of the trustworthiness of the digital record are calculated respectively as follows:

bel record (T ) = m record (T ); pls record (T ) = 1 -bel record (T ) = 1 -m record (T )
The belief function states that we can believe that the digital record is trustworthy to the extent that bel record (T ). The plausibility function states that the digital record may be trustworthy to the extent that pls record (T ). The trustworthiness of the digital record is a value within the interval from bel record (T ) to pls record (T ). However, to be conservative, we say that the trustworthiness of the digital record is bel record (T ).

An Example of the Assessment of the Trustworthiness

In this section, we present an example showing how the assessment model works based on a proposed record's life-cycle model [START_REF] Ma | Development and validation of requirements for evidential value for assessing trustworthiness of digital records over time[END_REF] with elaborated EKM required for the assessment. Here, we only describe the trustworthiness assessment during the creation phase as an example of the trustworthiness assessment of a digital record, since the approach is basically the same for the other life-cycle phases.

Suppose three experts E 1 , E 2 , and E 3 share their knowledge by assigning evidential values to EKM, as shown in Table 2. The numeric evidential values are given right after the linguistic evidential values and expressed as percentage for clarity. By mapping linguistic evidential values to numeric evidential values, the experts' knowledge during the creation phase is modelled as follows:

Ψ creation = {{(95%, true), (95%, f alse), (0, φ)} . . . {(80%, f alse), (80%, true), (65%, f alse)}} Then, using Equations ( 7) and ( 8), the basic beliefs of EKM during the creation phase can be assigned. As an example, the basic belief assigned to "name of originator" is given below:

m ON ame1 (T ) = 0.95; m ON ame1 (T ) = 0; m ON ame1 (U ) = 0.05 m ON ame2 (T ) = 0; m ON ame2 (T ) = 0.95; m ON ame2 (U ) = 0.05 m ON ame3 (T ) = 0; m ON ame3 (T ) = 0; m ON ame3 (U ) = 1
The evidence-combination module then combines the experts' knowledge for each piece of EKM using Equation (5) as follows:

m ON ame (T ) = [m ON ame1 (T ) ⊕ m ON ame2 (T )] ⊕ m ON ame3 (T ) ≈ 0.4872 m ON ame (T ) ≈ 0.4872; m ON ame U ≈ 0.0256
Since both proposition sets T and T only contain a single proposition, its belief function equals its mass function, as presented in Equation (2). Thus, bel ON ame (T ) = m ON ame (T ) = 0.4872, bel ON ame (T ) = m ON ame (T ) = 0.4872.

The belief function states that, based on the three experts' knowledge, the reliability score of the originator's name as evidence of the truth of the hypothesis "the originator is trustworthy" is 48.72%. It also states the reliability score of the originator's name as evidence of the hypothesis "the originator is untrustworthy" is 48.72%. This occurs due to the experts' conflicting knowledge and opinions. We address this issue in Section 5.1.

The combined results of all EKM during the creation phase are presented in Table 3. The trustworthiness assessment module aggregates the evidence of attributes to their parent components to assess the trustworthiness of those components, as shown below.

Equation ( 9) states that, based on the experts' knowledge of the EKM during the creation phase, the trustworthiness score of the digital record is 99.91% after its creation.

Similarly, the trustworthiness of the digital record for the other phases of the life-cycle can be calculated. Finally, the trustworthiness of the digital record can be assessed by integrating its trustworthiness in all its life-cycle phases.

Below, we highlight three cases to present how the trustworthiness assessment of the experts' knowledge works.

Case One

As in the above example, Expert 1 and 2 agree that the originator's name has extremely high evidential value, which means it is a strong evidence for the trustworthiness or untrustworthiness of the component Originator. However, the knowledge of each individual expert concerning the trustworthiness hypotheses is in conflict with that of the other(s). Combining their knowledge, we arrived at bel Exp1&Exp2 (T ) = 0.4872, bel Exp1&Exp2 (T ) = 0.4872, and bel Exp1&Exp2 (U ) = 0.0256. As the belief functions show, due to the contradictory nature of the knowledge of the experts, although it is strong evidence in the experts' opinions, it can not be used to support the assertion of either the trustworthiness or untrustworthiness of the record in any way that has any high evidential value.

Case Two

To continue with the calculation of the trustworthiness of originator's name, due to the lack of information, Expert 3 believes that the originator's name can prove nothing about the trustworthiness or untrustworthiness of the component. Thus, he/she assigned basic belief with full uncertainty (m Exp3 (U ) = 1). When combining the knowledge of Expert 3 with the knowledge of other experts, assignments from Expert 3 have no impact on the combined result.

Case Three

About the EKM "affiliation of originator", Expert 1 believes that it supports the claim that the originator is trustworthy, while other experts have opposing opinions. If their knowledge is combined based on the majority-vote approach, the results will suggest that the originator is untrustworthy. However, from the perspective of Expert 1, the affiliation of the originator has very high evidential value, which means the evidence it presents is strong. The other experts regard the affiliation as having low evidential value, which means although it suggests that the originator is not trustworthy, the evidence is not strong enough. Thus, the combined results using D-S theory suggest that affiliation provides evidence that the originator's trustworthiness score is 62.82%, which acknowledges Expert 1's knowledge.

Discussion and Future Work

There have been many researches on the area of digital trust, however, they either focus on developing secure algorithms [START_REF]Handbook of applied cryptography[END_REF], protocols [START_REF] Rescorla | SSL and TLS: Designing and building secure systems[END_REF], and architectures [START_REF] Gladney | Trustworthy 100-year digital objects: Evidence after every witness is dead[END_REF][START_REF] Gladney | Trustworthy 100-year digital objects: durable encoding for when it's too late to ask[END_REF] to protect digital records, or pay attention to the establishment of trustworthy repositories [START_REF]Trustworthy repositories audit & certification: Criteria and checklist[END_REF][START_REF]Consultative Committee for Space Data Systems: Reference model for an open archival information system[END_REF], which are intended to be a guarantee of the digital records stored therein. To our knowledge, no research has been conducted into the calculation of the trustworthiness of digital records using evidential value as a measure of trustworthiness. In addition, not much research has been conducted into the value of the metadata around digital records as evidence of the trustworthiness of these records. Therefore, we look into the EKM of digital records. By using the D-S theory of evidence, we developed a model for the assessment of the trustworthiness of digital records. Our model demonstrates that the incremental improvement of experts' knowledge in the area of evidential value, and the adoption of a rigorous formal approach, make possible the objective assessment of the trustworthiness of digital records.

There still remain a number of challenges to be met, including (1) the impact on the assessment from the temporal aspect is a challenge which needs further research, (2) as one of the criticisms on the D-S theory, the way of handling conflicts between EKM in the assessment model needs further studies, (3) since EKM may have different importance to the assessment result, weighting difference within the model needs further investigation, and (4) some of EKM can be interrelated in the model, such as name and affiliation of an operator, thus, how to combine dependent EKM needs further studies.

Conclusion

In this paper, we have developed and described a model for the assessment of the trustworthiness of digital records using Dempster-Shafer (D-S) theory. It uses the records' evidential values as a measure of trustworthiness. This model consists of three modules, (i) a knowledge-modelling module, which models the experts' knowledge related to a digital record, (ii) an evidence-combination module, which combines experts' knowledge of evidential values of Evidence-Keeping Metadata (EKM), and (iii) a trustworthiness assessment module, which assesses the trustworthiness of the digital record by aggregating and integrating evidence of EKM. We have presented an example with three cases to show how this model works. We have also identified challenges to the assessment model, which we will investigate in our future work.

Our results show that by incrementally improving experts' knowledge about evidential values and applying a rigorous formal approach, the trustworthiness of digital records can be assessed objectively.

As mentioned in the previous section, in our future work, we will continue to investigate the temporal, conflict, weighting and dependency aspects of the trustworthiness assessment of digital records.

m

  Originator (T ) = 0.6779; m Originator (T ) = 0.3197; m Originator (U ) = 0.0024 m Creator (T ) = 0.8918; m Creator (T ) = 0.0940; m Creator (U ) = 0.0142 m Creation (T ) = 0.9848; m Creation (T ) = 0.0152; m Creation (U ) = 0 Based on the aggregated results, it integrates the trustworthiness of components into the parent level, where the trustworthiness of the digital record during the creation phase is obtained, as shown below. m creation (T ) = 0.9991; m creation (T ) = 0.0009; m creation (U ) = 0 bel creation (T ) = 0.9991; pls creation (T ) = 1 -bel creation (T ) = 0.9991

Table 1 .

 1 Mapping linguistic evidential values to numeric evidential values.

	Linguistic EV extremely high very high high medium low very low extremely low φ
	Numeric EV	95%	80% 65% 50% 35% 20%	5%	0

Table 2 .

 2 Assigned evidential values of EKM during creation.

		EKM	Exp.1	Exp.2	Exp.3
	Originator	Name	(EH (95%)), true) (EH (95%), false)	(φ (0), φ)
		Affiliation	(VH (80%), true) (L (35%), false) (L (35%), false)
		Compose Time	(φ (0), φ)	(H (65%), false) (H (65%), true)
	Creator	Name	(H (65%), true) (H (65%), false) (VH (80%), true)
		Affiliation	(VH (80%), true) (M (50%), false) (L (35%), false)
	Creation Record's Name (VH (80%), true) (VH (80%), false) (VH (80%), true)
		Time	(L (35%), true) (H (65%), false) (VH (80%), false)
		Environment	(H (65%), true) (VH (80%), true) (H (65%), false)
		Format	(EH (95%), true) (EL (5%), true) (M (50%), false)
		Source	(H (65%), true) (H (65%), true) (VL (20%), false)
		Reason & Purpose (VH (80%), false) (VH (80%), true) (H (65%), false)

Table 3 .

 3 Combined results of experts' knowledge on EKM during creation phase.

		EKM	m(T ) m(T ) m(U )
	Originator	Name	0.4872 0.4872 0.0256
		Affiliation	0.6282 0.2147 0.1571
		Compose Time 0.3939 0.3939 0.2122
	Creator	Name	0.8230 0.1150 0.062
		Affiliation	0.5652 0.2717 0.1631
	Creation Record's Name 0.8276 0.1379 0.0345
		Time	0.0363 0.8962 0.0675
		Environment	0.8230 0.1150 0.062
		Format	0.9094 0.0453 0.0453
		Source	0.8514 0.0297 0.1189
		Reason & Purpose 0.2188 0.7266 0.0546

EV = φ means that the EKM can be used to establish neither that their higher-level nodes are trustworthy nor that they are untrustworthy.


M Angela Sasse
email: a.sasse@cs.ucl.ac.uk

Iacovos Kirlappos

Familiarity breeds con-victims: why we need more effective trust signaling

Introduction

The past 10 years have seen a plethora of research on trust in online interactions. In the late 90s, the issue was whether people would be willing to trust the Internet enough to order and enter their credit card details online. Most of the academic research and commercial advice published then focused on 'how to increase user trust online' by making websites 'user friendly' and having a 'personal touch' e.g. in the form of photos of company staff. Unfortunately, much this advice on how to make your Internet presence trustworthy is now being used by perpetrators of phishing scams, who are using the latest 'trustworthy UI design techniques' to trick users into revealing authentication credentials and other personal data. A key trust issue that has emerged with the huge popularity of social networking is users' voluntary (and sometimes ill-judged) disclosure of personal information, and accidental sharing of that data by applications and other users.

Whilst many new applications and services have emerged, little progress has been made in helping ordinary users to work out who they can trust online, and who they can't. Trust is only required when risk and uncertainty are present. Since it serves as a shortcut for a full risk-benefit analysis and mechanisms to assure that a transaction partner delivers what is being promised, there are significant economic benefits to trust-based environments [START_REF] Gefen | E-Commerce: The Role of Familiarity and Trust[END_REF]. In online transactions, uncertainty is increased because transactions partners are separated in space, and -unless delivery is instant (e.g. when buying a music track) -in time.

The importance of trust signaling

When deciding whether to trust, user look for signals of trustworthiness -cues about the transaction partner's ability and motivation to deliver their side of the transaction, rather than 'taking the money and run' [START_REF] Twyman | Trust in motives, trust in competence: Separate factors determining the effectiveness of risk communication[END_REF]. In real-world transactions, first-time interactions are regarded as more risky, whilst a past history of interactions allow the trustor to form a reasonable expectation of the trustee's behaviour. Users transfer this behaviour to online transactions: they will trust website that they have used in the past, or rather -any site that looks, feels or sounds like one they have used successfully in the past -not realising that in online environments, attackers can more easily mimic the appearance and behavior of genuine transaction partners.

In a recent study, we had participants buying music festival tickets under conditions of risk and uncertainty. We found that people use the following as indicator of trustworthiness:

1. Previous experience with the website. Users will trust websites they have used before -or rather: websites they think they have used before -and those that look or feel familiar. Small differences in appearance or behavior usually won't raise suspicion, nor do certificate warnings, because users have been de-sensitised by too many false positives.

Logos and certifications.

Most of the websites display some form of trust logo, and many users them as symbols of trust. We found, however, that none of our participants could explain though what these logo signify, and why a website is secure if it has this logo. Very few participants checked whether the logo was a clickable link and what information about the merchant it was providing. 3. Reference to other names the participants could recognize. Websites that had affiliate programs which included known venues around the country created a feeling of trust in participants. The inclusion of the Oxfam charity name in a website (www.gigantic.com), and mentioning that they give 10% of their profits to it, made participants think that it cannot be fake -even though there was no way to verify whether the claims of that website were true, since no links existed that confirmed. 4. Advertising. Participants had mixed reactions on the presence of advertisements on websites. Adverts of well-known companies induced a feeling of trust for 14% of participants. Their main argument was "why would a company pay them to include advertisements in their website if they were scammers?" On the other hand, 11% of participants said that if they have a lot of advertisements, then they can be scams, and they preferred to buy from sites that displayed fewer of these.

Social Networking references Inclusion of links to Facebook and Twitter pages

can significantly affect the level of trust in a site. 19% of participants mentioned that if a retailer has a Facebook Page or a Twitter site, then they cannot be fraudulent, as their victims could post negative comments on those sites after they were scammed, deterring other people from using them. In addition, the inclusion of other user feedback in the website can also contribute in the creation of a feeling of trust and received positive comments by 11% of participants. This was strongly present in the case of a website which included pictures of the people that left feedback for its services, or other members of the website that are planning to attend an event, concurring with findings that richer media representations could lead to a positive trust bias.

Amount of information provided

The amount of information the website included on the particular event influenced 17% of participants. Although all websites included information on the event (gate opening times, facilities, instructions how to get to the venue etc), those that had that information viewable on the main event page seemed to attract the participants more. Inclusion of visual artifacts like maps increased the level of trust and made them appear more persuasive and real.

7. Website Layout 19% of participants mentioned that the structure of the website design was something that looked familiar to them from other websites they are using, which are known to be legitimate. So the websites they have chosen to trust are possibly genuine as the layout is similar. Indication that a site sells tickets for a variety of events was also critical, as participants did not perceive it as a scam aiming to target a particular event audience. 8. Company Information The type of information the website provided on the company behind it also affected decisions. 14% of participants mentioned that the presence of the registration number of the company, VAT numbers, direct telephone numbers, ticket delivery information and claims that they are official ticket outlets seemed to be trusted more. As with the logos (see 2), however, none of the participants knew how to verify this information though.

Our results show that trust signalling in online interactions is currently dysfunctional. Attackers have an easy game -techniques that are successfully employed in the real world are currently even cheaper and easier to online (a point elaborated by Stajano & Wilson [3]).

Information about ability and motivation of a trustee to fulfil can be inferred from signals of trust-warranting properties [START_REF] Riegelsberger | The mechanics of trust: a framework for research and design[END_REF]. There are two main types of signals for trustworthiness:

• Symbols of trustworthiness. Symbols have an arbitrarily assigned meaning -they are specifically created to signify the presence of trust-warranting properties.

Examples of symbols for such properties are e-commerce trust seals. Symbols can be protected by making them very difficult to forge, or by threatening sanctions in the case of misuse. They are a common way of signaling trustworthiness, but their usability is often limited. Because they are created for specific settings, the trustor has to know about their existence and how to decode them. At the same time, trustees need to invest in emitting them and in getting them known. • Symptoms of trustworthiness. Symptoms are not specifically created to signal trust-warranting properties; rather, they are by-products of the activities of trustworthy actors. As an example, a steady gaze and firm voice may not require much effort when telling the truth, but may require some training to maintain while lying. Therefore, exhibiting symptoms of trust incurs no cost for trustworthy actors, whereas untrustworthy actors would have to invest some effort to engage in effective mimicry. Our currently online environment has very much relied on trust symbols; but the results of our study illustrate why they do not work in an online environment -they are cheap to mimic, and users cannot tell the difference between genuine and mimicked ones. The presentation will argue that we need to shift our design efforts to supporting trust symptoms, which are impossible or expensive for attackers to forge, and provide user with richer cues that are embedded in the specific transactions.


Mark Hoogendoorn

S Waqar Jaffry

Peter-Paul Van Maanen
email: peter-paul.vanmaanen@tno.nl

Validation and Verification of Agent Models for Trust: Independent compared to Relative Trust

In this paper, the results of a validation experiment for two existing computational trust models describing human trust are reported. One model uses experiences of performance in order to estimate the trust in different trustees. The second model in addition carries the notion of relative trust. The idea of relative trust is that trust in a certain trustee not solely depends on the experiences with that trustee, but also on trustees that are considered competitors of that trustee. In order to validate the models, parameter adaptation has been used to tailor the models towards human behavior. A comparison between the two models has also been made to see whether the notion of relative trust describes human trust behavior in a more accurate way. The results show that taking trust relativity into account indeed leads to a higher accuracy of the trust model. Finally, a number of assumptions underlying the two models are verified using an automated verification tool.

Introduction

When considering relations and interaction between agents, the concept of trust is of utmost importance. Within the domain of multi-agent systems, the concept of trust has been a topic of research for many years (e.g., [START_REF] Sabater | Review on computational trust and reputation models[END_REF][START_REF] Ramchurn | Trust in multi-agent systems[END_REF]). Within this research, the development of models expressing how agents form trust based upon direct experiences with a trustee or information obtained from parties other than the trustee is one of the central themes. Some of these models aim at creating trust models that can be utilized effectively within a software agent environment (e.g., [START_REF] Maanen | Aiding human reliance decision making using computational models of trust[END_REF]), whereas other models aim to present an accurate model of human trust (e.g., [START_REF] Jonker | Formal analysis of models for the dynamics of trust based on experiences[END_REF][START_REF] Falcone | Trust dynamics: How trust is influenced by direct experiences and by trust itself[END_REF][START_REF] Hoogendoorn | Modeling dynamics of relative trust of competitive information agents[END_REF]). The latter type of model can be very useful when developing a personal assistant agent for a human with the awareness of the human's trust in different other agents (human or computer) and himor herself (trustees). This could for example avoid advising to use particular information sources that are not trusted by the human or could be used to enhance the trust relationship with the personal assistant agent itself.

In order for computational trust models to be usable in real life settings, the validity of these models should be proven first. However, relatively few experiments have been performed that validate the accuracy of computational trust models upon empirical data.

For instance, in [START_REF] Jonker | Human experiments in trust dynamics[END_REF] an experiment has been conducted whereby the trends in human trust behavior have been analyzed to verify properties underlying trust models developed in the domain of multi-agent systems. However, no attempt was made to fit the model to the trusting behavior of the human.

In this paper, the results of a validation experiment for two computational trust models describing human trust are reported. A trust model taken from [START_REF] Maanen | Aiding human reliance decision making using computational models of trust[END_REF], which was inspired on the trust model described in [START_REF] Jonker | Formal analysis of models for the dynamics of trust based on experiences[END_REF], has been taken as a baseline model. This model uses experiences of performance in order to estimate the trust in different trustees and is an influential model in the domain of agent systems. The second model which is validated in this study is a model which also carries the notion of relative trust [START_REF] Hoogendoorn | Modeling dynamics of relative trust of competitive information agents[END_REF]. The idea of relative trust is that trust in a certain trustee not solely depends on the experiences with that trustee, but also with trustees that are considered competitors of that trustee. A comparison between the two models is also made to see whether the notion of relative trust describes human trust behavior in a more accurate way.

The validation process includes a number of steps. First, an experiment with participants has been performed in which trust plays an important role. As a result, empirical data has been obtained, that is usable for validating the two models. One part of the dataset is used to learn the best parameters for the two different trust models. Then these parameters are used to estimate human trust, using the same input as was used to generate the other part of the dataset. Finally, a number of assumptions underlying the two trust models are verified upon the obtained dataset using an automated verification tool. These assumptions are useful to verify whether the humans indeed exhibit the patterns that are used as a basis for the development of trust models.

This paper is organized as follows. First, the two trust models that have been used in this study are explained in Section 2. The experimental method is explained in Section 3. Thereafter, the results of the experiment in terms of model validation and verification are described in Section 4. Finally, Section 5 is a discussion.

Agent Models for Trust

In this section the two types of trust models which are subject of validation are described. In Section 2.1 a model is explained that estimates human trust in one trustee independent of the trust in other trustees. In contrast, in Section 2.2 a model is described for which this relative dependency actually is important.

Independent Trust Model

This section describes the independent trust model [START_REF] Maanen | Aiding human reliance decision making using computational models of trust[END_REF][START_REF] Jonker | Formal analysis of models for the dynamics of trust based on experiences[END_REF]. In this model trustees are considered rational and are therefore thought of having no bias to calculate trust. Trust is based on experiences and there is a certain decay of trust.

For the present study, it is assumed that a set of trustees {S 1 , S 2 , . . . , S n } is available that can be selected to give particular advice at each time step. Upon selection of one of the trustees (S i ), an experience is passed back indicating how well the trustee performed. This experience (E i (t)) is a number on the interval [-1, 1]. Hereby, -1 expresses a negative experience, 0 is a neutral experience and 1 a positive experience. There is also a decay parameter λ i in the model, for which holds that 0 ≤ λ i ≤ 1.

Given the above, trust now can calculated by means of the following formula:

T i (t) = T i (t -1) • λ i + (1 - E i (t) + 1 2 ) • (1 -λ i )
The independent trust is calculated for each trustee. Note that the experience is mapped to the domain [0, 1] in this equation. Eventual reliance decisions are made by determining the maximum of the independent trust over all trustees. For more details on the rationale behing the formula, see [START_REF] Maanen | Aiding human reliance decision making using computational models of trust[END_REF][START_REF] Jonker | Formal analysis of models for the dynamics of trust based on experiences[END_REF].

Relative Trust Model

This section describes the relative trust model [START_REF] Hoogendoorn | Modeling dynamics of relative trust of competitive information agents[END_REF]. In this model trustees are considered competitors, and the human trust in a trustee depends on the relative experiences with the trustee to the experiences from the other trustees. The model defines the total trust of the human as the difference between positive trust and negative trust (distrust) on the trustee. The model includes several parameters representing human characteristics including trust flexibility β i (measuring the change in trust on each new experience), decay γ i (decay in trust when there is no experience) and autonomy η i (dependence of the trust calculation considering other options). The model parameters β i , γ i and η i have values from the interval [0, 1].

As mentioned before, the model is composed of two models: one for positive trust, accumulating positive experiences, and one for negative trust, accumulating negative experiences. Both negative and positive trust are represented by a number between [0, 1]. The human's total trust T i (t) in S i is the difference in positive and negative trust in S i at time point t, which is a number between [-1, 1], where -1 and 1 represent the minimum and maximum values of trust, respectively. The human's initial total trust in S i at time point 0 is T i (0), which is the difference in initial trust T + i (0) and distrust T - i (0) in S i at time point 0. As a differential equation the change in positive and negative trust over time is described in the following manner [START_REF] Hoogendoorn | An adaptive agent model estimating human trust in information sources[END_REF]:

dT + i (t) dt = E i (t) • (E i (t) + 1) 2 • β i • η i • (1 -T + i (t)) + (1 -η i )• (τ + i (t) -1) • T + i (t) • (1 -T + i (t)) - γ i • T + i (t) • (1 + E i (t)) • (1 -E i (t)) dT - i (t) dt = E i (t) • (E i (t) -1) 2 • β i • η i • (1 -T - i (t)) + (1 -η i )• (τ - i (t) -1) • T - i (t) • (1 -T - i (t)) - γ i • T - i (t) • (1 + E i (t)) • (1 -E i (t))
In these equations, E i (t) is the experience value given by S i at time point t. Furthermore, τ + i (t) and τ - i (t) are the human's relative positive and negative trust in S i at time point t, which is the ratio of the human's positive or negative trust in S i to the average human's positive or negative trust in all trustees at time point t defined as follows:

τ + i (t) = T + i (t) n j=1 T + j (t) n and τ - i (t) = T - i (t) n j=1 T - j (t) n
Finally, the total change in trust can be calculated as follows (using which the new trust value can easily be calculated):

dT i (t) dt = dT + i (t) dt - dT - i (t)
dt Similarly as for the independent trust model, the trustee with the highest trust value is relied upon.

Method

In this section the experimental methodology is explained. In Section 3.1 the participants are described. In Section 3.2 an overview of the used experimental environment is given. Thereafter, the procedure of the experiment is explained in four stages: In Sections 3.3, 3.4, 3.5 and 3.6, the procedures of data collection, parameter adaptation, model validation and verification are explained, respectively. The results of the experiment are given in Section 4.

Participants

18 Participants (eight male and ten female) with an average age of 23 (SD = 3.8) were found to be willing to participate in the experiment as paid volunteers. Non-color blinded participants were selected. All were experienced computer users, with an average of 16.2 hours of computer usage each week (SD = 9.32).

Task

The experimental task was a classification task in which two participants on two separate personal computers had to classify geographical areas according to specific criteria as areas that either needed to be attacked, helped or left alone by ground troops. The participants needed to base their classification on real-time computer generated video images that resembled video footage of real unmanned aerial vehicles (UAVs). On the camera images, multiple objects were shown. There were four kinds of objects: civilians, rebels, tanks and cars. The identification of the number of each of these object types was needed to perform the classification. Each object type had a score (either -2, -1, 0, 1 or 2, respectively) and the total score within an area had be determined. Based on this total score the participants could classify a geographical area (i.e., attack when above 2, help when below -2 or do nothing when in between). Participants had to classify two areas at the same time and in total 98 areas had to be classified. Both participants did the same areas with the same UAV video footage.

During the time a UAV flew over an area, three phases occurred: The first phase was the advice phase. In this phase both participants and a supporting software agent gave an advice about the proper classification (attack, help, or do nothing). This means that there were three advices at the end of this phase. It was also possible for the participants to refrain from giving an advice, but this hardly occurred. The second phase was the reliance phase. In this phase the advices of both the participants and that of the supporting software agent were communicated to each participant. Based on these advices the participants had to indicate which advice, and therefore which of the three trustees (self, other or software agent), they trusted the most. Participants were instructed to maximize the number of correct classifications at both phases (i.e., advice and reliance phase). The third phase was the feedback phase, in which the correct answer was given to both participants. Based on this feedback the participants could update their internal trust models for each trustee (self, other, software agent).

In Figure 1 the interface of the task is shown. The map is divided in 10 × 10 areas. These boxes are the areas that were classified. The first UAV starts in the top left corner and the second one left in the middle. The UAVs fly a predefined route so participants do not have to pay attention to navigation. The camera footage of the upper UAV is positioned top right and the other one bottom right.

The advice of the self, other and the software agent was communicated via dedicated boxes below the camera images. The advice to attack, help, or do nothing was communicated by red, green and yellow, respectively. On the overview screen on the left, feedback was communicated by the appearance of a green tick or a red cross. The reliance decision of the participant is also shown on the overview screen behind the feedback (feedback only shown in the feedback phase). The phase depicted in Figure 1 was the reliance phase before the participant indicated his reliance decision.

Data Collection

During the above described experiment, input and output were logged using a serverclient application. The interface of this application is shown in Figure 2. Two other client machines, that were responsible for executing the task as described in the previous subsection, were able to connect via a local area network to the server, which was responsible for logging all data and communication between the clients. The interface shown in Figure 2 could be used to set the client's IP-addresses and ports, as well as several experimental settings, such as how to log the data. In total the experiment lasted approximately 15 minutes per participant.

Experienced performance feedback of each trustee and reliance decisions of each participant were logged in temporal order for later analysis. During the feedback phase the given feedback was translated to a penalty of either 0, .5 or 1, representing a good, neutral or poor experience of performance, respectively. This directly maps to the value

Ei(t)+1 2
in the trust models. During the reliance phase the reliance decisions were translated to either 0 or 1 for each trustee S i , which represented that one relied or did not rely on S i .

Parameter Adaptation

The data collection described in Section 3.3 was repeated twice on each group of two participants, called condition 1 and condition 2, respectively. The data from one of the conditions was used for parameter adaptation purposes for both models, and the data from the other condition for model validation (see Section 3.5). This process of parameter adaptation and validation was balanced over conditions, which means that condition 1 and condition 2 switch roles, so condition 1 is initially used for parameter adaptation and condition 2 for model validation, and thereafter condition 2 is used for paramter adaptation and condition 1 for model validation (i.e. cross-validation). Both the parameter adaptation and model validation procedure was done using the same application as was used for gathering the empirical data. The interface shown in Figure 2 could also be used to alter validation and adaptation settings, such as the granularity of the adaptation.

The number of parameters of the models presented in Section 2 to be adapted for each model and each participant suggest that an exhaustive search [START_REF] Hoogendoorn | An adaptive agent model estimating human trust in information sources[END_REF] for the optimal parameters is feasible. This means that the entire parameter search space is explored to find a vector of parameter settings resulting in the maximum accuracy (i.e., the amount of overlap between the model's predicted reliance decisions and the actual human reliance decisions) for each of the models and each participant. The corresponding code of the implemented exhaustive search method is shown in Algorithm 1.

In this algorithm, E(t) is the set of experiences (i.e., performance feedback) at time point t for all trustees, R H (e) is the actual reliance decision the participant made (on either one of the trustees) given a certain experience e, R M (e, X) is the predicted reliance decision of the trust model M (either independent or relative) given an experience e and candidate parameter vector X (reliance on either one of the trustees), δ X is the distance between the estimated and actual reliance decisions given a certain candidate parameter vector X, δ best is the distance resulting from the best parameter vector X best found so far. The best parameter vector X best is returned when the algorithm finishes. This parameter adaptation procedure was implemented in C#.

If for Algorithm 1 the number of parameters is µ, Γ the granularity for each parameter, N the number of trustees and B the number of reliance decisions (i.e., time points) made by the human, then the worst case complexity of the algorithm is expressed as O(10 µΓ BN ). The complexity also depends on N , since R M (e, X) results in a calculation of trust values over all trustees. For the independent trust model it holds that µ = 1 (i.e., the parameter λ i ) and for the relative trust model µ = 3 (i.e., the three parameters β i , γ i and η i ). In the current experiment it furthermore holds that Γ = 2 (i.e., steps of .01), N = 3 (the two humans and the software agent) and B = 98 (the total of classi-

Algorithm 1 ES-PARAMETER-ADAPTATION(E, R H ) 1: δ best ← ∞ 2: X ← 0 3: for all parameters x in parameter vector X do 4:
for all settings of x do 5:

δX ← 0 6:

for all time points t do 7:

e ← E(t) 8:

rM ← RM (e, X) 9:

rH ← RH (e) 10:

if rM = rH then 11:

δX ← δX + 1 12:

end if 13:

end for 14:

if δX < δ best then 15:

X best ← X 16:

δ best ← δX 17:

end if 18:

end for 19: end for 20: return X best fied geographical areas). This means that 2.94 • 104 computation steps are needed for the independent trust model and 2.94 • 10 8 for the relative trust model, which took on average 31 milliseconds for the first, and 3 minutes and 20 seconds computation time for the second model. 3

Validation

In order to validate the two models described in Section 2, the measurements of experienced performance feedback were used as input for the models and the output (predicted reliance decisions) of the models was compared with the the actual reliance decisions of the participant. The overlap of the predicted and the actual reliance decisions was a measure for the accuracy of the models. The results are in the form of dynamic accuracies over time, average accuracy per condition (1 or 2) and per trust model (independent or relative). A comparison between the averages per model and the interaction effect between condition role allocation (i.e., parameter adaptation either in condition 1 or 2) and model type, is done using a repeated measures analysis of variance (ANOVA).

Verification

Next to a validation using the accuracy of the prediction using the models, another approach has been used to validate the assumptions underlying existing trust models.

The idea is that properties that form the basis of trust models are verified against the empirical results obtained within the experiment. In order to conduct such an automated verification, the properties have been specified in a language called Temporal Trace Language (TTL) [START_REF] Bosse | Specification and verification of dynamics in agent models[END_REF] that features a dedicated editor and an automated checker. The language TTL is explained first, followed by an expression of the desired properties related to trust.

Temporal Trace Language (TTL)

The predicate logical temporal language TTL supports formal specification and analysis of dynamic properties, covering both qualitative and quantitative aspects. TTL is built on atoms referring to states of the world, time points and traces, i.e., trajectories of states over time. In addition, dynamic properties are temporal statements that can be formulated with respect to traces based on the state ontology Ont in the following manner. Given a trace γ over state ontology Ont, the state in γ at time point t is denoted by state(γ, t). These states can be related to state properties via the formally defined satisfaction relation denoted by the infix predicate |=, i.e., state(γ, t) |= p denotes that state property p holds in trace γ at time t. Based on these statements, dynamic properties can be formulated in a formal manner in a sorted firstorder predicate logic, using quantifiers over time and traces and the usual first-order logical connectives such as ¬, ∧, ∨, ⇒, ∀ and ∃. For more details on TTL, see [START_REF] Bosse | Specification and verification of dynamics in agent models[END_REF].

Properties for Trust Models Within the literature on trust, a variety of properties have been expressed concerning the desired behavior of trust models. In many of these properties, the trust values are explicitly referred to, for instance in the work of [START_REF] Jonker | Formal analysis of models for the dynamics of trust based on experiences[END_REF] characteristics of trust models have been defined (e.g., monotonicity and positive trust extension upon positive experiences). In this paper however, the trust function is subject of validation and hence, cannot be taken as a basis. Therefore, properties are expressed on an external basis, solely using the information which has been observed within the experiment to see whether these behaviors indeed comply to the desired behavior of the trust models. This information is then limited to the experiences that are received as an input and the choices that are made by the human that are generated as output. The properties from [START_REF] Hoogendoorn | Modelling trust dynamics from a neurological perspective[END_REF] are taken as a basis for these properties. Essentially, the properties indicate the following desired behavior of human trust:

1. Positive experiences lead to higher trust 2. Negative experiences lead to lower trust 3. Most trusted trustee is selected As can be seen, the properties also use the intermediate state of trust. In order to avoid this, it is however possible to combine these properties into a single property that expresses a relation between the experiences and the selection (i.e., the above items 1 + 3 and 2 + 3). Two of these properties are shown below. In addition, a property is expressed which specifies the notion of relativity in the experiences and the resulting selection of a trustee. The first property expresses that a trustee that gives the absolute best experiences during a certain period is eventually selected at least once within, or just after that particular period, and is shown below.

P1(min duration, max duration, max time): Absolute more positive experiences results in selection

If a trustee a 1 always gives more positive experiences than all other trustees during a certain period with minimal duration min duration and maximum duration max duration, then this trustee a 1 is selected at least once during the period [ The second property, P2, specifies that the trustee which gives more positive experiences on average during a certain period is at least selected once within or just after that period. P2(min duration, max duration, max delay, higher exp): Average more positive experiences results in selection If a trustee a 1 on average gives the most positive experiences (on average more than higher exp better than the second best) during a period with minimal duration min duration and maximum duration max duration, then this trustee a 1 is selected at least once during the period [min duration, max duration+max delay].

Formal:

P2(min duration:DURATION, max duration:DURATION, max delay:DURATION, higher exp:REAL) ≡ ∀γ:TRACE, t start , t end :TIME, a:TRUSTEE [ [ t end -t start ≥ min duration & t end -t start ≤ max duration & average highest experiences(γ, a, t start , t end , higher exp)] ⇒ selected(γ, a, t start , t end , max delay) ] where average highest experiences(γ:TRACE, a:TRUSTEE, t start :TIME, t end :TIME, higher exp:REAL) ≡ ∀t:TIME, r1, r2:REAL, a2:TRUSTEE = a [ t ≥ t start & t < t end & [ ∀t:TIME case(experience received(γ, a, t, t start , t end , e), e, 0) > ( ∀t:TIME (case(experience received(γ, a, t, t start , t end , e), e, 0)) + higher exp * t end -t start ) ] ]

In the formula above, the case(p, e, 0) operator evaluates to e in case property p is satisfied and to 0 otherwise. The final property concerns the notion of relativity which plays a key role in the models verified throughout this paper. The property expresses that the frequency of selection of a trustee that gives an identical experience pattern during two periods is not identical in case the other trustees give different experiences.

P3(interval length, min difference, max time): Relative trust If a trustee a 1 gives an identical experience pattern during two periods [t 1 , t 1 + interval length] and [t 2 , t 2 + interval length] and the experiences of at least one other trustee is not identical (i.e., more than min difference different at each time point), then the selection frequency of a 1 will be different in a period during, or just after the specified interval.

Formal:

P3(interval length:DURATION, min difference:REAL, max time:DURATION) ≡ ∀γ:TRACE, t1, t2:TIME, a:TRUSTEE [ [ same experience sequence(γ, a, t1, t2, interval length) & ∃a2:TRUSTEE =a [different experience sequence(γ, a, t1, t2, min difference)] ⇒ ∃i:DURATION < max time ∀t:TIME case(selected option(γ, a, t, t1 + i, t1 + i+ interval length), 1, 0) / (1 + ∀t:TIME case(trustee selected(γ, t, t1, t1 + i+ interval length), 1, 0) ) = ∀t:TIME case(selected option(γ, a, t, t2 + i, t2 + i+ interval length), 1, 0) / (1 + ∀t:TIME case(trustee selected(γ, t, t2

+ i, t2 + i+ interval length), 1, 0) )

Validation Results

From the data of 18 participants, one dataset has been removed due to an error while gathering data. This means that there are 2 (condition role allocations, i.e., parameter adaptation either in condition 1 or 2) times 17 (participants) = 34 data pairs (accuracies for 2 models). Due to a significant Grubbs test, from these pairs 3 outliers were removed. Hence in total 31 pairs were used for the data analysis.

In Figure 3 the main effect of model type (either independent or relative trust) for accuracy is shown. A repeated measures analysis of variance (ANOVA) showed a significant main effect (F (1, 29) = 7.60, p < .01). This means that indeed the relative trust model had a higher accuracy (M = .7968, SD = .0819) than the independent trust model (M = .7185, SD = .1642).

Figure 4 shows the possible interaction effect between condition role allocation (parameter adaptation in condition 1 is referred to as adaptation 1 and parameter adaptation in condition 2 is referred to as adaptation 2) and model type (either independent or relative trust) on accuracy. No significant interaction effect was found (F (1, 29) = .01, p = .93). Hence, no significant learning effect between conditions was found. Crossvalidation was not needed to balance the data, but the procedure still produced twice as much data pairs.

Verification Results

The results of the verification of the properties against the empirical traces (i.e., formalized logs of human behavior observed during the experiment) are shown in Table 1.

First, the results for properties P1 and P2 are shown. Hereby, the value of max duration has been kept constant at 30 and the max time after which the trustee should be consulted is set to 5. The minimal interval time (min duration) has been varied. Finally, for property P2 the variable higher exp indicating how much higher the experience should be on average compared to the other trustees is set to .5. The results in Table 1 indicate the percentage of traces in which the property holds out of all traces in which the antecedent at least holds once (i.e., at least one sequence with the min duration occurs in the trace). This has been done to avoid a high percentage of satisfaction due to the fact that in some of the traces the antecedent never holds, and hence, the property is always satisfied. The table shows that the percentage of traces satisfying P1 goes up as the minimum duration of the interval during which a trustee gives the highest experience increases. This clearly complies to the ideas underlying trust models as the longer a trustee gives the highest experiences, the higher his trust will be (also compared to the other trustees), and the more likely it is that the trustee will be selected. The second property, counting the average experience and its implication upon the selection behavior of the human, also shows an increasing trend in satisfaction of the property with the duration of the interval during which the trustee on average gives better experiences.

The percentages are lower compared to P1 which can be explained by the fact that they might also give some negative experiences compared to the alternatives (whereas they are giving better experiences on average). This could then result in a decrease in the trust value, and hence, a lower probability of being selected. The third property, regarding the relativity of trust has also been verified and the results of this verification are shown in Table 2. Here, the traces of the participants have been verified with a setting of min difference to .5 and max time to 5 and the variable interval length during which at least one trustee shows identical experiences whereas another shows different experiences has been varied. It can be seen that property P3 holds more frequently as the length of the interval increases, which makes sense as the human has more time to perceive the relative difference between the two. Hence, this shows that the notion of relative trust can be seen in the human trustee selection behavior in almost 70% of the cases.

Discussion and Conclusions

In this paper, an extensive validation study has been performed to show that human trust behavior can be accurately described and predicted using computational trust models.

In order to do so, an experiment has been designed that places humans in a setting where they have to make decisions based upon the trust they have in others. In total 18 participants took part in the experiment. The results show that both an independent [START_REF] Maanen | Aiding human reliance decision making using computational models of trust[END_REF][START_REF] Jonker | Formal analysis of models for the dynamics of trust based on experiences[END_REF] as well as a relative trust model [START_REF] Hoogendoorn | Modeling dynamics of relative trust of competitive information agents[END_REF] can predict this behavior with a high accuracy (72% and 80%, respectively) by learning on one dataset and predicting the trust behavior for another (cross-validation). Furthermore, it has also been shown that the underlying assumptions of the trust models (and many other trust models) are found in the data of the participants.

Of course, more work on the validation of trust models has been performed. In [START_REF] Jonker | Human experiments in trust dynamics[END_REF] an experiment has been presented to investigate human trust behavior. Although the underlying assumptions of trust models have to some extent been verified in that paper, no attempt has been made to fit a trust model to the data. Other papers describing the validation of trust models for instance validate the accuracy of trust models describing the propagation of trust through a network (e.g., [START_REF] Guha | Propagation of trust and distrust[END_REF]). In [START_REF] Mcknight | Developing and validatin trust measures for e-commerce: An integrative topology[END_REF] a multidisciplinary, multidimensional model of trust in e-commerce is validated. The model includes four high-level constructs: disposition to trust, institution-based trust, trusting beliefs, and trusting intentions. The proposed model itself does however not describe the formation of trust on such a detailed level as the models used throughout this paper, it presents general relationships between trust measures and these relationships are subject to validation. Gefen and Straub [START_REF] Gefen | Consumer trust in b2c e-commerce and the importance of social presence: experiments in e-products and e-services[END_REF] validate a four-dimensional scale of trust in the context of e-Products and revalidates it in the context of e-Services which shows the influence of social presence on these dimensions of trust, especially benevolence, and its ultimate contribution to online purchase intentions. Again, correlations are found between the concepts of trust that have been distinguished, but no computational model for the formation of trust and the precise prediction thereof is prosed. Finally, in [START_REF] Da | Development-based trust: Proposing and validating a new trust measurement model for buyer-seller relationships[END_REF] a development-based trust measurement model for buyer-seller relationships is presented and validated against a characteristic-based trust measurement model in terms of its ability to explain certain variables of interest in buyer-seller relationships (long-term relationship orientation, information sharing, behavioral loyalty and future intentions).

Within the domain of agent systems, quite some trust models have been developed, see e.g. [START_REF] Sabater | Review on computational trust and reputation models[END_REF], [START_REF] Ramchurn | Trust in multi-agent systems[END_REF] for an overview. Although the focus of this paper has been on the validation of two specific trust models, thereby also comparing relative with absolute trust, other trust models can also be validated using the experimental data obtained in combination with parameter estimation. This is part of the future work. Furthermore, other parameter adaptation methods will be explored or extended for the purpose of realtime adaptation, which accounts for human learning. In addition, a personal assistant software agent will be implemented that is able to monitor and balance the functional state of the human in a timely and knowledgeable manner. Also applications in different domains are explorable, such as the military and air traffic control domain.

Fig. 1 .

 1 Fig. 1. Interface of the task.

Fig. 2 .

 2 Fig. 2. Interface of the application used for gathering validation data (Connect), for parameter adaptation (Tune) and validation of the trust models (Validate).

Fig. 3 .

 3 Fig. 3. Main effect of model type for accuracy.

Fig. 4 .

 4 Fig. 4. Interaction effect between condition role allocation and model type on accuracy.

  min duration, max duration + max time]. DURATION, max duration:DURATION, max delay:DURATION) ≡ ∀γ:TRACE, t start , t end :TIME, a:TRUSTEE [ [ t end -t start ≥ min duration & t end -t start ≤ max duration & absolute highest experiences(γ, a, t start , t end ) ⇒ selected(γ, a, t start , t end , max delay) where absolute highest experiences(γ:TRACE, a:TRUSTEE, t start :TIME, t end :TIME) ≡ ∀t:TIME, r1, r2:REAL, a2:TRUSTEE =a [ [ t≥ t start & t < t end & state(γ, t) |= trustee gives experience(a, r1) & state(γ, t) |= trustee gives experience(a2, r2) ] ⇒ r2 < r1]

	Formal:
	P1(min duration:

selected(γ:TRACE, a:TRUSTEE, t start :TIME, t end :TIME, z:DURATION) ≡ ∃t:TIME [ t≥ t start & t < t end + z & state(γ, t) |= trustee selected(a) ]

  experience received(γ:TRACE, a:TRUSTEE, t:TIME, t start :TIME, t end :TIME, r:REAL) ≡ [ ∃r:REAL, t≥t start & t < t end & state(γ, t) |= trustee gives experience(a, r) ]

Table 1 .

 1 Results of verification of property P1 and P2.

	min duration % satisfying P1 % satisfying P2
	1	64.7	29.4
	2	64.7	29.4
	3	86.7	52.9
	4	92.3	55.9
	5	100.0	58.8
	6	100.0	70.6

Table 2 .

 2 Results of verification of property P3.

	interval length % satisfying P3
	1	0
	2	41.1
	3	55.9
	4	67.6
	5	66.7
	6	68.4

This was on an ordinary PC with an Intel(R) Core(TM)2 Quad CPU @2.40 GHz inside. Note that 31 • 2.94•10 8 2.94•10

milliseconds =

[START_REF] Guha | Propagation of trust and distrust[END_REF].17 minutes = 3.33 minutes computation time. This is due to a fixed initialization time of on average 11 ms for both models.

Acknowledgments

This research was partly funded by the Dutch Ministry of Defense under progr. no. V929. Furthermore, this research has partly been conducted as part of the FP7 ICT Future Enabling Technologies program of the European Commission under grant agreement no. 231288 (SOCIONICAL). The authors would like to acknowledge Francien Wisse for her efforts to gather the necessary validation data and implementing the experimental task. The authors would also like to thank Tibor Bosse, Jan-Willem Streefkerk and Jan Treur for their helpful comments.