Zeinab Noorian
email: z.noorian@unb.ca

Stephen Marsh
email: stephen.marsh@crc.gc.ca

Michael Fleming

Prob-Cog: an Adaptive Filtering Model for Trust Evaluation

Trust and reputation systems are central for resisting against threats from malicious agents in decentralized systems. In previous work we have introduced the Prob-Cog model of multi-layer filtering for consumer agents in e-marketplaces which provide mechanisms for identifying participants who disseminate unfair ratings by cognitively eliciting the behavioural characteristics of e-marketplace agents. We have argued that the notion of unfairness does not exclusively refer to deception but can also imply differences in dispositions. The proposed filtering approach goes beyond the inflexible judgements on the quality of participants and instead allows environmental circumstances and the human dispositions that we call optimism, pessimism and realism to be incorporated into our trustworthiness evaluation procedures. In this paper we briefly outline the two layers before providing a detailed exposition of our experimental results, comparing Prob-Cog to FIRE and the personalized approach under various attacks and normal situations.

Introduction

Open e-marketplaces are uncertain places. These uncertainties contribute to misunderstandings amongst the agents that inhabit them [?]. While malicious agents exist, the recommendations of even honest agents who are unknown must be considered to be unreliable. Strategies for managing the uncertainties exist. In particular, in order to diminish the risk of being misled by unfair advisers, a consumer agent seeks advice from participants with the most similar ratings [?], [?].

In previous work [?] we amended this common view of trustworthiness [?],[?] by introducing a new definition for unfairness. Unfairness can be examined across two categories: 1) intentional, a) participants consistently act malevolently and b) participants occasionally engage in deceitful activities. And 2) unintentional, as a result of a) lack of personal experiences and b) various behavioural characteristics resulting in different rating attitudes.

Our algorithm uses a two-layered filtering approach combining cognitive and probabilistic views of trust [?] to mainly target the intentional group of unfair advisers. We showed that modeling the trustworthiness of advisers based on a strict judgement of the quality of their recommendations is not complete unless it is accompanied by the analysis of their dispositions. Thus, through the comprehension of their rating attitudes, a consumer agent could take appropriate steps to evaluate them.

In this paper, we provide an overview of the algorithm before presenting new experimental results to show its efficacy in filtering unfair advisers whilst still managing the problem of unfairness to new or unknown others. We then describe the adaptive approach of the Prob-Cog model in determination of the employed threshold parameters in different environmental circumstances. Our experimental results show the utility of our approach in classification of various participants and, specifically, how consumers could detect more honest advisers in a community where the majority of participants are unfair. Our Prob-Cog filtering model can therefore be seen as an effective approach in modeling the reputation of advisers in a dynamic agent-oriented e-commerce application.

Related Works

Several reputation systems and mechanisms have been proposed for modeling the trustworthiness of advisers and coping with the problem of unfair ratings in multi-agent online environments. Below we provide a description on two representative approaches: FIRE and the personalized model. More detailed overviews of other existing trust and reputation systems can be found in [?], [?].

The FIRE Model [?] is a decentralized trust and reputation system designed for open multi-agent systems such as e-commerce applications. In FIRE, trust is evaluated within the context of a number of different information components:1)Interaction Trust (IT) that is built from the direct experience of buying agents ; 2) Witness Reputation (WR) that is based on the direct observation of selling agents' performance by third-party agents; 3)Certified Reputation (CR) which consists of certified references disclosed by selling agents; and 4) Role-based Trust (RT), which models the trust across predefined role-based relationships between two participants. In this trust model, each component has a deterministic trust formula with a relevant rating weight function [?]. These weight functions are designed such that they reflect intrinsic characteristics of their components. For example, in the IT component, the weight function is merely based on the recency of the reputation information, whereas in WR the weight is calculated based on the credibility of its reputation providers. To evaluate the credibility of reputation providers, FIRE has developed an adaptive mechanism to detect and filter out inaccurate reports. It defines an adaptive inaccuracy tolerance threshold based on the selling agents' performance variation to specify the maximal permitted differences between the actual performance and the provided ratings. Credibility ratings of the reputation providers are tuned to be inversely proportional to the differences, i.e., the higher the differences are, the lower their credibility.

Zhang [?] proposed a personalized approach for handling unfair ratings in centralized reputation systems. It provides public and private reputation components to evaluate the trustworthiness of advisers. Depending on the availability of reputation information, consumer agents would determine the weight of private and public reputation components differently. In the personalized approach, advisers share their subjective opinions over a common set of providers. To estimate the credibility of advisers, consumers estimate the recency of their ratings using the concept of a time window [?] and exploit a probabilistic approach to calculate the expected value of advisers' trustworthiness based on their provided ratings.

Our work differs from them in a number of ways. Unlike other models[?],[?],[?], [?] which mainly evaluate the credibility of advisers based on the percentage of unfair ratings they provided, the Prob-Cog model takes initiative steps to aggregate several parameters in deriving the trustworthiness of advisers. That is, in addition to the similarity degree of advisers' opinions, it further aggregates their behavioural characteristics and evaluates the adequacy of their reputation information in its credibility measure. In this model, every consumer with different behavioural characteristics is able to objectively evaluate the similarity degree of advisers through a multi-criterion rating approach. Consumer agents could adaptively predict the trustworthiness of advisers using different credibility measures well-suited for various kinds of advisers. Prob-Cog provides a consumer with the ability to simply adjust the influence of each view of trust based on its own preferences and determines the influence of each layer in its decision making. Besides, while in most existing models [?],[?],[?],[?] the evaluation of the adopted thresholds are not addressed explicitly, in this model we explore some determinant factors which are important in evaluating the adopted thresholds effectively.

The Prob-Cog Filtering Algorithm

In the Prob-Cog model, consumers analyze the neighbours' trustworthiness based on two types of information. The first, which helps build the first layer of our filtering algorithm, is used to identify malicious participants with a complementary model of deception[?] who lie significantly in their ratings. It also detects newlyjoined agents with insufficient personal experiences. The second helps consumers to recognize the behavioural characteristics of their neighbours. As such, it will be able to subjectively evaluate their degree of trustworthiness. Note that, in the second layer of the model, consumers take an analytical approach in order to detect deceitful participants with volatile dispositions who cheat opportunistically. By hiding their true intentions, this group of deceitful participants impose greater risk and insecurity to the system compared with those with a frequently deceptive attitude[?],[?], [?].

Below we provide an overview of the formal model. A more detailed exposition can be found in [?].

First Layer: Evaluating the Competency of Neighbours

A consumer agent C sends a query to its neighbours N = {N 1 , N 2 , ..., N i } requesting information about providers P = {P 1 , P 2 , ..., P q } ⊆ {P 1 , P 2 , ..., P m }, q ≤ m on interactions occurring before a time threshold T (which diminishes the risk of changeability in a provider's behaviour), and with a Quality of Service (QoS) threshold Ω to imply C's belief about an acceptable minimum level of trust.

Neighbour N k responds by providing a rating vector R (N k ,Pj ) for each provider. It contains a tuple r, s which indicates the number of successful (r) and unsuccessful (s) interaction results with provider P j respectively. In the first layer of Prob-Cog, neighbours are asked to provide merely a binary rating: "1" means that P j is reputable and "0" means not reputable. Thus, considering the consumer's QoS threshold, they will send reputation reports as a collection of positive and negative interaction outcomes. Once the evidence is received, for each R (N k ,Pj ) , C calculates the expected value of the probability of a positive outcome for a provider P j [?] as:

E(pr r , P j ) = r + 1 r + s + 2 (1)
For an e-marketplace we use E(pr r , P j ) P ar where P ar ∈ {C} ∪ N implies participants of the community.

Clearly, 0 < E(pr r , P j ) P ar ≤ 1 and as it approaches 0 or 1, it indicates unanimity in the body of evidence [?]. That is, particularly large values of s or r provide better intuition about an overall tendency and service quality of providers. In contrast, E(pr r , P j ) P ar = 0.5, (i.e, r = s) signifies the maximal conflict in gathered evidence resulting in increasing the uncertainty in determining the service quality of providers. Based on these intuitions, we are able to calculate the degree of reliability and certainty of ratings provided by neighbours.

Let x represent the probability of a successful outcome for a certain provider. Based on the Definitions(2) and (3) in [?], the Reliability degree of each R (N k ,Pj ) is defined as:

c(r, s) = 1 2 1 0 | x r (1 -x) s 1 0 x r (1 -x) s dx -1 | dx (2)
Similar to E(pr r , P j ) P ar , we can use c(r, s) P ar . Following [?], reliability is a minimum when E(pr r , P j ) P ar = 0.5. As such, the less conflict in their ratings, the more reliable the neighbours would be. However, in Prob-Cog, C would not strictly judge the neighbours with rather low reliability in their R (N k ,Pj ) as deceptive participants since this factor could signify both dishonesty of neighbours and the dynamicity and fraudulent behaviour of providers. That is, some malicious providers may provide satisfactory quality of service in some situations when there is not much at stake and act conversely in occasions associated with a large gain. As such, even though they retain a certain level of trustworthiness, their associated reliability degree is low.

To address this ambiguity, C computes the E(pr r , P j ) C and c(r, s) C of its personal experiences, R (C,Pj ) , for a common set of providers. Through the comparison of neighbours' metrics with its own, it would select those with a similar rating pattern and satisfactory level of honesty as its advisers. More formally, it measures an average level of dishonesty of N k by:

d (N k ) = |P | j=1 | E(pr r , P j ) C -E(pr r , P j ) N k | |P | (3)
It may also happen that a truthful neighbour lacks in experience. Thus, despite its inherent honesty, its reliability degree is low and it is not qualified to play the role of adviser. To address this, we introduce an uncertainty function

U (N k )
to capture the intuition of information imbalance between C and N k as follows:

U (N k ) = |P | j=1 | (c(r, s) C -c(r, s) N k ) Pj | |P | (4)
In light of the uncertainty function, the opinions of deceptive neighbours who attempt to mislead consumer agents by supplying a large number of ratings are discounted. Similarly, this model hinders short-term observations of newly-joined agents from having influence on a consumer agent's decision making process. Given the formulae 3 and 4, the competency degree of N k is calculated by reducing its honesty based on its certainty degree:

Comp (N k ) = (1 -d (N k ) ) * (1 -U (N k ) ) (5)
Consumer C determines an incompetency tolerance threshold µ which indicates an acceptable level of a neighbour's incompetency. It further chooses the neighbours with (1 -Comp (N k ) ) ≤ µ as its potential advisers and filters out the rest.

To attain partial perception on overall quality of the environment, a consumer C evaluates an approximate dishonesty of participants based on its observation of the quality of its neighbours in this layer. It calculates an Approximate Dishonesty Coefficient ADC (C) as the ratio of detected incompetent neighbours to all of its neighbours as follows:

ADC (C) = |{N k |(1 -Comp (N k ) ) > µ , k ≤ i}| |N | (6)
It is worthwhile to note that, since in this layer we target the participants with a significant lying pattern, detecting fraudulent agents with oscillating rating attitudes is left for the next layer.

Second Layer: Calculating a Credibility Degree of Advisers

In the first phase of the Prob-Cog model a consumer agent has obtained a rough estimate of the honesty level of neighbours and selects a subset of them as its advisers. However, the open e-marketplace allows various kinds of participants with distinctive behavioural characteristics [?] to engage in the system. Besides, the multi-dimensional rating system provides tools for a consumer agent to objectively evaluate the performance of service providers across several criteria with different degrees of preference. Evidently, the measured QoS is mainly dependent on how much the criteria with a high preference degree are fulfilled [?]. Owing to the different purchasing behaviour of the agents, it is expected that preference degrees vary from one participant to another, resulting in dissimilar assessment of the quality of the same service. As such, computing the credibility of advisers regardless of their behavioural characteristics and rating attitudes, and merely based on their subjective opinions would not sufficiently ensure high quality judgements of their trustworthiness.

In the second layer of Prob-Cog, C gives credits to advisers to the extent that their evaluation of each criterion of a negotiated context is similar to its own experiences. For this purpose, it asks advisers about mutually agreed criteria over which they have bargained with highly-reliable providers whose reputation value has been recently released in the form of binary ratings. They also are requested to include the time of the latest interaction with such information so as to give a higher weight to more recent feedback. For this we adopt the concept of forgetting factor presented in [?],[?] and define the recency factor as:

T (C,A k ) P j = 1 λ T A k -T C (7)
Here, T A k and T C indicate the adviser's and consumer's time windows when they had an experience with the same provider. Also, the λ represents the forgetting parameter and 0 < λ ≤ 1. When λ = 1, there is no forgetting and all the ratings are treated as though they happened in the same time period. In contrast, λ ≈ 0 specifies that ratings from different time windows will not be significantly taken into account. Similarly to [?], in this filtering algorithm, the recency factor is characterized with a discrete integer value where 1 is the most recent time period and 2 is the time period just prior. Also, it is presumed that the adviser's ratings are prior to those a consumer agent supplies so that

T A k ≥ T C .
Adviser A k responds with an interaction context IC (A k ,Pj ,T A ) that contains a tuple of weight and value: {W i .V i |i = 1..n} and the latest interaction time T A for each provider. Given A k 's interaction context, a consumer agent would estimate the possible interaction outcomes of an adviser based on its own perspective. That is, C will examine its IC (C,Pj ,T C ) -which contains pairs of weight and value: {Y i .R i |i = 1..n}-and replace A k 's preferences W i with its personal preference degrees Y i . Based on this, the interaction context of A k is updated to: IC (A k ,Pj ,T A ) = {Y i .V i |i = 1..n}. We formalize the difference of C and A k in assessing a provider P j as follows:

Diff (C,A k ) P j = 1 - n i=1 Y i × R i n i=1 Y i × V i (8)
Based on Equations 7 and 8, C would calculate the average differences between the transaction result of A k and its own experiences with a same set of providers as:

Diff (C,A k ) = |P | j=1 | Diff (C,A k ) P j | * T (C,A k ) P j |P | (9)
In the Prob-Cog model of filtering, we take a further step and embrace the diversity in participants as an influential factor in our credibility measures. For this purpose, C captures the overall tendency of A k in evaluating the providers' QoS as:

T endency (C,A k ) = |P | j=1 Dif f (C,A k ) P j |P | (10)
A positive value of T endency (C,A k ) indicates that an adviser has the attitude of overrating providers while a negative value declares that an adviser has a tendency to underrate providers.

Further, an adaptive threshold β is used to determine behavioural patterns of advisers such that if A k 's IC (A k ,Pj ,T A ) is compatible with those experienced by C (Diff (C,A k ) β), they will be counted as credible advisers. In Prob-Cog, C determines the outlook of the advisers by analyzing Diff (C,A k ) . If it is marginally greater than β with a negative T endency (C,A k ) , the corresponding adviser's attitude is identified as pessimistic. Similarly, in case their differences marginally exceed β with a positive T endency (C,A k ) , the respective adviser's attitude is recognized as optimistic. We define a marginal error as a ratio of β and it is subjectively determined by a consumer agent. If A k 's IC (A k ,Pj ,T A ) significantly deviates from the consumer agent's direct experiences, they will be detected as malicious advisers with deceitful behavioural models.

The classification mechanism of the behavioural pattern of A k based on C's interaction context is formally presented as follows:

BP (C,A k ) =        Credible : Diff (C,A k ) β Optimistic : β < Diff (C,A k ) β + & T endency (C,A k ) > 0 P essimistic : β < Diff (C,A k ) β + & T endency (C,A k ) < 0 Deceitf ul : Diff (C,A k ) > β + (11)
Given the BP (C,A k ) , the credibility measure CR (C,A k ) is formulated as:

CR (C,A k ) =            1 -Diff (C,A k ) : BP (A k ) = Credible (1 -Diff (C,A k ) ) × e -θ * Diff (C,A k ) : BP (A k ) = Optimistic (1 -Diff (C,A k ) ) × e -σ * Diff (C,A k ) : BP (A k ) = Pessimistic 0 : BP (A k ) = Deceitful (12)
Here, θ and σ represent the optimistic and pessimistic coefficients respectively. Coefficients θ and σ are formalized with reference to the consumer's disposition as:

θ = max{| Diff (C,A k ) P i | |i = 1...m} Risk-Averse consumer min{| Diff (C,A k ) P i | |i = 1...m} Risk-Taking consumer (13) σ = min{| Diff (C,A k ) P i | |i = 1...m} Risk-Averse consumer max{| Diff (C,A k ) P i | |i = 1...m} Risk-Taking consumer (14)
The coefficient parameters ensure that the recommendation of advisers with volatile behaviour who have a high variability in their opinions is heavily discounted.

Evaluating Threshold Parameters

In the Prob-Cog, we combine cognitive and probabilistic views of trust such that each might have different weights depending on the consumer's endogenous factors, such as willingness and preferences. That is, some consumers might assign a great deal of influence on the probabilistic evaluation results while having less interest in the inclusion of the factor of behaviour in their evaluation. The priority of either view is projected into different thresholds dedicated to each layer. In this model, the values of the adopted thresholds are attributed to many factors such as: 1) the variation of the providers' performance, 2) percentage of neighbours with dishonest attitude and 3) the influence of the cognitive approach on the consumer's perspective (Inf view:cog ).

To optimally estimate β in the second layer, C needs to acquire enough information about the potential reasons for a reporter's inaccuracy. For example, variation in providers' performance can be served as a measure of reporters' inaccuracy [?]. Thus, the inaccuracy tolerance threshold β is evaluated by capturing the mean variation in providers' quality of products. However, for the precise calculation of the provider's performance variation, in this model C only selects highly-reliable providers whose c(r, s) > 0.50. Based on this principle, the variation of a provider P j can be calculated as follows:

dev(C, P j ) = ri∈ (C,Pj ) (v i -v) 2 | (C, P j )| ( 15
)
And β is estimated as:

β = |P | j=1 dev(C, P j ) |P |
where dev(C, P j ) is the standard deviation of provider P j 's performance in the last interactions experienced by C. v i is the value of the rating r i which is the rating of C provided for P j and 0 ≤ v i ≤ 1. And v is a mean value of all the rating values in the set of ratings (C, P j ) which is a collection of r i . Depending on the value of Inf view:cog , consumers show different levels of interest in modeling the behavioural patterns of advisers. To satisfy their interests, is designed to give consumers an opportunity to detect different dispositions of advisers. However, initializing not only depends on Inf view:cog but also relies on β and the approximate dishonesty coefficient of participants (ADC (C) ) that is estimated in the first layer. More explicitly, in a dynamic environment where providers indicate highly-variant behaviour, a high value of β increases the risk that deceptive reporters remain undetected. In such conditions, should be automatically adjusted to a low value in order to protect consumers against spurious participants. As such, consumer C would compute as:

= (1 -ADC (C) )e -β Inf view:cog (16)
As aforementioned, the incompetency tolerance threshold µ should be evaluated in such a way to be able to expel neighbours with significant dishonesty or unreliability. Hence, we get the intuition that µ should be assigned a higher value than the second layer thresholds (β + ) so as to be able to target only major dishonest participants. It also should be aligned with the cognitive preferences of consumers. That is, since a high value of Inf view:cog signifies the importance of the second layer's evaluation mechanism and behavioural modeling, a higher value of µ is desirable so as to reduce the number of filtered participants in the first layer and gives opportunity to consumers to cognitively evaluate the trustworthiness of advisers based on their behavioural characteristics in the second layer. Based on these principles, µ is calculated as follows:

µ = n * (β + e -β Inf view:cog ) ( 17
)
where n > 1.

Experimental and Comparison Results

In this section we explore the performance of our Prob-Cog model confronting different scenarios and attacks in comparison with two representative approaches: the FIRE model[?] and the personalized approach[?]. We picked out the important features of each model and conducted experiments to analyze how our model compares in similar conditions. For example, some experiments are dedicated to studying the effectiveness of different approaches dealing with dynamicity in an environment like the situation when providers change their behaviours. We also evaluate the accuracy of different models coping with a majority of unfair participants and indicate how exploitation of the cognitive view of trust could improve the performance in such situations. We further compare various approaches in addressing the bootstrapping problem of newcomers having limited experiences.

Performance Measurement

To measure the performance of different approaches, we have used the Matthews Correlation Coefficient (MCC) [?] to evaluate the quality of various approaches in differentiation between honest and dishonest participants. MCC is a precise metric and it gives a single value for the quality of binary classification and is calculated as follows:

M CC = (t p .t n ) -(f p .f n ) (t p + f p )(t p + f n )(t n + f p )(t n + f n ) (18)
where in this paper t p represents the number of advisers correctly detected as dishonest, t n signifies advisers correctly detected as honest. Also, f p represents honest advisers misclassified as dishonest and f n signifies dishonest advisers that are incorrectly classified as honest advisers. The MCC value is between [-1, +1].

A coefficient of +1 indicates accurate detection, a coefficient of 0 indicates an average detection quality and -1 indicates the worst possible detection.

Cold Start

Consider the scenario when consumer agent C has recently joined the system and intends to bootstrap its relationship with its neighbours. In the Prob-Cog model, C relies only on its few personal experiences. On the other side, in the personalized approach[?], C relies heavily on the public knowledge component when its personal knowledge is scarce. Exploiting public knowledge sounds promising when the majority of participants are honest. However, when an environment is controlled by a majority of deceptive participants, using public knowledge would be misleading.

The first experiment demonstrates C's performance in classification of participants when it has a limited number of personal experiences using Prob-Cog model and the personalized approach. It involves 100 advisers and 3 providers. We vary the percentage of dishonest advisers from 0% to 95% in an e-marketplace. We then measure an average MCC value for the Prob-Cog model and the personalized approach with 10 and 40 experiences commonly rated by both consumer C and advisers for the same set of providers. Results are presented in Figure 1. It indicates that the personalized approach produces high MCC when the majority of participants are honest while its performance degrades as the percentage of dishonest participants increases in an e-marketplace. It also implies that as the amount of personal knowledge increases, the resistance of C against misleading opinions of the majority of participants increases considerably. Figure 1 also shows that the Prob-Cog model consistently yields high performance in every condition since public knowledge does not have any influence on its evaluation mechanism. Dealing with insufficiency of personal experiences should not be restricted to consumer agents. Rather, it may happen that advisers with inadequate experiences unintentionally disseminate inaccurate information throughout an emarketplace. Trust models must provide consumers with a mechanism to detect advisers with few experiences and reduce their influence in a consumer's decision making process.

The next experiment demonstrates how the Prob-Cog model evaluates the competency level of an intrinsically honest but inexperienced adviser with various amounts of experience. It involves one consumer C asking adviser N about its common experiences with 2 and 50 providers. N provides various percentages (0% to 100%) of differences in number of common experiences, presented by a normal distribution. The results indicate that the competency of even an honest adviser degrades as its number of experiences decreases (Figure 2). We also observe that C can effectively evaluate the competency level of N even with a limited set of providers.

Flooding

From [?] we get the intuition that the degree of reliability and confidence in advisers' opinions is directly related to the quantity of evidence they provide. This issue motivates advisers to provide a large number of ratings regarding certain providers upon the request of consumers. That is, deceitful advisers could manipulate a consumer by flooding it with a large number of ratings to increase their reliability substantially. Also, newcomers may exaggeratively increase their number of ratings so as to conceal their lack of experiences. This flooding problem affects the robustness and efficiency of trust models and should be dealt with effectively. To address such a problem, the Prob-Cog model discounts the num- ber of ratings provided by advisers and degrades their reliability degree using Equations 2 and 4. The personalized model uses a different approach and exploits the concept of time window. It considers those ratings of advisers that are provided in a same period of time as the ratings of the consumer more valuable and underestimates others.

The next class of experiment involves two consumers: 1) consumer C 1 with few experiences and 2) consumer C 2 with sufficient experiences. We examine the accuracy of the Prob-Cog model in classifying the advisers in a situation where different percentages of advisers from 0% to 100% flood consumers by providing 100-150 more ratings than C 1 and C 2 . From the results in Figure 3 we can see that C 2 with sufficient experiences is more robust than C 1 with few experiences against the flooding attack of advisers. However, this attack does not have any significant negative impact on the overall performance of the Prob-Cog model.

Providers with Varying Behaviors

Our Prob-Cog model adopts a promising mechanism for capturing the variation in providers' performances. We have conducted specific experiments to demonstrate how our approach can accurately classify advisers in such an environment where providers continuously change their behaviour. This set of experiments involves 100 advisers which are divided in three groups: 1) 50% honest, 2) 25% deceitful who lie a small percentage of the time, and 3) 25% malicious with significant dishonesty. In this environment, providers have different levels of variation in their performance ranging from 5% to 100%.

To examine the effectiveness of our approach compared with other models, we consider four different threshold evaluation mechanisms: 1) fixed low threshold β = 0.5 as is used in the personalized approach [?], 2) fixed high threshold β = 1.0, 3) auto β which is exploited in the FIRE model [?] and 4) adaptive β + which is used by the Prob-Cog model in the second layer1 .

The results of this experiment are plotted in Figure 4, indicating the consumer's accuracy in classifying different groups of advisers. Specifically, the second approach with fixed β = 1.0 performs worst when the mean variation of the providers' performance is low. In contrast, the performance of the first approach with fixed β = 0.5 degrades as providers change their performance significantly. By having the ability to monitor the actual variations of the providers' performances, only the third and the last approach can maintain a high level of classification accuracy. However, the Prob-Cog model outperforms other approaches as it fairly achieves maximum classification accuracy by integrating the factor of behaviour in its evaluation.

The next experiment aims to highlight the influences of the cognitive view of trust in advisers' classifications. We learn that different Inf view:cog values yield different performances in various conditions. More explicitly, in case consumers deal with low-variance providers, a high value of Inf view:cog degrades the classification accuracy significantly. However, it shows better results as the providers' performance variation rose from 50% to 100%. As it is implied in Figure 5, assigning an average influence Inf view:cog = 0.5 to the cognitive approach ensures consistent high performance throughout the experiment.

Unbalanced Environment with Dishonest Majority

Trust models should be able to effectively cope with the problem of unfair ratings. They specifically should perform ideally in a situation where a majority of participants act dishonestly in an environment. In the following series of experiments we examine the performance of the personalized approach and the Prob-Cog model in classifying participants when 5% to 90% of them are dishonest. In this environment providers change their performance from 35% to 45%. We consider two patterns for dishonesty: 1) a deceitful pattern which includes 50% dishonest participants and 2) a complementary pattern which covers the remaining percentage of dishonest participants. We also assume that in both models consumer C has an adequate number of experiences2 and advisers' ratings are provided in the same time window as consumer C. We adjust the Inf view:cog of the Prob-Cog model and the trustworthiness threshold of the personalized approaches to 0.5.

Results are shown in Figure 6. We can see that the classification performance of the Prob-Cog model is higher than the personalized approach across different percentages of dishonest participants. This is mainly due to the static approach of the personalized approach in determination of the trustworthiness threshold. That is, it might happen that in the environment where providers vary their QoS, this model labels honest participants as dishonest. This issue shows its significant deficiency when the majority of dishonest participants prevail in the environment, resulting in the detection of fewer honest advisers. To better perceive the reasons behind the performance leaks, we compute the error rates (FPR and FNR) of these two models in detecting honest and dishonest participants dealing with different population tendency. Based on Figure 7, we observe that in the Prob-Cog model, when the majority of advisers are honest, the low value of ADC (C) in the first layer increases the effect of the cognitive dimension. As such, the high value of relatively amplifies the probability of misclassification of dishonest advisers as honest so that F N R ≥ 0. On the other hand, in this model when a majority of advisers turn out to be dishonest, it adaptively reduces so as to degrade the influence of the cognitive dimension and behavioural modeling in trustworthiness evaluation. Even though this strategy helps consumer C to detect a high percentage of deceitful participants, there is a chance that honest advisers with low credibility will be misclassified as dishonest, resulting in a reduction of the classification performance (F P R ≥ 0).

In the personalized approach when C has sufficient personal experiences and the threshold is assigned to a low value, it can perfectly detect dishonest participants so that (F N R = 0). However, since this model does not capture the providers' variations, C would highly misclassify honest advisers as malevolent (F P R > 0). In these series of experiments we observed that with the employment of the Prob-Cog approach we are able to detect more honest advisers compared with other approaches.

Summary of the Results

We have carried out a set of experiments to compare overall performance of three representative approaches: FIRE, the personalized approach and the Prob-Cog model in different scenarios. We measure their accuracy in detecting honest advisers when a majority of advisers are unfair, providers vary their behaviours in different degrees and consumers lack in personal experiences. We notice that the Prob-Cog model performs the best as it is able to better classify advisers in the aforementioned situations in comparison with other approaches. We have shown that, owing to the limited observation of the environment, it is not a sensible idea to exploit public knowledge as the environment might be controlled by a majority of dishonest participants. We noticed that the Prob-Cog model could successfully differentiate honest participants from dishonest ones in the cold start problem. We also verified how our approach effectively detects advisers with insufficient experiences and reduces their competency degree proportionately.

Conclusion and Future Work

In this paper, we present an adaptive multi-layered filtering algorithm that enables consumers with different behavioural attitudes to subjectively evaluate the trustworthiness of a variety of advisers in an e-marketplace. In the Prob-Cog model, the genuine beliefs and behavioural characteristics of participants are cognitively modeled and integrated in their trustworthiness evaluation metrics.

The principles of the two-layer filtering algorithm detect and disqualify various types of participants such as: malicious agents with a complementary rating pattern, newcomers with insufficient experiences, and fraudulent participants who retain a minimum level of trust to cheat opportunistically. In the Prob-Cog model, consumers can dynamically adjust the influence of the cognitive view of trust pertaining to their behavioural patterns to amplify or reduce the effect of different dimensions on credibility measures. This model also provides consumers with a mechanism to adaptively determine the value of the thresholds' parameters based on the observations of the quality of providers and environmental conditions. To demonstrate the effectiveness and capabilities of our approach, we focused on the experimental comparison with two representative approaches: the personalized approach and FIRE. We specifically examined some prominent scenarios, including ones dealing with participants' lack of experience, advisers flooding consumers with lots of ratings, providers' dynamicity and an environment with a majority of dishonest participants. Such empirical studies are useful for highlighting the importance of the capabilities of our Prob-Cog model.

Notably, results indicate that through the proper adaptation of the employed thresholds, consumers are able to identify more honest advisers compared with other approaches in different environmental circumstances, specifically when a majority of participants are unfair and when reliable advisers are scarce. One possible avenue for future work is to develop a provider classification mechanism which exploits the Prob-Cog model to evaluate the qualification of the participating providers in an e-marketplace.

Ready IFIPTM PAPER.bbl Ready IFIPTM PAPER.bbl

Fig. 1 :

 1 Fig. 1: Performance comparison of personalized & Prob-Cog approaches in classification of advisers

Fig. 2 :

 2 Fig. 2: Competency degradation of adviser N having different percentages of common experiences

Fig. 3 :

 3 Fig. 3: The accuracy degree of Prob-Cog model dealing with different percentages of flooding

Fig. 4 :

 4 Fig. 4: Classification of advisers across different variations in providers' behaviours

Fig. 6 :

 6 Fig. 6: The Prob-Cog model vs Personalized approach Performance

Fig. 7 :

 7 Fig. 7: The Error Rate of Prob-Cog model vs Personalized approach

In this experiment, we assume that none of the advisers are filtered in the first layer so that ADC (C) = 0

Based on this assumption, the weight of the public knowledge component in the personalized approach is negligible.


Sini Ruohomaa
email: sini.ruohomaa@cs.helsinki.fi

Aleksi Hankalahti

Lea Kutvonen

Detecting and reacting to changes in reputation flows

In inter-enterprise collaboration, autonomic services from different organizations must independently determine which other services they can rely on. Reputation-based trust management in the Pilarcos open service ecosystem combines shared experience information on the actors' past behaviour and the decision context to estimate the risks of a collaboration. The trust decision process is semi-automatic, with selected decisions forwarded to a human user. A particularly interesting feature of the decision process is incongruity, that is, unexpected changes in service performance. In the classical example, a previously well-behaved service turns malicious to cash in its good reputation as illgained monetary profit. If the reputation system swiftly reacts to such changes, it protects its user more efficiently and deters misbehaviour. We present a new model for detecting and reacting to incongruities in a reputation-based trust management system. The model is based on the concept of reputation epochs, dividing an actor's reputation into periods of internally consistent behaviour. In contrast to earlier approaches, this model provides the necessary flexibility for the trust management system to adjust to constantly changing business situations.

Introduction

In inter-enterprise collaboration, services from different organizational domains join together to fulfil a mutual goal. In the open service ecosystem, the services are autonomous and there is no centralized control on the collaboration process. Each service must independently determine which other services it can rely on, both in the sense of making its own resources available, and in expecting that the other collaborators do their part in realizing the joint goal. To support these decisions, it collects experience information on the past performance of other services, both first-hand and shared by other actors in the ecosystem. This experience information forms the reputation of a service. Due to the decentralized nature of open service ecosystems, reputation is subjective to the actor who has collected and analyzed the information; it is not globally agreed upon by all.

Reputation-based trust management supports making trust decisions on different services, in the context of a given collaboration and possibly a specific set of transactions within it. The decision process consists of two parts [START_REF] Ruohomaa | Making multi-dimensional trust decisions on interenterprise collaborations[END_REF]: First, reputation information is combined with a model of the decision context in order to estimate the risks of a positive decision. Second, this estimate is compared to a risk tolerance policy for the particular type of decision in order to determine the outcome: yes, proceed; no, withdraw; or, if the result falls on a gray area between the two, forward the decision to a human user.

A semi-automatic decision process is necessary due to the complex and constantly changing business environment. Automation is perfect for handling routine cases, which we expect to form the majority of decisions. Unforeseen situations and uncertainty, on the other hand, cannot be comprehensively dealt with by exact rules, and are left for a human user to resolve. Due to this division, the trust management system must be able to detect when a decision is not routine.

Incongruities, i.e. sudden changes in service performance, are a challenge for the automated decision process. In the classical example, a previously wellbehaved service turns malicious to cash in its good reputation as ill-gained monetary profit. As reputation largely depends on shared experiences, information sources can also change their behaviour, and begin to spread misinformation.

We require a reputation system to swiftly react to such changes, both to limit the losses of the decision-maker service, and to discourage misbehaviour by minimizing the gains from it. At the same time, an honest actor's reputation should not be irreparably tarnished due to a momentary outage or dishonest negative feedback. These conflicting requirements are impossible to meet with a single universal, or fixed, set of rules; instead, reputation-based trust management systems must have support for appropriately handling incongruity through policies that can be configured -and re-configured -according to the business situation.

This paper presents a new model for detecting and reacting to incongruities in a reputation-based trust management system. We build on our existing Pilarcos trust management system, presented in earlier work [START_REF] Ruohomaa | Trust and distrust in adaptive inter-enterprise collaboration management[END_REF]. Our model separates reputation analysis policies from trust decision policies in order to be able to use the same reputation information in a variety of decision-making contexts. Similarly, we separate the detection of behaviour changes from how their existence should affect upcoming trust decisions.

The model is based on the novel concept of reputation epochs, periods of internally consistent behaviour. A detected change in the behaviour pattern causes a change of reputation epoch. To illustrate the concept, we compare a few simple algorithms for identifying a pattern and detecting when it is broken. For this, we draw inspiration from the field of anomaly detection. The power of the concept goes beyond our examples, however, and it provides unprecedented flexibility for handling incongruity in reputation evolution.

The paper is organized as follows: Section 2 presents the problem context and related work, Section 3 presents reputation epochs, and evaluates the costs and benefits of introducing them. Section 4 presents three example epoch detection policies for use in three different scenarios, and Section 5 presents simulation results on how the policies behave in practice for each scenario. Section 6 concludes the paper.

Background

In this section, we first introduce the context in which we utilize reputation flows to for trust management in Pilarcos. We then present related work on the topic of adjusting to changes and uncertainty in reputation flows, and relate our proposal to the existing research.

Reputation-based trust management in Pilarcos

The reputation-based trust management system we propose has been implemented as a part of the Pilarcos open service ecosystem [START_REF] Kutvonen | Service-oriented middleware for managing inter-enterprise collaborations[END_REF]. Besides trust management, the Pilarcos collaboration management tools provide automated support for setting up collaborations, including interoperability checking and contract negotiation, and runtime monitoring, including contract breach detection and recovery. For signing contracts, actors are required to have persistent identities.

The trust management process can be divided into two parts: the trust decisions, and the evolution process of the reputation information. Both are governed by their own, separate policies; this separation is necessary in order to be able to use the once-collected reputation information in different decision contexts.

A trust decision is triggered at specific points of the collaboration process, whenever resources are being committed and risk evaluation is needed. To evaluate the risk of proceeding with the collaboration, we predict the outcome it would have on different assets based on previous experiences, stored in reputation information [START_REF] Ruohomaa | Making multi-dimensional trust decisions on interenterprise collaborations[END_REF]. For the purposes of this paper, we only consider the effects on the monetary asset. These effects are divided into a scale of minor or major, positive or negative effects on the asset, no effect, and unknown effect for cases when the outcome cannot be observed for all assets.

To complete the trust decision, the risk estimate is compared to a risk tolerance policy, which essentially categorizes the risk into three options: acceptable (proceed with the collaboration), unacceptable (withdraw) or uncertain (forward the decision to a human user). The risk tolerance policy defines a minimum level of certainty required for an automated decision; certainty is influenced by a set of factors, measuring the amount and quality of reputation information used in the decision. A central measure of the quality of the information is its credibility -reputation based on local observations is ultimately credible, while the credibility of external reputation information varies [START_REF] Ruohomaa | Making multi-dimensional trust decisions on interenterprise collaborations[END_REF][START_REF] Ruohomaa | Reputation management survey[END_REF].

The evolution of reputation information allows the system to adjust to changes in partner behaviour. New experiences from collaborations are stored into the system from two kinds of sources: a flow of first-hand experiences from local monitors, observing parameters such as quality of service and detecting any breaches of contract, and flows of external experiences, reported by other actors through reputation networks. A reputation network is the combination of a reputation system, defining the processes of dissemination, calculation and evolution of reputation scores, and the actors using it. We expect that third-party reputation information relevant to a specific service will be scattered over a number of different reputation networks. The local trust management system will merge the reputation information from different sources, taking into account how relevant it is and how credible the source is considered to be.

The epoch detection process we are proposing will take place after reputation flows from different networks have been analyzed and merged into a single external reputation flow, and compared to the flow of local experiences. The ordering is significant in that an epoch change must be based on credible information; errors should be minimized to avoid situations where outlier experiences trigger unnecessary epoch changes. An epoch change affects both local and external reputation streams simultaneously.

Related work on changes and uncertainty in reputation flows

While there exists a notable body of research on reputation systems [START_REF] Ruohomaa | Reputation management survey[END_REF][START_REF] Jøsang | A survey of trust and reputation systems for online service provision[END_REF], the evolution of reputation remains a largely uncharted area. A typical approach to addressing changes in behaviour is time-based discounting of old experiences [START_REF] Jøsang | A survey of trust and reputation systems for online service provision[END_REF], which ensures that newer experiences gain a greater weight in decision-making. While this does mean that bad behaviour is reflected in the actor's reputation value somewhat faster, an increase in reaction speed also directly increases the speed in which old information is lost -and any old transgressions forgotten.

Simulation experiments, used for comparing reputation metrics (e.g. [START_REF] Schlosser | On the simulation of global reputation systems[END_REF][START_REF] Kinateder | Towards a generic trust modelcomparison of various trust update algorithms[END_REF]), commonly assume consistent behaviour from both the well-behaved actors and any attackers. While it is quite reasonable to expect that an attacker intelligently adjusts its behaviour to the policies in place, the simulated attacker behaviour that we have observed so far is far from optimal. It is revealing that the most simple baseline attack against reputation systems, one where an attacker first gains reputation through good behaviour and then uses it up with bad behaviour, is dubbed the "disturbing" attacker model by Schlosser et al. [START_REF] Schlosser | On the simulation of global reputation systems[END_REF]. The name reflects how poorly the compared systems could handle strategic changes in behaviour. Our proposal directly addresses this issue.

A promising example of related work, TrustGuard, proposes a reputation calculation formula which can react to incongruity [START_REF] Srivatsa | TrustGuard: countering vulnerabilities in reputation management for decentralized overlay networks[END_REF]. In the model, decisions on a given actor are based on a trust value calculated as a weighted sum of three factors: 1) the current experiences, i.e. reports received in a given time period, 2) the (optionally weighted) average of accumulated experiences overall, and 3) a "derivative" of the current reports, representing whether there has been a recent change for the better or worse in the reported experiences.

The TrustGuard model is one-dimensional: it assumes the experience report values are real numbers between 0 and 1, and the result is a single real number. The Pilarcos model, in contrast, is multidimensional, with reputation represented as a vector of observed outcomes in relation to different assets and a set of certainty measures. In other words, the trust score alone does not fix the decision.

TrustGuard has no concept of certainty; the calculated trust value is the sole basis of a trust decision. The first factor represents the idea that current experiences should be emphasized in the decision. However, as other time-based discounting systems, it discounts all other information equally, independent of their information content or context. The second, accumulated average factor can emphasize the time-based discounting, or treat stored experiences equally. The derivative, on the other hand, could capture sudden changes in behaviour. The larger the change, the larger the derivative value. Given a high weight, the factor could speed up reaction to a current drastic change considerably. On the other hand, it would equally strongly reward any change for the better, partially overriding even the accumulated reputation or lack thereof. Information about past changes in behaviour is not retained.

A few other reputation systems introduce certainty measures for the resulting decision. For example REGRET [START_REF] Sabater | Reputation and social network analysis in multi-agent systems[END_REF] defines a certainty measure based on the amount of information used, the variation in experience values, the subjective confidence of the recommender in the information they give, and social relationships. If the certainty of the calculated reputation value is too low, the model includes an option for calculating reputation using different approaches, such as falling back from actor-specific experiences to the reputation of the social group the actor belongs to. The amount of information stored is tracked also by e.g. Travos [START_REF] Teacy | TRAVOS: Trust and reputation in the context of inaccurate reputation sources[END_REF]. SECURE, on the other hand, equates certainty with the particularity of information [START_REF] Cahill | Using trust for secure collaboration in uncertain environments[END_REF]: it defines trust values as ranges between 0 and 1, and the wider the range is, the less certainty there is, as it excludes fewer values as incorrect.

Pilarcos has a computational measure for the degree of certainty [START_REF] Ruohomaa | Trust and distrust in adaptive inter-enterprise collaboration management[END_REF]. As a result, specific trust decisions can be identified as needing human attention. We can also take advantage of knowing how inconsistent an actor's behaviour has been in the past. If an actor changes its behaviour all the time without a discernible pattern, a reputation system should be able to detect that the information it has is insufficient for the task at hand -it cannot predict the unpredictable actor's future behaviour.

The option to selectively involve an external human actor based on certainty is generally not used in existing reputation systems, which are designed to either be fully autonomous or to only provide supporting information for a human decision-maker [START_REF] Ruohomaa | Reputation management survey[END_REF]. Even for a fully automated system, certainty could be used for activating further levels of computation, such as REGRET does. Indeed, it is natural to divide decision processes in partially supervised systems to multiple levels as well, with a human intervention as the last option if other attempts fail. We have discussed different levels of policy in earlier work [START_REF] Ruohomaa | Trust and distrust in adaptive inter-enterprise collaboration management[END_REF].

Tracking changes with reputation epochs

When analyzing experience and reputation information for decision-making, a central concern is whether the information is up-to-date, i.e. describes the current behaviour of the actor in question well enough to be useful in trying to predict its future behaviour. When faced with ten positive experiences and two negative, it can make quite a difference if the negative experiences are ancient and the actor's recent behaviour has been spotless, or if the good experiences are mostly older and the two negative are the most recent experiences available of the actor.

Whether it is possible to detect the order or timing of actions depends on the reputation information model. Storing the ordering of experiences sets heavy requirements on the way experiences are stored and processed: treating each experience as a unique object with a timestamp, or with a position in a queue of experience objects, creates large data structures, which take an increasing time to process as the number of experiences grows. While a theoretical model of reputation can accommodate for infinite amounts of experience information, practical models must adapt to time constraints at decision-making time: either information must be compressed, which loses information, or old experiences must be purged after a while.

We have chosen to compress experience items into outcome counters. The compression tradeoff loses timing information. The basic reputation data structure places equal weight to all experiences, independent of the time they were gathered. While it would be possible to discount old information through e.g. aging factors, we find that such methods in practice steadily lose information: they form a kind of fixed-size window to the past. The main problem with fixed windows, in turn, is that they cannot be easily adjusted at the time of the decision: data is already lost while it is gathered. For example, past transgressions can be completely erased from such systems by simply flooding the network with new experiences from low-value real transactions or false experiences produced by colluding partners.

Considered against the goal of reacting to changes in behaviour, we find that time is actually not the optimal measure for determining the weight or value of a unit of experience at all. Instead, we should measure whether the experience brings new information; something we did not already know.

We propose to divide reputation information into reputation epochs, groups of abstract periods of a given type of behaviour. While the latest turn of behaviour is the most interesting, it is also typical that there is very little experience on it; hence information from older epochs should also be included. The weight given to the current epoch determines the speed in which the system reacts to changes in behaviour. As an example, a pessimistic decision could even be based on the worst ever observed behaviour. The number of epochs also provides a measure of the consistency of the trustee: if experiences on the trustee are divided into a large and constantly increasing number of epochs, it indicates that the trustee's behaviour is not stable -or that it is not entirely fitting into any behavioural categories the system can detect.

While reputation epochs do allow us to give less weight to old information, they are superior to time-based constant discounting in two aspects: First, as epochs are based on behaviour changes rather than strict time periods, they fit the purpose of detecting when information is outdated in the sense of not being useful for predicting future behaviour. Second, the weighing policy between new and old information can be dynamically changed, and as no information is actually discarded, the oldest experiences remain available for later analysis: the reputation system can be configured to never forget anything without straining the time-constrained decision-making process.

We assume that the number of epochs will not grow without limit, and can therefore be processed in real time. It is also possible to set up epoch pruning processes that ensure the number of distinctly stored epochs remains under control. For example, if it turns out that an actor's behaviour regularly fluctuates between two types of epochs, older epochs can be regularly merged, as the fluctuations then actually represent a different type of consistent behaviour in the long term.

Detecting changes in service performance

As a baseline risk tolerance policy, we will use a simple additive policy that gives more weight to negative than positive outcomes (by a factor of 3), and further weight on major effects as opposed to minor effects (another factor of 3) [START_REF] Ruohomaa | Trust and distrust in adaptive inter-enterprise collaboration management[END_REF]. As an example, an actor with 10 experiences stored, of which 4 represent major positive outcomes, 2 minor positive, 2 minor negative and 1 major negative, would receive a trust score of (4 * 3) + 2 + 2 * (-3) + 1 * (-3) * 3 = -1. We set the trust score threshold for a positive decision to 0, so this would result in a negative decision. Changes in behaviour are then addressed through epoch change policies: for simplicity, our simulations will use only the current epoch to calculate this trust score.

In the general case, detecting changes between reputation epochs can be approached through the reasonably well-studied problem of anomaly detection [START_REF] Viljanen | A survey on application level intrusion detection[END_REF]. Anomaly detection algorithms are often based on an example set of "normal" values learned from earlier data, which are used to form a model of normal behaviour; anything deviating from the model is then an anomaly.

In more specific cases, even quite simple epoch change policies can be suitable. We present two example policies to achieve two different goals:

Load balancing: a service provider usually provides good service, but occasionally the service quality varies depending on the number of incoming requests. The first example policy should quickly react to a drop in the quality of service, as it also indicates a need for load balancing. Oscillation detection: a service provider oscillates between good and malicious behaviour: first it collects good reputation, then it cuts corners in as many service transactions as it can. Whenever there is a fixed decision policy in use that is known or can be deduced by experimenting, the optimal attacker targeting the reputation system will collect just enough positive reputation to not be shut out of the community, which makes this kind of behaviour relevant to address. The second example policy should quickly react to this kind of change for the worse, but also take advantage of the service returning to normality.

In the load balancing example, we apply a simple dynamically learning algorithm: a window of n previous experiences is stored by the epoch change detector, and whenever a new experience falls outside the values present in the existing filled window, a new epoch is created. As normal service quality is indicated by the vast majority of experiences, the window is typically filled with such experiences. At the first drop in reputation, a new epoch and a new, empty learning window are created. While the disturbance goes on, the window is filling up with negative (or less positive) experiences. During this learning phase, when the epoch contains less than n experiences, new epochs are not created. In our simulations in the following section, we set n = 10.

If the window (n) is set to be shorter than a typical disturbance, it will be full of negative experiences by the time the service returns to normal load, and a new epoch is started when the first positive experience arrives. This leads to a swift return to the service provider when it is no longer overloaded. For a more pessimistic, slow recovery, the window (n) can be chosen to be longer than a typical disturbance, which means that reputation is slowly regained within the newest epoch. Again, once the window fills up with normal experiences, the first sign of a negative experience causes a new epoch to be started. A limitation of this policy is that if the experiences indicating normal or overloaded states have some natural variation, new epochs may be created too easily.

In the oscillation detection example, the difference between good and malicious behaviour is simple to observe, as the experiences will be polarized: positive or negative. To allow greater variation in behaviour than the previous policy, we apply a static, specification-based epoch detection algorithm. We define two behaviour profiles: "good" and "evil". The good profile covers positive experiences, the evil profile negative. Neutral experiences, or those representing unknown outcomes, fall in neither category.

Given these profiles, we define each ongoing epoch to be either good or evil, and the epoch changes if an incoming experience matches the opposite profile rather than the current one. Neutral or unknown outcomes do not change the epoch, as they match neither. Again, the ongoing epoch can in principle be given full weight in decision-making. On the other hand, the attacker may respond by oscillating on every service request: cooperate, defect, cooperate, defect. To withstand this kind of behaviour, the number of epochs or the number of experiences in the current epoch should play a part in choosing a better weight division between the current and previous epochs, or indicate that the decision should really be delegated to a human user due to high uncertainty in the reputation information.

The two above policies perform at their best when the central source of reputation information is either first-hand experience, or a single highly credible reputation network. On the other hand, sometimes experiences on an actor are only available through a low-credibility reputation network, where there may be errors in the experience information -either intentional misinformation or due to e.g. differences in measurement standards. To cover this scenario, we extend the oscillation detection case above with an additional requirement:

Conservative oscillation detection: a potentially oscillating service provider is only known through a reputation network where some experience reports are incorrect. The third example policy should be cautious in trusting rep-utation information that is out of the ordinary, and treat it as an outlier unless it is backed up by additional information.

For this requirement, we apply the idea of sequential hypothesis testing [START_REF] Wald | Sequential tests of statistical hypotheses[END_REF], which can be used to limit the probability of overreacting in anomaly detection [START_REF] Jung | Fast portscan detection using sequential hypothesis testing[END_REF].

In sequential hypothesis testing, a single experience out of the ordinary does not yet change the epoch. It only strengthens the hypothesis that the epoch should be changed, by a constant measure i; we set i = 1 for the purposes of this text. Similarly, an experience supporting the current epoch weakens the hypothesis by 1. Again, neutral and unknown experiences cause no effect. For the epoch to change, either the change must amass support exceeding a given threshold k, or during a period of t consecutive experiences there must be more support for changing it than there has been for continuing the current epoch. For our experiments in the following section, we set k = 5 and t = 10.

Combined to the oscillation detection policy, we get the following algorithm: % I n i t i a l i z e and r e s e t s u p p o r t and t i m e r v a r i a b l e s t o 0 . Sequential hypothesis testing can be similarly combined to the window-based load balancing algorithm, to test the need to change epochs once the learning window has been filled. However, this modification alone will not stop outliers in incoming reputation information from being stored as examples of normal behaviour during the learning process. Therefore, the algorithm would remain vulnerable to any noise in reputation flows.

Comparison of epoch detection policies

We illustrate the behaviour of the policies proposed in the previous section by applying them to four scenarios with different experience input. These reputation flows are manually constructed to illustrate the kind of a situation each policy is designed to handle. For realistic applications, a combination of detection policies is likely to be better suited than any specialized single policy. In the first scenario, a service behaves well (major positive experiences) for the first half of the time period, then misbehaves (major negative experiences) for the latter half; this situation could be caused e.g. by a service going permanently offline, getting hacked or otherwise becoming untrustworthy. For a traditional additive trust decision policy, its trust score (positives -negatives) would remain positive to the end of this simulation, the trusting service suffering considerable losses during that time. As discussed in the previous section, however, our baseline policy for comparison is already more strict: it gives more weight (x3) to negative than positive experiences. Our threshold for a positive trust decision is set to 0, i.e. when the calculated trust score drops below 0, trust decisions become negative.

The plots only follow the trust score calculated from the current epoch. As seen in Fig. 1 In the second scenario, the monitored service generally behaves well (major positive experiences), but suffers two drops in service quality due to overloadat rounds 20 and 50, the flow outputs minor negative experiences to reflect e.g. a slow response time. The first disturbance lasts for 10 rounds, after which the service recovers. The second disturbance is less predictable, with two minor positive experiences arriving in the middle of it -in other words, the response time was reasonable, but the service had not actually recovered and was congested again soon after. The scenario is depicted in Fig. 2.

Using the baseline policy, the service has a positive trust score throughout the simulation. The weight on negative experiences is cancelled out due to their lesser impact: positive experiences are major, while the service quality drops produce minor negative experiences.

The epoch detection policies react quickly to the first outage; again, the Load balancing and Oscillation detection algorithms behave the same way for the first service quality drop, and immediately recover as service quality returns to normal. In the second disturbance, however, the 10-round-long learning window of the Load balancing policy is only filling up when the temporary recovery occurs, and it does not change epochs in the middle of its learning phase. On the other hand, the Oscillation detection algorithm reacts somewhat too quickly to the temporary change to positive. As before, the Conservative oscillation detection algorithm reacts with a delay while it accumulates evidence of the change; the inconsistency during the second disturbance simply delays its epoch change by two rounds.

The third scenario represents the "disturbing" behaviour pattern [START_REF] Schlosser | On the simulation of global reputation systems[END_REF], an actor who oscillates between good and bad: the service collects just enough good reputation to not be shut out of the system when it denies service. This can also be interpreted as an opportunistic or "lazy" service provider who is ready to violate contracts to cut costs, but takes care to not burn up its reputation entirely. The length of the different oscillation phases is optimized for a given trust decision policy. In the case of our baseline policy, it behaves well 75% of the time (minor positive experiences), and misbehaves 25% of the time (minor negative experiences); as a result, its trust score is never negative with the baseline policy. This scenario is depicted in Fig. 3 on the next page.

The Oscillation detection and Load balancing algorithms react immediately to the first transgression. Their differences become apparent when the quality of service increases again: The policy optimized for regular oscillation changes the epoch in order to take advantage of the period of good service, up until the next disturbance. Meanwhile, due to the shortness of the period of low service quality (8 rounds), the Load balancing algorithm is still in its learning phase when the change for better occurs; it only changes epoch at the next drop in service quality. By then its window has filled with positive experiences (at round 56), and the current epoch's reputation has just climbed to zero, resulting in a mirror plot of the baseline policy. Finally, the Conservative oscillation detection algorithm's reactions are slightly delayed versions of those observed for the basic Oscillation detection.

The strategic oscillation presented here is only an optimal attack against the baseline policy. The Oscillation detection policy would appear to severely discourage misbehaviour, although it is also instantly forgiving. This combination of epoch detection and trust decision policies is altogether only feasible as an example to build on; it reacts too absolutely to a single negative or positive experience.

In the fourth scenario, noise is introduced to a basic oscillation pattern, i.e. experience reports which disagree with the norm. We expect this kind of pattern to be more realistic than reputation flows consisting of unanimous agreement between sources, which makes it interesting to see how the different policies can handle it. The scenario is depicted in Fig. 4 on the next page. First, two neutral experiences ("no effect") interrupt a pattern of minor positive experiences. In the second "oscillation cycle", the series of minor negative experiences is interrupted by two minor positive experiences. Finally, both the positive and negative halves are affected, by three minor negatives on the positive side, and two major positives on the negative side.

The Load balancing algorithm becomes somewhat unstable in this scenario. It reacts to the introduction of neutral experiences in round 12; due to its full learning window not containing any of them from before, it is the only policy strongly affected by this kind of noise. It changes epochs again when the negative half of the oscillation begins, and again at the second drop in service quality. During the second drop, minor positive experiences are introduced in the learning window, and therefore the policy does not change epochs at the third rise, but only at the third drop -which, ironically, zeroes out the already negative trust score before it drops again. A final epoch change is introduced as the last oscillation cycle turns downwards. Similarly, the Oscillation detection algorithm reacts strongly to every change in behaviour except the neutral experiences, zigzagging between positive and negative trust scores. The Conservative oscillation detection policy endures the introduced noise, and only changes epochs once per each longer change in behaviour. It first deviates from the baseline policy once it has observed 5 minor negative experiences in the first cycle; it similarly ignores the bumps in the second and third cycle. The cost of this stability is the same as observed in all these scenarios: a slightly delayed reaction to changes, as the algorithm awaits for supporting evidence.

Conclusion

An important strength of reputation-based trust management, as opposed to more static, certification-based trust management, is in its ability to adjust to changes in behaviour. This strength has gone underutilized in the past, as proposed reputation systems provide quite limited means of detecting or reacting to incongruity in reputation information.

In contrast, the epoch-aware reputation model we have proposed provides the necessary flexibility for our trust management system to adjust to constantly changing business situations.

A central design cornerstone has been to keep separate the policies for updating reputation information, and making decisions based on it: this allows us to use the same reputation data in multiple decision contexts, without having to collect it repeatedly. As a logical extension, we also separate the detection of behaviour changes, i.e. epoch change policies, from the reaction to such changes, i.e. policies on weighing different epochs and detecting when behaviour is too inconsistent to warrant an automated decision. The first process is governed by reputation update policies, and the latter by trust decision policies.

Trust management for inter-enterprise collaboration is inherently policydriven; it must be designed to be reconfigured at runtime as the need arises. As Pilarcos is a general inter-enterprise collaboration management infrastructure, it must be able to cater for very different needs. We have demonstrated in this paper how different scenarios warrant different approaches, and proposed suitable policies for four example scenarios. These scenarios also demonstrate the expressive power of the epoch concept; it can be adjusted according to the situation, while for example time-based discounting can only be set up once.

Addressing changes in the behaviour of external sources of reputation information remains an important item of future work. Spreading misinformation into reputation networks must have a negative impact on the source's own reputation. To fulfil this requirement, we are currently researching contractually governed reputation systems based on objective, verifiable experiences.

  f o r each round : i f e x p e r i e n c e and epoch match : % ( b o t h good / b o t h e v i l ) i f t i m e r == 0 : s k i p t o next round ; e l s e : support --; i f e x p e r i e n c e and epoch mismatch : % ( one good , one e v i l ) s u p p o r t++; t i m e r ++; i f s u p p o r t >= k : c h a n g e e p o c h ( ) ; % Overwhelming s u p p o r t f o r change . r e s e t v a r i a b l e s ( ) ; i f s u p p o r t < 0 : r e s e t v a r i a b l e s ( ) ; i f t i m e r >= t : i f s u p p o r t > 0 : c h a n g e e p o c h ( ) ; % M a j o r i t y o f t v o t e s s u p p o r t s i t . r e s e t v a r i a b l e s ( ) ;

Fig. 1 .

 1 Fig. 1. Scenario 1: A change for the worse.

  , the two first epoch detection algorithms (Load balancing and Oscillation detection) react instantaneously to a change in behaviour; their trust scores are equal. The more conservative version of oscillation detection follows closely behind; the sequential hypothesis tester waits until 5 consequtive evidences of the change in behaviour have arrived, then triggers an epoch change. The baseline algorithm, on the other hand, patiently waits until the old good experiences are "used up" before turning negative. Even though it gives triple weight to negative experiences, it lags behind the epoch change policies in reaction speed (by 17 rounds).

Fig. 2 .

 2 Fig. 2. Scenario 2: A need for load balancing.

Fig. 3 .

 3 Fig. 3. Scenario 3: Oscillating behaviour.

Fig. 4 .

 4 Fig. 4. Scenario 4: Oscillating behaviour with noise.

Acknowledgements

This work has been performed in the CINCO group at University of Helsinki. We thank the anonymous reviewers for their encouraging and helpful comments on improving the manuscript.