Heng Chuan Tan

Maode Ma

Houda Labiod
email: labiod@telecom-paristech.fr

Peter Han
email: peter.chong@aut.ac.nz

Joo Chong
email: ehjchong@ntu.edu.sg

Jun Zhang
email: jun.zhang@telecom-paristech.fr

A Non-Biased Trust Model for Wireless Mesh Networks

Keywords: Wireless Mesh Networks, Information Fusion, Recommendation based Trust Model, Reputation based Attacks, Packet Dropping Attacks, Dempster's Rule of Combination

Trust models that rely on recommendation trusts are vulnerable to badmouthing and ballot-stuffing attacks. To cope with these attacks, existing trust models employ different trust aggregation techniques to process the recommendation trusts and combine them with the direct trust values to form a combined trust value. However, these trust models are biased as recommendation trusts that deviate too much from one's own opinion are discarded. In this paper, we propose a non-biased trust model that considers every recommendation trusts available regardless they are good or bad. Our trust model is based on a combination of two techniques: the dissimilarity test and the Dempster Shafer Theory. The dissimilarity test determines the amount of conflict between two trust records, whereas the Dempster Shafer Theory assigns belief functions based on the results of the dissimilarity test. Numerical results show that our trust model is robust against reputation based attacks when compared to trust aggregation techniques such as the linear opinion pooling, subjective logic model, entropy-based probability model and regression analysis. In addition, our model has been extensively tested using network simulator NS-3 in an Infrastructure based WMN and a Hybrid based WMN to demonstrate that it can mitigate blackhole and grayhole attacks.

INTRODUCTION

A Wireless Mesh Network (WMN) is formed by a collection of mesh routers and mesh clients that cooperate to establish mesh connectivity and network coverage over an area [START_REF] Akyildiz | A survey on wireless mesh networks[END_REF][START_REF] Akyildiz | Wireless mesh networks: a survey[END_REF]. The mesh routers are usually static and form the wireless mesh backbone of the network for providing network access. The mesh clients, on the other hand, can be static or mobile and have limited computing capabilities. Each node relies on the cooperation of the intermediate nodes in forwarding the packets to the destination along a multi-hop path. The advantages of WMNs include low deployment cost, easy extension of network coverage to hard-to-wire areas and highly reliable wireless connectivity via the multi-hop communications. Due to this, WMN has found widespread applications in many areas of wireless networking that include public safety/military, residential, enterprise, campus networking and in rescue operations. Depending on the application requirements and the type of However, due to the openness and the multi-hop nature of the WMNs, attacks can be launched at any layer of the Internet protocol stack [START_REF] Glass | Securing Wireless Mesh Networks[END_REF][START_REF] Sen | Secure routing in wireless mesh networks[END_REF]. While cryptography has been the traditional approach of providing network security in terms of confidentiality, integrity, authentication, and nonrepudiation, it is not sufficient to protect the network against nodes exhibiting selfish behaviors i.e. nodes that refrain from forwarding packets to save scarce resources. Such selfish behavior is hard to detect as they appear to be legitimate nodes with valid cryptographic keys. Subsequently, they may misbehave and conduct packet dropping attacks such as blackhole and grayhole attacks to degrade the overall throughput of a network. To enforce cooperation in the network, various trust models have been developed to detect and isolate selfish nodes in order to improve the network throughput.

The first pioneering work [START_REF] Marti | Mitigating routing misbehavior in mobile ad hoc networks[END_REF] was proposed in 2000 by Marti et al., who proposed the use of trust ratings to assess the reliability of a node in forwarding packets. In their model, they have proposed the Watchdog mechanism which gathers information based on the promiscuous mode of observations. Using this information, a trust rating is defined for selfish node detection. The downside of this model is that trust convergence is slow as the trust evaluation only depends on the direct observations.

To enable the trust value to converge faster, [START_REF] Buchegger | Nodes bearing grudges: Towards routing security, fairness, and robustness in mobile ad hoc networks[END_REF][START_REF] Michiardi | Core: a collaborative reputation mechanism to enforce node cooperation in mobile ad hoc networks[END_REF][START_REF] Li | A trust model based routing protocol for secure ad hoc networks[END_REF] have proposed to rely on both the direct trust and indirect trusts from the neighboring nodes. By gathering recommendation trusts from the other nodes, it improves the detection time of selfish nodes in the network [START_REF] Buchegger | A robust reputation system for peer-to-peer and mobile ad-hoc networks[END_REF]. Consequently, the use of direct and indirect trusts has become the design standards of many recent trust models. However, as pointed out by [START_REF] Sun | Attacks on trust evaluation in distributed networks[END_REF][START_REF] Sun | Information theoretic framework of trust modeling and evaluation for ad hoc networks[END_REF][START_REF] Sun | A trust evaluation framework in distributed networks: Vulnerability analysis and defense against attacks[END_REF][START_REF] Ganeriwal | Reputation-based framework for high integrity sensor networks[END_REF][START_REF] Sun | Defense of trust management vulnerabilities in distributed networks[END_REF], trust models that depend on recommendation trusts are more prone to badmouthing attacks and ballot-stuffing attacks. More specifically, the malicious recommender may assign a very poor trust value in an attempt to demote the reputation of a well-behaved node known as the badmouthing attacks. As a result, the well-behaved node is blacklisted from further communications which lead to network partition. The malicious recommender may also try to promote its accomplice's trust level by recommending a very high trust value known as the ballotstuffing attacks. This prolongs the lifetime of the malicious nodes in the network for causing further damage. Methods of preventing the badmouthing and ballot-stuffing attacks have been discussed by [START_REF] Buchegger | A robust reputation system for peer-to-peer and mobile ad-hoc networks[END_REF][START_REF] Sun | Attacks on trust evaluation in distributed networks[END_REF][START_REF] Sun | Information theoretic framework of trust modeling and evaluation for ad hoc networks[END_REF][START_REF] Sun | A trust evaluation framework in distributed networks: Vulnerability analysis and defense against attacks[END_REF][START_REF] Ganeriwal | Reputation-based framework for high integrity sensor networks[END_REF][START_REF] Sun | Defense of trust management vulnerabilities in distributed networks[END_REF][START_REF] Wang | Trust-based Service Management of Mobile Devices in Ad Hoc Networks[END_REF][START_REF] Buchegger | A robust reputation system for mobile ad-hoc networks[END_REF][START_REF] Kane | Using uncertainty in reputation methods to enforce cooperation in ad-hoc networks[END_REF][START_REF] Liu | A novel reputation computation model based on subjective logic for mobile ad hoc networks[END_REF][START_REF] Lin | PA-SHWMP: a privacy-aware secure hybrid wireless mesh protocol for IEEE 802.11 s wireless mesh networks[END_REF][START_REF] Chen | Trust management in mobile ad hoc networks for bias minimization and application performance maximization[END_REF][START_REF] Ruidong | A Hybrid Trust Management Framework for Wireless Sensor and Actuator Networks in Cyber-Physical Systems[END_REF][START_REF] Wang | LogitTrust: A logit regressionbased trust model for mobile ad hoc networks[END_REF] where models employing different trust aggregation techniques to combine the direct trusts and indirect trusts have been proposed. These techniques impose further constraints to process the recommendation trusts before the aggregation process. In [START_REF] Buchegger | A robust reputation system for peer-to-peer and mobile ad-hoc networks[END_REF], recommendation trusts are only considered if they pass the deviation test which is determined by the similarity with one's own direct trust. In [START_REF] Michiardi | Core: a collaborative reputation mechanism to enforce node cooperation in mobile ad hoc networks[END_REF][START_REF] Ganeriwal | Reputation-based framework for high integrity sensor networks[END_REF], only positive recommendation trusts are allowed to propagate in the network. In [START_REF] Sun | Attacks on trust evaluation in distributed networks[END_REF][START_REF] Sun | Information theoretic framework of trust modeling and evaluation for ad hoc networks[END_REF][START_REF] Sun | A trust evaluation framework in distributed networks: Vulnerability analysis and defense against attacks[END_REF][START_REF] Sun | Defense of trust management vulnerabilities in distributed networks[END_REF], constraints are imposed where only recommendation trusts from the trustworthy nodes with trust value higher than a pre-defined threshold are considered in the trust aggregation. Due to these reasons, the existing trust models are said to be biased as important evidence may be discarded. In addition, trustworthy nodes may misreport the recommendation trusts only to a certain group of nodes in the network which increase the difficulty of detection.

In this paper, we propose a non-biased trust model called the DS-Trust model to address two problems in WMNs, that is, [START_REF] Akyildiz | A survey on wireless mesh networks[END_REF] to overcome the attacks that can subvert the proper operation of the reputation systems, namely the badmouthing and the ballot-stuffing attacks (2) to mitigate the effects of packet dropping attacks that cannot be solved by cryptography. Our trust model is non-biased because every recommendation trusts, whether they are good or bad are considered in the trust aggregation process using the Dempster Shafer Theory (DST) [START_REF] Shafer | A Mathematical Theory of Evidence[END_REF]. Henceforth, our trust model is called the DS-Trust model. The major contributions of our work are summarized below:

• Propose the Dempster Shafer's rule of combination to fuse direct trust and indirect trusts together to obtain the final combined trust.

• Introduce a dissimilarity test to check the amount of conflict between one's own observations and each received recommendation trusts. The result of the dissimilarity test is then used to determine the basic probability assignment (bpa) mass for each subset of the power set in DST.

• Demonstrate that DS-Trust has a higher resiliency against badmouthing attacks and ballotstuffing attacks compared to the benchmarking approaches.

• Incorporate the DS-Trust into the Ad hoc On Demand Distance Vector Routing (AODV) protocol [START_REF] Perkins | RFC 3561 Ad hoc On-Demand Distance Vector (AODV) Routing[END_REF]

A. Linear Opinion Pooling

In [START_REF] Buchegger | A robust reputation system for peer-to-peer and mobile ad-hoc networks[END_REF][START_REF] Buchegger | A robust reputation system for mobile ad-hoc networks[END_REF], S. Buchegger and J.-Y. Le Boudec have proposed the use of linear opinion pooling to combine the recommendation trusts to form an indirect trust value. In this approach, the linear opinion pooling technique is just a weighted average of the individual recommendation trusts as shown in [START_REF] Akyildiz | A survey on wireless mesh networks[END_REF].

𝑇𝑇 𝑖𝑖,𝑗𝑗 𝐼𝐼𝐼𝐼𝐼𝐼𝑖𝑖𝐼𝐼𝐼𝐼𝐼𝐼𝐼𝐼 = ∑ 𝜔𝜔 𝑘𝑘 𝑇𝑇 𝑘𝑘,𝑗𝑗 𝐼𝐼𝑖𝑖𝐼𝐼𝐼𝐼𝐼𝐼𝐼𝐼 𝑁𝑁 𝑘𝑘=1 ∀𝑘𝑘 = 1,2, …, N (1)
where 𝜔𝜔 𝑘𝑘 is a small positive weight in the range (0,1), 𝑇𝑇 𝑘𝑘,𝑗𝑗 𝐼𝐼𝑖𝑖𝐼𝐼𝐼𝐼𝐼𝐼𝐼𝐼 denotes the recommendation trust of node 𝑗𝑗 as observed by recommender 𝑘𝑘 and 𝑇𝑇 𝑖𝑖,𝑗𝑗 𝐼𝐼𝐼𝐼𝐼𝐼𝑖𝑖𝐼𝐼𝐼𝐼𝐼𝐼𝐼𝐼 denotes the indirect trust of node 𝑗𝑗 as derived by node 𝑖𝑖. In this model, the recommendation trusts are only considered if they are compatible with the current indirect trust value determined using a deviation test, otherwise the recommendation trusts are discarded. In [START_REF] Ganeriwal | Reputation-based framework for high integrity sensor networks[END_REF][START_REF] Chen | Trust management in mobile ad hoc networks for bias minimization and application performance maximization[END_REF][START_REF] Ruidong | A Hybrid Trust Management Framework for Wireless Sensor and Actuator Networks in Cyber-Physical Systems[END_REF], the authors have proposed to derive the weight associated with each recommendation trust in (1) based on the trustworthiness of the recommender such that the recommendation trusts that come from an untrustworthy recommender are discounted more than the one that comes from a highly reputed recommender. In [START_REF] Ruidong | A Hybrid Trust Management Framework for Wireless Sensor and Actuator Networks in Cyber-Physical Systems[END_REF], Li et al. have proposed an additional check besides the deviation test to differentiate badmouthing and conflicting behavior attacks. This additional check is based on checking the trust level of the recommenders in providing recommendations which are maintained separately inside a reputation generation system. In [START_REF] Chen | Trust management in mobile ad hoc networks for bias minimization and application performance maximization[END_REF], R.

where 𝑃𝑃 𝑖𝑖,𝑗𝑗 is the probability that node 𝑗𝑗 performs an action, 𝑃𝑃 𝑖𝑖,𝑘𝑘 is the probability that recommender 𝑘𝑘 makes good recommendations and 𝑃𝑃 𝑘𝑘,𝑗𝑗 is the probability that node 𝑗𝑗 performs some actions in the recommender's view. The probability values are estimated by evaluating the expected value of the Beta distribution [START_REF] Jsang | The beta reputation system[END_REF]. The second model is called the multipath propagation model which is used in scenarios where there are multiple recommendation paths between node 𝑖𝑖 and node 𝑗𝑗. In the second model, the mean and variance of the each path 𝑚𝑚 is first converted to Beta parameters (𝛼𝛼 𝑚𝑚 , 𝛽𝛽 𝑚𝑚 ).

Then, a new pair of parameters (𝛼𝛼, 𝛽𝛽) is updated as follows in [START_REF] Glass | Securing Wireless Mesh Networks[END_REF].

𝛼𝛼 = ∑ 𝛼𝛼 𝑖𝑖 𝑚𝑚 𝑖𝑖=0 ∀𝑖𝑖 = 1, … , 𝑚𝑚 (3)
𝛽𝛽 = ∑ 𝛽𝛽 𝑖𝑖 𝑚𝑚 𝑖𝑖=0 ∀𝑖𝑖 = 1, … , 𝑚𝑚
Once 𝛼𝛼 and 𝛽𝛽 values are updated, the aggregated probability is found by evaluating the expected value of the beta distribution. After that, the aggregated probability is converted to trust values using the entropy function as described in [START_REF] Sen | Secure routing in wireless mesh networks[END_REF].

𝑇𝑇 𝑖𝑖,𝑗𝑗 = � 1 -𝐻𝐻�𝑃𝑃 𝑖𝑖,𝑗𝑗 �, 𝑓𝑓𝑓𝑓𝑓𝑓 0.5 ≤ 𝑃𝑃 𝑖𝑖,𝑗𝑗 ≤ 1 𝐻𝐻�𝑃𝑃 𝑖𝑖,𝑗𝑗 � -1, 𝑓𝑓𝑓𝑓𝑓𝑓 0 ≤ 𝑃𝑃 𝑖𝑖,𝑗𝑗 < 0.5 𝐻𝐻�𝑃𝑃 𝑖𝑖,𝑗𝑗 � = -𝑃𝑃 𝑖𝑖,𝑗𝑗 𝑙𝑙𝑓𝑓𝑙𝑙 2 �𝑃𝑃 𝑖𝑖,𝑗𝑗 � -(1 -𝑃𝑃 𝑖𝑖,𝑗𝑗 )𝑙𝑙𝑓𝑓𝑙𝑙 2 (1 -𝑃𝑃 𝑖𝑖,𝑗𝑗 ). (4)

C. Subjective Logic Operators

In [START_REF] Jøsang | Artificial reasoning with subjective logic[END_REF]

From the definition of an opinion, trustworthiness of a node is derived by evaluating the expectation of the subjective opinion as defined in ( 6)

𝑇𝑇 𝑖𝑖,𝑗𝑗 = 𝑏𝑏 𝑖𝑖,𝑗𝑗 + 𝑎𝑎 𝑖𝑖,𝑗𝑗 𝑢𝑢 𝑖𝑖,𝑗𝑗 (6)
where 𝑇𝑇 𝑖𝑖,𝑗𝑗 represents node 𝑖𝑖 's trust in 𝑗𝑗 and the parameter 𝑎𝑎 𝑖𝑖,𝑗𝑗 determines how much uncertainty contributes towards the trust computation. Because subjective logic is able to account for uncertainty, it improves the clarity and expressiveness of an opinion compared to the traditional probabilistic logic. The subjective logic further establishes two operations [START_REF] Josang | Simplification and analysis of transitive trust networks[END_REF][START_REF] Jøsang | Trust network analysis with subjective logic[END_REF] to handle trust propagations in a network. The first operator is called the discounting operator which is used to derive a trust opinion from transitive paths via a recommender. The second operator is called the consensus operator and is used to derive a trust opinion from multiple parallel paths. The concept of subjective logic has been very popular and widely used in Mobile Ad Hoc Networks (MANETs) [START_REF] Li | A trust model based routing protocol for secure ad hoc networks[END_REF][START_REF] Kane | Using uncertainty in reputation methods to enforce cooperation in ad-hoc networks[END_REF][START_REF] Liu | A novel reputation computation model based on subjective logic for mobile ad hoc networks[END_REF] and WMNs [START_REF] Lin | PA-SHWMP: a privacy-aware secure hybrid wireless mesh protocol for IEEE 802.11 s wireless mesh networks[END_REF] including VANETs [START_REF] Dietzel | A flexible, subjective logic-based framework for misbehavior detection in V2V networks[END_REF] with some slight variations. In [START_REF] Kane | Using uncertainty in reputation methods to enforce cooperation in ad-hoc networks[END_REF], the trust opinions from multiple recommenders are first combined into a single opinion using the weighted average approach before it is fused with the direct trust using the consensus operator. In [START_REF] Liu | A novel reputation computation model based on subjective logic for mobile ad hoc networks[END_REF], the weighting factor for each recommendation trust opinion is derived based on a familiarity value that denotes the familiarity degree of the recommender with the target node to be evaluated. In [START_REF] Lin | PA-SHWMP: a privacy-aware secure hybrid wireless mesh protocol for IEEE 802.11 s wireless mesh networks[END_REF], each of the recommendation trusts are weighted by the trustworthiness of the recommender. Subsequently, the recommendation trusts are aggregated using a simple average function. In [START_REF] Dietzel | A flexible, subjective logic-based framework for misbehavior detection in V2V networks[END_REF], subjective logic is proposed as a tool to merge opinions coming from different misbehaviour detection mechanisms together to enhance the trust accuracy and detection capability of the system.

D. Regression Analysis

In [START_REF] Wang | Trust-based Service Management of Mobile Devices in Ad Hoc Networks[END_REF][START_REF] Wang | LogitTrust: A logit regressionbased trust model for mobile ad hoc networks[END_REF], Y. Wang et al have proposed the LogitTrust model to estimate the trustworthiness of nodes with logit regressions. It gathers the direct and indirect observations as a function of the operational and environmental factors to infer the trustworthiness of a node. Trust, in this model, is expressed as a logistics function and is given by [START_REF] Michiardi | Core: a collaborative reputation mechanism to enforce node cooperation in mobile ad hoc networks[END_REF].

𝑇𝑇 𝑗𝑗 𝐼𝐼+1 = 1 1 + 𝑒𝑒 -(𝑥𝑥 𝑡𝑡 ) 𝑇𝑇 𝛽𝛽 𝑗𝑗 (7)
where 𝑇𝑇 𝑗𝑗 𝐼𝐼+1 represents the trust of node 𝑗𝑗 at time 𝑡𝑡 + 1, 𝑥𝑥 𝐼𝐼 is a vector of variables that characterize the operational and environmental factors at time 𝑡𝑡 and 𝛽𝛽 𝑗𝑗 is a vector of regression coefficients. The Expectation Maximization (EM) algorithm is then used to estimate the regression coefficients such that the log-odds of a node in providing a satisfactory service are greater than 0. After that, the regression coefficients are substituted back into [START_REF] Michiardi | Core: a collaborative reputation mechanism to enforce node cooperation in mobile ad hoc networks[END_REF] to compute the trust of a node. The LogitTrust achieves resiliency against badmouthing and ballot-stuffing attacks by replacing the latent error in logistics distribution with a white noise in t-distribution. Because the t-distribution has heavier tails, the impacts of records with a high variance are weighted down; therefore, it provides a more accurate estimate. However, this method is sensitive to sampling bias and requires more samples to achieve stable and accurate results.

III. SYSTEM MODEL

A. Network Model

We consider the Infrastructure-based WMN and the Hybrid-based WMNs in our model. The

Infrastructure-based WMN is made up of static mesh routers that establish an infrastructure backbone for the clients. These static mesh routers can be installed within a building to connect stationary computers and other related devices together to form a small-size enterprise network [START_REF] Akyildiz | Wireless mesh networks: a survey[END_REF]. The mesh routers can also be installed on the rooftop of multiple buildings to bridge communication between them to form an even larger corporate enterprise networking. Some of the mesh routers are equipped with gateway functionality that enables them to provide internet connectivity and to relay traffic to and from the Internet to support the entire enterprise network. This greatly improves the information flow among departments and facilitates management of data. In contrast, the Hybrid based WMNs consist of static mesh routers and mobile clients. The mobile clients roam around the network and can access the network services through the mesh routers or through direct meshing with other mesh

clients. An application scenario of Hybrid based WMNs is the Vehicular Networks (VNs) as discussed by [START_REF] Salem | Securing wireless mesh networks[END_REF]. The roadside units are assumed to be the mesh routers and the mobile mesh clients are the vehicles on the road. In this case, WMN enabled VNs can be used to support applications including accident reporting, collision avoidance, electronic toll collection and etc.

B. Attack Model

We consider two types of attacks in the system: reputation based attacks that subvert the proper operation of the reputation systems and packet dropping attacks that are due to the selfish behavior of the nodes. Selfish nodes, in this case, try to preserve their own resources while exploiting the services of others and depleting their resources.

First, we consider two reputation based attacks, namely the badmouthing attacks and ballotstuffing attacks. In the bad mouthing attacks, the recommender node attempts to ruin the reputation of a well-behaved node intentionally by providing bad recommendations against it so as to decrease the chance of that node being selected for service. Ballot-stuffing attack, on the other hand, does the exact opposite. The malicious recommenders attempt to boost the trust of another malicious node by providing good recommendations so as to increase the chance of that malicious node being selected as a forwarder. Subsequently, the trustee may conduct other attacks such as the packet dropping attacks.

Second, we consider two types of packet dropping attacks that are the blackhole and grayhole attacks. By a blackhole attack, a malicious node will advertise itself as having the best route to the destination even though it does not have a route to it. It does this by sending a Route Reply (RREP) packet immediately to the source node [START_REF] Sen | Secure routing in wireless mesh networks[END_REF]. The source node, upon receiving this malicious RREP assumes the route discovery is complete and ignores all other RREPs from the other nodes and selects the path that now includes the malicious node as a relay node to forward the data packets.

Subsequently, the malicious node drops all the traffic received to create a blackhole in the network. A grayhole attack is a variation of the blackhole attacks. Instead of dropping all the traffic, the node drops the packets selectively that makes grayhole attacks more difficult to detect as the selective packet dropping may be perceived as packet loss because of the unreliable wireless channels in the networks. Hence, the grayhole attacks may go undetected for a longer period of time than the blackhole attacks [START_REF] Sen | Secure routing in wireless mesh networks[END_REF]. Furthermore, the grayhole nodes may appear well-behaved during the route discovery process or at the starting of data transmission. Subsequently, they will start to drop packets randomly that originate from specific peers in the network.

IV. PRELIMINARIES

In this section, we introduce the concept of DST [START_REF] Shafer | A Mathematical Theory of Evidence[END_REF] and highlight the motivations behind the use of DST that serves as the basis of our proposed DS-Trust model.

A. Background

DST is a theory of belief based on plausible reasoning and uncertainty [START_REF] Shafer | A Mathematical Theory of Evidence[END_REF]. It has two interesting features, one of which is the ability to quantify uncertainty. To illustrate this idea, let us assume that node 𝑋𝑋 has a belief of 0.8 in the trustworthiness of node 𝑌𝑌 as a forwarding node. If DST is used, the remaining belief of 0.2 is classified as uncertainty because there is no evidence to support that node 𝑌𝑌 is untrustworthy. With traditional probability theory, the remaining probability is assigned to the untrustworthy state to obey the additive rule of probability. Hence, DST is more flexible than traditional probability theory in handling ignorance or lack of evidence. Another feature of DST is the ability to handle conflicting evidences from multiple sources. This is reflected in the Dempster's rule of combination operator where the conflicting information is ignored through a normalization factor to emphasize the agreement among multiple evidences. These unique features make DST very appealing for modelling trust relationships, including trust aggregation, especially in wireless networks where unreliable overhearing and contradicting opinions because of misbehaviors are prevalent. In the following, we focus on the three important functions related to DST.

B. Concepts of DST

Let Θ be the frame of discernment containing a finite set of possible possibilities. Let 2 Θ be a power set of Θ that contains singleton and all possible unions of the singletons including Θ. An evidence source generates a belief mass or bpa denoted by a mass function 𝑚𝑚 𝑗𝑗 (•) for various subsets of the power set where 𝑗𝑗 = {1, … , 𝐽𝐽} refers to the index of the evidence source. In this case, the mass function, 𝑚𝑚 𝑗𝑗 (•) is a probability defined as a mapping from a set 𝑠𝑠𝑠𝑠2 Θ to a non-negative value between 0 and 1 given in [START_REF] Li | A trust model based routing protocol for secure ad hoc networks[END_REF].

𝑚𝑚 𝑗𝑗 (𝑠𝑠): 2 Θ → [0,1], 𝑠𝑠 ∈ 2 Θ (8) 𝑚𝑚 𝑗𝑗 (𝜙𝜙) = 0 (9) � 𝑚𝑚 𝑗𝑗 (𝑠𝑠) = 1 𝑠𝑠𝑠𝑠2 Θ (10)
The bpa expresses the strength of the evidence pertaining to the subset of 2 Θ under consideration.

When assigning bpa, two conditions must be adhered to, that is. no bpa should be assigned to the empty set 𝜙𝜙 and the sum of belief mass should be equal to 1 according to ( 9) and ( 10) respectively.

DST further defines two functions that make use of the bpa. They are called the belief function and plausibility functions. Belief functions are the sum of all bpas that supports a proposition, 𝑠𝑠 defined in [START_REF] Sun | Information theoretic framework of trust modeling and evaluation for ad hoc networks[END_REF] while the plausibility function is represented by the sum of all masses that partially or fully support a proposition, 𝑠𝑠 as in [START_REF] Sun | A trust evaluation framework in distributed networks: Vulnerability analysis and defense against attacks[END_REF]. Together, the belief and plausibility functions define a belief interval bounded by [𝑏𝑏𝑒𝑒𝑙𝑙𝑖𝑖𝑒𝑒𝑓𝑓(𝑠𝑠), 𝑝𝑝𝑙𝑙𝑎𝑎𝑢𝑢𝑠𝑠𝑖𝑖𝑏𝑏𝑙𝑙𝑖𝑖𝑡𝑡𝑝𝑝(𝑠𝑠)] where the probability of a set 𝑠𝑠𝑠𝑠2 Θ can be obtained.

𝑏𝑏𝑒𝑒𝑙𝑙𝑖𝑖𝑒𝑒𝑓𝑓 𝑗𝑗 (𝑠𝑠) = � 𝑚𝑚 𝑗𝑗 (𝑝𝑝) 𝑝𝑝⊆𝑠𝑠 𝑝𝑝∈2 Θ (11) 𝑝𝑝𝑙𝑙𝑎𝑎𝑢𝑢𝑠𝑠𝑖𝑖𝑏𝑏𝑖𝑖𝑙𝑙𝑖𝑖𝑡𝑡𝑝𝑝 𝑗𝑗 (𝑠𝑠) = � 𝑚𝑚(𝑝𝑝) 𝑝𝑝∩𝑠𝑠≠∅ 𝑝𝑝∈2 Θ (12)

C. Dempster's Rule of Combination

For a given frame of discernment, it is possible for multiple sources to provide their evidence.

Assuming that evidence comes from independent sources, they can be combined in a pairwise manner using the Dempster's rule of combination defined in ( 13) to arrive at a common shared belief.

𝑚𝑚 𝐷𝐷𝐷𝐷 (𝑠𝑠) = 𝑚𝑚 1 (𝑠𝑠)⨁𝑚𝑚 2 (𝑠𝑠)⨁ … ⨁𝑚𝑚 𝐽𝐽 (𝑠𝑠) ∀𝑠𝑠 ∈ 2 Θ ( 13
)
where 𝑚𝑚 𝐷𝐷𝐷𝐷 (𝑠𝑠) denotes the resulting mass function after combination and ⨁ represents the combination operator. If there are only two evidence sources, 𝐸𝐸 𝑖𝑖 and 𝐸𝐸 𝑗𝑗 , the pairwise combination operator is written as follows:

𝑚𝑚 𝑖𝑖,𝑗𝑗 (𝑠𝑠) = 1 1 -𝐾𝐾 � 𝑚𝑚 𝑖𝑖 (𝑝𝑝)𝑚𝑚 𝑗𝑗 (𝑞𝑞) 𝑝𝑝∩𝑞𝑞=𝑠𝑠 𝑝𝑝∈2 Θ 𝑞𝑞∈2 Θ 𝑠𝑠 ≠ 𝜙𝜙 (14)
𝐾𝐾 = � 𝑚𝑚 𝑖𝑖 (𝑝𝑝)𝑚𝑚 𝑗𝑗 (𝑞𝑞) 𝑝𝑝∩𝑞𝑞=𝜙𝜙 𝑝𝑝∈2 Θ 𝑞𝑞∈2 Θ (15)
where 𝑚𝑚 𝑖𝑖 (𝑝𝑝) and 𝑚𝑚 𝑗𝑗 (𝑞𝑞) represent the bpa assigned to 𝑏𝑏𝑒𝑒𝑙𝑙𝑖𝑖𝑒𝑒𝑓𝑓 𝑖𝑖 and 𝑏𝑏𝑒𝑒𝑙𝑙𝑖𝑖𝑒𝑒𝑓𝑓 𝑗𝑗 functions respectively. The quantity 𝐾𝐾 denotes the amount of conflict between the two evidence sources and is treated as the normalization factor to ensure that the total sum of combined masses 𝑚𝑚 𝑖𝑖,𝑗𝑗 = 1. In essence, the DST's rule of combination sums up all the possible intersections of the propositions and normalized the value by removing all the conflicts in the system.

V. DS-TRUST MODEL

In this section, we describe the five modules of the DS-Trust model which is shown in Figure 1 and their relationship to each other. The five modules are installed on every node, and they are the monitor module, the feedback module, the correlation module, the fusion module and the decision module.

A. Monitoring Module

The monitor module is equipped with the Watchdog mechanism [START_REF] Marti | Mitigating routing misbehavior in mobile ad hoc networks[END_REF] to monitor the next hop forwarding behavior by keeping track of the number of packets sent and the number of packets overheard locally. More specifically, each node stores the packet ID and the node ID that the packet is directed to in a table. When each node overhears a packet sent and finds a match in the corresponding table, the table entry corresponding to the overheard packet ID is deleted. During each trust monitoring period denoted as 𝑇𝑇 , the node tallies the sum in the table and computes the forwarding probability of the downstream node as in [START_REF] Buchegger | A robust reputation system for mobile ad-hoc networks[END_REF]. Next, the forwarding probability of a node is converted into a trust value using a set of equations ( 17) and [START_REF] Liu | A novel reputation computation model based on subjective logic for mobile ad hoc networks[END_REF].

𝑝𝑝 𝑓𝑓 = # 𝑓𝑓𝑓𝑓 𝑓𝑓𝑜𝑜𝑒𝑒𝑓𝑓ℎ𝑒𝑒𝑎𝑎𝑓𝑓𝑑𝑑 𝑝𝑝𝑎𝑎𝑝𝑝𝑘𝑘𝑒𝑒𝑡𝑡𝑠𝑠 𝑠𝑠𝑒𝑒𝑠𝑠𝑡𝑡 𝑏𝑏𝑝𝑝 𝑠𝑠 𝑖𝑖 # 𝑓𝑓𝑓𝑓 𝑝𝑝𝑎𝑎𝑝𝑝𝑘𝑘𝑒𝑒𝑡𝑡𝑠𝑠 𝑠𝑠𝑒𝑒𝑠𝑠𝑑𝑑 𝑡𝑡𝑓𝑓 𝑠𝑠 𝑖𝑖 𝑓𝑓𝑓𝑓𝑓𝑓 𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑎𝑎𝑓𝑓𝑑𝑑𝑖𝑖𝑠𝑠𝑙𝑙 (16) 𝐷𝐷𝑇𝑇 = � 1 -0.5𝐻𝐻 𝑏𝑏 �𝑝𝑝 𝑓𝑓 �, 𝑓𝑓𝑓𝑓𝑓𝑓 0.5 ≤ 𝑝𝑝 𝑓𝑓 ≤ 1 0.5𝐻𝐻 𝑏𝑏 �𝑝𝑝 𝑓𝑓 �, 𝑓𝑓𝑓𝑓𝑓𝑓 0 ≤ 𝑝𝑝 𝑓𝑓 < 0.5 (17)
𝐻𝐻 𝑏𝑏 �𝑝𝑝 𝑓𝑓 � = -𝑝𝑝 𝑓𝑓 log 2 𝑝𝑝 𝑓𝑓 -�1 -𝑝𝑝 𝑓𝑓 � log 2 �1 -𝑝𝑝 𝑓𝑓 � (18)
where 𝐷𝐷𝑇𝑇 denotes the trust value of a node, 𝐻𝐻 𝑏𝑏 (𝑝𝑝 𝑓𝑓 ) denotes the binary entropy function and 𝑝𝑝 𝑓𝑓 denotes the forwarding probability of a node. The use of the entropy function is to reflect the amount of uncertainty about the gathered information because the promiscuous mode of observations is affected by channel conditions and transmission power [START_REF] Marti | Mitigating routing misbehavior in mobile ad hoc networks[END_REF]. The mapping function in [START_REF] Kane | Using uncertainty in reputation methods to enforce cooperation in ad-hoc networks[END_REF], on the other hand, is to bind the trust values in the interval (0,1) where a trust value of 1 means a node is fully trusted and a trust value of 0 means a node is not trusted. Furthermore, we incorporate the exponential averaging function as shown in [START_REF] Lin | PA-SHWMP: a privacy-aware secure hybrid wireless mesh protocol for IEEE 802.11 s wireless mesh networks[END_REF] to give more weight to the recent trust value than the past trust values.

𝐷𝐷𝑇𝑇 𝐼𝐼 = 𝛼𝛼 • 𝐷𝐷𝑇𝑇 𝐼𝐼 + (1 -𝛼𝛼) • 𝐷𝐷𝑇𝑇 𝐼𝐼-1 (19)
where 𝛼𝛼 is a constant smoothing factor between 0 and 1, 𝐷𝐷𝑇𝑇 𝐼𝐼 represents the trust value at time 𝑡𝑡 and 𝐷𝐷𝑇𝑇 𝐼𝐼-1 represents the previous trust value recorded by the monitoring module. If the smoothing factor

𝛼𝛼 is large, it discounts the previous trust faster. Once the direct trust is obtained, it is passed to the correlation module and the decision module that is discussed later.

B. Feedback Module

This module is responsible for gathering recommendation trusts from the neighboring nodes.

During every trust monitoring period 𝑇𝑇, the node broadcasts a request message for the direct trust of a target node. When the neighboring nodes receive the request message, each of them checks its own record to see if there is a trust record for the target node. If a record is found, the neighboring nodes send a recommendation message containing the trust value of the target node back to the requestor. In this case, the recommendation trusts from the recommenders are calculated the same way as described in the monitoring module. When the requestor receives the recommendation message, it weighs the received recommendation trust value by its opinion of the recommender to calculate the indirect trust and then, outputs it to the correlation module. Suppose node 𝐶𝐶 is the target node, node 𝐴𝐴 is the requestor soliciting the opinion of the recommender 𝐵𝐵, the indirect trust denoted by 𝐼𝐼𝐷𝐷𝑇𝑇 is formulated as [START_REF] Chen | Trust management in mobile ad hoc networks for bias minimization and application performance maximization[END_REF].

𝐼𝐼𝐷𝐷𝑇𝑇 𝐴𝐴𝐴𝐴 = 𝐷𝐷𝑇𝑇 𝐴𝐴𝐴𝐴 • 𝐷𝐷𝑇𝑇 𝐴𝐴𝐴𝐴 (20)

C. Correlation Module

The correlation module and the fusion module are the two core components of the DS-Trust model that help to mitigate badmouthing and ballot-stuffing attacks. Different from the approaches in [START_REF] Michiardi | Core: a collaborative reputation mechanism to enforce node cooperation in mobile ad hoc networks[END_REF][START_REF] Buchegger | A robust reputation system for peer-to-peer and mobile ad-hoc networks[END_REF][START_REF] Sun | Attacks on trust evaluation in distributed networks[END_REF][START_REF] Sun | Information theoretic framework of trust modeling and evaluation for ad hoc networks[END_REF][START_REF] Sun | A trust evaluation framework in distributed networks: Vulnerability analysis and defense against attacks[END_REF][START_REF] Sun | Defense of trust management vulnerabilities in distributed networks[END_REF], every single recommendation trusts received by the correlation module are considered in the trust aggregation regardless they are good or bad. The correlation module uses the dissimilarity test to compare the direct trust record and the received indirect trust record. The dissimilarity ratio measures the amount of conflict between one's own opinion and the opinions of others. It determines how much the indirect trust records contribute towards the final trust aggregation. The dissimilarity ratio, as shown in [START_REF] Ruidong | A Hybrid Trust Management Framework for Wireless Sensor and Actuator Networks in Cyber-Physical Systems[END_REF], is expressed as the normalization of the absolute difference between the two trust records. If the dissimilarity ratio is large, it implies that the two trust records are in conflict.

Thus, the evidence supporting the indirect trust record is viewed as uncertainty instead of being filtered out. On the other hand, a small deviation means that the two trust records are almost similar and this amplifies the belief with reduced uncertainty about the observed proposition.

𝑑𝑑𝑖𝑖𝑠𝑠𝑠𝑠𝑖𝑖𝑚𝑚(𝑎𝑎, 𝑏𝑏) = |𝑎𝑎 -𝑏𝑏| |𝑎𝑎| + |𝑏𝑏| (21)

D. Fusion Module

The role of the fusion module is to evaluate the trust value of a node by fusing the direct trust and the indirect trust together. Before the actual aggregation takes place, the results of the dissimilarity test are used to re-evaluate the contribution of the indirect trust values and this is carried out based on the Dempster Shafer Theory (DST) [START_REF] Shafer | A Mathematical Theory of Evidence[END_REF]. We first classify the behavior of the nodes into two states: trusted (T) and untrusted(𝑇𝑇 � ) that forms the frame of discernment Θ defined as (𝑇𝑇, 𝑇𝑇 � ). For the power set denoted by 2 𝛩𝛩 , it consists of the following subsets:

2 𝛩𝛩 = [(𝑇𝑇), (𝑇𝑇 � ), (𝑇𝑇, 𝑇𝑇 � ), (∅)] (22)
The set represented by (𝑇𝑇, 𝑇𝑇 � ) denotes uncertainty in our model that means that a node can be trusted or untrusted. To facilitate the assignment of bpas, we apply the direct trust values obtained from [START_REF] Kane | Using uncertainty in reputation methods to enforce cooperation in ad-hoc networks[END_REF] or [START_REF] Lin | PA-SHWMP: a privacy-aware secure hybrid wireless mesh protocol for IEEE 802.11 s wireless mesh networks[END_REF] as the bpas to denote the strength of evidence pertaining to a particular subset of 2 𝛩𝛩 . In the design, if the trust value is above a certain detection threshold called 𝛾𝛾, it will be classified as a trusted node, whereas a trust value less than 𝛾𝛾 will be classified as an untrusted node. As an example, if the threshold 𝛾𝛾 is 0.5 and the direct trust value of a node is 0.6, the bpa assigned to the set 𝑚𝑚(𝑇𝑇) will be 0.6. The remaining belief mass of 0.4 will be allocated to the set 𝑚𝑚(𝑇𝑇, 𝑇𝑇 � ). For classification of indirect trust values, we leverage on the 𝑑𝑑𝑖𝑖𝑠𝑠𝑠𝑠𝑖𝑖𝑚𝑚(𝑎𝑎, 𝑏𝑏) value received from the correlation module and classify the node according to rules defined in [START_REF] Shafer | A Mathematical Theory of Evidence[END_REF].

If 𝐼𝐼𝐷𝐷𝑇𝑇 ≥ 𝛾𝛾 then, 𝑚𝑚(𝑇𝑇, 𝑇𝑇 � ) = 𝑑𝑑𝑖𝑖𝑠𝑠𝑠𝑠𝑖𝑖𝑚𝑚(𝑎𝑎, 𝑏𝑏)

𝑚𝑚(𝑇𝑇) = 1 -𝑚𝑚(𝑇𝑇, 𝑇𝑇 � ) 𝑚𝑚(𝑇𝑇 � ) = 0 (23)
Else

𝑚𝑚(𝑇𝑇, 𝑇𝑇 � ) = 𝑑𝑑𝑖𝑖𝑠𝑠𝑠𝑠𝑖𝑖𝑚𝑚(𝑎𝑎, 𝑏𝑏) 𝑚𝑚(𝑇𝑇 � ) = 1 -𝑚𝑚(𝑇𝑇, 𝑇𝑇 � ) 𝑚𝑚(𝑇𝑇) = 0
From ( 23), the dissimilarity value is treated as the belief mass for the set 𝑚𝑚(𝑇𝑇, 𝑇𝑇 � ) because the amount of conflict between the two trust records denotes uncertainty. Next, depending on the value of the received IDT, the belief mass for the set 𝑚𝑚(𝑇𝑇) and 𝑚𝑚(𝑇𝑇 � ) is updated accordingly such that 𝑚𝑚(𝑇𝑇) + 𝑚𝑚(𝑇𝑇 � ) + 𝑚𝑚(𝑇𝑇, 𝑇𝑇 � ) = 1 as stated in [START_REF] Shafer | A Mathematical Theory of Evidence[END_REF]. Once the belief masses have all been updated for the direct and indirect trust, the Dempster's rule of combination is applied to fuse the two trust evidences together and the result is sent to the decision module for actions. We provide a numerical example to illustrate the trust aggregation process.

Example: Let us suppose that the first evidence 𝐸𝐸 1 which represents node 𝐴𝐴's direct trust value of node 𝐶𝐶, is 0.9. Because it is more than the detection threshold 𝛾𝛾 of 0.5, a bpa value of 0.9 is assigned to the set 𝑚𝑚(𝑇𝑇) and the remaining 0.1 is assigned to the uncertainty set 𝑚𝑚(𝑇𝑇, 𝑇𝑇 � ). Suppose now the IDT about node 𝐶𝐶 from one of the recommenders, say node 𝐵𝐵 is 0.1. The dissimilarity ratio between 𝐴𝐴's trust and 𝐵𝐵's trust will be 0.8 according to [START_REF] Ruidong | A Hybrid Trust Management Framework for Wireless Sensor and Actuator Networks in Cyber-Physical Systems[END_REF]. Thus, for the second set of evidence, 𝐸𝐸 2 that represents the indirect trust value of node C based on B's recommendation, 𝑚𝑚(𝑇𝑇 � ) will be assigned with 0.2 since IDT is less than 𝛾𝛾 and the remaining 0.8 will be allocated to set 𝑚𝑚(𝑇𝑇, 𝑇𝑇 � ).

With this information, we tabulate Table I and use the Dempster's rule of combination in ( 14) and [START_REF] Wang | Trust-based Service Management of Mobile Devices in Ad Hoc Networks[END_REF] to evaluate the final trust. Using the Dempster's rule of combination, the combined belief

𝑚𝑚 1,2 (𝑇𝑇) that node C is trusted from node A's perspective is 𝑚𝑚 1,2 (𝑇𝑇) = 1 1 -𝐾𝐾 [𝑚𝑚 1 (𝑇𝑇) • 𝑚𝑚 2 (𝑇𝑇, 𝑇𝑇 � )] = 1 1 -0.18 [0.72] = 0.87805

E. Decision Module

If the network is sparse and there are no recommenders to provide indirect trust, the decision module will base its decision only on the direct trust from the monitoring module. Otherwise, the combined trust value as calculated per the fusion module is used. Below summarizes the actions undertaken by the evaluating node when the trust value falls below the detection threshold 𝛾𝛾.

• Isolate selfish nodes -the evaluating node will blacklist the misbehaved node. At the same time, it conducts a blacklist broadcast throughout the network to inform other nodes who will further block it from all subsequent communications. We wish to highlight that excluding the blacklist nodes permanently from routing is better than assigning low ratings to them and allowing them to regain their trust slowly. It is because the latter may induce the misbehaved nodes to misbehave on and off intermittently to avoid detection which is more challenging to solve. In our model, the blacklist nodes who wish to re-join the network can contact an authorized WMN operator to be reinstated. The WMN operator will track the number of times a particular node has been blacklisted. If a particular node has been blacklisted repeatedly beyond a certain number of counts pre-defined by the WMN operator, it can never re-join the network. By relying on a trusted authority, the WMN operator has a better visibility of the health of the nodes in the network.

• Initiate new route discovery -decision about the trust level of a node is also sent to the underlying routing protocol. It will trigger the routing protocol to send a route error (RERR) message to notify the source node to initiate a new route discovery to find a path free of selfish nodes.

VI. SECURITY ANALYSIS

We conduct an experiment to analyze numerically the changes in the trust value as a function of increasing badmouthing and ballot-stuffing attackers and compare our results to the benchmarking schemes discussed in the related works. The benchmarking schemes used are the linear opinion pooling technique, entropy-based probability model, subjective logic and the regression analysis technique based on the work of [START_REF] Chen | Trust management in mobile ad hoc networks for bias minimization and application performance maximization[END_REF], [START_REF] Sun | Information theoretic framework of trust modeling and evaluation for ad hoc networks[END_REF], [START_REF] Dietzel | A flexible, subjective logic-based framework for misbehavior detection in V2V networks[END_REF] and [START_REF] Wang | LogitTrust: A logit regressionbased trust model for mobile ad hoc networks[END_REF] respectively. The aim of this comparative study is to validate the effectiveness of the existing trust aggregation schemes in comparison to using DST for mitigation of badmouthing and ballot-stuffing attacks. In our comparison with the benchmarking schemes, the main is the idea behind each of the various aggregation techniques put forth in the related papers. As such, in the implementation of the linear opinion pooling technique presented in [START_REF] Chen | Trust management in mobile ad hoc networks for bias minimization and application performance maximization[END_REF], we are not concerned about the optimal weight selection and therefore, have configured the weights for both the direct and indirect trust components of the linear combination function to 0.5. Also in [START_REF] Wang | LogitTrust: A logit regressionbased trust model for mobile ad hoc networks[END_REF], the key point is to assess the effectiveness of using the subjective logic operators to combine trust, instead of validating the fusion of node-centric and data-centric opinions from different detection mechanism as presented in the paper. Nevertheless, we try to model as closely as possible in accordance with each paper to ensure a fair comparison.

A. Experiment Setup

We consider the scenario as shown in Figure 2 until it reaches 20. The same rule applies to the second experiment except that each recommender is now configured to feedback a rating of 0.9 to simulate ballot-stuffing attacks. In this comparison, the trust value is defined as a continuous value in the range (0,1). Therefore, the trust value of the entropy-based probability model is remapped into the range (0,1) using equation ( 17) for fair comparisons. values as seen by the low dip just below the trust threshold boundary of 0.5. The aggregated trust value is 0.495 indicating that the node is untrustworthy. This is due to the choice of the weighting factors in the linear function which we configure as 0.5 in this comparative study. We note that the performance of the linear opinion pooling technique could be improved by using a heavier weight on the direct trust component of the linear function. However, relying too much on the direct trusts would downplay the influence of the indirect trusts towards the final trust aggregation. To resolve this problem, R. Chen et al. [START_REF] Chen | Trust management in mobile ad hoc networks for bias minimization and application performance maximization[END_REF] has proposed to set the weights dynamically in response to past node changes and environmental changes. However, this approach is not indicative enough to model the actual behavior of a node and can only be regarded as an estimate. The other reason for the small trust variation as seen from the flat curve is that all the indirect trust values are first combined into a single aggregate indirect trust value using the weighted average approach before it is merged with the direct trust value. Therefore, the impact of the aggregated indirect trust is very small in comparison to direct trust observations. Figure 4 shows the trust relationship when there are ballot-stuffing attackers in the network. Similar results are observed where the DS-Trust model is able to tolerate up to ten ballot-stuffing attackers before it succumbs to the false recommendations while the rest of the scheme are vulnerable to a small number of ballot-stuffing attackers. In figure 4, the aggregated trust value based on the linear opinion technique is 0.5 that implies that node 𝐵𝐵 is trustworthy. This value is calculated based on the assumptions that the trustworthiness of each recommender from node 𝐴𝐴's perspective is 1. We reiterate that the linear opinion approach is not effective even through the weights of the linear combination function can be dynamically adjusted according to the operation profile of a node [START_REF] Chen | Trust management in mobile ad hoc networks for bias minimization and application performance maximization[END_REF]. This is because a node with healthy energy level and higher cooperative index does not necessarily mean that it is cooperative in nature and would adhere to the rules of the protocol.

B. Results and Discussions

VII. PERFORMANCE ANALYSIS

In this section, we incorporate the DS-Trust model into the AODV protocol [START_REF] Perkins | RFC 3561 Ad hoc On-Demand Distance Vector (AODV) Routing[END_REF] and evaluate the performance in terms of the Packet Delivery Ratio (PDR), Normalized Routing Overhead (NRO) and the network throughput. The performance is evaluated under the blackhole and grayhole attacks for two different types of WMN architecture: an Infrastructure based WMN and Hybrid based WMN.

The simulations are performed using the Network Simulator NS3 (v3.20) [START_REF]NS-3 network simulator homepage[END_REF] and the results are compared to the baseline AODV and a variant of the DS-Trust that does not consider II.

• Packet Delivery Ratio (PDR) refers to the ratio of the number of delivered packets to the number of packets generated by the CBR sources.

• Normalized Routing Overhead (NRO) refers to the number of routing control packets, such as the RREQ, RREP, RERR and the trust related control packets transmitted per data packet delivered at the destination.

• Throughput refers to the amount of data successfully delivered to the intended destinations over a wireless channel. It is measured in bits per second (bps).

• False positive rate is the ratio of the number of nodes that the DS-Trust model misreports as misbehaving to the total number of nodes in the network. Next, we study the PDR performance of the Infrastructure based WMN and the Hybrid based WMN under the influence of grayhole attackers. We assume that 10% of the network nodes are grayhole attackers and they perform dropping rates between 0% and 100%. Simulation results in the rate of 65536bps, there is no performance improvement between the two models. This could be due to the blacklist of false positives located near the source node that results in no available future work, we plan to estimate wireless losses due to bad wireless channel quality or medium access collisions to set the trust detection threshold adaptively. This would allow us to detect grayhole attackers with much higher accuracy and further improve the packet delivery ratio and throughput.

  nodes present, WMNs can be further classified into an Infrastructure based WMN, Client based WMNs and Hybrid based WMNs where the Hybrid based WMNs is basically a combination of the Infrastructure based WMN and Client based WMNs architecture consisting of static mesh routers and mobile clients respectively.

  and analyze the performance of an Infrastructure based WMN and Hybrid based WMNs to show that it can mitigate packet dropping attacks. The rest of the paper is organized as follows. Section II reviews the related works on trust aggregation techniques. Section III presents the network model and reviews some of the attacks addressed by DS-Trust. Section IV presents the concept of DST that serves as a basis of our proposed trust model. Section V provides the details of the DS-Trust model. Section VI presents the performance improvements of DS-Trust against badmouthing and ballot-stuffing attacks. Section VII presents the simulation results to demonstrate the performance of DS-Trust in an Infrastructure based WMN and Hybrid based WMN. Section VIII concludes the paper. II. RELATED WORKS Recommendation trusts are important in trust modeling because it improves the trust evaluations and shortens the detection time of selfish nodes in the network. When recommendation trusts are available, there needs to be a method to combine them with the direct trust values. This process is commonly known as the trust aggregation. In this section, we provide a review of the most common trust aggregation techniques and classify them into four types: linear opinion pooling, entropy-based probability model, subjective logic (SL) operators and regression analysis.

Fig. 1 .

 1 Fig. 1. DS-Trust Model.

  = 0.18 {𝑇𝑇} = 0.72 {𝑇𝑇 � } = 0 {𝑇𝑇 � } = 0 {𝜙𝜙} = 0 {𝑇𝑇 � } = 0 {𝑇𝑇 � } = 0 {𝑇𝑇, 𝑇𝑇 � } = 0.1 {𝑇𝑇, 𝑇𝑇 � } = 0 {𝑇𝑇} = 0 {𝑇𝑇 � } = 0.02 {𝑇𝑇, 𝑇𝑇 � } = 0.08Table I: Aggregation of 𝐸𝐸 1 and 𝐸𝐸 2

  to illustrate the aggregation of direct trust and indirect trust. We are interested in the number of badmouthing and ballot-stuffing attackers that can swing the trust values into the untrusted region. For this, we assume that the trust detection threshold is set to 0.5. According to Figure2, node 𝐴𝐴 has local observations about node 𝐵𝐵 that is known as the direct trust. Besides that, there are up to 20 recommenders (node 𝐶𝐶 𝑡𝑡𝑓𝑓 𝑉𝑉) from which node 𝐴𝐴 can gather recommendation trusts about node 𝐵𝐵. The direct trusts are denoted by solid lines, whereas the recommendation trusts from recommenders 𝐶𝐶, 𝐷𝐷 etc. are denoted by dotted lines. When node 𝐴𝐴 receives the recommendation trusts, it calculates the indirect trusts by weighing the recommendation trust values based on the trust level of the recommenders 𝐶𝐶, 𝐷𝐷, … , 𝑉𝑉 etc. We assume that node 𝐴𝐴 has the same direct trust value on each of the recommenders so that any observed changes in the trust aggregation results are due to the recommendation trust values. In the first experiment, we start by configuring one recommender to send a low rating of 0.1 to node 𝐴𝐴 to simulate badmouthing attacks and increase the number of badmouthing recommenders each round

Figure 3

 3 Figure 3 describes the changes in the aggregate trust value by varying the number of

Fig. 2 .

 2 Fig. 2.Trust aggregation.

Fig. 3 .

 3 Fig. 3. Trust value as a function of badmouthing recommenders.

Fig. 4 .

 4 Fig. 4. Trust value as a function of ballot-stuffing recommenders.

Fig. 5 .Fig. 6 .Figure 7 Figure 7 ,

 5677 Fig. 5. Simulation topology for Infrastructure based WMN.

Figure 9

 9 Figure 9 show that the PDR performance of the DS-Trust model is almost similar to the baseline

Fig. 7 .

 7 Fig. 7. PDR performance in an Infrastructure based WMN

Fig. 9 .

 9 Fig. 9. PDR performance in an Infrastructure based WMN in the presence of 10% grayhole

Fig. 12 .

 12 Fig. 12. Normalised routing overhead performance in a Hybrid based WMN

Fig. 15 .Fig. 16 .

 1516 Fig. 15. PDR performance in a Hybrid based WMN under varying speed

Fig. 17 .Fig. 18 .

 1718 Fig. 17. Throughput Performance in an Infrastructure based WMN

  Chen et al have proposed two mechanisms to consider the trust recommendations, namely the threshold based filtering and the relevance based trust mechanisms. In threshold based filtering, only

	nodes with recommender trustworthiness higher than a pre-defined threshold are considered and in
	relevance based trust scheme, only recommenders with high trust in a particular context are taken
	into considerations. Based on these criteria, selected recommendation trusts are aggregated using the
	weighted average method before they are combined with the direct trust through another weighting
	function to form an aggregate trust.
	B. Entropy based Probability Model
	In [10-12, 14], Y. Sun et al. have proposed two models based on the probability theory to govern
	trust propagation through a third party. The first model is called the trust concatenation model.
	Suppose node 𝑖𝑖 wants to establish the trust level of node 𝑗𝑗 through a recommender 𝑘𝑘 , the trust
	concatenation model defines the formula in (2) to merge the trust probabilities.
	𝑃𝑃 𝑖𝑖,𝑗𝑗 = 𝑃𝑃 𝑖𝑖,𝑘𝑘 𝑃𝑃 𝑘𝑘,𝑗𝑗 + (1 -𝑃𝑃 𝑖𝑖,𝑘𝑘 )(1 -𝑃𝑃 𝑘𝑘,𝑗𝑗 )

  , Josang have proposed an algebra that is able to quantify uncertainty in trust relationships between entities. Such uncertainties occur due to the imperfect knowledge about the reality or due to the lack of evidence. Consequently, this leads to the notions of belief, disbelief, and uncertainty which forms the basis of subjective logic. In this model, trust is treated as a subjective opinion consisting of four parameters (𝑏𝑏 𝑖𝑖,𝑗𝑗 , 𝑑𝑑 𝑖𝑖,𝑗𝑗 , 𝑢𝑢 𝑖𝑖,𝑗𝑗 , 𝑎𝑎 𝑖𝑖,𝑗𝑗 ) where 𝑏𝑏 𝑖𝑖,𝑗𝑗 and 𝑑𝑑 𝑖𝑖,𝑗𝑗 represents node 𝑖𝑖 's belief and disbelief in node 𝑗𝑗, 𝑢𝑢 𝑖𝑖,𝑗𝑗 represents the amount of uncertainties regarding the observations and 𝑎𝑎 𝑖𝑖,𝑗𝑗 is

	the a prior probability in the absence of evidence. These parameters have the following relationships
	and satisfy the following conditions in (5).
	𝑏𝑏 𝑖𝑖,𝑗𝑗 + 𝑑𝑑 𝑖𝑖,𝑗𝑗 + 𝑢𝑢 𝑖𝑖,𝑗𝑗 = 1.0,	𝑏𝑏 𝑖𝑖,𝑗𝑗 , 𝑑𝑑 𝑖𝑖,𝑗𝑗 , 𝑢𝑢 𝑖𝑖,𝑗𝑗 , 𝑎𝑎 𝑖𝑖,𝑗𝑗 ∈ [0.0,1.0]

C. NRO Performance

The NRO metric is a measure of the effective use of the wireless channel. First, we examine the NRO performance under the blackhole attacks. Next, we analyze the performance in the presence of grayhole attacks.

E. Throughput Performance

We are interested in the throughput performance of the DS-Trust model when the application rate is increased in an Infrastructure based WMN and a Hybrid based WMN. We assume there are 8 blackhole nodes and the application rate is varied from 16384bps to 200000bps. Figure 17 compares


Patrice Renaud

Christophe Taffoureau

Philippe Picard

Jean Borsenberger

Steve Torchinsky

Henrik Olofsson

Franc ¸ois Viallefond

Monitoring and Control of EMBRACE, a 4608 Elements Phased Array for Radio Astronomy

EMBRACE is a technology demonstrator for the decimetre wavelength range of the Square Kilometre Array. As a demonstrator instrument, the primary goal is to test and verify its merits as an SKA candidate design. For this purpose, we have developped the control software for EMBRACE including the real-time control software, the data acquisition and the observation setup systems. We have reused and adapted the LOFAR C++ control software and implemented a similar architecture on the LCU (Local Control Unit) computer. Station Control Unit (SCU) software provides a Python interface to LCU for users to easily setup observation scripts for various types of observation and to capture integrated data. Tests with satellites and strong radio sources are in progress to validate the system and characterize the demonstrator.

Introduction

EMBRACE is a SKA Pathfinder for the mid frequencies. Two EMBRACE stations were built,one at Westerbork in the Netherlands (G.W. Kant 2011) and the other at Nanc ¸ay, largely financed by the European Commision Framework Program 6 project SKADS. EMBRACE is the first large-scale demonstrator of the dense aperture array technology for radio astronomy. EMBRACE@Nanc ¸ay is a phased-array of 4608 densely packed antenna elements (64 tiles of 72 elements each). For mechanical, and electromagnetic performance reasons, EMBRACE@Nanc ¸ay has, in fact, 9216 antenna elements, but only one polarization (4608 elements) have fully populated signal chains.

EMBRACE is capable of real-time analog beamforming in two independant direcusing a LOFAR backend. The observable frequency range was reduced by a high pass filter which was installed to eliminate high power transmissions from nearby digital television stations. EMBRACE digital and RF processing is built from a LOFAR backend, which provides both integrated data (statistics) and raw data (beamlets). The LOFAR LCU (Local Control Unit) real-time control software was adapted to the specific needs of EMBRACE. An interface layer, implemented on a Station Control Unit (SCU) computer, provides interaction with the LCU and to setup and run observations. Tests are in progress to study functionalities of the demonstrator. RF and Digital EMBRACE Processing EMBRACE@Nanc ¸ay uses a hierarchy of four levels of analog beamforming leading to 16 inputs to the LOFAR backend system for digital beamforming.

EMBRACE Processing

The first beamforming is of 4 Vivaldi elements done on the integrated circuit "beamformer chip" developed at Nanc ¸ay (S. Bosse 2010). The output of 3 beamformer chips is summed together on a "hexboard" and 6 hexboards make a tile. At Nanc ¸ay, we have one further analog summing stage with 4 tiles making a tileset. The output of the tilesets is fed into a LOFAR-type RCU and RSP system for digital beamforming. The LCU (Local Control Unit) computer calculates coefficients for RF and Digital beamforming.

1 second integrated data (statistics data) are calculated by backend firmware for calibration. There are 3 kind of statistics: subbands statistics (power distribution for the total observation bandwidth -100 MHz-), beamlet statistics (power for each subband selected and for 2 directions), and crosslet statistics (cross-correlation data between all receiver inputs). Raw data (beamlets) are output to 3 × 1 Gbps ethernet ports.

Observation setup and integrated data acquisition is provided by Station Control Unit (SCU) software.

Local Control Unit (LCU) software architecture

The EMBRACE Monitoring and Control (MAC) system is based on the LOFAR Local Control Unit (LCU), with significant modifications and extensions added in order to operate on the EMBRACE array. EMBRACE has a 4-level hierarchy of analog beamforming making it more complex than a LOFAR station. In particular, the MAC must configure the phase-shift parameters applied by beamformer chips for each of the 4096 antenna elements. The number of parameters is double the number of antenna elements in order to configure the two independent RF beams. The LCU can also configure a time delay parameter available on each tile (group of 72 antenna elements).

Other capturer processes provide real-time acquisition of configuration parameters during the observation. These include amongst others: directions, calibration parameters, digital beam weight coefficients, etc. These data are used for instrument characterization and tests.

Future plans include the implementation of SDM (Scientific Data Model) to continue EMBRACE characterization 4) and Cygnus-A observed in the HI line (1420 MHz, right in Fig. 4). The drift scans are used to measure the main lobe profile of EMBRACE. The main lobe is Gaussian to a high degree, and the beam width matches the expected value.

Observation results

  Figure 1. RF and Digital EMBRACE Processing

Figure 4 .

 4 Figure 4. Cassipeia-A and Cygnus-A observation

  Multiple digital beams can be formed inside each RF beam. Key parameters for the Station control software are:

	2
	Nanc ¸ay Physical collecting area:	70 m 2
	Number of polarizations:	single
	Number of independant fields of view (RFbeams): 2
	Max number of digital beams:	248
	Tuning frequency range:	500 -1500 MHz
	Observable frequency range:	900 -1500 MHz
	Instantaneous bandwidth:	48 MHz
	1

The EMBRACE LCU permits the creation of multiple digital beams pointing towards astronomical sources on the sky. Beams are formed by complex weighted addition of the sub-band separated signals of up-to n × 72 antenna elements, where n is the number of tiles. The LCU can also configure the station into multiple sub-arrays. For example, it is possible to create an array of half of the antennas and another array consisting of the remainder. There are two independent control systems, one for each RF beam. Each control system is composed of independent processes, except for the the antenna tile driver which is common to both RF beam chains, as there is only one hardware address per tile.

The LCU is accessible by a server inside the application layer. Station Control Unit (SCU) is the interface between the EMBRACE user and the control software (LCU). An extensive Python package library was developed for EMBRACE and is installed on the SCU (Station Control Unit) computer. This software gives scripting functionnality for users to easily setup observation scripts for various targets and types of observation. With access to the powerful functionality of the Python scripting language, the EM-BRACE user can build complex observation setups by using the numerous standard packages provided by Python.

Station Control Unit (SCU) Software

Integrated statistics data calculated continuously by the firmware backend at 1 second intervals are acquired by the SCU from the LCU and saved into FITS files. Raw data (beamlets) are captured from LCU Ethernet 1 Gbps outputs by a dedicated acquisition program (for performance reasons) and saved into binary files.