Trusted P2P Transactions with Fuzzy Reputation Aggregation

Transcription

1 Trusted P2P Transactions with Fuzzy Reputation Aggregation Shanshan Song, Kai Hwang, Runfang Zhou, and Yu-Kwong Kwok University of Southern California Internet commerce is facing a problem of distrust among participating sellers and buyers. This article presents a new fuzzy-logic approach to aggregating peer reputation using public-domain trace data. Based on the analysis and simulation experiments over the ebay trace, the authors demonstrate the efficacy and robustness of the etrust and EigenTrust reputation systems to facilitate trusted P2P transactions. The Internet has enabled e-commerce or e-auction based commodity exchanges among strangers throughout the world. Internet commerce is wide open in that each participant can sign on and off asynchronously at will [7]. The e-transaction is mostly conducted at a peer-to-peer (P2P) level. The P2P environment does not involve a central entity to mediate the exchanges. The P2P transactions can be carried out point-to-point or point-to-multipoint, anonymously. Thus, it is crucial to have an effective trust management system based on peer reputations. This system must be built with public-domain e-commerce data such as the ebay trace file, which allows participants to locate trustworthy partners to exchange commodity over the Internet. Manuscript submitted to the IEEE Internet Computing Magazine Special Issue on Security for P2P and Ad Hoc Networks on April 1, All rights reserved by the authors. Corresponding author: Kai Hwang, USC Internet and Grid Computing Lab, 3740 McClintock Avenue, EEB-212, Los Angeles, CA kaihwang@usc.edu, Tel.: (213)

2 P2P Reputation System for e-transactions Figure 1 shows the desired components of a reputation system in an Internet commerce environment. Each of the four applications at the top relies on a reputation evaluation and dissemination system to bind the sellers and buyers together. P2P Transaction Applications: In consumer product exchanges, a buyer would like to know the reputation of a seller before committing the payment of the desired goods. In a file sharing application, the downloading peer would like to get files from a trusted peer, lest the files got may be infected by virus or embedded with Trojan horse. Consumer product exchanges and P2P file sharing are usually conducted at the desktop level. Figure 1. A peer reputation evaluation system built with a P2P overlay network for trusted commodity exchanges over the Internet. We also see increasing P2P exchange activities at the server level, where the security update information is exchanged. Obviously, a server would always want to receive and process updates from trusted servers. In the form of Grid Computing, server machines now share their - 2 -

3 processing cycles to aggregate computing power to tackle large-scale applications. For security reasons, a server would never like to execute remote jobs from servers that cannot be fully trusted [3], [12]. However, good reputation is hard to be quantified with so many dynamic factors involved [1], [2], [4], [6], [8], [9]. Reputation Evaluation and Dissemination: In a fully distributed network, a peer often cannot afford to compute the reputation of another peer by itself. Instead, it has to rely on the remote opinions from the peers. The peer has to decide on the trustworthiness of each opinion received before aggregating them to form its own opinion on a potential partner. Thus, an effective system has to assess reputation locally and to aggregate the meta-reputation globally. The reputation system must accurately capture and track various local parameters. For instance, a buyer should be able to capture potential seller s credit record, preferences, etc. with respect to the goods being sold. The reputation system has to accurately filter out untrustworthy second opinions from some malicious remote peers, which try to black-mouth on the reputation of a well-behaved peer. The ebay Reputation System The ebay is by far the most successful cyber-exchange platform, which is based on a simple reputation evaluation mechanism. The ebay reputation system works by having the exchange partners provide feedback to the centralized reputation data store about their experiences in the transactions. Analysis of ebay Trace Data: Using extensive data extracted from the ebay website by crawling more than 10,000 users web pages, we have performed detailed analysis as to the efficiency of the ebay reputation system. In order to gain some insights about P2P transaction distribution, we collect transaction records from the ebay commodity auctions. We observe three important characteristics on electronic transactions

4 (a) User rank ordered by transactions (b) Super users vs. small users Percentage of Transactions (%) super user small user Time Interval Between 2 Consecutive Trans (min) Percentage of Total Value (%) Percentage of Ordered Transactions (%) (c) Time intervals between transactions (d) Transaction amount distribution Figure 2. ebay transaction trace by ranks, hot spots, request interval, and amounts. Super vs. Small Users: As illustrated in Fig. 2(a), we sort the users in decreasing order of the number of transactions conducted. The ebay user transactions follow a power-law distribution according to user ranks. We realize a hot-spot situation, where a small number of super users, represented by big circles in Fig.2(b), conducted large amounts of transactions; while a large number of small users (small circles) involved only small amounts of transactions. Unstable transactions for small users: The time interval between two consecutive transactions is stable for large users, and unstable for small users as shown in Fig.2(c). The super user conducted 10,000 transactions in 3 months. The small user conducted only 285 transactions in - 4 -

5 2.5 years. The super user conducted 64.6% transactions within 10 minutes from last transactions. The small users conducted 50% of transactions 40 hours later. Dispersed transaction amount: The transaction amount is highly dispersed in that a small number of users conducted large transactions. The largest transaction is $1500, while the smallest is $3 only. In Fig.2(d), the user transactions are sorted based on the commodity value exchanged. For example, the 30% large transactions amount 70% of the commodity value, while 70% small transactions involves only 30% of the total value. The etrust Reputation System We propose a reputation-based trust system for P2P transactions, called etrust. This system is based on fuzzy logic inferences. Basic concepts of fuzzy theory and application are introduced in the sidebar. To learn from ebay transaction characteristics, we suggest the following design criteria. System Design Requirements: First, the network bandwidth consumption to exchange local trust scores for those hotspots could be extremely high. Thus, a reputation system for e-transactions should consider the unbalanced transactions among users. Second, to address the issue of small users, a reputation system should not use the same evaluation cycle for all users. Third, because of the dispersed transaction amount, it makes sense to evaluate the large transactions more often than those small value transactions. Our system works by carrying out the following two major inference steps: local score calculation and global reputation aggregation as illustrated in Fig. 3. Local Score Computation: In etrust, peers perform fuzzy inference of local parameters to generate the local scores for other peers to use. Figure 3(a) illustrates the local score calculation in ebay transactions. In the Sidebar, we show a detailed fuzzy inference procedure using two simple inference rules. The fuzzy inference mechanism can capture uncertainties involved [10], and it is self-adjusting in the sense that it can adaptively track the local parameters and align the reliability of remote peers

6 Global Reputation Aggregation: The etrust system aggregates local trust scores t ij from all remote peers, the aggregation weight w ij is decided by four fuzzy variables: the remote peer score, transaction date, transaction amount, and remote peer life cycle. We use fuzzy-logic inference to perform the reputation aggregation. The weight calculation is illustrated in Fig.3(b). Given below are several fuzzy inference rules used in our etrust system construction. Rule 1: If transaction amount is high, then aggregation weight is high. Rule 2: If transaction amount is low, then aggregation weight is low. Rule 3: If remote peer trust value is high, then aggregation weight is high. Rule 4: If remote peer trust value is medium, then aggregation weight is medium. Rule 5: If remote peer lifecycle is long, then aggregation weight is high. The global reputation score is calculated by using the following formula in Eq.(1), where T i is the global trust value of peer i, t ji is the local trust scores of peer j rated by peer i, w j is the aggregation weight of the local trust score of peer j, and R is the set of peers, with whom peer i has conducted transactions. T wt w (1) j ji j j R i = t ji j w = R j wj j R j R An Illustrative Example: Figure 3(c) shows an example of global reputation aggregation. The aggregation process adopts a recursive approach. The upper layer calculates the lower layer s aggregation weights at the lower layer. The upper layer pulls the local trust scores to calculate global trust value using Eq.(1). This is a dynamic top-down system, the bottom layer trust values are drawn from previous aggregation cycle. To tackle the hotspot issue, the etrust sets various aggregation thresholds based on the number of transactions conducted. High threshold is set for super users and low threshold is set for small users. For example, 0.8 is set for peer 4 and 0.5 is set for peer 15 in Fig.3(c). By setting high threshold to hotspots, only a small number of peers are queried. Thus, the bandwidth consumption is reduced

7 Buyer s local trust score Seller s local trust score Remote Peer s Trust Value Fuzzy inference Fuzzy inference Transaction Date Fuzzy Inference Payment method Payment Time Goods Quality Deliver Time Transaction Amount Aggregation weight Remote Peer s Lifetime (a) Local score inference Aggregation Threshold = (b) Fuzzy inference of global aggregation weight w4 w15 T = t + t 2 w 4,2 15,2 4+ w15 w4+ w = = w 4 = 0.9 t 42 = 0.8 w 15 = 0.7 t 15,2 = 0.9 Aggregation Threshold = Aggregation Threshold = 0.5 w 6 = 0.8 w 9 = 0.9 w 12 = 0.7 w 17 = 0.9 w 20 = (c) A global trust aggregation example Peer id = 17 <Transactions> </Transactions> Peer id = 20 <Transactions>. </Transactions> Peer id = 2 <Transactions> <Transaction PeerID = 4> <Score = 0.9> <Date = 01/04/05> <Amount = $100> </Transaction> <Transaction PeerID = 15> <Score = 0.8> <Date = 01/06/05> <Amount = $1000> </Transaction> </Transactions> Peer id = 15 <Transactions> <Transaction PeerID = 2>. </ Transaction> <Transaction PeerID = 20>. </Transaction> </Transactions> Peer id = 12 <Transactions> </Transactions> Peer ID = 9 Peer ID = 6 Peer id = 4 <Transactions> <Transaction PeerID = 2>. </ Transaction> <Transaction PeerID = 9>. </Transaction> <Transaction PeerID = 12>. </Transaction> </Transactions> (d) Transaction records maintained at 8 peers in Part (c) Figure 3. Trust aggregation using fuzzy inference in the etrust reputation system

8 DHT-based Overlay Implementation: The proposed etrust system can be implemented on a distributed hash table (DHT) based P2P overlay networks, which provides fast trust aggregation and message transmission. The peer ID is used as the key. The transaction value corresponds to XML-formatted records, as shown in Fig.3(d). The transaction record lookup is achieved via logn messages among N peers. The etrust system leverages on the efficiency of the Chord protocol [11] to handle the join and leave of participating peers. Simulated etrust and EigenTrust Performance We evaluate below the etrust and EigenTrust systems for P2P transactions using the same ebay trace data set. We compare the two systems in three aspects: (1) the convergence time to establish the global trust, (2) the detection rate of malicious peers, (3) the message overhead involved in trust aggregation. The simulated performance results are reported in Fig.4. Simulation of the Two Systems: We simulate with different number of peers in the P2P system, ranging from N=100 peers to large P2P network of N=10,000 peers. For each case, the most active peer conducts 10N transactions. The number of transactions conducted by peers follows the power-law distribution with a slope of The transaction date follows a Poisson distribution with an arrival rate λ = 0.2 transaction/minute. The simulation ends up with calculating the local trust scores and the aggregated global reputation. Global Convergence Time: We plot the convergences times of the EigenTrust and etrust systems in Fig.4(a). The two convergence times of the two systems are quite close to each other, with the etrust converges slightly faster than the EigenTrust system. Overall, the two systems have comparable convergence time, which increase linearly with respect to the network size. Detection Rate of Malicious Peers: Let α be the percentage of malicious peers in the P2P system. Malicious peers are those who acted with no or late payment as buyers and no-delivery or delivering bad-quality goods as sellers. The black mouth is a malicious peer who gives fake trust score to its peers. Let m be the number of malicious peers in the system. Thus m = αn, - 8 -

9 where N is the total number of peers in the system. In the simulation experiments, we preset α=0.3. Denote the number of actually detected malicious peers as d(t), which depends the time of measurement our experiments. The detection rate θ of malicious peers is defined below: θ(t) = d(t) /m = d(t)/α N (2) Figure 4(b) plots the measured results on the detection accuracy of the etrust system as a function of time t for various system sizes represented by N for a fixed α = 0.3. Two observations are made: (1) All detection rate starts with zero. As the aggregation process comes to the end, the detection rate rises sharply from zero to a saturated value close to 100% successful detections. (2) The larger is the network, the longer time it takes to see the detection rate rising to the saturated value of 100%. For example, the system with 1,000 peers reaches the saturation at 0.2 minutes (12 seconds), the size 5,000 system reaches saturation at 10 minutes, and the large system of 10,000 peers reaches saturation at 30 minutes. EigenTrust aggregates all local information, thus EigenTrust is envisioned to have the same high detection rate as etrust. Message Overhead: Figure 4(c) shows the number of messages transmitted by individual peers for a system N = 1,000 peers. Messages transmitted in etrust are roughly distributed among the peers evenly. In etrust system, all peers transmit less than 100 messages, and half peers transmit less than 10 messages in the trust evaluation process. However, there are more than 15% EigenTrust users transmitting hundreds to thousands of messages to establish the global trust, which is rather high overhead. The message being conveyed here is that almost all peers in using the etrust system experience low overhead in messaging. In other words, the etrust system can alleviate the hot spot problem, effectively. Figure 4(d) shows the total number of messages required to reach the global trust convergence. The gap between total message overheads is widened as the network size increases. The etrust system is more scalable in handling larger number of P2P services

10 Convergence Time (sec) etrust EigenTrust Number of Peers (N) (a) Comparison of the global convergence time 95 Detection Rate (%) N = 100 N = 1000 N = 5000 N = No. of Messages by Individual Peer E Time (minute) (b) Detection rate of malicious peers using the etrust system EigenTrust etrust Peer ID (c) Messaging overhead of individual peers in a P2P system for N = 1,000 users Total No. of Messages by all peers 6x10 5 5x10 5 4x10 5 3x10 5 2x10 5 1x EigenTrust etrust Number of Peers (N ) (d) Total messaging overhead to calculate the global trust value Figure 4 Simulated performance of the etrust system compared with the EigenTrust system in processing ebay trace data

11 Comparison of Five P2P Reputation Systems: Table 1 compares the reputation generation and dissemination mechanisms in five reputation systems that have been proposed for P2P applications. The ebay, PeerTrust, and etrust systems are all suitable for commodity exchanges in e-commerce applications. The EigenTrust and DCRC systems were designed for general-purpose P2P file sharing applications. Table 1: Comparison of Five P2P Reputation Systems Reputation System Reputation Generation Reputation Dissemination ebay System, PeerTrust system at Georgia Institute of Technology [4] DCRC and CORC (Debit-credit vs. Credit Only Reputation Computation) [3] EigenTrust system at Stanford University [5] etrust system at University of Southern California Buyers and sellers rate each other after each transaction; A simple +1, 0, or -1 score to reflect satisfactory, neutral or discontent performance, respectively Based on a weighted sum of 5 factors: Feedback from peers, feedback scope, credibility of feedback, transaction context, and community context Based on weighted sum of capability (processing power, bandwidth, etc.) and behavior (search or download distributions, etc.) Peer reputation score is the net number of satisfactory transactions normalized by all peers, computed by a weighted sum of all raw reputation scores Local trust score is evaluated for each transaction, which is inferred out by fuzzy inference procedure from local transaction information. Centralized database system to store and manage the scores. Data is open to public so new comers can easily obtain peer scores Fully distributed, overlay for trust propagation, PKI securing remote scores, Preventing malicious behaviors after establishing good reputation Partially distributed, Peers compute local scores, PKI for secure processing of remote reputation data Fully distributed, peers supported by a DHT overlay network. Majority voting is used to check faulty reputation scores reported Fully distributed, supported by DHTbased overlay network. Partial aggregate local information. Alleviate hotspot problem by reducing message overhead The ebay system is the simplest and most popular system in use today. It is a centralized reputation system specially tailored for e-auction based transactions. The remaining systems are all proposed from academic research work. They all emphasize distributed reputation generation and dissemination. It would be useful to see these research systems be prototyped for e- commerce applications. The performance of these prototype systems can be further verified by

12 real-life benchmark experiments over the e-transaction data traces not only from ebay but also from other heavyweight e-commerce sites such as Amazon, Yahoo, Dell, etc. Conclusions A fuzzy-aggregation method is introduced for reputation calculation to establish the mutual trust between strangers in P2P transaction processing. We analyzed the auction-based ebay transaction trace data to sort out the characteristics of client behaviors. Then we propose to build the etrust, a fuzzy reputation system for e-commerce. The system is built with DHT-based P2P overlay networks. Fuzzy logic inference rules are introduced to perform the global trust aggregation and dissemination of updated trust index values among the peers. This etrust system is evaluated with event-driven simulation experiments over the ebay data, which is collected form the public domain during March The simulation results show that the etrust system has comparable global convergence time with that of the EigenTrust system proposed at Stanford University [5]. With a large P2P system of N=10,000 users, the etrust system detected 70% of the malicious peers in 10 minutes and reached the 100% detection rate in 30 minutes. On the average, less than tens of messages are used by each peer to perform a global trust evaluation. This is significantly lower than hundreds of messages needed in using the EigenTrust system. In other words, the etrust system is proven to have significant lower messaging overhead to establish the global trust among the good sellers and buyers. We also compared the etrust and EigenTrust systems with other P2P trust systems. The general conclusion is that distributed trust management is fast in establishing global trust, more effective to update the trust among peers, and more accurate to match with the real-life peer behaviors. Acknowledgements: This work was supported by a NSF ITR Grant at the University of Southern California. The assistance and discussions with the GridSec research

13 team are useful to improve the quality of the work reported here. We want to thank all team members working on the GridSec project. References [1] T. Grandison and M. Sloman, A Survey of Trust in Internet Applications, IEEE Communications Surveys & Tutorial, 2000, available at: [2] R. Guha, R. Kumar, P. Raghavan, and A. Tomkins, Propagation of Trust and Distrust, Proc. ACM WWW 2004, pp , May [3] M. Gupta, P. Judge, and M. Ammar, A Reputation System for Peer-to-Peer Networks, Proc. ACM NOSSDAV 03, pp , June [4] A. Josang, R. Ismail, and C. Boyd, A Survey of Trust and Reputation Systems for Online Service Provision, Decision Support Systems, [5] S. Kamvar, M. Schlosser, and H. Garcia-Molina, The EigenTrust Algorithm for Reputation Management in P2P Networks, Proc. ACM WWW 2003, pp [6] S. Maini, A Survey on Reputation Management Schemes in P2P Networks, available at: Schemes%20in%20P2P%20Networks1.htm, [7] D. W. Manchala, E-Commerce Trust Metrics and Models, IEEE Internet Computing, March 2000, pp [8] S. Marti and H. Garcia-Molina, Limited Reputation Sharing in P2P Systems, Proc. ACM EC 04, pp , May [9] P. Resnick and R. Zeckhauser, Trust Among Strangers in Internet Transactions: Empirical Analysis of ebay s Reputation System, in The Economics of the Internet and E-commerce. [10] S. Song, K. Hwang, and M. Macwan, Fuzzy Trust Integration for Security Enforcement in Grid Computing, Proc. of IFIP International Conf. on Network and Parallel Computing, (NPC-2004). [11] I. Stoica, R. Morris, D. Karger, M. F. Kaashoek, and H. Balakrishnan, Chord: A Scalable Peer-to-Peer Lookup Service for Internet Applications, Proc. ACM SIGCOMM [12] L. Xiong and L. Liu, PeerTrust: Supporting Reputation-Based Trust for Peer-to-Peer Electronic Communities, IEEE Trans. Knowledge and Data Engineering, July

14 Biographical Sketches: Shanshan Song received the B.S. in Computer Science from the University of Science and Technology of China in She is currently a PhD candidate in Computer Science at USC. Her research interests include network security, trust management in Grid and P2P systems. Her shanshan.song@usc.edu. Kai Hwang is a Professor and Director of Internet and Grid Computing Laboratory at USC. An IEEE Fellow, he specializes in computer architecture, parallel processing, Internet security, and distributed computing systems. Presently, he leads the GridSec project supported by a NSF/ITR program at USC. Dr. Hwang can be reached at kaihwang@usc.edu. The GridSec web site is Runfang Zhou received the B.S. and M.S. in computer science from Southeast University in China. She is currently pursuing Ph.D. in Computer Science at USC. Her research activities cover reputation systems, overlay networks and networks security. Her rzhou@usc.edu. Yu-Kwong Kwok is an Associate Professor of Electrical and Electronic Engineering at the University of Hong Kong (HKU). Currently, he serves as a Visiting Associate Professor at USC during his sabbatical leave from HKU. His research interests include Grid and mobile computing, wireless communications and network protocols. He can be reached at ykwok@hku.hk

15 Start of Sidebar Fuzzy Logic Inference and Applications Ever since Lotfi Zadeh proposed the fuzzy logic 40 years ago [1], fuzzy theory has demonstrated its power in managing uncertainties and mimic human-like decision-making process. Archival articles and tutorials on fuzzy logic can be found in [2], [3]. Successful application of fuzzy theory have been reported for adaptive control in robotics, tracking, and consumer electronics; information retrieval in database management, pattern recognition in advanced automation, and fuzzy decision support to handle uncertainties in large-scale information systems [4]. We introduce here yet another fuzzy trust management to the network security area. This is a new approach to supporting approximated reasoning. Fuzzy trust model is useful in manipulating information that is imprecise or uncertain. Indeed, there exist close common features between a reputation system and a fuzzy controller designed for control optimization. Below we use the seller s local score inference example to explain basic fuzzy concepts. In fuzzy theory, the membership function µ(x) for a fuzzy variable x specifies the degree of an element belonging to a fuzzy set. It maps x into the range [0, 1] with 1 for full membership and 0 for no membership. Figure 1(a) shows a high membership function for modeling the local score. Figure 1(b) shows five levels of the membership functions. Figure 1(c) illustrates the inference process. Consider two fuzzy variables: one is the product quality (Q) and another is the delivery time (T) with initial values: Q = 0.84 and T = For illustrative purpose, two simple fuzzy inference rules are applied here. Rule 1: If Q is very good and T is moderate, then Γ is high. Rule 2: If Q is ordinary and T is fast, then Γ is medium

16 µ high (Γ) µ (Γ) (a) High local score (b) 5 levels of local score Rule 1: Q is very good AND T is moderate IMPLY Γ is high Rule 2: Q is ordinary AND T is fast IMPLY Γ is medium AGGREGATE Q = 0.84 T = 0.26 Γ = 0.6 (c) Trust aggregation using two fuzzy inference rules Figure 1. Fuzzy membership functions and fuzzy reputation aggregation procedure All rules are inferred in parallel. Initially, the membership is determined by assessing all terms in the premise. The fuzzy operator AND is applied to determine the support degree of the rules. The AGGREGATE superimposes two result curves. The final local score Γ = 0.6 is thus generated by defuzzifying from the aggregation. In a real-life P2P reputation system, the number of fuzzy logic inference rules could range from tens to hundreds. References: [1] L. Zadeh, Fuzzy sets, Information and Control, Vol. 8, pp , [2] Fuzzy Logic Archive, [3] Fuzzy Sets and Systems, [4] S. D. Kaehler, Fuzzy Logic Tutorial, End of Sidebar