Collective Classification for Spam Filtering - Computational Intelligence in Security for Information Systems - page 9

Detecting Bad-Mouthing Attacks on Reputation Systems
Using Self-Organizing Maps
Z. Banković, J.C. Vallejo, D. Fraga, and J.M. Moya
Dep. Ingeniería Electrónica, Universidad Politécnica de Madrid, Av. Complutense 30,
28040 Madrid, Spain
{zorana,jcvallejo,dfraga,josem}@die.upm.es
Abstract. It has been demonstrated that rating trust and reputation of individual
nodes is an effective approach in distributed environments in order to improve
security, support decision-making and promote node collaboration. Neverthe-
less, these systems are vulnerable to deliberate false or unfair testimonies. In
one scenario the attackers collude to give negative feedback on the victim in or-
der to lower or destroy its reputation. This attack is known as bad mouthing at-
tack, and it can significantly deteriorate the performances of the network. The
existing solutions for coping with bad mouthing are mainly concentrated on
prevention techniques. In this work we propose a solution that detects and iso-
lates the abovementioned attackers, impeding them in this way to further spread
their malicious activity. The approach is based on detecting outliers using clus-
tering, in this case self-organizing maps. An important advantage of this ap-
proach is that we have no restrictions on training data, and thus there is no need
for any data pre-processing. Testing results demonstrates the capability of the
approach in detecting bad mouthing attack in various scenarios.
Keywords: reputation systems, bad mouthing detection, self-organizing maps.
1 Introduction
Trust and reputation have recently been suggested as an effective security mechanism
for open and distributed environments (Ad Hoc networks [2], WSNs [1, 2], P2P net-
works [3], etc.). In essence, the nodes that do not behave properly (according to the
established policy of “proper” behavior) will have low reputation, so the rest of the
nodes will avoid any collaboration with them, which is equivalent to its isolation from
the network. Extensive research has been done on modeling and managing trust and
reputation, and it has been demonstrated that rating trust and reputation of individual
nodes is an effective approach in distributed environments in order to improve secu-
rity, support decision-making and promote node collaboration.
There are many different definitions of trust and reputation, but in essence trust is a
belief about future behavior that one node holds in others and it is based on its own
experience, thus its main characteristic is subjectivity. On the other hand, reputation is
considered to be the global perception of the behavior of a node based on the trust that
others hold in it, thus considered to be objective [2]. The common way of defining a
trust value is by using policies or credentials, so a node that behaves according to the
established policy system will have high reputation and vice versa.