Collective Classification for Spam Filtering - Computational Intelligence in Security for Information Systems - page 10

Alternatives to reputation systems can be incentive systems [4], where it is advan-
tageous for the nodes to act in a way that the resulting global welfare is optimal. In
these systems the nodes receive some sort of payment if they behave properly. Ra-
tional peers have no reason (in other words, incentive) to deviate from the equilibrium
behavior. Different variations of reputation systems have been developed for various
purposes. The distinguishing characteristics of all of them are the following: represen-
tation of information and classification, use of second-hand information, definition of
trust and redemption and secondary response.
Among the principal threats on reputation systems we can include colluding at-
tacks. Here we distinguish two opposite scenarios: ballot stuffing, where a number of
entities agree to give positive feedback on an entity (often with adversarial inten-
tions), resulting in it quickly gaining high reputation, and the opposite case, known as
bad mouthing, where the attackers collude to give negative feedback on the victim,
resulting in its lowered or destroyed reputation. In this work we concentrate on detect-
ing bad mouthing attack, although the similar principle could be applied to detect
ballot stuffing as well.
Available solutions for coping with bad mouthing attack mostly rely on prevention
techniques, such as cryptography. However, these methods only increase the effort
the attacker has to make in order to make his attack successful. For this reason, we
present a machine learning based solution for detecting the sources of the attack. In
this work we are mainly concerned about the reputation systems used in distributed
systems such as wireless sensor or mesh networks, where these are mainly used for
isolating anomalous behavior. However, the approach can easily be adapted for the
situations where the entities in the network are humans. The main idea consists in
detecting great inconsistencies in appraising an entity by other entities that have been
in contact with it. The inconsistencies are treated as data outliers and are being de-
tected using self-organizing maps.
The rest of the work is organized as follows. Previous work is surveyed in Section
2. Section 3 details the principles of the proposed solution, while Section 4 provides
its evaluation. Finally, conclusions are drawn in Section 5.
2 Previous Work
As already mentioned, the majority of the existing solutions for coping with bad
mouthing attack rely on prevention techniques. A typical solution is the one given in
[5] that relies on cryptography. However, with the existence of side channel attacks
[6], the attacker can easily guess the secret keys and compromise the cryptography-
based protocols. Another solution proposes to use “controlled anonymity” [7], where
the identities of the communicating entities are not known to each other. In this way,
each entity has to provide ratings based on the quality of service provided, and as they
can no longer identify their “victims”, bad-mouthing and negative discrimination can
be avoided. However, this is not always possible, for example in the case of online
hotel ratings. All these solutions in essence increase the effort the attacker needs to
introduce in order to compromise the system, but it will not protect the system from
all the attacks. Thus, a second line of defense that would detect the attacks and stop
their further spreading is necessary.