Online recommender systems are a common target of attack. Existing research has focused on automated manipulation of recommender systems through the creation of shill accounts, and either do not consider attacks by coalitions of real users, downplay the impact of such attacks, or state that such attacks are difficult to impossible to detect. In this study, we examine a recommender system that is part of an online social network, show that users successfully induced other users to manipulate their recommendations, that these manipulations were effective, and that most such manipulations are detectable even when performed by ordinary, non-automated users.

Online Social Networks (OSN)[OSN] are experiencing an explosive growth rate and are becoming an increasingly important part of people’s lives. There is an increasing desire to aid online users in identifying potential friends, interesting groups, and compelling products to users. These networks have offered researchers almost total access to large corpora of data. An interesting goal in utilizing this data is to analyze user profiles and identify how similar subsets of users are. The current techniques for comparing users are limited as they require common terms to be shared by users. We present a simple and novel extension to a word-comparison algorithm [6], entitled Inter-Profile Similarity (IPS), which allows comparison of short text phrases even if they share no common terms. The output of Inter-Profile Similarity (IPS) is simply a scalar value in [0,1], with 1 denoting complete similarity and 0 the opposite. Therefore it is easy to understand and can provide a total ordering of users. We, first, evaluated the effectiveness of Inter-Profile Similarity (IPS) with a user-study, and then applied it to datasets from Facebook and Orkut verifying and extending earlier results. We show that Inter-Profile Similarity (IPS) yields both a larger range for the similarity value and obtains a higher value than intersection-based mechanisms. Both Inter-Profile Similarity (IPS) and the output from the analysis of the two Online Social Networks (OSN)[OSN] should help to predict and classify social links, make recommendations, and annotate friends relations for social network analysis.

A primary difficulty in preventing malicious activity in distributed networks is that nodes do not have fixed classi fications. A node’s behavior can fluctuate between generating wa nted and unwanted interactions temporally or vary depending on t he action involved. To help alleviate this reputation systemshave been proposed. However, a formal model which encompasses the prior systems and allows direct comparison has not been forthcoming. We introduce a formal model which encapsulates many prior systems and allows one to determine many importan t properties of the systems. For example, we are able to derive the necessary and sufficient conditions for a reputation systemto bound the successful unwanted interactions a node can gener ate in its lifetime. We then show that by bounding the unwanted interactions yield a system which maintains anO(1) expected unwanted interactions received per node. To our knowledge t hese techniques have not been previously shown. We, also, determ ine the probability of success for a generic routing algorithm.With these tools, we compare the effectiveness of some represent ative deterministic and probabilistic reputation systems. We then show how to modify these prior systems to improve their effectiveness, and, when possible, how they can be changed to bound the successful unwanted interactions. Our evaluations of the p rior trust and routing schemes match our analysis. Our work has many applications, e.g. preventing spams in a social or dist ributed networks, or in designing a system which is secure against De nial of Service (DoS) attacks. I. I NTRODUCTION & RELATED WORK A primary difficulty in preventing malicious activity in distributed networks is that nodes do not have a fixed classifications. A node’s behavior may fluctuate temporally, or may vary depending on the action involved. For example, a node may become infected with a virus and, possibly, even be unaware of the infection. A node which initiates wanted interactions might not be willing to forward message for oth er nodes. Reputation systems have been proposed to provide security and robustness in dynamic distributed networks. There have been a lot of work on reputation systems, some focus on a particular component of reputation systems [1], [ 2], [3], some build more complete reputation systems, c.f. [4], [5], [6]. However, a formal model which encapsulates these systems has been lacking, and so analysis has been limited to the singular system. The lack of a model makes it very difficul t to determine which reputation system component should be used (or even what the components are). There is also a lack of formal methods to determine the bounds of these systems. This makes it difficult to determine the benefits and limitati ons of various systems. In this paper, we introduce a formal model which encapsulates many prior systems. This formal model identifies the core components in reputation systems and details the requirements of each. Using the formal model we are able to directly compare the prior systems, and to derive the bounds of various schemes. Importantly, our formal model separate tr ust structures for different actions, which is essential for de signing robust systems. We derive the requirements for a reputation systems to bound the successful unwanted interactions a node can generate in its lifetime. Counter-intuitively, we show that a s ystem which uses a deterministic dropping mechanism cannot provide a bound, and that systems utilizing a probabilistic dropping mechanism can. We also show how to modify some prior reputation systems to achieve bounding. Importantly , once the unwanted interactions are bounded, the expected number of unwanted interactions received per node is no longer linear with respect to the fraction of malicious node s in the network, instead it isO(1). To our knowledge, these bounding conditions and insights have not been shown before . We are also able to determine a generic probability of success formula forany routing scheme for distributed reputation systems. We show two examples of how to apply our formula to derive the probability of successful routing; we conside r a shortest path algorithm used by [4] and a routing that combin es trust with distance and degree [6]. We apply our formal model to compare some representative prior systems, notably: 1) a Credit Based (CR) system [4] (deterministic), 2) the Counter-Based (CB) system [1], [2] (probabilistic), 3) the Forgetting Factor (FF) system [3] ( probabilistic), and 4) our KarmaNet (KN) system [6] (probabilist ic). Surprisingly, we find that a system introduced in [7], which utilized a remembering factor, collapses to the FF system [3 ]. We derive many important system properties, and determine which can bound the successful unwanted interactions a node can generate in its lifetime. We then modify the prior system s to improve their ability to effectively operate, and for tho se that can, we give them the ability to bound the successful unwanted interactions. We also show how to modify them to remove the incentives for whitewashing. Finally, we perform extensive simulations to compare the benefits and limitations of four representative reputation systems. In all cases, the simulation matches our theory and predicted results. We show that CR cannot bound, but adapts reasonably well to changes in behavior; the CB system is not ble to dynamically adapt to changes in a node’s behavior; the FF system can never completely cutoff malicious nodes; and that KN can adapt to dynamic network well, modified CB and full version of KN can provide bounds on unwanted interactions a node can generate and receive. II. T HE FORMAL MODEL In this section we introduce a formal model for a generic reputation systems which encompasses most prior distribut ed reputation systems. First, we give an overview of the underlying components and then we describe each component in detail. We show the components of a generic reputation system for our formal model in Figure 1. The dataflow is drawn using dashed lines, and the entity relationship is drawn with soli d lines. Let G = (V,E) be the graph used for communication, N = |V| be the size of the graph, and s, . . . , v, u, . . . , w be a communication path with the source ( s) attempting to communicate with the destination ( w). u makes use of a reputation system described in Figure 1 in order to decide if s should be allowed to communicate with w. Figure 1 is portrayed fromu’s perspective. Note that v need not be distinct from s. Furthermore,u does not need to know the identity of the source ( s), only the prior hop. This implies that the model can be used in anonymous networks. We will maintain the notationsu, v, s, andw as in Figure 1 throughout the paper. We use the terminteraction to denote a communication attempt between a source and a destination. An unwanted interaction is a communication that was successfully propagated to the destination, but was undesired by the recipien t. In contrast, awanted interactionis desired by the recipient. We use the termoutcome(o) to denote the quality of the interaction. Theoutcome propagationis a feedback mechanism to the reputation system. If the interaction fails, i.e . was disallowed by some node on the communication path, then the source can generate an outcome to inform the communication path of the failure. Otherwise, the interaction succeeded, an the destination can generate the outcome to inform the rever s communication path. There are two inputs to this system: interaction and outcome. At a minimum the interaction must specify the previous hop (v), the destination ( w), and the action ( a). Action denotes the activity engaged by the previous hop ( v); for example, the previous hop could beinitiating an interaction orforwarding an interaction for another node. TMS Tracking Strategy Recommendation Scheme

When the Internet was conceived, its fundamental operation was envisioned to be point-to-point communication allowing anybody to talk directly to anybody. With its increasing success, the Internet is under increasing attack, e.g. spams, Denial of Service (DoS), Domain Name Server hijacking, etcetera. This paper introduces a clean-slate approach to redesigning the Internet, entitled Davis Social Links (DSL). Instead of directly connecting the source and sink, DSL routes the message (or request to communicate) through social contacts each of which can decide to drop the message/request based upon the previous hop’s prior actions. In this way, trust is an integral part of networking. DSL separates identity from location, and promotes searching to a fundamental operation in the network. DSL also provides end-users control over who can reach them, and who their messages reaches. Finally, DSL provides components in the operating system to aid the user in identifying applications which are misbehaving. These features help make the entire network more resilient to attacks, and provides mechanisms that current and future applications can utilize to stop worrying and love the Net.

Many existing problems in distributed systems can be linked to routing being orthogonal to trust and ignoring the social connectivity. This paper introduces a novel and economical protocol, entitled KarmaNET, which binds any routing protocol with trust to build a trusted social path and create judicious forwarders. This creates incentives for nodes to build good karma, and excises any node that has accumulated too much bad karma. KarmaNET requires only local knowledge, cuts off malicious nodes at the source, adapts to dynamic changes in behavior, bounds the number of unwanted messages a node can generate in its lifetime (even in the presence of collusion, part-time spammers, and errors in marking the outcome), and achieves an expected 0 spams received per node in the limit. KarmaNET ostracizes spammers, freeloaders, and minimizes Sybil attacks with negligible false positive and negative rates (less than 0.5%). We theoretically prove bounds on the damage an attacker can cause, that KarmaNET achieves exponentially fast adaptation to a node's dynamic behavior, and show that our simulation matches the theory.

Every communications medium can be abused for unwanted messages, e.g. email is dominated by spam messages, and Peer-to-Peer (P2P) file sharing systems have high proportions of invalid files. At the same time, the interest in Onlin e Social Networks (OSNs) has grown. OSNs attempt to reduce unwanted messages by restricting communication to approved individuals. OSNs require centralized management, and are too restrictive, disallowing any-to-any communication. This paper introduces a novel, anonymous, economical approach to providing any-to-any communication, utilizing an underlying social network in both distributed and centralized settings that reduces spam. Another issue in di stributed systems is users who do not contribute to the network (freeloaders). Message Reaper provides strong incentives for nodes not to send spam and not to freeload. MessageReaper requires only local knowledge and no automatic content analysis (and thus can be combined with existing spam blocking algorithms). It uses a simple greedy routing algorithm, trust structures, and an outcome propagatio n phase to drastically reduce the amount of spam and penalize freeloading nodes–suppressing these at the source. The outcome of each interaction is identified by the end-users, and only the majority of these need to be correct. MessageReaper achieves fast stabilization, incentives to neither s end spam nor freeload, and achieves low false negatives ( 22%) and neglible false positives ( < 1%) even with a large fraction of the network misbehaving ( 30%). This architecture is applicable to a variety of applications, from email to Insta t Messaging (IM) to P2P file sharing to OSNs.

Recently there has been an influx of work on extending a wireless sensor networks lifetime by distributing source compression and deploying non-homogeneous nodes to handle the aggregation. Both of these mechanisms have been shown to increase the network's lifetime, but they each have requirements that might not be plausible. With distributed source compression, message distributions must be known a-priori, and the existing practical schemes tend to require modification of a layer in the network stack. In non-homogeneous node deployment, placement of more powerful nodes is a major factor in balancing network energy, but many scenarios exist where this is not reasonable. We propose non-uniform entropy compression wherein bottleneck nodes trade computation energy for transmission energy and do more aggressive compression, which induces a synthetic nonhomogeneity across a network built from physically identical nodes and extends network lifetime. Our method inserts a compression layer between medium access control (MAC) and the routing layers without modifying existing network layers, thus providing a general platform for message compression. We performed extensive simulations to show how our architecture affects network energy and delay considering message size, queue size, compression ratio and time, and network topology. Our simulations show that a computationally inexpensive and effective compression algorithm (with high compression ratio) that takes less than 0.2 s/ kbytes time (including both compression and decompression time) to execute will help extend network lifetime for most motes; for some motes (such as Mica2 and Rene2) 1 s/kbytes or more will work also. This supports our theory that synthetic-non-homogeneity is a viable and practical method for extending wireless sensor networks(WSNs) lifetime.

As wireless motes are battery powered, many listen-sleep Medium Access Control (MAC) protocols have been proposed to reduce energy consumption. Security issues related to the design of these protocols have, however, largely been ignored. In this paper, we present a novel attack (the synchronization attack) on listen-sleep MAC protocols. This attack can cause 100% message loss and approximately 30% higher energy drain throughout either a cluster or the entire network, with only a single constrained malicious node modifying its schedule. We show this attack can be applied to many slotted listen-sleep protocols such as Sensor MAC (S-MAC), its enhanced version Global Schedule Adoption (GSA), Timeout MAC (T-MAC), Dynamic Sensor-MAC (DSMAC), and Mobile S-MAC (MS-MAC). We propose a heuristically near-optimal threshold-based scheme to defend against large scale synchronization attack. Depending on the traffic rate, our defense can limit the message delay to at most 20% and the message drop to at most 12%. We performed extensive simulations to show the attack and its defense. Our theoretical analysis proves these results in a general listen-sleep framework. An important impact of this work is that without a reliable MAC layer, higher layer secure protocols cannot be developed, e.g. secure routing depends on a reliable exchange of messages and our attack disrupts this exchange.

Many tasks require multiple sensing capabilities; in wireless sensor networks (WSNs), it is expensive to deploy a homogeneous network wherein every sensor has the same functionality. Instead, it is economical to deploy a heterogeneous network wherein sensors differ in their capabilities; in such a network, efficient data querying is essential. We propose a multi-keyword routing protocol, iBubble, for heterogeneous wireless sensor networks (HWSNs) where keywords describe sensor functionalities. iBubble provides an efficient query interface for locating data; queries are routed only along paths with nodes matching the query. iBubble utilizes an intelligent bubbling mechanism to propagate keywords to the base-station (BS). The keywords are aggregated via a novel use of lattices to reduce network cost. We show that iBubble can emulate diffusion and generally produce less traffic by restricting the query dissemination based upon both application type and data value. Our study analytically compares iBubble and diffusion, and formally characterizes the conditions required for iBubble to outperform diffusion in both static (fixed) and dynamic (mobile) networks. We did extensive simulations, our results match our theory and show that iBubble can outperform diffusion in many heterogeneous deployments when keyword distributions are "clustered" enough to satisfy the fraction of the network involved in a query/update defined by our analytical bound. Additionally, iBubble handles mobility, fault-tolerance, and provides network diagnosis via keyword bubbling. By utilizing keywords, iBubble bridges many routing and energy problems prevalent in WSNs, and provides a simple, uniform solution.

In large wireless sensor networks (WSNs), each hop might incur varying delays due to medium access contention, transmission and computation delays. Fast and efficient query responses are essential to network performance and maintenance. To save energy in battery-powered sensors, it is desirable that data be aggregated or compressed along the way toward the base-station (BS). The common method to aggregate data from network edge to the BS uses a hard-line precomputed timer that requires sensors near the network edge to respond to a query earlier than sensors in the vicinity of the BS [1], [2]. Such rigid scheduling ignores the WSNs's topology and stability. Aggregation opportunities are wasted if the query response timer is set incorrectly. Estimating and allocating precise per- hop communication timers for each node in a large WSN is difficult because timing depends on the network dynamics. We develop a novel, generic and scalable method, which we call soft-line recursive response (SRR), that bases response-wait on actual response times to previous queries using a history buffer, and therefore, is tolerant of network faults or temporal delays. Our simulations show that SRR can improve aggregation opportunities up to 120% over the hard-line approach, while increasing delay less than 5%. SRR reduces query response traffic and data redundancy in both homogeneous and heterogeneous static and mobile WSNs with a maximum O(N) transmission overhead in large WSNs of N nodes and O(logb) update cost where b is the history buffer size.