Multiagent Trust Modeling for Open Network Environments Doctoral Thesis

Trust models are specific knowledge structures designed to gather, hold and share agent’s knowledge about the reliability of its partners: the trustees. These models are updated by observations generated upon direct interaction with the trustees and by receiving the observations or opinions from other agents. The existing trust models are built on the assumption of recurrent and similar interactions of well defined partners. This assumption is valid in traditional application domains for the multiagent systems, but does not hold in the emerging domains of ad-hoc and mobile ad-hoc networks, where the cooperating community, as well as the solved tasks, evolves rapidly. To address this challenge, we have designed an overlay mechanism which can be integrated with most existing trust models, and which allows the agents to reason about the similarity of trusting situations and trustees. This similarity is used to predict the behavior of previously unknown partner, or to select the relevant past experience to predict the reliability of a particular trustee in a specific situation. Furthermore, we propose a specific approach to trust model distribution between a group of cooperative agents, where each agent reasons about different aspects of the trustee’s identity and situation description. In the last part of our work, we propose a specific application of the proposed technique in the domain of network intrusion detection, where we use our approach to integrate the data from several anomaly detection algorithms. The underlying anomaly detection algorithms only work with network traffic statistics, and are typically prone to high levels of false positives, i.e. the classification of legitimate traffic as potentially malicious. The application of collective trust modeling technique alleviates the problem and significantly reduces the error rate measured on real network traffic. In the same time, the application of the technique does not increase the rate of false negatives (malicious traffic misclassified as legitimate) and the performance characteristics of the technique allow its deployment for real-time traffic monitoring.