Estimation of Misbehaved Threshold

The purpose of misbehaved threshold is to distinguish misbehaved nodes from good ones.

(Equation 4-6 describes the usage of the misbehaved threshold.) So the threshold should be less than the mean reputation value of most evil nodes and higher than that of most good nodes. The estimated values for other primary factors can be seen in the Table 7-4.

Parameter Value Parameter Value

Publish timeout 2 s Inactivity fading 0.9

Deviation threshold 0.75 Secondhand information

weight 0.2

Inactivity timeout 2 s Percentage of evil nodes 40%

PACK timeout 0.5s

Table 7-4 Parameters used when estimating misbehaved threshold

7.5 Estimation of Primary Factors 75

To estimate the threshold value we take several steps to analyze the simulation results and approximate the value to the best selection.

Step 1: Analyze average mean reputation value

We first conduct a simulation to analyze the mean reputation value of each node. This step has following purposes.

1) Prove that there exists a misbehaved threshold that can distinguish misbehaved nodes from normal nodes. It requires that the intervals of the mean reputation values of misbehaved nodes and normal nodes do not overlap.

2) Select the range of misbehaved threshold so that the reasonable values will be tested to get the best simulation result.

In CONFIDANT, each node keeps reputation rating about any other nodes that it has communicated or heard about in the network. The mean reputation value is calculated according to Equation 2-4 and it indicates whether a node misbehaves or not when compared with misbehaved threshold. If the mean reputation value of a node is greater than the misbehaved threshold, it is considered as misbehaved node. Otherwise it is considered as normal node.

It is meaningless if we look at the mean reputation value of only a few nodes due to the deviation. A better way is to analyze the average mean reputation value of any node stored by all other 49 nodes. As discussed in section 2.3.2, there are three alternative methods to calculate the average of sample data. Which one to use depends on the nature of data set and what is of interest to the user. Before analyzing the data we don’t know which one should be used. However if the reputation system works in a correct way, the results of the three methods should look similar. Thus we calculate the average using all three methods and compare them.

The results of the simulation are shown in Figure 7-1. Because of the space limitation, here we only present the average mean reputation values of the first 20 nodes. The results for all the 50 nodes can be seen in the Appendix F. As seen in the figures, the mean, median and mode of the mean reputation values look very similar. That means any one of the three kinds of values is meaningful to be used as the average. The modes for a few nodes are missing in the figure because there are several possible values for each of the modes and the word processing tool just doesn’t know how to display them. But after checking the data source, those values are very similar to mean or median of the same node.

Average mean reputation value (node 0 ~ 19)

0 0.2 0.4 0.6 0.8 1 1.2

0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 Node ID

Mean reputation value

Mean Median Mode

Figure 7-1 Average mean reputation value of mobile nodes in the network

As seen in the figure, the average mean reputation values of the misbehaved nodes are mostly higher than 0.8 while the values of good nodes are lower than 0.5. In our simulation the actual evil nodes in the simulation are 1, 3, 5, 7, 10, 11, 16, 19, etc. The figure shows that the mean reputation values higher than 0.8 absolutely match the actual evil nodes. This result proves the purpose 1) and also provides basis for choosing an appropriate range to tune the misbehaved threshold further. After analyzing average mean reputation values for more scenarios, we have found that the misbehaved threshold should be a value greater than 0.8.

Step 2: Adjust misbehaved threshold

Having estimated a gross range, we conduct more simulations to choose the best misbehaved threshold. Figure 7-2 shows the good throughput and evil throughput at different misbehaved threshold. We can see that the lower the threshold, the lower both the good and evil throughputs. Thresholds 0.85 and 0.9 are more favorable because the evil throughputs are very low while good throughputs are medium.

Throughputs

15 25 35 45 55 65

0.8 0.85 0.9 0.95 0.98

misbehave threshold

Throughput

Good throughput Evil throughput

Figure 7-2 Throughputs with different misbehaved threshold

7.5 Estimation of Primary Factors 77

Step 3: Analyze the misbehaved identification rate and false negative rate

Now we have narrowed our selection within two values, 0.85 and 0.9. We further analyze the misbehaved identification rate and false negative rate to decide which one to choose.

Figure 7-3 shows the misbehaved identification rate for different misbehaved threshold.

Figure 7-4 shows the false negative rate at different time. We can see that the identification rate of threshold 0.9 is slightly higher than that of threshold 0.85. However, in Figure 7-4, the threshold 0.9 has lower false negative rate. Thus we choose 0.9 as misbehaved threshold.

Misbehaved nodes identification rate

0

Figure 7-3 Misbehaved nodes identification rate

False negative rate

Figure 7-4 False negative rate

Summary: Through the three-step analysis, we get a misbehaved threshold which results in low evil throughput, medium good throughput and precise identification of misbehaved nodes. Through the analysis we can see that sometimes throughput is not the only criteria to select the value for a parameter. We should also consider the purpose of the parameter and analyze other results that are directly affected by the parameter.