Trust Establishment in Computer Networks: Theories and Applications by Yafei Yang a Dissertation Submitted in Partial Fulfillment of the Requirements for the Degree of Doctor of Philosophy in Electrical Engineering

Trust, a subject extensively studied in sociology and psychology, has long been known as the driving force for collaboration in social communities. Recently, trust is recognized as a key component in new security tools to defend computer networks, such as rating system in e-commerce networks, peer-to-peer networks, mobile ad hoc networks, and wireless sensor networks, against possible attacks. This dissertation focuses on trust framework, theoretical analysis and applications in different computer networks. It provides in-depth understanding of trust establishment process and analyze the vulnerability of trust and reputation mechanisms. Online feedback-based rating systems are gaining popularity. Dealing with collaborative unfair ratings in such systems has been recognized as an important but difficult problem. This problem is challenging especially when the number of honest ratings is relatively small and unfair ratings can contribute to a significant portion of the overall ratings. In addition, the lack of unfair rating data from real human users is another obstacle toward realistic evaluation of defense mechanisms. We propose a set of methods that jointly detect smart and collaborative unfair ratings based on signal modeling. Based on the detection, a framework of trust-assisted rating aggregation system is developed. Furthermore, we design and launch a Rating Challenge to collect unfair rating data from real human users. The proposed system is evaluated through simulations as well as experiments using real attack data. Compared with existing schemes, the proposed system can significantly reduce the impact from collaborative unfair ratings. Based on the real attack data from the rating challenge, we discover important features in unfair ratings, build attack models, and develop an unfair rating generator. The models and generator can be used to test current rating aggregation systems, as well as to assist the design of future rating systems. Similar to other security mechanisms, reputation systems can be under attack. We report the discovery of a new attack, named RepTrap(Reputation Trap), against feedback-based reputation systems, such as those used in P2P file-sharing systems and E-commerce websites(e.g. Amazon.com). We conduct an in-depth investigation on this new attack, including analysis, case study, and performance evaluation based on real data and realistic user behavior models. We discover that the RepTrap is a strong and destructive attack that can manipulate the reputation scores of users, objects, and even undermine the entire reputation system. Compared with other known attacks that achieve the similar goals, the RepTrap requires less effort from the attackers and causes multi-dimensional damage to the reputation systems. There have been many time synchronization protocols proposed for sensor networks. However, the security problems related to time synchronization have not been fully solved yet. If malicious entities manipulate time synchronization, failures of many functionalities in the sensor networks would occur. we identify various attacks against time synchronization and then develop a trust and self-healing scheme to defeat those attacks. The proposed scheme has three phases: (1) abnormality detection performed by individual sensors, (2) trust-based malicious node detection performed by the base station, and (3) self-healing through changing the topology of synchronization tree. Simulations are performed to demonstrate the effectiveness of the proposed scheme as well as the implementation overhead. In the current literature, the methods proposed for trust establishment are always evaluated through simulation, but theoretical analysis is extremely rare. We present a suite of approaches to analyze trust establishment process. These analysis approaches are used to provide in-depth understanding of trust establishment process and quantitative comparison among trust establishment methods. The proposed analysis methods are validated through simulations.