Initial Trust of Newcomers and Forgetting Factor in Trust-Based Gateway Discovery for an Integrated Internet-MANET under On-Off Attacks: An ns-3 Study

Initial Trust of Newcomers and Forgetting Factor in Trust-Based Gateway Discovery for an Integrated Internet-MANET under On-Off Attacks: An ns-3 Study

Mohammed Abdul Raheem (1), Khaleel Ur Rahman Khan (2)

(1) Research Scholar, Rayalaseema University, Kurnool, India.

(2) ACE Engineering College, Hyderabad, India.

Abstract – When a gateway is chosen from the trust of the relays on the route, two parameters of the trust model matter more than they seem to: the value given to a node that has just joined, and the rate at which old evidence is forgotten. This paper measures both with the ns-3 simulator in an integrated Internet-MANET with two gateways. A watchdog supplies evidence, trust is the Beta expectation, and a source selects the trusted route with the fewest hops. Three honest and two malicious nodes join a running 30-node network, and four existing nodes drop packets in an on-off pattern of 40 s good and 40 s bad behaviour; every setting was run ten times. An initial trust below the decision threshold kept honest newcomers excluded for 70 and 64 per cent of the time after joining (initial trust 0 and 0.3), whereas any value at or above the threshold admitted them within one 5 s slot, but left the malicious newcomers trusted in 88 per cent of the slots in which they dropped packets. A lower forgetting factor made the trust of on-off nodes recover more often in the good phase (88 per cent of forwarding slots trusted at A = 0.8, against 74 per cent at A = 1) but flagged fewer of the dropping slots (19 against 33 per cent). Compared with nearest-gateway selection, trust-aware selection gave a small gain in delivery (0.6 percentage points, not significant with ten runs) and fewer selections of routes with dropping relays. The results show that the initial trust acts only through its position relative to the threshold, and that the forgetting factor trades the detection of attacks against the readmission of nodes that behave again.

Keywords-Integrated Internet-MANET, gateway discovery, trust management, newcomer, initial trust, on-off attack, forgetting factor, Beta reputation, ns-3

1. INTRODUCTION

   Mobile nodes of an ad hoc network reach the Internet through gateways. The discovery of the gateways, by advertisement, by solicitation or by a hybrid of the two, and the adaptation of the advertisement range and interval to the network, have been studied for years [1, 2, 3, 4]. A source that has found several gateways must still choose one, and the choice decides which relay nodes carry its traffic. If some relays accept packets and discard them, a choice based only on hop count is exposed to them. A choice based on trust can avoid them, but only if the trust values are good, and the trust values are only as good as the model that produces them [5].

   Two parameters of a reputation model decide how it behaves over time, and they are seldom examined separately. The first is the starting value of a node that has just joined. It has no history, so some value must be assumed. A high value lets a node that misbehaved under one identity return under another and be trusted again, which is the whitewashing attack in the classification of Hoffman et al. [6]. A low value keeps honest newcomers out of the routes until they have shown that they forward. The second is the forgetting

   factor. Old evidence has to fade, because nodes change, but if it fades quickly a node that drops packets can behave well for a while and erase its record. Such on- off behaviour is a known attack on trust evaluation [7].

   This paper measures both parameters in the setting of gateway selection in an integrated Internet-MANET, which is the topic of the thesis of the first author. The contributions are as follows.

   1. An ns-3 study of the initial trust of honest and malicious newcomers over five values and ten runs, with a clear distinction between the effect below and at or above the decision threshold.

   2. An ns-3 study of the forgetting factor against on-off attackers, with the detection rate, the share of correctly trusted forwarding slots, and the detection and recovery delays.

   3. An online comparison of trust-aware and nearest- gateway selection in the same scenario, with paired statistics, and a short guideline for choosing the two parameters.

      Section II reviews related work, Section III describes the model and algorithms, Section IV the set- up, Section V the results, Section VI discusses the results, Section VII gives guidelines, and Section VIII concludes.

2. RELATED WORK

   Gateway discovery in an integrated Internet- MANET is classified as proactive, reactive or hybrid [1]. Ruiz and Gomez-Skarmeta [2, 3] adapt the range of the advertisements to the farthest active source and to the benefit of a larger range. Surveys of adaptive mechanisms and of load-balanced management are given in [4, 8, 9], and a trust-based selection of gateways has been discussed in [10, 11]. None of these examines how a newcomer is treated.

   The watchdog of Marti et al. [12] is the standard source of direct evidence. CONFIDANT [13] and CORE [14] use it in reputation systems, and the Beta reputation system [15] gives a simple formula with a prior that acts as the initial trust. The survey of 10sang et al. [16] discusses how reputation systems treat new entities, and Hoffman et al. [6] list whitewashing and the exploitation of the initial value among the attacks. Sun et al. [7, 17] treat trust with information theory and describe attacks that exploit the dynamics of the evaluation. Cho et al. [5] and Chen et al. [18] survey trust management in MANETs, including the choice of parameters. The present paper does not propose a new model; it measures the two parameters in a gateway-

   selection setting and gives the numbers that a designer needs.

   The idea of choosing a gateway from more than one criterion is not new. The maximal source coverage scheme sets the advertisement range from the farthest active source, and the benefit-based variant weighs the cost of flooding against the cost of serving sources without advertisements [2, 3]. Comparisons of proactive, reactive and hybrid discovery in ad hoc networks that use Mobile IP are available in [1]. Later work from the authors’ group considered the load of the gateways and of the paths to them [8, 9], and a review of trust management for heterogeneous networks [11] motivates the use of trust in the choice of gateway and path. In all of these, a newly arriving node and the ageing of evidence are secondary matters, which is the gap that this paper addresses.

3. MODEL AND ALGORITHMS

   1. System and attacker model

      Figure 1 shows the system. MANET nodes move in a region and send flows to the Internet through one of two gateways over AODV routes [19]. Some nodes are dropping nodes; they take part in route discovery and then discard the data they should relay. A dropping node may be always bad, or on-off: it drops for a bad period and forwards for a good period, and the two periods alternate. Honest and malicious newcomers join at a known time.

      Figure 1. Integrated Internet-MANET with two gateways. Node 5 and node 8 drop packets; node 11 is a newcomer. A source that is aware of trust would take GW1 over node 3 in place of the dotted route through node 5.

   2. Evidence and trust

      The observer i hands a packet to the next hop j and listens for 0.5 s to see whether j transmits it (Algorithm 1). The counts are collected in slots of 5 s. Trust is the Beta expectation with a prior of weight w centred on the initial trust T0, and the counters are multiplied by a forgetting factor A at the end of each slot (Algorithm 2):

      T(i,j) = [ r(i,j) + w·T0 ] / [ r(i,j) + s(i,j) + w ] (1)

      A node is regarded as misbehaving when its network trust T(j), the mean of T(i,j) over the observers with at least three observations, is below 8 = 0.5. A node without enough observations has T(j) = T0. The initial trust therefore determines the state of a newcomer until evidence arrives: it is trusted from the start if T0 8 and excluded if T0 < 8 (Algorithm 3).

      The forgetting factor controls the memory: the effective window is about 1/(1 – A) slots, which is 5, 20 and 50 slots for A = 0.8, 0.95 and 0.98, and unlimited for A = 1.

      Algorithm 1. Watchdog evidence

      1. Input: data packet handed by node i to next hop j (j is not the destination)

      2. On hand-over: start watch timer W = 0.5 s; set pending(i, j, packet) = true

      3. On overhearing j transmit the same packet before W expires:

      4. forwarded(i, j, slot) += 1; pending = false

      5. On W expiry with pending = true:

      6. dropped(i, j, slot) += 1

      7. At the end of every 5 s slot k, report the pair (forwarded, dropped) for each j

Algorithm 2. Beta trust with forgetting and initial trust

1. Input: counters r(i,j), s(i,j); prior weight w; initial trust T0; forgetting factor A; slot evidence (f, d)

2. At the end of each slot:

3. r(i,j) = A · r(i,j) + f; s(i,j) = A · s(i,j) + d

4. n = r(i,j) + s(i,j)

5. T(i,j) = ( r(i,j) + w · T0 ) / ( n + w )

6. Network trust of j: T(j) = mean of T(i,j) over observers i with n

   n_min = 3

7. If no observer has n n_min then T(j) = T0

8. Node j is trusted if T(j) 8, otherwise it is marked as misbehaving

Algorithm 3. Treatment of a newcomer

1. Input: node j joins at time t_j with no evidence; T0, A, 8

2. Set r(·,j) = s(·,j) = 0, so that T(j) = T0 for the first slots

3. While n(j) < n_min: treat j as trusted only if T0 8

4. For each later slot apply the Beta update with forgetting (Algorithm 2)

5. Gateway selection uses T(j) of every relay on the route (Algorithm 3)

6. A route through j is used only if T(j) 8, unless no trusted route exists

1. Trust-aware gateway selection

Every 10 s a source reads the AODV route to each gateway, computes the path trust PT as the smallest T(·) among the relays, and takes the route with the fewest hops among those with PT 8, or the route with the highest PT if none qualifies (Algorithm 4). The baseline takes the gateway with the fewest hops.

Algorithm 4. Trust-aware gateway selection

1. Input: gateways G, source s, threshold 8, period 10 s

2. Every 10 s, for each gateway g in G read the AODV route from s:

3. if there is no valid route then mark g as unreachable

4. hops(g) = number of hops; R(g) = relay nodes on the route

5. PT(g) = min of T(r) over r in R(g) (PT(g) = 1 for a direct route)

6. T = { g reachable : PT(g) 8 }

7. If T is not empty then choose g* in T with the fewest hops (keep the current gateway on a tie)

8. Else choose the reachable g* with the largest PT(g)

9. If g differs from the current gateway then switch the flow to g

Figure 2. Flow of the trust-aware gateway selection.

1. SIMULATION SET-UP

   1. Implementation in ns-3

      The watchdog is implemented with the promiscuous receive callback of the wireless device. When a node hands a data packet to the next hop, it records the packet identifier and the next hop and starts a timer of

      0.5 s; a later transmission of the same packet by the next hop that is heard by the observer cancels the timer and counts a forwarded packet, and the expiry of the timer counts a dropped packet. A dropping node is realised by switching off IP forwarding in the node while leaving its AODV agent active, so that it answers route requests and attracts routes in the normal way. The gateways are two fixed nodes that run UDP sinks; every source sends its data to the address of the currently selected gateway and, in addition, a short probe to both gateways every 5 s, so that AODV keeps a route to each of them. The route used by the selection is read from the AODV routing tables hop by hop, starting at the source. The evidence counters, the Beta trust and the path trust are computed inside the simulation, so that the selection uses only information that exists at that simulated time. The ground truth of the dropping state is used only to compute the metrics.

   2. Parameters and runs

   The simulator is ns-3.49 [20]. Table 1 gives the parameters. Twenty-five nodes are present from the start; four of them are on-off dropping nodes with 40 s of good and 40 s of bad behaviour. At 100 s three honest and two on-off malicious nodes join. Twelve flows start at honest initial nodes. Ten seeds (101-110) were used in every setting. The watchdog evidence of the nearest-gateway runs was recorded and used offline to evaluate the initial trust (T0 E {0, 0.3, 0.5, 0.7, 1}, w

   = 4, A = 0.95) and the forgetting factor (A E {0.8, 0.9,

   0.95, 0.98, 1}, T0 = 0.5, w = 2). Online, the trust-aware policy was simulated with five parameter pairs (w = 4), and its delivery, delay and exposure to dropping relays were compared with nearest-gateway selection. Values are means with 95 % confidence intervals over the ten runs. As in the companion study, runs that did not finish within the wall-clock limit of 110 s were repeated with another seed; of the 138 completed runs of the whole study 55 were repeated at least once, 24 of them in the settings of this paper.

   Table 1. Simulation parameters

   Parameter	Value
   Simulator / routing	ns-3.49 / AODV
   Nodes	25 initial + 5 newcomers; 2 gateways
   Area / range	800 m x 800 m / 250 m
   MAC	IEEE 802.11g, 6 Mb/s
   Mobility	Random waypoint, 1-5 m/s
   Traffic	12 CBR/UDP flows, 512 B / 0.25 s
   Attackers	4 on-off (40 s / 40 s) + 2 newcomers
   Newcomers join	100 s (3 honest, 2 malicious)
   Slot / watchdog	5 s / 0.5 s
   8, n_min	0.5, 3
   Run time / seeds	300 s / 10 (101-110)

   1. Analytical view of the two parameters

      Some of the results can be predicted from Equation

      1. A newcomer with all-successful evidence has trust (n + w·T0)/(n + w) after n observations. It reaches the threshold 8 when n w(8 – T0)/(1 – 8), and it can only be classified when n n_min. A malicious newcomer wose first s observations are all drops has trust w·T0/(s + w), which falls below 8 when s > w(T0/8 – 1). Table 2 gives the resulting numbers of observations for the prior weights w = 2, 4 and 8. For T0 8 a newcomer is trusted at once and needs no good evidence, and a malicious newcomer with T0 = 1 and w

         = 4 has to be seen dropping more than four packets before it is flagged; this is the mechanism behind the long period of trust of the malicious newcomers in Section V-A. For T0 < 8 the honest newcomer has to be observed forwarding several packets, and, as flows reach a node only occasionally, this takes tens of seconds.

         Table 2. Observations needed: good ones to be trusted, drops to be flagged (0 = 0.5, n_min = 3)

         w	T0	Good obs.	Drops
         2	0.0	3	0 (excluded)
         2	0.3	3	0 (excluded)
         2	0.5	0 (trusted)	3
         2	1.0	0 (trusted)	3
         4	0.0	4	0 (excluded)
         4	0.3	3	0 (excluded)
         4	0.5	0 (trusted)	3
         4	1.0	0 (trusted)	5
         8	0.0	8	0 (excluded)
         8	0.3	4	0 (excluded)
         8	0.5	0 (trusted)	3
         8	1.0	0 (trusted)	9

         Figure 3. Trust of a newcomer against the number of observations for w = 4 (analytical, Equation (1)); the dashed line is 0.

         The effect of A can be seen in the same way. With a forgetting factor A the counters behave like a window of about 1/(1 – A) slots, that is 25 s, 50 s, 100 s and 250 s for A = 0.8, 0.9, 0.95 and 0.98, and the whole run for A

         = 1. Figure 4 shows the trust of an on-off node with 40 s good and 40 s bad phases for a synthetic, uniform evidence of two hand-overs per slot. With a window shorter than a phase the trust follows the phases and falls below 8 in each bad phase; with a long window the trust of a node that drops half of its packets stays near the long-run forwarding fraction of 0.5, and the node is not flagged at all. Real evidence is not uniform, and a second effect appears in the measurements: when no hand-over to the node is observed, the decayed counters shrink and the trust returns to the prior T0, which is 0.5 and therefore counts as trusted. A small A thus makes the trust of a node that is rarely observed return to the threshold quickly, which is consistent with the higher share of trusted forwarding slots and the lower share of flagged dropping slots for small A in Table 5. We did not isolate this effect with a separate experiment.

         Figure 4. Trust of an on-off node for three forgetting factors (synthetic uniform evidence, w = 2, T0 = 0.5).

2. RESULTS AND DISCUSSION

   1. Initial trust of newcomers

      Table 3 and Figure 5 show the effect of the initial trust. With T0 = 0 and T0 = 0.3 an honest newcomer was below the threshold in 70 ± 13 and 64 ± 16 per cent of the slots after joining and needed on average 78 s and 69 s to be trusted. With T0 = 0.5, 0.7 and 1 there was no exclusion and the newcomer was trusted within the first slot, so the three values gave identical results. The initial trust therefore acts through its position relative to 8 and not through its size.

      The malicious newcomers show the other side. For T0 = 0 and 0.3 they were trusted in only 5 ± 10 and 6 ± 10 per cent of the slots in which they dropped packets, and were flagged within 5 s and 5.8 s of the first bad period. For T0 0.5 they were trusted in 88 ± 12 per cent (T0 = 0.5) and 91 ± 12 per cent (T0 = 1) of the dropping slots; the flag came after 20 s on average among the newcomers that were flagged at all, with a wide interval (± 29 s). The two settings thus trade the exclusion of honest newcomers (up to 70 per cent of the time) against the trust given to malicious newcomers (up to 91 per cent), and no value of T0 avoids both, since it is only the threshold that matters.

      Table 4. Prior weight w: honest newcomers excluded and malicious newcomers trusted while dropping (%), ‘J = 0.95, n = 10

      T0	w = 1	w = 2	w = 4	w = 8
      0.0 (excl.)	64	64	70	83
      0.3 (excl.)	64	64	64	66
      0.5 (trusted)	88	88	88	88
      1.0 (trusted)	88	88	91	92

      Figure 5. Initial trust: exclusion of honest and trust in malicious newcomers (top), and delays (bottom).

      Table 3. Newcomers, mean ± 95 % CI (n = 10)

      T0	Honest excl. (%)	Honest admit (s)	Malicious trusted (%)
      0.0	70 ± 13	78 ± 33	5 ± 10
      0.3	64 ± 16	69 ± 33	6 ± 10
      0.5	0 ± 0	5 ± 0	88 ± 12
      0.7	0 ± 0	5 ± 0	88 ± 12
      1.0	0 ± 0	5 ± 0	91 ± 12

   2. Prior weight of the Beta expectation

      The weight w of the prior decides how many observations are needed to overcome the initial trust (Table 2). Table 4 repeats the newcomer analysis for w

      = 1, 2, 4 and 8 with A = 0.95. The weight has almost no effect: for w from 1 to 4 the exclusion of honest newcomers with T0 = 0 and 0.3 stayed between 64 and 70 per cent, and the malicious newcomers with T0

      0.5 were trusted in 88 to 91 per cent of their dropping slots. Only the largest weight, w = 8, changed the picture, and then only at the extremes: it raised the exclusion at T0 = 0 to 83 per cent and the trust given to malicious newcomers at T0 = 1 to 92 per cent. That the exclusion is already high for w = 1 suggests that the main cause is not the prior but the small number of observations that a new node collects, because the rule that at least three observations are needed leaves the node at T0 until then. We did not vary n_min, which would be the natural way to test this explanation.

   3. Forgetting factor against on-off attackers

      Figure 6 and Table 5 show the effect of A on the nodes with on-off behaviour. A lower A shortens the memory. With A = 0.8 the trust of an on-off node was above the threshold in 88 ± 3 per cent of its forwarding slots, and with A = 1 in 74 ± 6 per cent; the share of dropping slots in which the node was flagged rose from 19 ± 4 to 33 ± 7 per cent. A long memory flags more of the bad slots but also keeps the node below the threshold after it has returned to forwarding. The time to flag a node after the start of a bad period was between 14 s (A = 1) and 17 s (A = 0.8), and the time to trust it again after a good period began was about 7 s for all A; the differences between settings are inside the confidence intervals. The share of bad periods that were flagged at all was 33 per cent for A = 0.8 and 42 per cent for A = 1. These hares are low for every A. A likely reason, which we did not verify separately, is that an on-off node with a bad period of 40 s is on a route for only part of that time, and a watchdog needs hand-overs to a node to record its drops; a node that is not on any route in a bad period leaves no evidence.

      The false-positive share for honest nodes was very low for all values of A (0.1 to 0.3 per cent of the slots). Forgetting therefore costs little in false accusations in this scenario, and its main effect is on the on-off nodes.

      Figure 6. Forgetting factor: share of slots classified correctly (top), and detection and recovery delay (bottom).

      Table 5. On-off nodes against ‘J, mean ± 95 % CI (n = 10)

      A	Drop slots flagged (%)	Fwd. slots trusted (%)	Bad periods flagged (%)
      0.80	19 ± 4	88 ± 3	33 ± 6
      0.90	23 ± 7	84 ± 5	33 ± 8
      0.95	27 ± 9	81 ± 8	37 ± 10
      0.98	27 ± 9	80 ± 8	35 ± 10
      1.00	33 ± 7	74 ± 6	42 ± 7

   4. Effect on the gateway selection

   Figure 7 and Table 6 compare the online policies. Nearest-gateway selection delivered 0.959 ± 0.012 of the packets and trust-aware selection with T0 = 0.5 and A = 0.95 delivered 0.965 ± 0.011. The paired difference was 0.6 ± 0.6 percentage points (p = 0.09), which is not significant with ten runs. The share of selections whose route contained a dropping relay was 2.1 % for the nearest gateway and 1.6 % for the trust-aware policy (paired difference -0.5 ± 0.3 points, p = 0.023). The settings T0 = 0.5 and T0 = 0.7 gave identical results, as the offline analysis predicts, and the other settings differed from them by less than the confidence intervals. The number of gateway switches per flow was higher for the trust-aware policy (15.5 against 11.2). In this small network the gateways are close to every source, so most routes have no relay and the gain is small whatever the parameters; the offline analysis of Sections V-A to V-C is therefore more informative about the parameters than the online runs.

   Figure 7. Online comparison: delivery ratio (top, axis starts at 0.90) and exposure to dropping relays (bottom).

   Table 6. Online results, mean ± 95 % CI (n = 10)

   Policy	PDR	Exposure (%)	Switc hes
   Nearest	0.959 ± 0.012	2.1 ± 0.8	11.2
   T0 0.3, A 0.95	0.964 ± 0.010	1.5 ± 0.7	19.8
   T0 0.5, A 0.95	0.965 ± 0.011	1.6 ± 0.8	15.5
   T0 0.7, A 0.95	0.965 ± 0.011	1.6 ± 0.8	15.0
   T0 0.5, A 1	0.964 ± 0.010	1.8 ± 0.8	15.4
   T0 0.5, A 0.8	0.964 ± 0.012	1.7 ± 0.8	16.0

3. DISCUSSION

   Three observations stand out. First, the decision threshold is the real parameter. Every value of T0 on one side of 8 gave the same result, and the prior weight w mattered only at its largest value. A designer who tunes T0 in steps of 0.1 above 8 spends effort without effect; the useful choices are one value below 8 and one at or above it. Second, the two kinds of error cannot be removed by the starting value alone. A newcomer without history is either given the benefit of the doubt, or not, and the cost of each choice falls on a different party: the honest newcomer that is kept out of the routes, or the other nodes that send traffic through a malicious newcomer. Third, the forgetting factor interacts with the sparsity of evidence. Because a node leaves no evidence when it is not on a route, forgetting returns its trust to the prior, and a prior at the threshold is read as trust. The consequence is that forgetting is not neutral with respect to the decision rule; it moves nodes towards the side where the prior lies.

   The online comparison puts the offline numbers in perspective. In the network studied, most routes to a gateway are short, so that the policy has few routes to choose from, and a trust-aware choice cannot do much

   more than avoid the few routes through a dropping relay. The gain in delivery was about half a percentage point and was not significant, and the reduction in exposure was about half a percentage point as well. The parameters will matter more in networks in which the routes are longer and the choice between gateways is real, and the offline results of this paper are likely to carry over to them because they depend on the evidence that a watchdog collects and not on the topology; this expectation has not been tested.

   Table 7. Summary of the findings

   Parameter	Finding	Evidence
   T0	Only its side of 8 matters	Tables 3, 4
   T0 < 8	Honest newcomers excluded 64-70 % of the time	Fig. 5
   T0 8	Malicious newcomers trusted 88- 91 % of dropping slots	Fig. 5
   w	No effect for w 4	Table 4
   A	Small A: more trusted slots, fewer flagged	Fig. 6, Table 5
   Selection	Small gain in delivery, lower exposure	Fig. 7, Table 6

4. GUIDELINES

   Gateway discovery adds a further consideration. In a proactive or hybrid scheme the gateways advertise themselves and the nodes register with them, so a newcomer is a node that has not yet registered or has just arrived in the proactive zone. The gateway sees the registration and could vouch for a node that has registered successfully, which is a source of initial evidence that a purely watchdog-based scheme lacks. It could also supply the delivery feedback that a source gets from the end of the path, which would replace the overheard forwarding for the last hop. These extensions would shorten the exclusion of honest newcomers without raising the trust given to malicious ones, and are a natural next step for trust-based adaptive gateway discovery.

   The results suggest the following rules, which hold for the scenario studied. (1) Choose the initial trust relative to the threshold, not by its value: below 8 for caution, at or above 8 for fast admission; values above 8 add nothing. (2) Where whitewashing is a concern, take T0 below 8 and accept that honest newcomers wait; the wait in this study was about 70 to 80 s, and shortening it needs another source of evidence, such as a recommendation from a trusted neighbour or from the gateway. (3) Where fast admission is needed, use T0 8 and rely on the watchdog and on a low weight w of the prior to remove a malicious newcomer quickly. (4) For on-off attackers use a long memory to flag them and a short one to readmit nodes that have repaired; as one value cannot do both, an asymmetric update, in which bad evidence is forgotten slower than good evidence, is a natural direction for further study. (5) Measure the share of bad periods that leave no evidence, because it limits every setting of A.

   A. Threats outside the scope

   Three threats were not simulated. A node that changes its identity after being flagged re-enters as a

   newcomer, and with T0 8 it is trusted again until the watchdog collects at least hree observations; the cost of the attack is therefore the time to collect them, and a lower T0 or a binding of identities to the gateway registration would raise it. A group of Sybil identities can supply false recommendations about newcomers, and the trust-weighted aggregation used in the companion study does not help against newcomers whose recommenders are themselves new. Finally, a node can behave well towards the watchdog and badly towards the traffic it is not watched on, which is not captured by overheard forwarding.

5. LIMITATIONS AND CONCLUSION

The study used one network size, one on-off period, five values of each parameter and ten runs. The offline analyses use the evidence of the nearest-gateway runs and not a feedback loop in which the trust values change the routes; the online runs show that this feedback has only a small effect here. The newcomers were on-off malicious nodes; always-bad newcomers were not included in this data set. The wide intervals mean that the differences in delay between the settings of A should not be interpreted.

The initial trust of a newcomer and the forgetting factor were measured in a trust-based gateway- selection scenario in an integrated Internet-MANET. The initial trust acts only through its position relative to the threshold, and it trades the exclusion of honest newcomers against the trust given to malicious ones. The forgetting factor trades the flagging of the dropping slots of on-off nodes against the readmission of the same nodes when they forward again. Trust- aware selection gave a small and not significant gain in delivery and a reduction in exposure. Future work will add the adaptive advertisement range of the gateways to the trust model, include always-bad newcomers, and test asymmetric forgetting.

Future work will follow three lines. The first is the asymmetric update, in which evidence of dropping is forgotten more slowly than evidence of forwarding, so that an on-off node cannot recover its trust as fast as it lost it. The second is the use of the gateway as a source of initial evidence for newcomers. The third is a joint treatment with the adaptive advertisement range and interval of the gateways, in which the trust of the nodes in the proactive zone influences how far and how often the advertisements are sent; this joins the present results with the thesis topic of trust-based adaptive gateway discovery.

DECLARATIONS

AI-use statement. AI tools were used to assist with language editing, drafting support and preparation of figures. The research question, simulations, manuscript and conclusions are the authors’ own, and all methods, results and technical content were verified by the authors, who take full responsibility for this work.

Conflict of interest. The authors declare no conflict of interest. Funding. No external funding was received. Data availability. The ns-3 scenario, the evidence files and the analysis scripts are available from the corresponding author on request.

REFERENCES

1. A. Hamidian, U. Korner, and A. Nilsson, “Performance of Internet access solutions in mobile ad hoc networks,” in Lecture Notes in Computer Science, vol. 3427. Berlin, Germany: Springer, 2005, pp. 189-201.

2. P. M. Ruiz and A. F. Gomez-Skarmeta, “Maximal source coverage adaptive gateway discovery for hybrid ad hoc networks,” in Ad-Hoc, Mobile, and Wireless Networks (Lecture Notes in Computer Science, vol. 3158). Berlin, Germany: Springer, 2004, pp. 28-41.

3. P. M. Ruiz and A. F. Gomez-Skarmeta, “Adaptive gateway discovery mechanisms to enhance Internet connectivity for mobile ad hoc networks,” Ad Hoc & Sensor Wireless Networks, vol. 1, no. 1-2, pp. 159-177, 2005.

4. R. U. Zaman, K. U. R. Khan, and A. V. Reddy, “A survey of adaptive gateway discovery mechanisms in heterogeneous networks,” Int. 1. Computer Network and Information Security, vol. 2013, no. 7, pp. 34-42, 2013.

5. 1.-H. Cho, A. Swami, and I.-R. Chen, “A survey on trust management for mobile ad hoc networks,” IEEE Commun. Surveys Tuts., vol. 13, no. 4, pp. 562-583, 2011.

6. K. Hoffman, D. Zage, and C. Nita-Rotaru, “A survey of attack and defense techniques for reputation systems,” ACM Comput. Surv., vol. 42, no. 1, 2009.

7. Y. Sun, Z. Han, W. Yu, and K. 1. R. Liu, “Attacks on trust evaluation in distributed networks,” in Proc. Conf. Information Sciences and Systems (CISS), 2006, pp. 1461-1466.

8. R. U. Zaman, S. S. Begum, K. U. R. Khan, and A. V. Reddy, “Efficient adaptive path load balanced gateway management strategies for integrating MANET and the Internet,” Int. 1. Wireless and Microwave Technologies, no. 2, pp. 57-75, 2017.

9. R. U. Zaman, H. M. Alam, and K. U. R. Khan, “Improvement of adaptive load balanced gateway discovery protocol in hybrid integrated Internet-MANET,” Int. 1. Interactive Mobile Technologies, vol. 11, no. 3, 2017.

10. R. U. Zaman and R. Sultana, “Identifying trustworthy nodes in an integrated Internet MANET to establish a secure communication,” in Advances in Intelligent Systems and Computing, vol. 712. Singapore: Springer, 2018, p. 321 ff.

11. R. U. Zaman, A. V. Reddy, M. A. Raheem, and K. U. R. Khan, “Contemporary trust management strategies for establishing secure communication in the heterogeneous network,” Int. 1. Sci. Res. Rev., vol. 8, no. 2, pp. 2075-2093, 2019.

12. S. Marti, T. 1. Giuli, K. Lai, and M. Baker, “Mitigating routing misbehavior in mobile ad hoc networks,” in Proc. 6th Annu. Int. Conf. Mobile Computing and Networking (MobiCom), 2000.

13. S. Buchegger and 1.-Y. Le Boudec, “Performance analysis of the CONFIDANT protocol,” in Proc. ACM Int. Symp. Mobile Ad Hoc Networking and Computing (MobiHoc), 2002, pp. 226-236.

14. P. Michiardi and R. Molva, “CORE: A collaborative reputation mechanism to enforce node cooperation in mobile ad hoc networks,” in Advanced Communications and Multimedia Security, IFIP vol.

    100. Boston, MA: Springer, 2002, pp. 107-121.

15. A. 10sang and R. Ismail, “The Beta reputation system,” in Proc. Bled Electronic Commerce Conf., Bled, Slovenia, 1une 2002.

16. A. 10sang, R. Ismail, and C. Boyd, “A survey of trust and reputation systems for online service provision,” Decision Support Systems, vol. 43, no. 2, pp. 618-644, 2007.

17. Y. L. Sun, W. Yu, Z. Han, and K. 1. R. Liu, “Information theoretic framework of trust modeling and evaluation for ad hoc networks,” IEEE 1. Sel. Areas Commun., vol. 24, no. 2, pp. 305-

    315, 2006.

18. I.-R. Chen, 1. Guo, F. Bao, and 1.-H. Cho, “Trust management in mobile ad hoc networks for bias minimization and application performance maximization,” Ad Hoc Networks, vol. 19, pp. 59-74, 2014.

19. C. Perkins, E. Belding-Royer, and S. Das, “Ad hoc On-Demand Distance Vector (AODV) routing,” RFC 3561, IETF, 1uly 2003.

20. G. F. Riley and T. R. Henderson, “The ns-3 network simulator,” in Modeling and Tools for Network Simulation. Berlin, Germany: Springer, 2010, pp. 15-34.