Improved Dynamic Subjective Logic Model with Evidence Driven

Article information

Abstract

1. Introduction

With the development of large-scale distributed systems, such as cloud computing, the Internet of things, and the ad-hoc network, the security and reliability of the systems are more concerned. Because these systems have open, dynamic, and uncertain characteristics, the corresponding model theories put forward higher requirements. At present, the trust relationship between nodes is mainly expressed by the trust model. According to the theoretical basis for trust, the trust model can be divided into the following types: a trust model based on fuzzy logic, a trust model based on reputation, and a trust model based on subjective logic, node behavior, analytic hierarchy process, and fuzzy logic [1]. Among them the trust model based on subjective logic, which was proposed by Jøsang, is more suitable for modeling the trust of a dynamic uncertainty object. Jøsang learned from the D-S evidence theory. He put the uncertainty into the model and proposed the subjective logic theory. On the basis of this, he modeled the trust relationship, and obtained very good results. In Jøsang’s subjective logic, the base rate (a) is used to calculate the expectation of an opinion and the non-informative prior weight (C) is an important parameter for calculating the uncertainty of the opinion. However, there are shortcomings in that the base rate (a) and non-informative prior weight (C) are constant and are not able to change dynamically in Jøsang’s subjective logic and that the fusion operator will have unreasonable results in a situation that has high conflict with the evidence. If we can solve these problems, it will promote the improvement and development of Jøsang’s subjective logic theory.

The rest of the paper is organized as follows: Section 2 provides the related work that has already been carried out on this subject. Section 3 introduces the fusion operator in Jøsang’s subjective logic and its issues. Establishes Improved Subjective Logic Model with Evidence Driven (ISLM-ED) in Section 4. Sections 5 describes our experimental setup, gives a evaluation of the performance of our model, and verifies the rationality of the model. Section 6 concludes the paper.

2. Related Work

In recent years, the research on the Jøsang’s subjective logic trust model has achieved fruitful results. Subjective logic theory proposed by Jøsang [2] can express subjective uncertainty. Its beta trust model, which was successfully applied in the open community of the trust management system, has become one of the classics in trust management field. The literature used by [3] used subjective logic for studying trust network analysis. In the literature presented in [4] reviewed the current trust and reputation systems. The literature used by [5] used conditional reasoning to extend binomial opinions to multinomial opinions for improving the subjective logic. In the literature presented in [6] pointed out the rich features of bias in the reputation system, which was applicable to many different problems and environments. The literature used by [7] designed the cumulative fusion operator and the average fusion operator for improving the subjective logic. The literature used by [8] extended and redefined mapping from the condition to the result by using subjective logic. The subjective logic provides a good theoretical foundation for trust representation and reasoning for trust management. Therefore, researchers have gradually begun to pay more attention to the research on subjective logic. Huang and Hu [9] considered the time related trust issue and proposed the extended subjective logic model. Using subjective logic, Yuan et al. [10] proposed an anomaly detection framework. Tian et al. [11] proposed a trust model based on subjective logic and the risk mechanism. Some scholars have pointed out that the fusion operator in some cases will produce an unreasonable result [12], but they have not considered that the three tuples (b,d,u) must meet the additivity of probability, in other words, the fact that the value of ‘b+d+u’ must equal one. The modified fusion operator does not meet this requirement. Zhou et al. [13] pointed out that the discounting operator increases the uncertainty in the operation by the fusion operator. They proposed a weight method to improve the fusion operator. This method carries out the discount operation in the calculation of trust value b and the relative uncertainty slightly increases. However, in both [12] and [13], the improved fusion operator does not meet associativity. This limits the practical application of the operator improved by [12] and [13]. Jøsang gives the transitivity (or discounting) operator. But the operator has the following problems: 1) in the trust transfer process, with the increasing depth of the trust chain, the trust discount is too rapid and the results are often inconsistent with the actual situation; 2) when the network node is more and more, the trust chain length is large and the computational complexity increases, which makes it difficult to ensure the practicality of the operator. We recognize that we can use an opinion to express weight. But for simplicity and efficiency, the weight W is set be a real number. As such, we can conceivably set the expectation of the subjective opinion as W.

This paper extends the theory of Jøsang’s subjective logic and proposes an ISLM-ED model. The main work of this paper accomplishing the following tasks: 1) Ensuring that the fusion operator that named the multi-agent unified fusion operator is improved. It is imperative that it not only meets the commutative and associative law but that it is also consistent with researchers’ cognitive rules. 2) Ensuring that the dynamic function for the base rate (a) and non-informative prior weight (C) through the changes of evidence are given. 3) Ensuring that the simulation experiments are carried out and comparing fusion operator proposed by Jøsang and Zhou et al. [13]

3. Jøsang’s Fusion Rule and Its Issues

Jøsang’s subjective logic is based on describing the beta distribution function of two events’ posteriori probability. Subjective logic theory proposes a certainty probability density function by computing an observed positive event ‘r’ and a negative event ‘s’. On this basis, the probability trust of each event produced among entities is calculated.

Jøsang et al. [3] proposed and used subjective logic to model the trust relationship. They introduced evidence space and opinion space to represent and measure the trust relationship and they also proposed a rich set of subjective logic operators for the deduction and calculation of the trust level. Subjective logic introduced subjective uncertainty into the trust notion. As such, it is able to express people’s subjective tendencies better than the classical probability theory can. It formed a set of relatively complete theory based on integrating predecessors’ experience.

Evidence space is comprised of a set of observed events that can be simply divided into a positive event and negative event. Opinion Space is comprised of a set of subjective opinions that can be expressed as ωXji={bXji,dXji,uXji}, and that satisfies the following conditions:

Where ωXji is the subjective opinion of observation period i to entity X_j; bXji,dXji,uXji describe absolute believability, absolute un-believability, and the uncertainty of entity X_j separately; ωXji is defined by Jøsang as the function of the positive event rXji and negative event sXji as follows:

The functions above are called Evidence Mapping Functions.

Let X = {x_i | i = 1, …, k} be a frame and let ω_X be an opinion on X with belief b and uncertainty mass u. Let a be a base rate vector on X. The function E(X) from X to [0, 1]k is expressed as:

This is called the probability expectation vector over X.

In order to provide an interpretation of the fusion operator in subjective logic, it is useful to consider a process that is observed by two sensors. A distinction can be made between the follow two cases.

4. The ISLM-ED Model

In this paper, there are three cases in the new fusion operator. They are as listed below:

4.1 Cumulative Fusion Operator

At the same frame of discernment X and the same agent’s opinions about x for cumulative fusion in different observation periods, because the cumulative fusion opinion is influenced by the observation period, the result may be different. Fig. 1 shows the distance diagram according to observation period.

Fig. 1

The distance diagram according to observation period.

Considering the different opinions ω_i by the same agent in N periods, (i = 1, 2,…, N), the influence on the fusion opinion can be studied according to the 3 cases listed below and as shown in Fig. 2:

Fig. 2

The influence of N periods to the fusion opinion.

1. Line 1 can be understood as the nearer time to the current, the greater the influence.

2. Line 2 can be understood as the further time to the current, the greater the influence. For example, a person’s first impressions are the strong.

3. Line 3 can be understood as the same influence on the fusion opinion among different periods. For example, the observation is a random event, and as such there is no effect on the fusion opinion among periods.

In different frame and environment, the fusion operator can be designed for different functions according to the actual situation. We designed simple function fun1 and fun2 as fusion operator examples, which correspond to line1 and line2 in Fig. 2, respectively. λ (i) denotes the influence coefficient of the opinion in i_th period to the cumulative fusion.

(7) fun1:λ(i)=i/∑i=1Ni

(8) fun2:λ(i)=(N-i)/∑i=1Ni

Supposing that the i_th agents’ opinion are: ωxi={bxi,dxi,uxi,axi} i∈[2,N], then, the N opinions for cumulative fusion operation are as follows:

(9) bN(x)=∑i=1Nλ(i)bxi

(10) uN=∑i=1Nλ(i)ui

4.6 Non-Informative Prior Weight with Evidence Driven

According to Jøsang’s evidence space mapping concept space theory, they define the number of negative evidences and positive evidences. The number of uncertain evidences should define the non-informative prior weight C before the observation period. This uncertainty that reflects on the evidence is expressed as the changes of the positive evidence numbers in different periods. There is a close relationship between C and the observation evidence. We give the definition of the non-informative prior weight C based on the obtained evidence in different observation periods.

There are M observations in each observation period and N observation periods in total. r_i denotes the positive evidence number of the i_th period. MAX_i and MIN_i denotes the maximum and minimum value of the positive evidence number in the former i periods.

(19) C1=M,

(20) Ci=MAXi-MINi, 2<=i<=N

Next, there are two groups of different observation data (see in Tables 1 and 2) in three periods for describing C’s design idea by analysis and comparison.

Table 1

The first group of the observation data

Table 2

The second group of the observation data

We found that that the positive evidence number increases as it changes. It changes from 30 to 40 in the second observation period of the first group, while it decreases as it changes in the second group (from 30 to 32). These changes reflect the changes in uncertainty levels. That is to say, the greater the change of the positive evidence number, the larger the uncertainty is. According to the formulas provided in (19) and (20), we can get the dynamic change of C.

5. Simulation Experiment

The experiment dataset was selected from the KDDCUP99 [17]. The 1999 KDD intrusion detection contest used the 1998 DARPA intrusion detection dataset to construct the connection records and to extract the object features. The 1998 DARPA intrusion detection dataset was acquired from nine weeks of raw TCP dumped data for a local area network (LAN) simulating a typical US Air Force LAN that was peppered with the following four main categories of attacks: DoS, Probe, U2R, and R2L. A connection record is a sequence of TCP packets starting and ending at some well-defined times, between which data flows to and from a source IP address to a target IP address under some well-defined protocol. Each connection is labeled as either normal, or as a specific type of attack. So, a normal record is defined as a positive event and an attack record is defined a negative event. We selected the 36,000^th–42,000^th records from the corrected data as experiment data. Assume that there are 600 records in each observation period and that there are 10 observation periods. Six observers gave each of the 600 records separately. That is to say, each observer provided 100 records. In order to use the new consensus operator, assume that the six observers’ weights were {0.5, 0.9, 0.7, 0.6, 0.8, and 0.8}. The statistical normal event number as positive evidence, the description see Table 3.

Table 3

The statistical positive evidence event number

Based on the data in Table 3, we compared and analyzed the ISLM-ED model, the model of contribution [13], and Jøsang’s model [16]. In the ISLM-ED model, the initial base rate was a₀=0.8. The discount coefficient was k=1, which means without consider the time effectiveness of evidence.

We could calculate all of the opinions by formula (1) and the opinion expectation by formula (2).

We calculated for 10 periods of the opinion expectations, respectively, as shown in Table 4 and Fig. 3.

Table 4

The opinion expectation in 10 observation periods using three models

Fig. 3

The opinion expectation in 10 observation periods. ISLM-ED=Improved Subjective Logic Model with Evidence Driven.

It can be directly observed via Fig. 3, that the network state is stable in the previous seven observation periods, that the expectation of the opinion changes little, and that the development trends in the three models are consistent. During the eighth observation, the expectation values decreased dramatically, which indicates that the network state decreased sharply and suffered an attack. The reflection of the eighth observation period for the 600 records is consistent with other periods. However, when the network state changes, it does not take into account the effect of the previous observation in Jøsang’s model. The expectation value of the opinion is too sensitive to dramatic changes that go quickly from 0.866 down to 0.190. According to the analysis in Section 3, we know that the fusion result is not unique and that it is inaccurate when using Jøsang’s fusion operator. In the ISML-ED model, a and C will change dynamically. This not only clearly reflects the change, but also not to be too sensitive; it can be more accurately reflect the actual situation of the network. Both the ISML-ED model and the contribution made by [13] have taken into consideration the effect of weight in the fusion operation of the opinion, and as shown in the Fig. 3, ISML-ED model and the contribution make by [13] are basically the same. However, for the computational complexity, the ISML-ED model is smaller than the model in the contribution made by [13]. What’s more, the fusion operator meets the associativity law in the fusion process in the ISML-ED model, while the others model do not meet this.

6. Conclusions

In this paper, we expand and enrich Jøsang’s subjective logic theory with the hope that this work can promote the development of the trust theory. The tasks include the multi-agent unified fusion operator and the dynamic function of the base rate (a) and non-informative prior weight (C). The multi-agent unified fusion operator is given by us. Finally, the results of the simulation experiments show that the ISLM-ED model is more reasonable and effective, and that it can better adapt to the changing environment. In our study, we have discovered that figuring out how to allocate the weights of observer is the next primary study that needs to be undertaken.

Article information Continued