Keywords

1 Introduction

Ratings can be found as a basis for trust in various networks including e-commerce and social media. Typically, actors will rate their interactions with one another. These individual ratings are propagated through the system, and considered by others when judging who is trustworthy. Timely and effective propagation is necessary for actors to accurately judge each other. Non-ideal networks introduce lag due to network connectivity, people providing ratings late, or other reasons. An attacker can exploit this lag by engaging actors who, due to lag, have not received news of the attacker’s prior negative behaviour and still consider them trustworthy. Broadly, we define a reputation lag attack as any instance where an attacker exploits a lag in the propagation of their negative reputation to allow them to perform negative actions they otherwise couldn’t have.

No substantial research or well-reported instances of the reputation lag attack exist (not much work has followed up [7], which introduced the notion). We do not know the scale, prevalence and effect on vulnerable networks remains unknown. Nonetheless, existing research [8] shows that the attack is viable on proposed trust systems. Attacks on trust systems often combine different types, and, e.g., fake ratings, Sybil accounts or camouflaging tactics are more obvious, so combined attacks may have been classified as these.

There is general theoretical model of reputation lag attacks. A formal model provides insight into the attacks, even without data. This paper takes a first step towards defining a general formal model of reputation lag attacks. The model successfully captures the core mechanism of the reputation lag attack: some user(s) must trust an attacker who they would not have trusted had no lag been present in the system. Three primary insights were gained from the model. Firstly, if users judge all actions equally regardless of when they occurred, there exists an ordering to the attacker’s actions which is always superior to any other ordering: the attacker first behaves positively; waits for that reputation to spread through the system; and then attempts to behave negatively as much as possible before being rejected by the users. This drastically reduces the search space of possible optimal sequences of actions for the attacker. Secondly, increasing the rate of communication between users relative to the attacker is always detrimental to the attacker in the average case. Finally, how to successfully performing a specified number of negative actions for a given instance of the system is an NP-hard decidability problem for the attacker.

2 Related Work

Distributed systems can use ratings or recommendations between actors as a basis for trust, where an actor’s reputation is defined through these ratings [19]. In such systems, reputation is imperative to actors’ decision-making processes, for example in marketplace environments [5, 18]. The delay present in the propagation of these ratings was first identified as a vulnerability by Kerr and Cohen [7] as the “reputation lag attack”. The vulnerability is not present in previous surveys on reputation systems [4, 13]. Hoffman, Zage and Nita-Rotaru [4] is an example of how the attack often went unrecognised. The authors decompose reputation systems into their constituent parts and discuss the vulnerabilities present in each. They are prudent in making rating propagation explicit within the dissemination stage. However, no notion of lag is considered here so the authors miss a likely environment for exploitation (focusing primarily on transmission integrity).

Even once discovered, the reputation lag attack remained largely unnoticed by the trust community, appearing in some subsequent surveys (e.g. [6, 15]) but not others (e.g. [10]). The first analysis is performed by Kerr and Cohen [8], when investigating the success of dishonest sellers against various proposed trust systems in a simulated marketplace. They conclude that the reputation lag attack, though somewhat successful, was largely less so than other attacks, acquiring less profit and beating fewer trust systems. This finding comes with two major caveats, however: Firstly, the authors’ intuitive but informal definition of reputation lag attacks assumes the attacker must at some point behave honestly. We find that no such restriction is necessary when defining the attack. The second caveat is the implementation of the lag. Every sale suffers from a constant lag before the buyer learns whether they have been cheated. There is no lag in the propagation of this information, however. This makes it difficult to separate how reputation lag effects buyers’ decision given that every sale is subject to the same reputation lag effect. An implication of the above two caveats is that according to their analysis the “re-entry attack” was more successful. We argue that, due to limitations in analysis, the attack was functionally identical to the “reputation lag attack”, except the attacker never needed to behave honestly (with even the author’s noting this). An issue is that, beyond the initial intuition, it is not always clear what a reputation lag attack entails. We feel the issues faced in existing research motivate an abstract formal model to avoid conflating the idiosyncrasies of an attack’s implementation with its analysis.

The reputation lag attack is not restricted to traditional reputation systems with many distributed networks being vulnerable to it. Commonly, strong security guarantees exist through the use of trusted authorities or shared secrets. In some networks, however, it is necessary to establish trust between nodes on a more ad-hoc basis [17]. Any delay in the communication of trust establishing information (and perhaps other “hopping” protocols) would be vulnerable to reputation lag attacks. For example, while research on reputation lag attacks in these contexts are not widespread, many instances of such networks encounter malicious peers and it is possible that the mechanisms against these attackers (e.g. distributed warning systems) are vulnerable to reputation lag attacks. Examples include peer-to-peer networks used for file-sharing (Gnutella, BitTorrent) [11, 20]; ad-hoc networks (mesh networks, vehicle-to-vehicle communication) [2, 14]; hardware networks (BGP/routing, IoT) [12]; and overlay networks (Tor, I2P) [1].

3 Preliminaries

In this section, some mathematical tools are defined for use later in the paper.

Sequences of events are an important notion through the paper as they are used to describe the sequential behaviour in time of the model presented herein. First, we define sequences recursively:

Definition 1 (Sequence)

A sequence \(\sigma \in \varSigma \) over an alphabet \(\mathcal {C}\) is recursively defined:

$$\begin{aligned} \sigma := {\left\{ \begin{array}{ll} \emptyset \\ \sigma \,{:}{:}\, c \in \mathcal {C}. \end{array}\right. } \end{aligned}$$

We may write \(\sigma \,{:}{:}\, \sigma '\) as a shorthand, where \(\sigma \,{:}{:}\,\emptyset = \sigma \) and \(\sigma \,{:}{:}\,(\sigma ' \,{:}{:}\, c) = (\sigma \,{:}{:}\, \sigma ') \,{:}{:}\, c\). It is useful to reason about the length of a sequence, \(|\overline{\sigma }|\), by letting \(|\emptyset | = 0\) and \(|\overline{\sigma }\,{:}{:}\, c| = |\overline{\sigma }| + 1\). This provides a mechanism for both differentiating the number of elements in sequences and assigning positions to elements of the sequence. To refer to elements or subsequences of a sequence by their position, we introduce indexing as follows:

$$\begin{aligned} \sigma _t = {\left\{ \begin{array}{ll} \sigma '_{t} &{} t < |\sigma | \wedge \sigma = \sigma ' \,{:}{:}\, c \\ c &{} t = |\sigma | \wedge \sigma = \sigma ' \,{:}{:}\, c \end{array}\right. } \end{aligned}$$
(1)
$$\begin{aligned} \sigma _{x \sim y} = {\left\{ \begin{array}{ll} \sigma _{x \sim y-1} \,{:}{:}\, \sigma _y &{} x < y \\ \sigma _{x} &{} x = y \end{array}\right. } \end{aligned}$$
(2)

It is useful to discuss the number of occurrences of a particular subset of elements in a sequence as well as the order in which that particular subset occurs irrespective of the other elements e.g. when analysing the behaviour of that particular subset alone. This is done by extracting the subsequence of a particular element from within a sequence. The function \(\sqsubset : 2^\mathcal {C}\times \varSigma \rightarrow \varSigma \) returns the subsequence of \(\overline{\sigma }\) consisting only of the members \(c \in C\) of the set of elements \(C \subseteq \mathcal {C}\):

$$\begin{aligned} C \sqsubset \sigma = {\left\{ \begin{array}{ll} (C \sqsubset \sigma ') \,{:}{:}\, c &{} \text {if } \sigma = \sigma ' \,{:}{:}\, c \text { where } c \in C \\ (C \sqsubset \sigma ') &{} \text {if } \sigma = \sigma ' \,{:}{:}\, c' \text { where } c' \not \in C \\ \emptyset &{} \text {if } \sigma = \emptyset \end{array}\right. } \end{aligned}$$
(3)

It is useful to be able to compare two sequences, where one sequence is essentially the same as another sequence, except it has certain additional actions sprinkled in. Intuitively \(\sigma \prec _C \sigma '\) means that we can transform \(\sigma '\) into \(\sigma \), by removing certain elements \(c \in C\) from \(\sigma '\). So, for \(c, c' \in C \subseteq \mathcal {C}\) s.t. \(c \not = c'\), we define \(\prec _C : 2^\mathcal {C}\times \varSigma \rightarrow \varSigma \):

$$\begin{aligned} \sigma \prec _C \sigma ' = {\left\{ \begin{array}{ll} True &{} \text {if } |C \sqsubset \sigma | < |C \sqsubset \sigma '| \\ &{} \;\;\; \wedge \, ((\mathcal {C}\backslash C) \sqsubset \sigma ) = ((\mathcal {C}\backslash C) \sqsubset \sigma ') \\ False &{} \text {otherwise} \end{array}\right. } \end{aligned}$$
(4)

Probability theory plays a significant part in the paper as the system is defined on continuous-time stochastic processes. If X is a (continuous) random variable, then \(X(\omega )\) represents the outcome of X, \(p(X = x)\) represents the probability density at x, \(\Pr (X < x)\) represents the probability that the outcome of X is below x; so \(\Pr (X < x) = \int _{-\infty }^x p(X = x) dx\).

The relevant stochastic processes can be modelled using continuous-time Markov chains [16]. Intuitively, a CTMC is a series of random variables indexed with a time t, representing the state at time t. More recent states are not influenced by older states, as the process must be memoryless [16].

Definition 2

A continuous-time Markov chain [16] is a continuous series of random variables \((S)_t\) for \(t \in \mathbb {R}\), such that for \(x> y > z\), \(\Pr (S_x = s | S_y = t) = \Pr (S_x = s | S_y = t, S_z = u)\) (Fig. 1).

Fig. 1.
figure 1

A graph of users \(\mathcal {U}= \{1,2,3\}\) and the independent attacker \(\mathcal {A}\) with rate \(r_\mathcal {A}\).

Full size image

4 Model

Our aim is to model the reputation lag attack. Honest users may communicate information to each other, but when and how often depends on external factors, such as internet connectivity, configuration settings or preference. We assume that honest users do not communicate strategically, and thus model them as stochastic processes. The attacker behaves strategically and tries to act in a way to maximise how often he can cheat others, relative to cooperating with others. However, the attacker is still bound to physical limitations, and cannot act at infinite speeds. The first step is to construct a model that defines how often certain users tend to communicate, as well as how often the attacker may be able to act. We refer to this model as the abstract model. The concrete model (Sect. 4.3) is an instantiation of the abstract model, and tells us the exact communication between users.

4.1 Abstract Model

The abstract model does not tell us what is being communicated, or what actions have occurred. In order to be able to reason about the concrete communications and actions (and thus the attacker’s strategy), we need to instantiate the attacker’s actions appropriately. The concrete model is defined in Sect. 4.3 to facilitate this. The final step will be to define and reason about the behaviour of the attacker.

The abstract model defines when two users communicate but not what they communicate. Attacker behaviour is not explicit in the abstract model, only when the attacker has an opportunity to act. We introduce the notion of abstract traces, which specify how and when users and the attacker communicate, but not what they communicate. Users may communicate at different rates. The attacker’s independent communication rate describes the rate at which they receive the opportunity to act.

Definition 3

An abstract system \(\overline{\psi }\in \overline{\varPsi }\) consists of a tuple \(\overline{\psi }= (\mathcal {U}, R, r_A)\): a set of users \(\mathcal {U}= \{i \in \{1,...,n\} \mid n \in \mathbb {N}_{>0} \}\); an \(n \times n\) matrix R describing the communication rates between users, with \(r_{ij} \in \mathbb {R}_{\ge 0}\) and \(r_{ii} = 0\); and the rate \(r_{A} \in \mathbb {R}_{\ge 0}\) with which the attacker acts.

An abstract trace is a sequence of abstract interactions between users and the attacker. It describes in what order interactions occurred for some particular instance of the stochastic system described in Subsect. 5. It is comprised of either the empty trace; an interaction between two users; an abstract attacker action; or the concatenation of two other traces. The trace semantics takes the form of sets of messages assigned to users, representing which messages those users have received:

Definition 4 (Abstract Trace)

An abstract trace \(\overline{\sigma }\in \overline{\varSigma }\) is a sequence over the alphabet \(\overline{\mathcal {C}}= \{c_{ij} \mid i,j \in \mathcal {U}\} \cup \{c_\mathcal {A}\}\).

As a shorthand, we may write \(r_{c}\) to mean \(r_{ij}\) or \(r_A\) if \(c = c_{ij}\) or \(c = c_{\mathcal {A}}\), respectively.

The abstract model defines a stochastic system (or probabilistic run) describing who interacts when. In this system, the actors communicate at intervals. The time between each communication is independent of the time between the preceding communications. Formally, every action in the abstract alphabet can be modelled as a series of random variables representing the time between occurrences of that action.

Definition 5

A probabilistic run of the abstract system \(\overline{\psi }\) consists of collection of series of random variables satisfying the Markov property. For each \(c \in \overline{\mathcal {C}}\), the probability density functions of the corresponding series \((m \ge 0)\) of random variables are:

$$\begin{aligned} p(\tau _{c}^{m} = t) = r_c e^{-r_c t} \end{aligned}$$

We let \(\lambda _{c}^{k}\) be a random variable representing the time in which the \(k^{\mathrm {th}}\) c-action occurred: \(\lambda _{c}^{k}(\omega ) = \sum _{0 \le i \le k} \tau _{c}^{i}(\omega )\).

The probabilistic run can be viewed as a distribution over possible traces. In particular, we can say that the probabilistic run defines a (continuous-time) Markov chain, where the state consists of the current trace. First, we define the

Definition 6

The abstract system execution is a continuous series of random variables \((S)_t\) for \(t \ge 0\), such that \(S_0(\omega ) = \emptyset \), and for every t, there exists \(t' < t\) such that either \(S_t(\omega ) = S_{t'}(\omega )\) or \(S_t(\omega ) = S_{t'}(\omega ) \,{:}{:}\, c\). The latter case occurs if and only if \(t' \le \lambda _{c}^{k}(\omega ) \le t\).

The random variable \(S_{10}\) would give you the distribution of all abstract traces of the abstract system running for 10 time units. Intuitively, the state only changes at times where the probabilistic run determines an action occurs. The definition implicitly assumes that no two actions happen at exactly the same time (and the probability of this occurring is indeed 0).

First we prove a lemma showing that the occurrence of an interaction within a particular time range is independent from any events occurring before that time range.

Lemma 1

\(\Pr (t< \lambda _{c}^{k+1} < t' \mid \lambda _{c}^{k+1} > t) = \Pr (\tau _{c}^{k+1} \le t' - t)\).

Proof

\(\Pr (t< \lambda _{c}^{k+1} < t' \mid \lambda _{c}^{k+1} > t)\) \(=\) \(\Pr (t< \lambda _{c}^{k} + \tau _{c}^{k+1} < t' \mid \lambda _{c}^{k} + \tau _{c}^{k+1} > t)\) \(=\) \(\Pr (t - \lambda _{c}^{k}< \tau _{c}^{k+1} < t' - \lambda _{c}^{k} \mid \tau _{c}^{k+1} > t - \lambda _{c}^{k})\) \(=\) \(\frac{\Pr ((t - \lambda _{c}^{k}< \tau _{c}^{k+1} < t' - \lambda _{c}^{k}) \wedge (\tau _{c}^{k+1}> t - \lambda _{c}^{k}))}{\Pr (\tau _{c}^{k+1} > t - \lambda _{c}^{k})}\) \(=\) \(\frac{\int ^{t' - \lambda _{c}^{k}}_{t - \lambda _{c}^{k}} r_c e^{- r_c t_c} dt_c}{\int ^{\infty }_{t - \lambda _{c}^{k}} r_c e^{- r_c t_c} dt_c}\) \(=\) \(\frac{e^{- r_c (t - \lambda _{c}^{k})} - e^{- r_c (t' - \lambda _{c}^{k})}}{e^{- r_c (t - \lambda _{c}^{k})}}\) \(=\) \(1 - e^{- r_c (t' - t)}\) \(=\) \(\Pr (\tau _{c}^{k+1} \le t' - t)\)    \(\square \)

The abstract system execution is a continuous-time Markov chain:

Proposition 1

The abstract system execution satisfies, for \(x> y > z\), that \(\Pr (S_x = \overline{\sigma }_x | S_y = \overline{\sigma }_y) = \Pr (S_x = \overline{\sigma }_x | S_y = \overline{\sigma }_y, S_z = \overline{\sigma }_z)\).

Proof

Recall that user communications are exponentially distributed. The definition of an abstract system execution trivially implies that \(\overline{\sigma }_{1 \sim x} = \overline{\sigma }_{1 \sim y} \,{:}{:}\, \overline{\sigma }'\), for some \(\overline{\sigma }'\). If \(\overline{\sigma }_{1 \sim x} = \overline{\sigma }_{1 \sim y}\), then \(\Pr (S_x = \overline{\sigma }_x | S_y = \overline{\sigma }_y) = \Pr (\forall _{c,m} \lambda _{c}^{m} \not \in [y, x]) = \Pr (S_x = \overline{\sigma }_x | S_y = \overline{\sigma }_y, S_z = \overline{\sigma }_z)\). If \(\overline{\sigma }_x = \overline{\sigma }_y \,{:}{:}\, c\), then \(\Pr (S_x = \overline{\sigma }_x | S_y = \overline{\sigma }_y) = \Pr (\forall _{c'\ne c,m} \lambda _{c'}^{m} \not \in [y, x] \wedge \exists ^1_{m} \lambda _{c}^{m} \in [y, x]) = \Pr (S_x = \overline{\sigma }_x | S_y = \overline{\sigma }_y, S_z = \overline{\sigma }_z)\), again, by the memorylessness of the exponential distribution. If \(\overline{\sigma }'\) isn’t \(\emptyset \) or in \(\overline{\mathcal {C}}\), then we can take \(x> y' > y\) and recursively apply the argument.    \(\square \)

In the abstract trace, the probability distribution for the “next” interaction to occur is independent of all previous occurrences. Specifically, the probability is dependent only on the relative interaction rates.

Proposition 2

For all times t and \(t'\) s.t. \(t' > t\) and for all abstract alphabets \(\overline{\mathcal {C}}\), \(\Pr (S_{t'} = \overline{\sigma }\,{:}{:}\, c | S_{t} = \overline{\sigma })\) increases with \(r_c\) relative to \(r_{c'} \in R\).

Proof

W.l.o.g. for each set of occurrences of some interaction c we define a single natural number \(k_c\) such that \(\forall _{c \in \overline{\mathcal {C}}} \exists ^1_{k_c} \lambda _{c}^{k_c} \le t < \lambda _{c}^{k_c+1}\). Again, w.l.o.g. we define \(t' = \min \{ \lambda _{c}^{k_c+1} \mid c \in \overline{\mathcal {C}}\}\).

By applying Lemma 1, we note that the probability that some interaction c occurs within an interval \([t,t']\) is \(\Pr (\lambda _{c}^{k+1} \in [t,t'] \mid \lambda _{c}^{k+1} > t) = \Pr (\tau _{c}^{k+1} \le t' - t)\) which is a result of the memorylessness of the exponential distribution.

From this we may conclude that for two interactions c and \(c'\) with distributions \(\tau _{c}^{} = r_c e^{- r_c t_c}\) and \(\tau _{c'}^{} = r_{c'} e^{- r_{c'} t_{c'}}\) respectively: \(\Pr (t< \lambda _{c}^{k_c+1}< \lambda _{c'}^{k_{c'}+1} \mid \lambda _{c}^{k_c+1}, \lambda _{c'}^{k_{c'}+1} > t) = \Pr (\tau _{c}^{k_c+1} < \tau _{c'}^{k_{c'}+1}) = \int ^\infty _0 r_{c'} e^{-r_{c'} t_{c'}} \int ^{t_{c'}}_0 r_c e^{-r_c t_c} dt_c dt_{c'} = \int ^\infty _0 r_{c'} e^{-r_{c'} t_{c'}} (1 - e^{-r_{c} t_{c'}}) dt_{c'} = \nicefrac {r_c}{(r_c + r_{c'})}\). This monotonically increase with \(r_c\) and decreases with \(r_{c'}\).

Thus, \(\Pr (S_{t'} = \overline{\sigma }\,::\, c \mid S_t = \overline{\sigma }) = \Pr (\lambda _{c}^{k_c+1} = \min \{ \lambda _{c'}^{k_{c'}+1} \mid c' \in \overline{\mathcal {C}}\}) = \bigwedge _{c' \in \overline{\mathcal {C}}, c' \not = c}\)\(\Pr (t< \lambda _{c}^{k_c+1} < \lambda _{c'}^{k_{c'}+1} \mid \lambda _{c}^{k_{c}+1}, \lambda _{c'}^{k_{c'}+1} > t) = \prod _{c' \in \overline{\mathcal {C}}, c' \not = c} \nicefrac {r_c}{(r_c + r_{c'})}\) which monotonically increase with \(r_c\) and decreases with each \(r_{c'}\). The last step follows from the fact that each interaction is independently distributed. Thus the theorem holds.    \(\square \)

4.2 Reputation

Before defining the concrete model, it is important that we capture the notion of reputation. We do this through the judgement function \(\delta \). We define a judgement function as any function that defines a metric over ratings (messages) that establishes the reputation of the attacker. Users will not accept interactions with a disreputable attacker. Despite this generalised definition of \(\delta \), there are some properties which we consider key to the definition of a rational judgement function:

  1. 1.

    Only information known by a user can be made when judging an incoming interaction on behalf of that user.

  2. 2.

    Positive actions must be rewarded and negative actions punished.

  3. 3.

    The judgement function must accept interactions from an attacker with no known prior behaviour to ensure they can enter the system.

There are many additional properties a judgement function could satisfy. Furthermore, it would be simple to extend the model to allow different users to utilise different judgement functions thus representing the various tolerances different users may have to the attacker’s behaviour. However, for the purposes of an initial analysis, the simple \(\delta \) defined for all users in this paper considers only the number of \(\top \) and \(\bot \) interactions known to user i as arguments. This means, for instance, it is independent of the order in which messages were received and the time at which interactions occurred.

Definition 7

The function \( \delta : \mathbb {N}_0 \times \mathbb {N}_0 \rightarrow \mathbb {R} \) is an arbitrary function with the following properties:

$$\begin{aligned} \delta (m', n)> \delta (m,n) \;{\textit{when}}\; m' > m \end{aligned}$$
(5)
$$\begin{aligned} \delta (m, n') < \delta (m,n) \; {\textit{when}} \; n' > n \end{aligned}$$
(6)
$$\begin{aligned} \delta (0,0) \ge 0 \end{aligned}$$
(7)

4.3 The Concrete Model

In the concrete model, the attacker instantiates their abstract actions with concrete actions consisting of an action applied to a user. Actions can have a positive impact or a negative impact, increasing or decreasing the actor’s reputation respectively. Positive actions are denoted \(\top \) and negative ones \(\bot \). When the attacker interacts with a user through one of the above actions, a message, held by that user, is generated. This message contains information regarding what action the attacker performed. It is then propagated through the graph of users, who then use this information to judge the trustworthiness of the attacker. This captures the notion of reputation. A user receiving messages from different users reporting e.g. a positive action, must be able to distinguish which particular action is being reported. We assume users can distinguish different actions and model this using a unique index for each action.

Definition 8

The concrete system \(\psi \in \varPsi \) is composed of a tuple \(\psi = (\mathcal {U}, R, r_A, M, \varTheta , \delta , \mathcal {A}, \varrho , \varGamma )\): set of users \(\mathcal {U}= \{1, \dots , n\}\); an \(n \times n\) matrix R describing the communication rates between users, with \(r_{ij} \in \mathbb {R}_{\ge 0}\) and \(r_{ii} = 0\); the rate \(r_{A} \in \mathbb {R}_{\ge 0}\) with which the attacker acts; a set of concrete messages \(M = \{(\theta , i, x) \mid \theta \in \varTheta , i \in \mathcal {U}, x \in \mathbb {N}\}\); two possible results \(\varTheta = \{\top , \bot \}\); a judgement function \(\delta \); an attacker function \(\mathcal {A}\); an attacker profit function \(\varrho \); and an instantiation function \(\varGamma \).

Every abstract trace \(\overline{\sigma }\) has a set of corresponding concrete traces. A concrete trace \(\sigma \) is an abstract trace \(\overline{\sigma }\) that has had every abstract attacker action \(c_{\mathcal {A}}\) substituted with a concrete attacker action. Concrete actions consist of interacting positively or negatively with a user i (\(c^{\top }_i\) or \(c^{\bot }_i\)) or skipping a turn (\(c^{\textvisiblespace }\)).

Definition 9 (Concrete Trace)

An concrete trace \(\sigma \) is a sequence over the alphabet \(\mathcal {C}= \{c_{ij} | i,j \in \mathcal {U}\} \cup \{c^\theta _i | \theta \in \varTheta , i \in \mathcal {U}\} \cup \{c^{\textvisiblespace }\}\).

The family of functions defining the set messages known by users in the concrete system is defined:

Definition 10

The function \(\mu ^{O \subseteq \varTheta }_{i > 0} : \varSigma \rightarrow 2^M\) returns the set of messages held by user i concerning actions of a type in T given that the trace \(\sigma \) occurred:

$$\begin{aligned} \mu ^{O}_{i}(\sigma ) = {\left\{ \begin{array}{ll} \mu ^{O}_{i}(\sigma ') \cup \mu ^{O}_{j}(\sigma ') &{} \sigma = \sigma ' \,{:}{:}\, c_{ji} \\ (\theta , i, |\sigma |) \cup \mu ^{O}_{i}(\sigma ') &{} (\sigma = \sigma ' \,{:}{:}\, c^{\theta }_{i}) \wedge (\theta \in O) \\ \mu ^{O}_{i}(\sigma ') &{} \sigma = \sigma ' \,{:}{:}\, c ,\; \textit{for}\; \textit{other}\; c \\ \emptyset &{} \sigma = \emptyset \\ \end{array}\right. } \end{aligned}$$
(8)

We introduce the shorthand:

$$\begin{aligned} \mu ^{O}_{}(\sigma ) = \bigcup \limits ^\mathcal {U}_{i=1} \mu ^{O}_{i}(\sigma ) \end{aligned}$$
(9)
$$\begin{aligned} \delta _{i}(\sigma ) = \delta (|\mu ^{\top }_{i}(\sigma )|,|\mu ^{\bot }_{i}(\sigma )|) \end{aligned}$$
(10)
$$\begin{aligned} \delta _{}(\sigma ) = \delta (|\mu ^{\top }_{}(\sigma )|,|\mu ^{\bot }_{}(\sigma )|) \end{aligned}$$
(11)

5 Reputation Lag Attack

Above we have defined the environment in which the reputation lag attack can occur. Now, we define the attacker model and the attack itself.

5.1 The Attacker Model

In this model, the attacker \(\mathcal {A}\) is captured as a function which outputs a trace of concrete attacker actions which, when substituted into an abstract trace, instantiates a set of abstract attacker action. The attacker function can instantiate each abstract action with one of three actions \(c^{\top }_i\), \(c^{\bot }_i\) or \(c^{\textvisiblespace }\). The attacker aims to maximise their profit.

Informally, profit is (rationally) defined as any function which monotonically increases with the attacker’s negative interactions and decreases with their positive interactions i.e. the profit depends on the number of negative interactions the attacker has committed relative to the number of positive interactions they have invested into the system. As such, an “optimal attacker” is defined as an attacker which, for all abstract traces \(\overline{\sigma }\), can commit the maximum number of negative interactions when restricted to a particular number of positive interactions and/or given an abstract trace of finite length i.e. maximise their profit given finite resources and/or finite time.

Definition 11

The attacker’s profit function \(\varrho : \varSigma \rightarrow \mathbb {R}\) is subject to the following constraints:

$$\begin{aligned} \varrho (\sigma ) < \varrho (\sigma ') \; \textit{when}\; \mu ^{\top }_{}(\sigma ) > \mu ^{\top }_{}(\sigma ') \; \textit{if} \; \mu ^{\bot }_{}(\sigma ) = \mu ^{\bot }_{}(\sigma ') \end{aligned}$$
(12)
$$\begin{aligned} \varrho (\sigma )> \varrho (\sigma ') \; \textit{when}\; \mu ^{\bot }_{}(\sigma ) > \mu ^{\bot }_{}(\sigma ') \; \textit{if} \; \mu ^{\top }_{}(\sigma ) = \mu ^{\top }_{}(\sigma ') \end{aligned}$$
(13)

In this model, different types of attacker can be delineated by how much information they have of the system when making decisions i.e. what subset of the system is considered by the attacker \(\mathcal {A}(s \subseteq \psi )\). For example, it is important to consider how much of the abstract trace \(\overline{\sigma }\) and attacker is aware of when making decisions. Note, for the purposes of a security analysis, assuming an apparently overestimated attacker is useful for testing the constraints of the system and providing strong guarantees of the system’s resilience against attack. We will consider this when choosing \(\mathcal {A}\):

  1. 1.

    Attacker Model 1 in which the attacker is omniscient to the past and future i.e. the attacker can view the full abstract trace \(\overline{\sigma }\) at will. This attacker’s power is somewhat unrealistic as it grants the attacker the ability to see the future when making decisions but, as stated, for the purposes of a security analysis this is not unreasonable. For instance, an eavesdropping attacker that monitors a system long enough to notice a pattern in the system behaviour could be captured somewhat realistically by this model. Thus, this is the model considered in this paper.

  2. 2.

    Attacker Model 2 in which the attacker is an eavesdropper to the entire system but is only aware of the past when making decisions i.e. for each abstract attacker action \(\overline{\sigma }_x = c_\mathcal {A}\), the attacker can view \(\overline{\sigma }_{1 \sim x - 1}\).

  3. 3.

    Attacker Model 3 in which the attacker is blinded to every interaction in \(\overline{\sigma }\) which is not an attacker action i.e. the attacker only sees \(c_\mathcal {A}\sqsubset \overline{\sigma }\).

Similarly, the attacker’s knowledge of other aspects of the system such as the user rates R or the judgement function \(\delta \) can also be allowed or restricted to different extents. However, given the fact that the attacker is solely concerned with instantiating an abstract trace such that their profit is maximised, for the most powerful attacker it is sufficient to only consider the abstract trace \(\overline{\sigma }\) and the and judgement function \(\delta \).

Using this information the attacker generates a trace of concrete attacker actions \(\dot{\sigma }\) such that \(|\dot{\sigma }| = |c_\mathcal {A}\sqsubset \overline{\sigma }|\). This attack trace is then substituted into the full abstract trace to make a concrete trace \(\sigma \):

Definition 12 (Attack Trace)

An attack trace \(\dot{\sigma }\in \dot{\varSigma }\) is a sequence over the alphabet \(\dot{\mathcal {C}}= \{c^\theta _i | \theta \in \varTheta , i \in \mathcal {U}\} \cup \{c^{\textvisiblespace }\}\).

Definition 13

Attack traces are constructed by the attacker function \(\mathcal {A}: \overline{\varSigma } \times (\mathbb {N}_0 \times \mathbb {N}_0 \rightarrow \mathbb {R}) \rightarrow \dot{\varSigma }\) defined thus:

$$\begin{aligned} \mathcal {A}(\overline{\sigma }, \delta ) = {\left\{ \begin{array}{ll} \emptyset \\ \dot{\sigma }\,{:}{:}\, c^{\theta }_i &{} \; \textit{where} \; (i > 0) \wedge (\theta \in \varTheta ) \\ \dot{\sigma }\,{:}{:}\, c^{\textvisiblespace } &{} \\ \end{array}\right. } \end{aligned}$$
(14)

We give no explicit definition of the function itself and instead explore its properties in Sect. 6. The attack trace \(\dot{\sigma }\) is then substituted into the abstract trace \(\overline{\sigma }\) to construct the concrete trace \(\sigma \). This is performed by an instantiation function. To model the fact that users will not accept interactions with a disreputable attack, the instantiation function will substitute any rejected attacker actions with a \(c^{\textvisiblespace }\) action. User i judges the attacker at each attacker action \(c^{\theta \in \varTheta }_i\) via \(\delta \) with only the information known to them:

Definition 14

The instantiation function \(\varGamma : \overline{\varSigma } \times \dot{\varSigma } \rightarrow \varSigma \) is defined:

$$\begin{aligned} \varGamma _{\delta }(\overline{\sigma }, \dot{\sigma }) = {\left\{ \begin{array}{ll} \emptyset &{} if \; \overline{\sigma }= \dot{\sigma }= \emptyset \\ c_{ij} \,{:}{:}\, \varGamma _{\delta }(\overline{\sigma }', \dot{\sigma },) &{} if \; \overline{\sigma }= c_{ij} \,{:}{:}\, \overline{\sigma }' \\ c \,{:}{:}\, \varGamma _{\delta }(\overline{\sigma }', \dot{\sigma }') &{} if \; (\overline{\sigma }= c_{\mathcal {A}} \,{:}{:}\, \overline{\sigma }') \wedge (\dot{\sigma }= c \,{:}{:}\, \dot{\sigma }') \wedge (\delta _{i}(\sigma ') \ge 0) \\ c^{\textvisiblespace } \,{:}{:}\, \varGamma _{\delta }(\overline{\sigma }', \dot{\sigma }') &{} if \; (\overline{\sigma }= c_\mathcal {A}\,{:}{:}\, \overline{\sigma }') \wedge (\dot{\sigma }= c \,{:}{:}\, \dot{\sigma }') \wedge (\delta _{i}(\sigma ') < 0) \end{array}\right. } \end{aligned}$$
(15)

If none of the attacker’s actions are denied by a user, we deem that attack trace complete for \(\overline{\sigma }\). Otherwise, we deem it incomplete for \(\overline{\sigma }\).

5.2 The Reputation Lag Attack

Here the reputation lag itself is defined in terms of the model presented thus far. Informally, a reputation lag attack occurs when the attacker is allowed to perform a (presumably malicious) interaction with a user who would have rejected the interaction had they had perfect information of the attacker’s prior actions. By construction, any example of imperfect user knowledge within this model stems directly from a failure of the system to propagate the messages in a timely manner. While this definition is very high-level, it successfully captures every instance which could be considered a reputation lag attack.

If an attacker interaction with user i is accepted by that user using only the information (messages) known to them but is rejected when using all the information present in the system, then a reputation lag attack has occurred.

First, we define an omniscient instantation function in which users judge the attacker with all the information available in the system:

Definition 15

The omniscient instantiation function \(\varGamma ^* : \overline{\varSigma } \times \dot{\varSigma } \rightarrow \varSigma \) is defined:

$$\begin{aligned} \varGamma ^*_{\delta }(\overline{\sigma }, \dot{\sigma }) = {\left\{ \begin{array}{ll} \emptyset &{} if \; \overline{\sigma }= \dot{\sigma }= \emptyset \\ c_{ij} \,{:}{:}\, \varGamma ^*_{\delta }(\overline{\sigma }', \dot{\sigma }) &{} if \;\overline{\sigma }= c_{ij} \,{:}{:}\, \overline{\sigma }' \\ c \,{:}{:}\, \varGamma ^*_{\delta }(\overline{\sigma }', \dot{\sigma }') &{} if \; (\overline{\sigma }= c_{\mathcal {A}} \,{:}{:}\, \overline{\sigma }') \wedge (\dot{\sigma }= c \,{:}{:}\, \dot{\sigma }') \wedge (\delta _{}(\sigma ') \ge 0) \\ c^{\textvisiblespace } \,{:}{:}\, \varGamma ^*_{\delta }(\overline{\sigma }', \dot{\sigma }') &{} if \; (\overline{\sigma }= c_\mathcal {A}\,{:}{:}\, \overline{\sigma }') \wedge (\dot{\sigma }= c \,{:}{:}\, \dot{\sigma }') \wedge (\delta _{}(\sigma ') < 0) \end{array}\right. } \end{aligned}$$
(16)

Here we define the reputation lag attack indicator. If the attacker has an increased profit when instantiated normally compared to when instantiated by the omniscient function (i.e. if the attacker has successfully exploited the lag for their own gain), a reputation lag attack has occurred.

Definition 16

The reputation lag attack indicator is defined:

$$\begin{aligned} \mathtt {RLA}^{\varrho }_{\delta }(\overline{\sigma }, \dot{\sigma }) = {\left\{ \begin{array}{ll} 1 &{} \varrho (\varGamma _{\delta }(\overline{\sigma }, \dot{\sigma })) > \varrho (\varGamma ^*_{\delta }(\overline{\sigma }, \dot{\sigma })) \\ 0 &{} \varrho (\varGamma _{\delta }(\overline{\sigma }, \dot{\sigma })) = \varrho (\varGamma ^*_{\delta }(\overline{\sigma }, \dot{\sigma })) \end{array}\right. } \end{aligned}$$
(17)

6 Results

The primary motivation for the above formalism is to provide insight into the reputation lag attack. Here we elicit the three following key properties of the attack: the definition of \(\delta \) defined herein is shown to be vulnerable to a superior ordering of attacker actions; increasing the rate of user communication is shown to never be detrimental to the users and could be detrimental to the attacker in the average case; the decidability problem of whether the attacker can perform a specified number of negative actions is shown to be have an NP-hard computational complexity.

6.1 Attack Ordering

The order in which the attacker executes their actions has an impact on their success. In a structured attack trace, the attacker goes through three phases: a \(\top \) phase, a \(\textvisiblespace \) phase and a \(\bot \) phase. In a given phase, the attacker only executes actions of that type. We show that structured attack traces, under the particular \(\delta \) defined in the above model, are always superior to unstructured strategies. Intuitively, this results from the fact that positive actions occurring earlier in the trace gives them more chance to be propagated whilst negative occurring later in the trace have less time to be propagated.

Definition 17

Define the reflexive partial order \(<_\mathcal {A}\) on attacker actions, s.t. \(c_i^{\top }<_\mathcal {A}c^{\textvisiblespace } <_\mathcal {A}c_j^{\bot }\), for all i, j. We define the partial order \(<_\mathcal {A}\) on traces as \(\dot{\sigma }\,{:}{:}\, c \,{:}{:}\, c' \,{:}{:}\, \dot{\sigma }' <_\mathcal {A}\dot{\sigma }\,{:}{:}\, c' \,{:}{:}\, c \,{:}{:}\, \dot{\sigma }'\) iff \(c <_\mathcal {A}c'\).

Proposition 3

For every \(\dot{\sigma }\), there is a minimal element \(\dot{\sigma }' <_\mathcal {A}\dot{\sigma }\), and this minimal element has the property that it is a structured attack trace.

Proof

If \(\dot{\sigma }'\) is structured, then there is no \(\dot{\sigma }' = \dot{\sigma }_1 \,{:}{:}\, c \,{:}{:}\, c' \,{:}{:}\, \dot{\sigma }_2\) where \(c' <_\mathcal {A}c\), so \(\dot{\sigma }'\) is a minimal element. Vice versa, any minimal element may not be of the shape \(\dot{\sigma }' = \dot{\sigma }_1 \,{:}{:}\, c \,{:}{:}\, c' \,{:}{:}\, \dot{\sigma }_2\) either, so it must structured.

Theorem 1

For all abstract traces \(\overline{\sigma }\); attack traces \(\dot{\sigma }\) and \(\dot{\sigma }' <_\mathcal {A}\dot{\sigma }\) (where \(\dot{\sigma }\) is complete for \(\overline{\sigma }\)); users i; and locations \(x \le |\overline{\sigma }|\): \(\delta _{i}(\varGamma _{\delta }(\overline{\sigma }, \dot{\sigma }')) \ge \delta _{i}(\varGamma _{\delta }(\overline{\sigma }, \dot{\sigma }))\)

Proof

Consider two adjacent attacker actions \(\dot{\sigma }_a\) and \(\dot{\sigma }_{a+1}\). We denote their corresponding positions in the abstract (or concrete) traces as \(\overline{\sigma }_{y}\) and \(\overline{\sigma }_{z}\) respectively. Two cases follow from this: \(\dot{\sigma }_a <_\mathcal {A}\dot{\sigma }_{a+1}\) and \(\dot{\sigma }_{a+1} <_\mathcal {A}\dot{\sigma }_a\).

Case 1 (\(\dot{\sigma }_a <_\mathcal {A}\dot{\sigma }_{a+1}\)): This implies \(\dot{\sigma }' \dot{\sigma }\). In this, it follows trivially that \(\delta _{i}(\varGamma _{\delta }(\overline{\sigma }, \dot{\sigma }')) \ge \delta _{i}(\varGamma _{\delta }(\overline{\sigma }, \dot{\sigma }))\)

Case 2 (\(\dot{\sigma }_{a+1} <_\mathcal {A}\dot{\sigma }_a\)): We construct \(\dot{\sigma }'\) by swapping the two elements in question: \(\dot{\sigma }' = \dot{\sigma }_{1 \sim a-1} \,{:}{:}\, \dot{\sigma }_{a+1} \,{:}{:}\, \dot{\sigma }_a \,{:}{:}\, \dot{\sigma }_{a+2 \sim |\dot{\sigma }|}\). This implies that \(\sigma _{1 \sim x-1} = \sigma '_{1 \sim x-1}\) and \(\sigma _{y+1 \sim |\sigma |} = \sigma '_{y+1 \sim |\sigma '|}\). We consider the case where \(\dot{\sigma }_{a+1} = \dot{\sigma }'_a = c^\top _i\). We notice two things: firstly, user i is still aware of the \(c^\top _i\) action at the time of \(\sigma '_{z}\) and so has lost no information in comparison to \(\sigma \).

Secondly, we notice that the earlier introduction of \(c^\top _i\) creates the opportunity for it to be propagated between \(\sigma '_{y}\) and \(\sigma '_{z}\) and thus possibly even further. Essentially, more users \(u \not = i\) may be aware of the \(c^\top _i\) in \(\sigma '\) than in \(\sigma \) from point y onward: for all users u and locations \(x \ge y\), \(\mu ^{\top }_{u}(\varGamma _{\delta }(\overline{\sigma }, \dot{\sigma })_{1 \sim x}) \subseteq \mu ^{\top }_{u}(\varGamma _{\delta }(\overline{\sigma }, \dot{\sigma }')_{1 \sim x}) \implies |\mu ^{\top }_{u}(\varGamma _{\delta }(\overline{\sigma }, \dot{\sigma }')_{1 \sim x})| \ge |\mu ^{\top }_{u}(\varGamma _{\delta }(\overline{\sigma }, \dot{\sigma }')_{1 \sim x})|\).

A symmetrical argument in the case that \(\dot{\sigma }_a = \dot{\sigma }'_{a+1} = c^\bot _i\) leads us to conclude that the each user is aware of less or equal negative actions after the swap: for all users u and locations \(x \ge |\sigma |\), \(|\mu ^{\bot }_{u}(\varGamma _{\delta }(\overline{\sigma }, \dot{\sigma }')_{1 \sim x})| \le |\mu ^{\bot }_{u}(\varGamma _{\delta }(\overline{\sigma }, \dot{\sigma })_{1 \sim x})|\). We also see from both arguments that the case in which one of the swapped attacker actions are \(c^{\textvisiblespace }\), that particular action has no effect on the knowledge of the users i.e. the inequality holds trivially. By the definition of \(<_\mathcal {A}\), it is not possible for two actions to be swapped where both actions are of the same type (e.g. where both are positive).

The increased awareness of positive interactions and the decreased awareness of negative ones coupled with the monotonicity of \(\delta \) implies that, for all users i and locations \(x \le |\sigma |\), \((|\mu ^{\top }_{u}(\varGamma _{\delta }(\overline{\sigma }, \dot{\sigma }')_{1 \sim x})| \ge |\mu ^{\top }_{u}(\varGamma _{\delta }(\overline{\sigma }, \dot{\sigma })_{1 \sim x})|) \wedge (|\mu ^{\top }_{u}(\varGamma _{\delta }(\overline{\sigma }, \dot{\sigma }')_{1 \sim x})| \le |\mu ^{\top }_{u}(\varGamma _{\delta }(\overline{\sigma }, \dot{\sigma })_{1 \sim x})|)\)

\(\implies \delta _{i}(\varGamma _{\delta }(\overline{\sigma }, \dot{\sigma }')_{1 \sim x}) \ge \delta _{i}(\varGamma _{\delta }(\overline{\sigma }, \dot{\sigma })_{1 \sim x})\).

By transitivity of \(<_\mathcal {A}\), the proof for pairs holds for all traces. Proposition 3 shows that the optimal ordering is structured.    \(\square \)

Thus, for all complete attack traces, structured traces are superior. We restrict our theorem to complete attack traces as incomplete traces contain counterexamples and any optimal attack trace will be complete. Structuring may not affect profit but it reduces the search space of attack traces as the optimal strategy must be structured. However, structuring is dependent on the judgement function. A judgement function in which reputation decays with time would be sensitive to abrupt changes in behaviour such as in a structured attack trace, thus making time-dependent judgement a simple but effective mitigation.

6.2 Effect of Communication Rates on the Attacker Strategy

Considering a structured attack trace \(\dot{\sigma }\) with optimal dealing (i.e. the users are aware of every \(\top \) in the system when the attacker is in their \(\bot \) phase), we show that increasing the communication rates is detrimental to the attacker. For the purposes of this analysis we focus on effectively cheating users, hence the assumption that we are in a state where the knowledge of the deals has spread to all users, and the attacker is in the \(\bot \) stage of their structured attack.

We formulate our theorem as follows:

Theorem 2

Let \(\overline{\psi }, \overline{\psi }'\) be a pair of abstract systems differing only in their respective matrices \(R, R'\), such that \(\exists _{i,j} (r_{ij} < r'_{ij}) \wedge (\forall _{p \not = i, q \not =j} r_{pq} = r'_{pq})\).

For any time \(t > 0\); any attack trace \(\dot{\sigma }<_\mathcal {A}\dot{\sigma }\); any concrete trace \(\sigma = \sigma ^{\top }\,::\, \sigma ^{\textvisiblespace } \,::\, \sigma ^{\bot }\) s.t. \(\forall _{i \in \mathcal {U}} c^\bot _i \sqsubset (\sigma ^\top \,::\, \sigma ^{\textvisiblespace }) = \emptyset \) and \(\forall _{i \in \mathcal {U}} \mu ^{\top }_{i}(\sigma ^{\top }\,::\, \sigma ^{\textvisiblespace }) = \mu ^{\top }_{}(\sigma ^{\top }\,::\, \sigma ^{\textvisiblespace })\); and any pair of system executions \(S_t\) and \(S'_t\) corresponding to abstract systems \(\overline{\psi }\) and \(\overline{\psi }'\) then:

\(\Pr (\mathtt {RLA}^{\varrho }_{\delta }(S'_t(\omega ), \dot{\sigma }) = 1) < \Pr (\mathtt {RLA}^{\varrho }_{\delta }(S_t(\omega ), \dot{\sigma }) = 1)\)

Proof

For notational convenience, we define \(C_\mathcal {U}= \{c_{ij} \mid r'_{ij} = r_{ij} \}\) and \(C'_\mathcal {U}= \{c_{ij} \mid r'_{ij} > r_{ij}\}\)

We prove that if \(\sigma \prec _{C'_\mathcal {U}} \sigma '\), then the attacker’s reputation during their misbehaving phase (i.e. during \(\sigma ^\bot \)) can only decrease in \(\sigma '\) compared to their reputation in \(\sigma \). If \(\sigma = \sigma _1 \,{:}{:}\, \sigma _2\) and \(\sigma ' = \sigma _1 \,{:}{:}\, c_{ij} \,{:}{:}\, \sigma _2\) for some \(c_{ij} \in C'_\mathcal {U}\), then for every user h, either \(\mu _h(\sigma ') = \mu _h(\sigma )\) or \(\mu _h(\sigma ') = \mu _h(\sigma ) \cup \mu _j(\sigma _1)\). The latter means that the messages j told i after \(\sigma _1\) have reached h, the former means that they have not, implying \(\mu _h(\sigma ) \subseteq \mu _h(\sigma ')\). For any two traces with \(\sigma \prec _{\{c_{ij}\}} \sigma '\) we can iteratively apply this argument for the additional messages. Due to the well-disseminated good messages \(\forall _{i \in \mathcal {U}} \mu ^{\top }_{i}(\sigma ^{\top }\,::\, \sigma ^{\textvisiblespace }) = \mu ^{\top }_{}(\sigma ^{\top }\,::\, \sigma ^{\textvisiblespace })\) and the fact that no new good interactions occur in \(\sigma ^{\bot }\), it is not possible for the users to learn any good messages during \(\sigma ^{\bot }\). This, combined with the monotonicity of \(\delta \), implies that the users may only know additional negative messages during the attacker’s \(\bot \) phase. Thus the reputation can only decrease along with the possibility of a reputation lag attack occurring. For notational convenience (and brevity), if we define w.l.o.g. \(\{k_1, \dots , k_n\}\) as the set of indices of the attacker’s \(\bot \) actions in trace \(\sigma \) and \(\{k'_1, \dots , k'_n\}\) as the corresponding indices in \(\sigma '\): \(\forall _{i \in \mathcal {U}} \forall _{x \in [1,n]} (\mu ^{\top }_{i}(\sigma _{1 \sim k_x}) = \mu ^{\top }_{i}(\sigma '_{1 \sim k'_x})) \wedge (\mu ^{\bot }_{i}(\sigma _{1 \sim k_x}) \subseteq \mu ^{\bot }_{i}(\sigma '_{1 \sim k'_x})) \implies \delta _i(\sigma '_{1 \sim k'_x}) \le \delta _i(\sigma _{1 \sim k_x}) \implies \mathtt {RLA}^{\varrho }_{\delta }(\overline{\sigma }', \dot{\sigma }) \le \mathtt {RLA}^{\varrho }_{\delta }(\overline{\sigma }, \dot{\sigma })\). Thus, \(\sigma '\) is more robust to the reputation lag attack than \(\sigma \). This is our first finding.

Now we show that \(\overline{\psi }'\) has a higher probability of outputting traces with more communication (and which are thus more likely to be robust) than \(\overline{\psi }\). By definition, the probability of n occurrences of \(c_{pq}\) before some time t is described by a homogeneous Poisson process [9]: \(\Pr (N(t)_{pq} = n) = \frac{(r_{pq} t)^n}{n!} e^{-r_{pq} t}\). When t is the time of the last event in an abstract trace, this shows us that the expected number of occurrences of \(c_{pq}\) within a trace increases with the rate \(r_{pq}\) independently of any other rate or interaction \(c_{ij} \not = c_{pq}\).

Similarly to Lemma 1, it can also be shown that the probability of n occurrences of \(c_{pq}\) happening between times \(t_1\) and \(t_2\) is dependent only on the time range \([t_1,t_2]\) and independent of the events preceding \(t_1\). Thus, \(\forall _{t_2> t_1} \Pr (N(t_1< t < t_2)_{pq} = n \mid t > t_1)) = \Pr (N(t_2 - t_1)_{pq} = n)\). From this we see that the expected number of \(c_{pq}\) occurrences within a given time range increases with only its own rate \(r_{pq}\) independently of events prior to that time range or any other rate. For example, the number of \(c_{pq}\) occurrences between two other actions \(\overline{\sigma }_1, \overline{\sigma }_2 \not = c_{pq}\) is dependent only on \(r_{pq}\) and the time between the actions.

From the above two findings alongside the premise, we may infer that the system execution \(S'_t\) is as likely to output a particular number and ordering of \(C_\mathcal {U}\) interactions as \(S_t\) but is more likely to output \(C'_\mathcal {U}\) interactions between any two \(C_\mathcal {U}\) interactions. Hence, the traces output by \(S'_t\) are more communicative and, by our first finding in this proof, more likely to be robust than those of \(S_t\):

  • \((\frac{\Pr (|C'_\mathcal {U}\sqsubset S'_t(\omega )|> |C'_\mathcal {U}\sqsubset S_t(\omega )|)}{\Pr (|C'_\mathcal {U}\sqsubset S'_t(\omega )|< |C'_\mathcal {U}\sqsubset S_t(\omega )|)}> 1) \wedge (\frac{\Pr (|C_\mathcal {U}\sqsubset S'_t(\omega )| > |C_\mathcal {U}\sqsubset S_t(\omega )|)}{\Pr (|C_\mathcal {U}\sqsubset S'_t(\omega )| < |C_\mathcal {U}\sqsubset S_t(\omega )|)} = 1)\)

  • \(\implies \frac{\Pr (S_t{\omega } \prec _{C'_\mathcal {U}} S'_t{\omega })}{\Pr (S'_t{\omega } \prec _{C'_\mathcal {U}} S_t{\omega })} > 1 \implies \Pr (\mathtt {RLA}^{\varrho }_{\delta }(S'_t(\omega ), \dot{\sigma }) = 1) < \Pr (\mathtt {RLA}^{\varrho }_{\delta }(S_t(\omega ), \dot{\sigma }) = 1)\).

Thus the theorem holds.    \(\square \)

6.3 NP-Hardness

While strategies may exist to improve the attacker’s profit in different scenarios, it is important to consider the feasibility of the optimal attacker. A polynomial optimal strategy for a given judgement function would be the ideal goal for any attacker. However, we show below that, for any judgement function, the computation complexity of constructing a strategy which can perform a specified number of negative interactions is NP-hard.

Theorem 3

For any judgement function \(\delta \), the decidability problem of whether it is possible to perform m cheats without performing deals is NP hard.

Proof

We provide a reduction to the 3-SAT problem, which is NP-complete [3]. In this proof outline, we provide the reduction itself, but omit the full proof that it is indeed a reduction. The full proof is a tedious exercise in bookkeeping, whereas the reduction provides insight in why it is NP-hard.

Let \(X = x_1 \dots x_k\) be the set of variables in the 3-sat problem. Let \(\ell _{ij}\) be the \(j^\mathrm {th}\) literal in the \(i^\mathrm {th}\) clause. Assume there are n clauses.

For each variable take a user for its positive and negative atom, take a user for each literal in the formula, and we add an additional pair of users for every variable: \(\mathcal {U}= \{u_{x_i}, u_{\lnot x_i} | x_i \in X\} \cup \{v_{ij} | \ell _{ij}\} \cup \{v_{x_i}, v_{\lnot x_i} | x_i \in X\}\). A pseudo clause is formed by each pair of users in the last set – they represent the clause \(x \vee \lnot x\). There are a total of \(n+k\) (pseudo) clauses. The set \(U^{\ge h} = \{v_{ij} | i \ge h, \ell _{ij}\} \cup \{v_{x_i}, v_{\lnot x_i} | i+n \ge h, x_i \in X\}\). As a short-hand, we say a set of users performs a kill-communication, if they communicate their messages to all other users (\(O(n^2)\)).

Consider an abstract trace \(\overline{\sigma }\) with the following shape:

  • The trace starts with k attacker actions.

  • Then, for \(h \in [1, \dots k+n]\) do:

    • Users \(U^{\ge h}\) perform a kill-communication.

    • The users \(u_x\), \(u_y\), \(u_z\), corresponding to the inverse of literals \(\ell _{h1}\), \(\ell _{h2}\), \(\ell _{h3}\) send a single communication to the respective literals.

    • The attacker gets 1 action.

    • All users \(u_x\) and \(u_\lnot x\) communicate to \(\ell _{h1}\), \(\ell _{h2}\), \(\ell _{h3}\).

  • After performing these \(k+n\) steps, the attacker gets k more actions.

The decidability question for k variables and n clauses is whether the attacker can perform \(n + 3k\) actions. The size of the trace \(\overline{\sigma }\) is \(O(n^3)\), which is polynomial.    \(\square \)

7 Conclusion

The formalism captured the two core properties of the attack: firstly, users inaccurately judging the reputation of the attacker due to incomplete knowledge caused by reputation lag and, secondly, a malicious actor exploiting this for their personal gain. The primary aim of the paper was to gain insight regarding the attacker’s strategies to help with both mitigation and detection of the attack. There were three key outcomes: Theorem 1 shows how to re-order the attacker’s actions, to increase the power of the attack: the attacker behaves positively; waits for this reputation to spread to as many users as possible; then begins behaving as negatively as possible before the users reject them. The fact that our judgement function, which models reputation, does not have a decay factor is a crucial ingredient for this theorem. Trust/reputation with decay factors may be somewhat more resistant against these attacks. Theorem 2 showed that, when dealing with an optimally dealing attacker, increasing user communication rates cannot be detrimental to users and may be detrimental to the attacker. Intuitively, this follows directly from the definition of the reputation lag attack which relies on poor user communication. However, as also evidenced by Theorem 3, the issue of determining the effectiveness of attacks is difficult, so it is important to have a proof of our intuitions. Finally, Theorem 3 showed that performing a specified number of negative interactions given any instance of the system \(\overline{\sigma }\) is an NP-hard problem, implying the optimal attacker is computationally unfeasible.

Our definitions were chosen to be sufficiently abstract to cover a variety of systems and are readily extendable to more than one particular reputation system. The class of systems we consider are those systems where users communicate certain information about how other users have acted in the past, where good behaviour offsets bad behaviour, and too much bad behaviour leads to refusing to interact. We argue that many systems that consist of a distributed set of entities communicating knowledge about one another could be defined through the presented model with some modification.

Here we discuss further study. There is much to learn about the system and its effect on the attacker e.g. the effects of different judgement functions or how profit functions affect them. Investigating the combination of the reputation lag attack with other attacks may be of use for learning in which environments the attack is likely to be. Identifying real-world examples of the attack would also offer insight into the effectiveness of the model. Further investigation into the attacker’s strategy is a vital next step as understanding identifying likely attack patterns is imperative not only to mitigating but also to detecting reputation lag attacks in the wild.

This paper provided a formal model of the reputation lag attack. The formalism captured the core properties of reputation lag attacks. The formalism allowed us to prove three interesting properties of the reputation lag attack: deals before cheats, communication benefits users but not the attacker, and finding optimal attacks is NP-hard. However, the analysis presented here is still in early stages. We hope to apply some of our techniques in practice, as well as continue to strengthen the formalism. The attacker’s strategies and their relationship with the system as a whole warrants further study.