Proposing a Distributed Algorithm to Finding Malevolent Entities and

Improving Security in E-Commerce Environments

Fatemeh Fouladfar
Department of Computer, Faculty of Engineering, University of Isfahan, Isfahan, Iran
fatemeh_fouladfar@[Link]

Abstract—In the context of e-commerce, the concept of Since all the calculations are carried out on a single
security involves two areas: hard security and soft security. machine in central mechanisms, the computation cost and
Hard security includes cryptography, information hiding and execution time are higher than distributed algorithms,
other standards, while soft security is associated with the which distribute the computational burden on the nodes
methods which are based on trust. finding malevolent entities
or malevolent agents are one of the most important concepts
of the network equally. Moreover, debugging central
in e-commerce. Thus, sufficient attention should be paid to algorithms is difficult and in case of a failure, the whole
their security. Since the centralized security management network stops working[2].Therefore, in wide area
architecture in e-commerce environment and cannot have networks with large number of users, the central
enough effectiveness nor be implemented, with the aim of algorithms are not successful. In addition, in those
overcoming the limitations of centralized architectures, a metrics where calculations are performed centrally, the
distributed and dynamic algorithm is proposed to finding node that performs the calculations should have access to
malevolent entities and improving security. This algorithm all information. Therefore, the graph nodes must disclose
uses a distributed network. The results of this study indicate all their information to the server. The problem that arises
that the proposed algorithm is capable of finds malevolent
entities and improves security in a fast and efficient manner.
is that how we can trust the central node? Secondly, how
can central nodes communicate with and trust each other?
Keywords —hard security, soft security, distributed algorithm, In distributed systems, the calculation is not the
e-commerce security,malevolent entities, distributed network responsibility of a central node and all the nodes are
involved in the calculation. The major benefit of
[Link] distributed algorithms is the availability of the calculated
With the growth of e-commerce organizations, their security factor for the entities. In addition, the entities
security needs are being exposed. In the area of e- only reveal their comments to their reliable entity.
commerce, accessing products and selling them is Therefore, since security management in a centralized
possible at any time and place, and each entity or agent manner is not practical in e-commerce and distributed
(buyer, seller) communicate dynamically with other areas, a distributed and dynamic algorithm is proposed in
unknown entities. There is a chance that the entities are this research to overcome the shortcomings of centralized
malevolent, so security is one of the most important schemes.
factors in the formation of transactions in e-commerce. In this algorithm, a distributed network is presented to
Security in e-commerce can be investigated from two discover and deal with malevolent entities and at the
aspects: hard security and soft security. Hard security same time improve the security.
includes cryptography, watermarking and other Section 2 of this paper is concerned with the
standards. Regarding soft security, trust-based methods introduction of the distributed network. In section 3, the
are used[1]. malevolent entities act deceptively. They distributed algorithm and the proposed framework are
inject false data into the network, present false products talked about. Section 4 is about the simulation while the
and assign unfair rates to products and vendors which simulation results are presented in Section 5. The
should be controlled by soft security since this cannot be conclusion is presented in section 6.
done through hard security. In the majority of researches,
there is a central algorithm which measures the security
of entities (products, buyers and sellers). In addition, this
algorithm maintains and manages the feedbacks [1].

1
978-1-5090-2172-7/16/$31.00 ©2016 IEEE
 II. The PROPOSED DISTRIBUTION NETWORK network instead of centeral point which calculates the
In this study, for improving security and dealing with security of entities (buyers, sellers and products), each
malevolent entities, a distributed network is proposed. In node or each entity is responsible for identifying
this network, an entity(buyer, seller) assigns a privilege malevolent entities. Upon receiving information from
to another entity through its own observations and the neighbors, each entity acquires a view of the entire
from other more honest neighbors. In the proposed network topology, calculates the security directly, and
network, a security graph is created and is used through additionally forms a directed weighted graph. As a result,
the publishing of information from information others. In entities reveal their comments about other entities only to
fact, each entity(buyer, seller) records the information other reliable entities.
about its neighbors in the memory and computing
security is done in an aggregative manner through the III. The PROPOSED DISTRIBUTION ALGORITHM
observation of the entity itself along with the The pseudo code on how to calculate the target
recommendations of neighbors. To receive function of the proposed algorithm is shown in Figure 1.
recommendations from the reliable entities, each entity This algorithm is a maximization function algorithm
sends a request for information about another entity to the whose aim is to choose the best entity (seller) and the
network. After receiving the results, recommendations best and the most secure product. Since the systems are
that are within the threshold are accepted. Therefore, if an vulnerable to attacks from malevolent entities, false
entity is malevolent and enters wrong information into recommendations and erroneous data, this algorithm
network, it will be identified and removed. The proposed calculates all aspects of security in a distributed manner.
network includes some privileges which entities assign to For these calculations, the distributed network described
each other. The network is represented as a directed in section 2 is used.
graph (A, E, R) where A is the set of entities (nodes), E is
the set of edges (links), and R is the mapping of
E → [D , 1 ]
2
. This mapping assigns the security level of
within the [D , 1 ]
+
R (c , d ) = ( R ( c , d ) , R − ( c , d )) 2

range to each pair (c, d) which are the connected entities.

+ −
R (c , d )
and R ( c , d ) are defined as the positive and
negative privileges respectively which entityC assigns to
entityD.
In the proposed network, buyers are modeled by
G u = ( vu , E u ) vu
where is a set of buyers and E u is a
set of relationships among them. Each buyer ( v u ) has
several features including <name, ID, type, organization,
job>.
Sellers are modeled by G p ( v p , E p ) . Each seller
has several features including <name, ID, type, product
name, company name >. And finally, products are
Fig. 1: The target function of the proposed algorithm
modeled by G s ( v s , E s ) . Each product has also some
features including <name, ID, type, product seller, In the proposed algorithm, instead of using a central
product buyer, product descriptions, product quality>. point which calculates the security of the buyer, seller
Each entity (buyer , seller) creates and maintains its and product, evaluating the received information is done
network separately. Also, using a traversal algorithm, the by more honest entities(buyer , seller). This system works
values can be extracted from the network. This network in a distributed manner and each agent calculates the
is also used to increase the number and the quality of security of other entities’ products through its
recommendations of entities, discover and deal with observations and the recommendations of other reliable
malevolent entities and also improve security. entities. According to the framework in figure 2, after
If security is only computed directly (ie, the receiving a request from the network administrator, each
experiences that an entity has from the features of another agent calculates the overall rate of the security of
entity), a malevolent entity can form a stream of events products, sellers and buyers both periodically and in a
which are beneficial to itself and publish it into the distributed manner, and then recommends a list of the
network. This results into the publishing of misleading best products (with the maximum security) to buyers.
information into the network. Therefore, in the proposed

2
978-1-5090-2172-7/16/$31.00 ©2016 IEEE
 agents ( sellers)

repository
security calculator
proposed distribution
algorithm
total Security
graphical seller interface

the best product according to

the buyer's request

request Feedback
showing results

network administrator

showing results Feedback

request

Graphical buyer interface

(GUI)

repository

buyer
Fig. 2: The proposed framework

3
978-1-5090-2172-7/16/$31.00 ©2016 IEEE
 The network administrator has a duty to send the • Case Study
request of buyers to reliable entities or reliable agents so In the area of e-commerce, many tasks are more
that entities can offer a list of the best products to them. complex that they may not be conducted only by one
These products meet the needs of buyers. According to single service or products. As a result, a combination of
the received results from interactions, the network services is used to do more complicated tasks. For
administrator updates the distributed network. The mathematical formulas and solving problems, a
network administrator shows a list to buyers which is combination of services can also be used. The first case
consisted of the best products (with the highest security) study is a scenario of formulas used in the field of
that entities recommend to buyers. computer networks which is the formula to calculate
efficiency in stop-and-wait approach. One of the most
important tasks of the data link layer is the flow control
[Link]
between sender and receiver. There are many classical
The proposed algorithm is simulated in an e-commerce software-based methods to control the flow, one of the
environment using the Java language. [Link] MVC which is stop-and-wait whose efficiency is obtained from
5.0 technology is the main design platform (MVC is one equation 1 [5].
of the architectures of Java that was implemented in
.Net). Products and the repository database are
implemented using the Web API and Fluent Nhibernate TF
: frame transmission time, according to equation 2 is
on SQL SERVER 2012 respectively.
equal to the length of the frame divided by the bit rate
[5].
•
Introduction to Web API
Web API is a new and easy way to build
services and products which can be used in a TP :
frame publish time, according to equation 3 is the
variety of projects in .Net. This technology allows distance between two stations divided by the speed of
developers to build some secure, reliable and propagation of the signal in the channel [5].
transaction-based solutions[3].Web API is based
on HTTP. As a result, web technologies such as
GET, POST, PUT and DELETE are sufficient to
T ACK
perform various actions. The most important : ACK transmission time: according to equation 4 is
advantage of Web API is that all advantages of the length of the ACK frame divided by the bit rate [5].
different models of building distributed systems
are integrated in one single, flexible unit [3].
Through supporting all existing technologies and
at the same time being independence of all PF
: Probability of error in the frame of length L shown
communication protocols, Web API offers in equation 5 [5].
numerous possibilities to the developers of
distributed systems [4]:
Since Web API supports a large number of Pbit
standards, security, reliability and transactions : Probability of error per each transmitted bit
with any other platform that is compliant with
those standards may exist. The result of these
capabilities is more strength and less complexity.

V. EVALUATION
To evaluate the proposed model, the algorithm is
implemented using the Java programming language in
simulated environments. In the evaluation section, the
proposed algorithm is compared with other similar
algorithms. To do this, a case study is carried out which
is described below. Fig. 3: The formulas of efficiency in stop-and-wait approach

4
978-1-5090-2172-7/16/$31.00 ©2016 IEEE
 In the first evaluation, the percentage of the accuracy of The third evaluation is about the comparison of the
the proposed algorithm is compared with the global execution time of the and the global genetic algorithm[7].
genetic algorithm [6]. As shown in Figure 4, the accuracy It is clear from Figure 6 that the execution time of the
of the proposed algorithm is higher than the genetic proposed algorithm is lower than that of the genetic
algorithm in all tests. Table 1 shows the details of the algorithm.
modes used in the first and second evaluations
respectively.

Table 1: The modes used in the first and second evaluation

Fig. 6: The comparison of execution time of the proposed

algorithm and the global genetic algorithm

According to results, in global methods such as global

genetic algorithms and harmony, the optimization
problem becomes multi-dimensional if more than one
criterion is considered for selecting the product, and thus
obtaining the optimal solution is exponential. Moreover,
the output of the global method is not clear for a
particular input. This is due to the random nature of the
algorithm which means the result will vary in each run of
the algorithm and the output that is returned by the
algorithm is non-deterministic, i.e. an optimal solution
Fig. 4: Comparison of average accuracy of the proposed algorithm with may not exist. Since the proposed method tries to select
the global genetic algorithm the best product, its precision and optimization rates are
higher and its execution time is lower as compared to the
The second evaluation compares the optimization rate global algorithms.
of global genetic algorithm[6] and the proposed In Figure 7, an experiment is carried out to compare the
[Link] measure shows the answer of each proposed algorithm with an algorithm in which the
approach. All 20 states have been tested. Figure 5 shows calculations are done in a centralized manner. Since the
that the optimization rate of the proposed algorithm is proposed algorithm is implemented in a distributed
higher than that of the global genetic algorithm. manner, its computational load and run-time are lower
compared to algorithm in which the calculations are done
in a centralized manner. Therefore, as the figure shows,
with an increase in the of products, the execution time of
the centralized algorithm increases much more sharply.

Fig. 5: The comparison of the optimization rate of the global genetic

algorithm and the proposed algorithm Fig. 7: The comparison of execution time of the proposed distributed
and the centralized algorithms

5
978-1-5090-2172-7/16/$31.00 ©2016 IEEE
 In this study, a distributed network was proposed to [4] TugberkUgurlu , Alexander Zeitler , Ali Kheyrollahi,Pro
deal with malevolent agents or entities and also improve [Link] Web API HTTP Web Services in [Link],2013.
security. Therefore, according to Figure 8, the proposed
model improves security in the presence of false [5] Andrew s. Tanenbaum, Computer Networks, 4th Edition,
recommendations, erroneous data and malevolent entities prentice Hall, 2003.
or malicious agents.
[6] Thierens, D., 2010, genetic algorithms, Evol. Comput.
7:331–352.

[7] Yu, T.-L., Goldberg, D. E., Yassine, A. and Chen, Y.-P.,

2011, A genetic algorithmstructure matrix genetic
algorithm, Artificial Neural Networks in
Engineering(ANNIE 2003), pp. 327–332.

[8] Head, M.M., &Hassanein, Trust in E-Commerce:

Evaluating the Impact of third-party seals. Retrieved
August 30, 2012.

[9] Smith, R., & Shao, J. 2007. Privacy and ECommerce:

Fig. 8: The comparison of average error rate of the proposed A consumer-centric perspective. Retrieved August 15,
algorithm and the centralized algorithm
2012.

VI. CONCLUSION [10] K. K. Mookhey, Common Security Vulnerabilities in e-

commerce Systems, 2012.
Since security management in a centralized manner is
not practical in e-commerce and distributed areas, a [11] Kesh, framework for analyzing e-commerce security,
distributed and dynamic algorithm is proposed in this Information Management & ComputerSecurity. Vol.10,
research to overcome the shortcomings of centralized Iss.4, 2013.
schemes. In this algorithm, a distributed network is
proposed to detect malevolent entities, deal with them
and also improve the security. In this algorithm,
computing security is done in an aggregative manner
through the observation of the entity itself along with the
recommendations of more honest neighbors. The
proposed algorithm was simulated in an e-commerce
environment and the results were analyzed and evaluated.
The simulation results show that the proposed
algorithm calculates the security of each product
correctly even in the presence of malevolent entities and
their false data. Another thing was that this algorithm
discovers malevolent entities and improves security with
a high efficiency rate and in a short time. This algorithm
has a high level of flexibility and with regard to its
architecture, it can be used in other areas such as Web-
based e-stores, grid computing and so on.

REFERENCES

[1] Eamonn O’Raghallaigh “Major Security Issues in E-

Commerce” web sciences.

[2] S.W. Smith “A Survey of E-Commerce Privacy and

Security Applications”, Web ALPS.

[3] FilipWojcieszyn,[Link] Web API 2 Recipes: A

Problem-Solution Approach 1st Edition, 2013.

6
978-1-5090-2172-7/16/$31.00 ©2016 IEEE