Peer-to-Peer Networking and Applications (2019) 12:951–968

[Link]

Reputation based approach for improved fairness and robustness

in P2P protocols
Francis N. Nwebonyi 1 & Rolando Martins 1 & Manuel E. Correia 1

Received: 8 November 2017 / Accepted: 19 November 2018 / Published online: 6 December 2018
# Springer Science+Business Media, LLC, part of Springer Nature 2018

Abstract
Peer-to-Peer (P2P) overlay networks have gained popularity due to their robustness, cost advantage, network efficiency and openness.
Unfortunately, the same properties that foster their success, also make them prone to several attacks. To mitigate these attacks, several
scalable security mechanisms which are based on the concepts of trust and reputation have been proposed. These proposed methods
tend to ignore some core practical requirements that are essential to make them more useful in the real world. Some of such
requirements include efficient bootstrapping of each newcomer’s reputation, and mitigating seeder(s) exploitation. Additionally,
although interaction among participating peers is usually the bases for reputation, the importance given to the frequency of interaction
between the peers is often minimized or ignored. This can result in situations where barely known peers end-up having similar trust
scores to the well-known and consistently cooperative nodes. After a careful review of the literature, this work proposes a novel and
scalable reputation based security mechanism that addresses the aforementioned problems. The new method offers more efficient
reputation bootstrapping, mitigation of bandwidth attack and better management of interaction rate, which further leads to improved
fairness. To evaluate its performance, the new reputation model has been implemented as an extension of the BitTorrent protocol. Its
robustness was tested by exposing it to popular malicious behaviors in a series of extensive PeerSim simulations. Results show that
the proposed method is very robust and can efficiently mitigate popular attacks on P2P overlay networks.

Keywords Trust . P2P . Edge clouds . Reputation . And security

1 Introduction dependency on centralized infrastructure (including standard

cloud computing infrastructures), especially in highly dense
Computing is currently drifting towards the network edge due environments such as stadiums, concerts and museums where
to increased interest in decentralized solutions that offer en- communication infrastructures are normally under strain.
hanced privacy preserving algorithms, better data locality and Generally speaking, P2P distributed networks are able to
alternative communication infrastructures. As an example, incorporate remote users by allowing them to connect easily
there are growing opportunities to engage the resources and and in an open manner to each other, thereby making commu-
properties of mobile devices in creating platforms to harvest nication cheaper, convenient and readily available. They can be
resources locally, through the use of hyper local clouds, also very dynamic: self-organizing, self-discovering and self-
called edge clouds [1]. These edge clouds offer a way to reduce adapting. This opposes the traditional centralized systems
which can be expensive and sometimes lack availability. But
several security issues remain unsolved [2], and different forms
* Francis N. Nwebonyi of aggressive attacks still target online P2P systems [3, 4].
fnwebonyi@[Link] The literature emphasizes trust and reputation based methods
as the way forward. This is demonstrated by many trust models
Rolando Martins
rmartins@[Link] which have already been proposed [5–11], targeting different
P2P platforms. Successful online commercial services such as
Manuel E. Correia
mcc@[Link]
Ebay use some of these methods to help users to discern who
to transact with, based on their reputation. Kazaa also used a
1
Faculty of Sciences, University of Porto, & CRACS/INESC-TEC, reputation management system, where users rate the participation
Porto, Portugal level of each other, by giving more grade to those that share
952 Peer-to-Peer Netw. Appl. (2019) 12:951–968

genuine contents frequently [8]. Similarly, BitTorrent adopts a and with respect to how much they have gained from
‘give and take’ method known as tit-for-tat. Although this is it. This concept played a significant role towards mit-
not exactly a reputation based system, it also rewards users that igating bandwidth attacks. It is further discussed in
contribute more to the network. section 5.2.
In this work, we have reviewed some popular trust and
reputation models in the literature that are aimed at addressing In order to assess our approach, we tested it on a classical
security challenges in distributed networks and P2P in partic- BitTorrent protocol, via detailed simulations. BitTorrent is used
ular. By identifying and building on their strengths, we de- mainly because of its popularity and well-known behavior, but
rived a method that can address their perceived weaknesses. our approach is designed to be adaptable to other similar P2P
Based on the review which is discussed in section 4, some of protocols. Our implementation has been done using PeerSim,
the noticed weaknesses (which also highlights our areas of an event based simulator [14] which has an implemented ver-
key contributions) are summarized as follows: sion of BitTorrent. The remaining part of this work is organized
as follows; an introduction to trust concepts is given in section
I. Most earlier methods focus mainly on how to mitigate 2. Section 3, provides an overview of BitTorrent, and describes
attacks from malicious nodes after they have joined the some well-known attacks on P2P networks, while section 4
network, but pay less attention to stopping or limiting discusses some related works. The proposed method is present-
malicious peers from joining initially. Those who attempt ed in section 5, succeeded by detailed description of experi-
to overcome this limitation often require pre-established ments and discussion of results in section 6. Conclusion and
trust relationships over other channels, or some central future work then appears in section 7.
entity such as server or super nodes which can constitute
prime target for attacks. The new method overcomes these
barriers and provides a distributed and fairer means of 2 Trust concept
bootstrapping reputation scores for newcomers.
II. Current methods tend to channel huge effort towards Trust has been identified as a crucial concept in digital secu-
protecting client nodes from malicious server nodes (or rity, without which it would be difficult to reason about the
seeders), but little attention is often given to the protection security of any system in a convincing manner [15]. While it is
of server nodes from malicious clients, especially in distrib- difficult to narrow trust down to a single universal definition,
uted P2P platforms. This gives rise to a form of bandwidth we adopt the view of Gambetta et al. [16] who defined it as a
attack which has escaped the attention of most trust and level of subjective probability on which a party bases his as-
reputation models in the literature. This attack has been sessment that another party will act in a certain manner, before
shown to have adverse potential effect on P2P networks monitoring the action (or even if he is not able to monitor it),
such as BitTorrent [12, 13], it is further discussed in section and given that the assessment affects his own action.
3. To the best of our knowledge, our work is the first to To consider an entity trustworthy means to have high prob-
tackle bandwidth attack (on seeders) in a distributed P2P ability that such entity will act favorably or at least in a manner
reputation model, based on actual leecher-to-leecher behav- that is not harmful, within a given context. Trust is context
ior of peers. The new method empowers both client and dependent, more like saying that you can trust a lawyer’s legal
server nodes to directly identify attackers and act fairly. advice but not his advice on how to fix your car. It is usually
III. It is a common practice to use interaction experience be- based on some sort of relationship; direct, indirect or both.
tween Btrustor^ and Btrustee^ to determine reputation and Reputation is usually a basis for determining trust, which
trust. In some cases, number of good interactions minus the implies that if an entity has maintained a good reputation
bad ones normally form the bases for direct reputation and during past interactions, it can be accorded a level of trust that
trust scores. Other times, it is based on the ratio of good to would warrant subsequent interaction, within a context.
total number of interactions. But the cumulative interaction Reputation can be seen as a view about an entity within a
rate barely reflects in the end result. This sometimes leads community, which is generally known and assessed by the
to situations where more familiar node(s) may have little or members of that community [17].
no noticeable advantage over a less familiar one. In the new Broadly speaking, trust can be direct, indirect or hybrid.
method, this silent interaction rate concept (or ‘familiarity’) Direct trust is achieved by observing a neighbor directly, with-
is accounted for, as a way of encouraging consistency out involving a third party. On the other hand, the concept of
among nodes. When nodes have similar reputation scores, trust transitivity is usually harnessed to establish indirect trust,
the new method would give priority to the agent with which involves gathering recommendations from neighbors
higher interaction rate, to reward consistency. Each about an entity. The indirect trust of a trustee is dependent
peer is also monitored to see how much they have on the observation of other entities concerning its behavior
invested in the network relative to their capabilities during their past interactions. These observations are usually
Peer-to-Peer Netw. Appl. (2019) 12:951–968 953

communicated to the trustor in the form of recommendations. [22] also use this method, assigning default score to newcomers.
A trustor is a node who decides whether or not to trust another Sometimes, this method is slightly extended, by taking the
peer, the trustee. weighted average, instead of the normal average. The extended
There is also a hybrid of these two forms of trust. It in- version allows for taking the reputation of the recommending
volves the combination of direct and indirect trust to achieve node (or similar factors) into account, as done in [8].
even a stronger paradigm. This becomes particularly impor-
tant when the trustor does not have enough information based 2.1.3 Bayesian Method
on direct experience, to make decision concerning the trustee.
Security has been broadly classified into two categories; Interaction outputs are usually rated as good or bad, that is, in a
hard security and soft security [18]. Hard security is associated binary form. The number of positive and negative scores are used
with traditional security approaches such as traditional access to compute reputation, using the beta probability density function
control and authentication. It provides partial security, because (PDF). The PDF tuple α and β represent the number of good and
only corporate resources are protected from unauthorized bad interactions respectively. The probability expectation value
users, but it does not always protect legitimate users from of beta distribution is represented as follows [23]:
malicious service providers. This means that a central entity
(usually the service provider) is able to assess peers that are
requesting service from him, but the service requester nodes E ðpÞ ¼ α=ðα þ β Þ: ð1Þ
are not empowered to assess such service provider in a dis-
Compared to other methods, this method tend to have de-
tributed manner. Soft security tackles this weakness, and trust
tailed theoretical background which can amount to higher
is often promoted as the basis of soft security [19].
confidence on its outcome. During bootstrapping, α and β
are assigned the value of 1 each, which amounts to a default
2.1 Reputation computation
score of 0.5. Despite being popular, this type of (default) score
initialization has been criticized for having the likelihood of
For nodes to communicate on trust platforms, it is necessary
being either unfair to the new node or the ones already in the
for them to be able to measure the level of trust they can place
network. It also has a tendency of not adequately addressing
on each other. This influences the disposition of the nodes to
white washing [24, 25].
engage in transactions, or otherwise.
It can be challenging to measure digital trust with absolute
precision, especially in distributed environments. The fact that 2.1.4 Fuzzy Techniques
many peers posses limited resources and capacities, adds to
this challenge. Moreover, trust is a social concept, and some This is one of the methods adopted for computing and aggregat-
human instincts and reasoning which aid people in making ing reputation [8]. It involves reasoning about trust in-terms of
trust decisions, are not easy to capture in algorithmic form. fuzzy values. It appears to give more room for incorporating
However, the literature contains series of approaches which human-like reasoning such as agreement compliance, transaction
have been proposed for the purpose of capturing, measuring time/age, etc., in reputation computation and aggregation. Given
and computing trust for digital environments [17]. Most of many recommendations for example, fuzzy technique can be
these proposals adopt one (or more) of the following methods applied to probe for the relevance of such recommendations by
to calculate reputations, upon which trust is based. reasoning about compliance (or otherwise) to transaction agree-
ment. That is, applying compliance as an objective measure to
2.1.1 Summation verify the subjective user ratings [26]. Different techniques apply
various means to capture trust, but fuzzy techniques appear
The simplest form of trust computation is usually to sum the popular in this kind of reasoning.
positive and negative scores separately, then subtracting the
negative from the positive, in order to determine how reliable 2.1.5 Flow Techniques
an agent has been. This approach has been adopted to calcu-
late direct reputation in [5], and it is also used by ebay repu- Here, reputation has to do with the level of importance that a
tation system [20]. peer attracts within a community. As an example, in
PageRank [27], the number of links pointing to an entity (such
2.1.2 Average as website) compared to the number of links that leaves the
entity, is used to determine the importance or reputation of that
Another method which is close to simple summation involves entity. If we take I(P) to be the set of other entities that are
taking the average of all scores of the peer being assessed, such as pointing to page P, otherwise called the in-links, and |P| to be
the case of Amazon [21]. Some other models such as TE-AODV the number of other pages that P is pointing out to, otherwise
954 Peer-to-Peer Netw. Appl. (2019) 12:951–968

called the outlink. Then PageRank of P denoted by r(P), is as properties and behaviors of P2P systems, with some added
follows: peculiar features.
A share process in BitTorrent is initiated by first creating a
meta-data describing the file that is to be shared, including
rðQÞ
rðPÞ ¼ ∑Q∈I ðPÞ ; ð2Þ SHA1 hash information about the pieces, among others. The
jQj information in the torrent file guides peers to the tracker and
where |Q| is the out-links from Q. r(P) is mainly influenced by subsequently to other leechers and seeders in the swarm [30].
the pages that are pointing to it, which can be regarded as Leechers are peers that do not have all the file pieces, while
recommendations. However, an increase in the number of seeders are peers with all the pieces. A tit-for-tat method is
references made by Q, reduces the influence of Q on P. As used to ensure that leechers who receive files also give to
the inlinks of Q grow, the rank or reputation of P also grows. others. Seeders are assets to the network because they selfless-
ly share files, without the need to download. Because of this,
the tit- for-tat does not directly apply to them and thus they can
2.1.6 Belief Models be exploited in some ways, as discussed in the following
subsection.
This approach is based on probability theory, but the sum of In DHT (Distributed Hash Table) based BitTorrent, the
probabilities for all possible outcomes do not necessarily have tracker does not aid in the discovery of files or peerset.
to be equal to 1. Trust is expressed as a belief that a system will Nodes do this all by themselves. With distributed tracker sys-
resist malicious attacks, or that a person will cooperate and not tems such as Mainline DHT (MLDHT), peers use content IDs
defect. Unlike some other models in which belief in an agent’s (also called infohash) to find the location of desired contents.
cooperation is considered true or false (i.e. discrete), belief Once a node knows the infohash of the file it wishes to fetch, it
models consider a case where there is no clear information applies some controls to arrive at its location. Some of the
on either belief or disbelief, and thus an uncertainty factor is controls include; ‘PING’ for ascertaining node’s availability,
introduced. This is done in a way that instead of using belief or ‘FIND NODE’ used to get the k closest neighbors, ‘GET
disbelief in order to determine trust, uncertainty also counts. PEERS’ for getting the initial peerset and ‘ANNOUNCE
Opinions are usually expressed in the form [28]: ωYX ¼ PEER’ used by nodes to announce that they are part of the
ðb; d; u; aÞ; where ωYX is X’s opinion about statement Y, swarm [31]. In our method, the tracker also does not play any
while b, d, and u stand for belief, disbelief, and uncertainty special role; it is focused on individual peers and thus can
receptively. a∈[0, 1] is referred to as relative atomicity, which function without any central agent.
is used to determine how uncertainty affects the expected
opinion. 3.1 P2P attacks

Decentralized networks suffer from diverse forms of attack.

2.1.7 Discrete Trust
Apart from free-riding, which is an act of selfishness, in which
peers download from others without uploading to them in
Trust is a social concept and thus humans as social entities are
return, some other popular attacks in BitTorrent and P2P in-
often better at determining the trust of other entities, based on
clude the following:
experience and other intangible factors. Computationally,
scholars try to capture as much of the human related attributes
1. Lying Piece Attack: The goal of this attack is to destabilize
as they can, so as to make algorithmic trust possible and close
the rarest first policy of Bittorrent, in which peers while
to the human perception of trust. For example, some models
downloading, give priority to blocks that are less available
such as [17] have emulated the human style of trust percep-
in the swarm, so that they will not be lost completely.
tion, to discreetly rank trust as very trustworthy, trustworthy,
Attackers advertise false pieces, thereby misleading other
untrustworthy, and very untrustworthy. Lookup tables are
peers on the pieces that are actually rare [4]. More gener-
used to then determine the actual trust of an entity.
ally, the intention of attackers here might also be to cause
other forms of confusion, such as diverting the attention of
victims from genuine contents to non-existing ones, in
3 BitTorrent order to frustrate their download efforts.
2. Chatty Peer Attack: Attackers establish many TCP con-
BitTorrent is the most popular among P2P protocols, account- nections with the victims. They announce possession of
ing for about 53% of the entire P2P traffic, and more than 30% many file pieces, but when the victims request for some
of overall Internet traffic [29]. It is a good case study because it blocks of such pieces, they never upload any. Instead, the
is well known, widely deployed and it harbors major attackers resend handshake messages, thereby sticking as
Peer-to-Peer Netw. Appl. (2019) 12:951–968 955

neighbors to the victims, who spend considerable amount effects of both fake block attack and index poisoning at-
of time waiting in vain for the attacker’s response [32]. tack. Combination attack has been illustrated to impose
This can be an extension of the previous attack. more harm than fake block or index poisoning attack in-
3. Fake-Block Attack: Attackers also advertise possession of dividually [37].
many or all blocks. When victims request for such blocks, 8. Peer Exchange (PEX) Attack: This is very similar to dis-
they send fake blocks in response. After downloading all tributed denial of service (DDoS) and index poisoning
blocks of a piece (from attackers and genuine peers), the attacks. It is sometimes captured separately to portray
victim checks if they are genuine. This check fails because the fact that they are launched on PEX; taking advantage
of the fake blocks, warranting that the entire piece be of its features such as large list of peers (up to 3000 in
downloaded afresh, meaning a huge waste of bandwidth some cases), and very frequent PEX massages. Although
and time [3]. this is not the ideal design of PEX, studies have shown
4. Bandwidth Attack: This is usually an attack targeted at the that almost all PEX implementations do not follow the
seeders with the goal of occupying their upload band- original rules and there is no effective way of enforcing
width, so that there is little or none left for legitimate it [38]. Making it easy for malicious peers to fabricate
peers. Specifically, BitTorrent seeders do not download, huge PEX peer lists with false IP addresses, so victims
so they keep uploading to the fastest downloading peer(s). waste resource and time trying in vain to connect.
Attackers therefore exploit this by simply connecting to Similarly, the attacker can also send PEX massages con-
seeders and downloading only from them at fastest rate taining the address and port number of the victim to as
possible, so that they are constantly unchoked, while the many others as it can. This is aimed at weighing the vic-
reputable peers are continually choked [12, 13, 33]. A tims down with too many connection requests, resulting
version of this attack can also apply to other P2P net- to DDoS.
works, since there are always nodes that serve as resource 9. Collusion Attack: Collusion attackers collude to favor
donors (seeders) in the network. Attackers can target those themselves at the expense of legitimate peers. Attackers
server nodes in various ways, thereby obstructing their can join forces under collusion attack to make any of the
services. mentioned attacks more devastating [39]. In P2P trust and
5. Sybil Attack: Fake identities, otherwise called sybils can reputation models, collusion attackers give themselves
be created very cheaply. To beat reputation systems, at- favorable scores, and downgrade the scores of others.
tackers create links between its sybils, and through that This can mislead genuine peers into erroneously believing
means unleash different kinds of attack, e.g. bad-mouth that the malicious nodes are the reputable ones, and vice
attack. They can also use such links for raising their own versa. With this trick, attackers can take over the network
reputation and thus gaining unmerited advantage [34, 35]. and successfully eliminate the genuine nodes from net-
6. Index Poisoning Attack: In P2P file sharing platforms work services.
such as BitTorrent, clients keep indexes of files which link
each file identifier to their hosts. Index poisoning at-
tackers exploit this setting by publishing fake file indexes,
with the goal of stopping their victims from accessing 4 Related work
genuine neighbors. The attacker basically starts a file
sharing task but with fake information such as port num- Attempts have been made to mitigate attacks and unfairness in
bers, IP addresses, infohash, etc. Since there are no strong P2P, such as [3, 5, 40, 41]; each with their strengths and
verification means, owing to the openness of the system, weaknesses. In this section, we review some of these reports,
this attack is easily executed. The innocent peers are left to beginning with those that are specifically focused on
pay the price by using up their time and resources trying BitTorrent, before exploring P2P in general. We intend to
to access contents that are not existing; leading to denial capture popular opinions in the field, and how they have ad-
of service [36]. dressed the focus of the proposed method.
7. Combination Attack: This is a form of content pollution A recent work [5] targets free-riding and similar attacks in
attack, which combines fake-block and index poisoning BitTorrent. Most decisions are made by the tracker, such as
attacks, to make a stronger impact. Attackers in this case decisions about the peers to service at any given time. This
extend index poisoning by including their own IDs in the makes the method too centralized. The authors of [3] proposed
fake infohash to be advertised. The idea is that if the a less centralized method in which 10% of the nodes act as
victims insist on establishing connections despite failures super-nodes, and are charged with the responsibility of decision
due to fake information, they would eventually connect to making. However, there is a possibility of some malicious
the attacker(s) who make situation more difficult for them, nodes actually becoming super nodes, and then ruining the
by feeding them with fake blocks. So, they suffer the network. Moreover, this method also relies on central agents.
956 Peer-to-Peer Netw. Appl. (2019) 12:951–968

Wong et al. [7] mainly focused on content pollution. For In general, proposals that have targeted trust or reputation
any pollution suspected, the network is divided into sub units, bootstrapping problem can be categorized into five [49]. The first
in order to identify and carve out the pollutant. This technique and most popular method involves assigning default values to
can cause huge overhead and possible isolation of network newcomers, examples of models belonging to this category were
parts. In the same vein, Santos et al. [42] proposed a reputation earlier discussed. The second is the dynamic initialization meth-
voting system based on subjective logic, where peers are re- od [50], in which the current level of security within the network
quired to vote for files as either polluted or whole. However, (or system) determines the scores that would be assigned to the
vote collection can take time, since the nodes might need to new nodes. If maliciousness is currently high, then the value of
download big chunk of the file before casting their votes. initial trust score will be low, otherwise it would be high.
Sybil attack was the focus of [43] in Kademlia based Thirdly, there is the recommendation and endorsement
BitTorrent. Nodes assess their potential service providers based based method. Under this category, if a newcomer have sim-
on trust scores. In particular, trust scores are taken into account ilar interest and capabilities [24] or patterns [25], with an
when ordering the k-bucket peers. New comers are kick started existing service (or node) which is already known as credible,
with some positive risk score to enable them join the network. then its initial score can be derived from such node or service.
As noted earlier, these methods reflect the trend in most The fourth involves the use of game theory [51] for predicting
P2P reputation and trust models, which involves placing em- initial trust, usually in web service platforms. While the fifth
phases mainly on client nodes, in order to shield them from involves the use of central/super entities [52], or prior regis-
malicious server nodes, but with minimal emphases on tration [49], or pre-existing trust relationship which was men-
protecting the server nodes (seeders) from greedy leechers. tioned earlier [47, 48].
This creates room for bandwidth attack, which has received Another method involves the use of challenge/puzzle [53,
little or no attention in current trust and reputation models. 54] to restrict the number of fake identities that an attacker can
Some methods which are not reputation or trust based have introduce into the network. This is less trust-based and more
attempted to address the challenge, but suffer crucial limita- related to resource testing. Since existing nodes need to verify
tions related to poor or nonexistent means of verifying claims/ the puzzle in order to introduce a newcomer, they may be
votes [33], and outrageous overhead due to frequent encryp- placed at a disadvantage if the would-be attacker has more
tion and decryption operations [44]. resources. Our method is different because the existing nodes
Another trend that is easily noticeable is that most methods do not have such disadvantage. The new method is also dis-
bootstrap trust by assigning initial trust (or risk) score which tributed, with no need for prior registration, pre-existing trust
does not reflect the newcomer’s behavior, and which may be relationship or super node. It also addressed bandwidth attack
unfair to either the existing nodes or the newcomer. Some which has been omitted in earlier systems.
exceptions are subsequently discussed. The discussed related works are summarized in Tables 1
Besides BitTorrent, trust models for other P2P protocols, and 2. In Table 2, ‘Y’ stands for ‘yes’, ‘-’ represents ‘no’, ‘NA’
also portray similar trends. For instance, [8, 10] both initialize means ‘Not Applicable’, while ‘P’ is for ‘partial’. Our judg-
new comers with scores that allow them to join the network ment for Sybil attack on the table agrees with an earlier work
without initial assessment, thereby making white-washing in [34], and more recently [43] which noted that no effective
very cheap. The proposals in [45, 46] require bootstrapping Sybil attack measure has been derived for distributed net-
servers for new nodes to join, which can be a bottleneck in works. We used the term ‘partial’ to mean that the reviewed
distributed settings. method can minimize the attack, but not stop it completely.
Other methods such as [47] require some form of While ‘yes’ indicates those we think have addressed them
‘pre-established’ trust relationship for newcomers, which more intensely. For want of space, we have not included
may not always be available. An alternative solution methods that focus only on Bootstrapping in the tables, they
which is based on Opennet model allows publicly known have however been discussed previously.
‘seednodes’ to assist in introducing new nodes. However,
this might involve revealing vital information to mali-
cious nodes too, which they can use to attack the net- 5 Proposed method
work. Additionally, if for any reason a ‘seednode’ be-
comes malicious, its effect would be high because it The proposed approach is termed FBit (Fairer BitTorrent), it is
has high privilege. A Sybil resistant method presented aimed at achieving better fairness and robustness against mali-
in [48] is also based on pre-established trust relationship, ciousness in P2P systems such as BitTorrent, with focus on
which can be unavailable in some cases. Such relation- bandwidth attack, fake block attack, Sybil attack and collusion
ships are expected to have been acquired offline, and are attack. FBit ensures that every peer is treated with priority that
accumulated to form a bootstrap graph, which is a core reflects its level of cooperation, thereby providing better motiva-
part of their modified DHT routing mechanism. tion for cooperation, better resource management, network
Peer-to-Peer Netw. Appl. (2019) 12:951–968 957

Table 1 Summary of related

work Ref. Strength Weakness

[9] Copyright protection. Pre-trusted and central entities.

[8] Effective aggregation. Resource intensive due to broadcasts.
[11] Partial anonymity. Not accountable for peers that drop requests.
[10] Scores reflect global view. Pre-trusted peers has to be trusted always.
[5] Hard on free-riders. Poor score sieve.
[3] Scorer’s reputation accessed. Rogue nodes might make it to super level.
[33] Independent decision Fake votes easy.
[40] Vote falsification is hard. Resource intensive.
[42] Early assessment. Not DHT compatible.
[41] Automatic scoring. Only implicit, not established.
[7] Checks fake blocks. Tracker could be overworked.
[6] Detects fake piece. False positive/negative.
[43] Distributed. Only manages the effect of sybils.
[47] Trust bootstrapping. When pre-relationship is unavailable, the alternative
can be weak.
[48] Safe routing. New comers require pre-trusted peers.
FBit Distributed, efficient bootstrapping, Churn effect not analyzed.
bandwidth attack mitigation.

safety, fairness and efficiency. Although BitTorrent has been used swarm through the tracker (or DHT), in a usual BitTorrent
for illustration here, the new method can be applied to similar pattern. Afterwards they send BBitfield^ (or similar control)
P2P systems. The following subsections contain detailed expla- massages requesting to be added as neighbors. Through the
nation of the various components of the proposed method. message, they also send their self-generated public keys and
self-signed certificates to show that the request originated
5.1 Reputation bootstrapping from them. When a trustor receives such request, it associates
the accompanying public key with the trustee, to distinguish it
At the point of entry, every node is expected to generate a key from other nodes. For the newcomer’s request to be granted, it
pair (Kp, Kb) with which they sign their transactions. New has to demonstrate some preliminary trustworthy acts. Node’s
nodes start by discovering other nodes that are already in the ID can be derived from its public key.

Table 2 More on summary of

related work Ref. Bootstrapping Fully Content Selfish Sybil Bandwidth
Assessment Distributed Pollution Acts Attack Attack

[9] – – Y – P –
[8] – Y Y Y P –
[11] – Y Y Y P –
[10] – Y Y Y P –
[5] – – Y Y P –
[3] – – Y Y P –
[33] NA Y – – – Y
[40] – Y Y Y P –
[42] – – Y P P –
[41] – – Y P P –
[7] – – Y Y – –
[6] – Y Y Y P –
[43] – Y Y Y Y –
[47] Y Y Y Y Y –
[48] Y Y – Y Y –
FBit Y Y Y Y Y Y
958 Peer-to-Peer Netw. Appl. (2019) 12:951–968

As an illustration, assuming that nodeA, nodeC and pass the accumulated Bf through a unit step function, Θ(Bf)
nodeE were already in the network, when nodeB requests which returns either 0 or 1 depending on the value it receives,
to join through nodeA. After nodeB’s request, when nodeA according to Eq. (4), where nmin is the minimum Bf required
receives the next Bunchoke^ message from any of its from a newcomer:
neighbors (e.g. nodeC), it responds by sending a request 
for a block, according to BitTorrent procedure. However, 0 if < nmin
ΘðBf Þ ¼ : ð4Þ
in addition, it requests that the block should be routed 1 otherwise
through nodeB (which is the new node), instead of having
it sent directly. When nodeB receives such block from The self-signed certificates mentioned previously, does not
nodeC, it forwards it to nodeA, appending its signature, stop generation of multiple fake identities, but it helps to en-
based on the key it generated initially. sure that malicious nodes do not impersonate existing trust-
Given that the transaction is honest, nodeB gains some rep- worthy ones. Recall that new nodes usually do some work in
utation point, and the reputation of nodeC is updated too. This order to gain entry into the network, which is to service some
ensures that the new node does not gain reputation advantage existing node(s) up to a minimum limit. This would mean
over the existing ones. NodeA can repeat this step for some spending some resources and a bit of time by the newcomers.
other blocks, giving nodeB more opportunities to serve and Since resources are not always limitless, the number of fake
build reputation. In case of DHT, proximity would be consid- identities that a Sybil attacker can introduce into the network
ered in the routing process, such that nearby nodes would be is limited. The attackers are further frustrated in the network
more active in helping a newcomer to gain reputation. through the reputation and ‘interaction rate’ checks which are
While nodeA is waiting, it can proceed with other subsequently discussed.
requests so that it is not trapped if nodeB does not de- It is important to minimize the number of fake identities at
liver. Other nodes in the network such as nodeC and entry stage because the lesser they are in number, the lesser
nodeE can also route some of their requests through their impact. The difference between the work done by new-
nodeB in order to speed-up the bootstrapping process. comers in FBit and that which they do by solving puzzles, is
The new node is not allowed to request any service until that genuine FBit nodes which are already in the network do
it is admitted. Each transaction, both from the new and not have to spend extra resources to verify the work done by
old nodes are signed. We count on the reputation of the newcomers. They simply perform normal checks which they
introducing nodes to expect that they will act fairly to usually do for all massages, even those from known trustwor-
the newcomers. However, they can loose reputation for thy nodes. So, there is less burden (due to bootstrapping) on
inappropriate introduction, and can also gain for appro- the trustors and the network in general. Whitewashing also
priate ones. appears less appealing and thus nodes are discouraged from
When nodeB joins through multiple nodes (e.g. nodeA, becoming malicious after joining the network.
nodeC, nodeE), nodeA determines if nodeB is due to be added Similarly, the new approach does not suffer the kind of
as a neighbor, by collecting recommended Bootstrap factors fundamental problem [55] experienced in puzzle based
(Bf) from the other nodes. NodeA further weighs each recom- methods, which has to do with disparity in resources or com-
mendation based on its trust on the nodes that sent them, as putation abilities between legitimate users and would-be at-
illustrated in Eq. (3). BfCB is the Bf reported by nodeC tackers. With the new method, even large disparity in compu-
concerning nodeB, while GSAC is the reputation of nodeC tational abilities between legitimate nodes and the new comers
from the perspective of nodeA. Same pattern repeats for every (or potential attackers) is not of visible significance.
neighbor that would submit Bf recommendation. Notice that Moreover, the proposed method favors productivity, because
nodeA still adds its own bootstrap factor, but with an optimal newcomers actually render valuable help, and in return gain
self-reputation of 1: initial reputation. As explained in subsection 5.4, this method
can be adapted to similar other file sharing P2P platforms. It is
distributed, and does not rely on any seed node or super peer.
B f AB ¼ ð∑C B f CB :GSAC Þ þ Bf AB : ð3Þ
5.2 Familiarity
No further normalization is relevant at this stage because
the newcomer is not expected to service too many nodes be- Many P2P file sharing systems (e.g BitTorrent) operate in a
fore it joins, and not all neighbors are therefore expected to Bgive and take^ manner. This is not strange since the network
respond to a request for Bf recommendation. Notice also that is usually self-sustaining. The idea behind familiarity (or in-
the interest is on the cumulative value, not the average. We teraction rate) is to enable nodes to ascertain how much each
Peer-to-Peer Netw. Appl. (2019) 12:951–968 959

neighbor has contributed to them particularly, and to the net- node j and downloaded y chunks from it, then y minus z will
work in general. We assume that more familiar nodes interact be the bases for determining the fairness or otherwise of j,
more often, and if genuine, contribute more to each other. This from the perspective of i. In some cases, ratio is used instead
idea is similar to the tit-for-tat method of BitTorrent where of the difference, mostly in models that are based on proba-
nodes prioritize neighbors that have given more to them. bility expectation value [23]. y and z can also represent the
However, unlike BitTorrent where nodes act mainly based number of favorable and unfavorable interactions respective-
on local tit-for-tat views, the new method allows nodes to also ly. Unanswered requests are often counted among the unfa-
ascertain the global impact of each node on every other node vorable transactions.
in the network (or neighborhood) at a given time, in-terms of The problem with such method is that the cumulative in-
resource contribution, on a scale of 0 to 1. This ensures that a teraction rate does not reflect adequately on the end results. As
more liberal and reputable node, gains some advantage, not an example, consider a case where y = 500, and z = 499, the
just for its reputation but also for its liberality in terms of difference will be 1, just the same as when y = 2 and z = 1,
rendering services to other nodes. We shall focus on familiar- ignoring the interaction frequencies, which can be a vital fac-
ity in this subsection, and then capture reputation in the next. tor by itself. If we take the ratio of good interactions over total,
Equation (5) captures the activity rate of peers in a swarm then the case with fewer interaction will be at clear advantage,
(which is a kind of P2P network) at intervals (t = 20 s). If node which can be somewhat unjust. Wang P. et al. [56], identified
i downloads from node j, or uploads to it, i records an inter- similar problem, but their approach soldered the concept rig-
action (download or upload), and vice versa. We also take note idly into trust computation, such that it might be a problem
of unanswered requests, because they could be signs of mali- when emphasis is preferred either on just trust or interaction
ciousness, such as lying piece attack. The time when interac- rate.
tions occur are also recorded. Given that node i has x success- In a nutshell, we use this concept of familiarity to capture
ful interactions (or transactions) with node j within time t, it the activity rate of a peer, not just locally, but generally in the
calculates the interaction rate of node j; IRij(t) using Eq. (5): network, on the scale of 0 to 1. Trust score alone can hardly
reveal this relationship. We have applied it more specifically
in subsection 5.5 to tackle bandwidth attack.
IRij ðtÞ ¼ Xij =nmax ð5Þ

where nmax is derived by dividing the node’s bandwidth by 5.3 Reputation score computation
the size of each block and multiplying the result by time (t).
Literally, nmax is the optimal rate at which each peer is expect- Applying the concept of probability expectation value [23],
ed to function in the swarm within t interval, and it is and based on recorded interaction experience, non-malicious
recalculated every t seconds. An alternative way to determine downloads are associated with α, while the bad ones plus
nmax in an environment where knowing the bandwidth is dif- uploads (as well as no replies) are associated with β.
ficult, would be to collect votes from participating nodes Expected behavior based on the previous reputation (DTij) of
based on their interactions during their first few seconds in node j, according to the direct experience of node i with re-
the network. Nodes pay more attention to neighbors who ser- spect to time (t), is given in Eq. (6):
vice them in return. If extended, it means that nodes give
priority to neighbors who give back to the network, in order

to ensure sustainability. Successful transaction means non ma- αi jðtÞ þ Θ B f i j
DTi jðtÞ ¼
: ð6Þ
licious uploads and downloads, which are expected to be con- αi jðtÞ þ βi jðtÞ þ Θ B f i j
siderably mutual.
As familiarity grows, IR tends to 1. nmax is chosen in a way A download is considered non malicious if its piece is
that keeps IR below 1 within the time (t) range. However, in hashed without error. Otherwise, if there is a mismatch in the
cases of extreme familiarity, depending on the choice of nmax, hash code, it is considered malicious. Bf serves as a normalizing
IR can be greater than 1. When this happens (which can be factor when computing expected reputation, since every node
rare in practice), the excess is not considered, so IR simply in the neighborhood of i is expected to have been bootstrapped,
equals 1. which implies that it has Bf > 0. The number of ‘uploads’
As already noted, most earlier approaches use parameters counts for β because we are interested in both credibility and
such as the difference between number of a peer’s ‘downloads contribution rate. For example, the reputation of a free-rider can
from’ and ‘uploads to’ another peer as a way of determining drop as a result of its act of not giving. While those that barely
cooperation. For instance, if node i has uploaded z chunks to give, would be caught up in the familiarity check.
960 Peer-to-Peer Netw. Appl. (2019) 12:951–968

As the number of interactions grow, the behavior of nodes shown in this work, with a weight of 0.6 assigned to σd. In our
may change, making it important for older interactions to have experience, this value appears optimal because it gives repu-
less weight or be completely forgotten. After more than 1 tation an upper hand, without undermining familiarity factor:
interactions (i.e. if ∃ DTij(t − 1)), decay or aging factor is
introduced. The aging factor used here is related to that of
TR ¼ σd :DT þ ð1−σd Þ:IT; ð10Þ
[8] and it basically considers the similarity between previous
records and the current outcome, the wider the difference, the
less consideration such history is given. If we denote the aging TIR ¼ σd :IR þ ð1−σd Þ:CIR; ð11Þ
factor by ρ(t), then we update our local experience with respect
where TR stands for Total Reputation, and TIR is the Total
to the just concluded transaction at time (t), as given in Eq. (7):
Interaction Rate. They can further be merged with Eq. (12).
  We observed on the course of this work that it makes lots of
DTi jðtÞ ¼ ρðtÞ DTi jðt−1Þ þ 1−ρðtÞ DTi jðtÞ ; ð7Þ difference when IR is considered, compared to when it is not.
(0 ≤ σt ≤ 1) is a weighting factor, in Eq. (12):
this equation also applies to IR.
To get a general view of the reputation and familiarity of
any neighbor, nodes usually ask others for recommendations GS ¼ σt :TR þ ð1−σt Þ:TIR; ð12Þ
concerning that neighbor. Replies to such recommendation
σt has same value as σd mentioned previously.
requests usually come in pairs; DT and IR. Considering our
testbed (BitTorrent), nodes can also update the tracker with
recommendation information when they make contacts, al- 5.4 Modified BitTorrent unchoke algorithm
though such tracker update is not a requirement for the pro- for leechers
posed method. When a node asks for recommendation from
its neighbors, it ranks each recommendation according to the For clarity, we have divided the algorithm into two parts. The
reputation of the recommending node, using the Ordered first (algorithm 1) briefly discussed in this subsection, cap-
Weighted Average (OWA) [57]. The choice of OWA is due tures the steps that FBit leechers take when unchoking other
to its weight tuning advantage, it allows us to easily associate leechers. While the second part (algorithm 2) which is pre-
each indirect score with the reputation of the node that sent sented in the next subsection, depicts the steps that seeders
them. If node i asks its n sequence of neighbors (j) about take when unchoking leechers. Algorithm 1 applies earlier
another peer l, i discounts collected recommendations (DTjl), discussed concepts of bootstrapping, familiarity and reputa-
and interaction rates (IRjl) as indicated in Eqs. (8) and (9): tion to mitigate Sybil attacks, fake-block attacks, free-ridding,
and similar others. While algorithm 2 focuses specifically on
∑nj¼1 DTi jðtÞ DT jlðtÞ stopping bandwidth attacks. The two algorithms work
ITilðtÞ ¼ ; ð8Þ smoothly together.
∑nj¼1 DTi jðtÞ
Some acronyms used in the algorithms which were not
∑nj¼1 IRi jðtÞ IR jlðtÞ earlier defined are:
CIRilðtÞ ¼ ; ð9Þ
∑nj¼1 IRi jðtÞ
& MaxUnchoke; used to indicate the maximum number of
where ITilðtÞ and CIRilðtÞ are the reputation and IR of l respec- neighbors a server node can service simultaneously at a
tively, according to i, based on the information it got from given time.
other peers. And assuming that DT jlðtÞ scores are arranged in & NumberUnchoked; used to show the number of neighbors
descending order. Similarity check, elaborated in section 6, is that is currently being served by a given node.
performed on the collected recommendations before compu- & InterestedPeerList; keeps a list of neighbors that are inter-
tation. This is to sieve out recommendations that may have ested in a given block of the file.
been submitted by collusion attackers. & TrustedPeerList; used to keep a list of nodes (among those
  interested in the current block) whose reputation score is
The trustor’s local reputation about the trustee DTilðtÞ
above ‘threshold’. IR does not influence this score; ‘GS’
can be added using Eqs. (8) and (9), with peak weight of 1. only counts for peers that have not been found malicious
Alternatively, recommended scores (IT, CIR) and direct scores at this preliminary stage.
(DT, IR) can be distinct, and then merged with Eqs. (10) and & threshold; minimum score (0.5) a peer must have before it
(11), adjusting the weight (0 ≤ σd ≤ 1) to suit peculiar needs. can be added to the list (‘InterestedPeerList’) of those that
We adopted the later (using Eqs. (10) and (11) for the results will be considered for a given transaction.
Peer-to-Peer Netw. Appl. (2019) 12:951–968 961

enough. Line 13 of algorithm 1 triggers Eqs. (8) to (11) which

are responsible for computing indirect scores and combining
them with direct experience of the trustor. The general score
(GS) is further calculated using Eq. (12) which basically ap-
plies desired weights to merge reputation and familiarity
scores. Based on the GS, all trustees that are not considered
malicious are collected in a list and priority is given to each
according to its contribution and reputation in the network.
Although peers may be given different names in different
P2P platforms, the concept of seeder (service giver) and
leecher (service receiver) is quite common. In most cases,
especially in distributed P2P, network peers serve as both ser-
vice providers and consumers. The algorithms presented in
this work has not been built to rigidly fit into BitTorrent to-
pology alone. Focus has been more on the nodes, so that any
similar topology would require minimal tuning to adapt it.

In a nutshell, here is the function of each line in the first 5.4.1 FBit in DHT based systems
algorithm. Lines 1 and 2 initiates MaxUnchoke and
NumberUnchoked variables respectively, while lines 3 to 4 start DHT (including MLDHT) makes it possible for the network to
the lists of InterestedPeerList and TrustedPeerList. According to function without a tracker. Every node acts as a mini tracker; they
line 5, if a node is currently able to service any additional neigh- collectively perform the task of discovering other peers in the
bor, it selects a trustee from the InterestedPeerList (line 6) and network. In MLDHT, nodes randomly choose 160-bit unique ID
calculates the IR and DT of the trustee (line 7). If the trustee is which also indicates their distance (in a way). At first, nodes need
very familiar to the trustor (line 8) then scores are based on direct to query the k-bucket to get nodes that are closest to the infohash.
experience only (lines 9 and 10), otherwise recommendations are The client node further tries to connect to those nodes in order to
collected (lines 12) and used for calculating scores (lines 13). initiate queries. Given that the connected node is aware of the
When recommendations are collected, a similarity check peers that are associated with the infohash, it returns a list of such
(explained in the last paragraph of section 6) is also done. GS peers and file download continues similar to the way it happens
is afterward calculated in line 14. However, if a trustee has a TR in the traditional protocol [58].
that is below threshold, it does not qualify to be considered for At this point, just before the download processes, the rep-
any service (lines 16 to 18). Those who are qualified to receive utation bootstrapping can happen for newcomers. Key ex-
services are serviced according to their GS scores beginning with change messages can be embedded in any of the controls
the highest score (lines 19 and 20). When a transaction process is mentioned earlier (eg. ‘FIND_NODE’), while newcomers
initialized, the trustee is removed from the InterestedPeerList may be served after successfully responding to some requests
(line 23). such as request for peers that are associated with the infohash
When nodes are able to validate each other and complete (which the newcomer should have at this stage). In the current
transactions, they mutually update reputations and interaction implementation of the proposed system, the tracker does not
rates, reflecting their experiences. In algorithm 1, leechers use perform any special task, every node is regarded as equal. This
such updates in determining requests to respond to, and the is a way of making it non-centralized and enabling its adapt-
priority that each requester deserves. Equations (6) and (7) are ability to other platforms.
applied to update direct reputation and familiarity (rate) infor- FBit is focused more on content downloads (retrieval/stor-
mation. If a node has communicated regularly with consistent age) and less on routing, but it can be featured in both pro-
reputation for a considerable amount of time (even recently), cesses. Instead of considering only the distance in choosing
then it makes sense to apply local information in making de- the k-bucket nodes, GS score in FBit can be engaged in the
cision for a subsequent transaction, in order to save resources process. A weighted average of the GS and Bdistance factor^
that would otherwise be used to gather and compute can be adopted, similar to the method used in [43]. With the
recommendations. advantages being reputation bootstrapping, computation of
Trustors contact neighbors for recommendations when indirect reputation and mitigation of bandwidth attack.
they do not have enough information to assess the trustee, or Similarly, in Gnutella, servants perform the task of both
when the direct familiarity between the two nodes is not high servers and clients [59]. To join, Gnutella newcomers connect
962 Peer-to-Peer Netw. Appl. (2019) 12:951–968

to any known host, and through that means get in-touch with As an illustration, nodes l, i, and j in Fig. 1 represent indi-
other nodes. Such known host(s) can serve as the initial trustor(s) vidual peers in a swarm who request services from a seeder
in the bootstrapping stage of the proposed system. Similarly, the node. The message accompanying their requests indicate oth-
Bbroadcast^ and Bback-propagation^ of information in Gnutella er peers (leechers) that they have downloaded the most from,
can serve as means of relating the reputation (and other informa- and the ones they have uploaded the most to. A malicious
tion) of peers to neighbors within the network. The new method node who chooses to download only from seeders in order
can also be adapted easily to fit into other offspring of P2P such to dodge assessment by fellow leechers, will have little or no
as mobile edge-clouds since every node is capable of making Bupload^ information to give and thus will not be qualified to
independent (and informed) decision. make requests. In this illustration, node i will be served first
because it has the highest vote, before node l and then node j.
Seeders confirm scores by validating submitted scores for
5.5 Modified BitTorrent unchoke algorithm consistency. For instance, it could be seen that nodes i and l
for seeders have both submitted scores about each other at same time
interval; it is therefore expected that the download rate (DR)
As mentioned earlier, malicious peers take advantage of the score which i submitted concerning l at a given time should
opening discussed under bandwidth attack to abuse seeders match the upload rate (UP) score that node l submitted
and download mainly from them, thereby blocking their un- concerning i at about the same time. Line 6 of algorithm 2
choke slots (i.e. making them unable to upload to legitimate executes this check, every t seconds.
peers). Such behavior also enable the malicious nodes to avoid If two or more peers have the same number of votes among
downloading from other leechers who could measure their the submitted top leechers, then the highest IR score will be
contributions based on experience. To check this, FBit in al- given priority, according to lines 9 to 11 of the algorithm. If
gorithm 2 warrants that a leecher (l) who requests download their IR scores are still same, the first request will be served
from a seeder (s), has to submit its top IR information along- first. By giving priority to nodes that show more cooperation
side its request. s uses such information to determine how with fellow leechers, they are rewarded for being cooperative
much l has uploaded and downloaded from its fellow leechers. and others are encouraged to do likewise. Low score nodes
The seeder then gives priority to peers that are more selfless which are genuine will have no problem downloading from
in their service to other leechers, in order to motivate them and other leechers in order to step up their scores. At the initial
encourage others not to be selfish. It also mitigates a kind of stage however, services by seeders are on first-come, first-
denial of service attack that would occur if the unchoke slots served basis.
of seeders are congested by attackers. This algorithm further Seeders also cache some of the information temporar-
holds each peer responsible for not only its reputation, but also ily, so that it could be used in the near future if need be.
the impact it is able to make in the network. Recall that seeders For example, if any other node besides i, j and l were
are basically service givers who have no need for receiving. voted, its score will be saved for when such node would
P2P networks need them, and they need to be encouraged and request a service, within some time limit (lines 14 to 16
optimally protected. of algorithm 2).

Fig. 1 When leechers send requests to a seeder

Peer-to-Peer Netw. Appl. (2019) 12:951–968 963

Here is a summary of the functions of the remaining lines in (e.g. [Link] [Link]). During
algorithm 2. Lines 1 to 3 initiates the variables the same way it Blogtime^, we update the files that have been created to
is done in the first algorithm, and line 4 also has similar func- store the information needed to measure the performance
tion. Line 5 enables a server node to collect votes from its of the network.
client nodes indicating the IR information of other nodes they & [Link].max_swarm_size was set to 200 to
have interacted with. Line 7 counts valid votes for each client show that the network can only grow to a maximum of
node in the InterestedPeerList and then services are rendered 200 nodes (there is no specific reason for choosing 200,
based on active cooperation in the network (line 8). Once a except that we needed a number that is more than the
transaction process is initiated, line 12 updates the number of network size which is 100). This can change to accommo-
nodes that are currently being served and line 13 removes the date any network size of choice.
node from InterestedPeerList to indicate that it is being & [Link]; every simulation needs to have a seed value.
served. After each transaction round, the MaxUnchoke is Using the scripts, this and other necessary variables are
decreased. automatically generated at the beginning of each simula-
tion. In the case of the random seed, the script generates it
randomly, while other values (such as percentages of at-
6 Experiments and results tacker) are picked accordingly from the series of provided
values.
The PeerSim simulator was used to implement a testbed for
the proposed method. It is a java based P2P simulator which A 95% confidence level was maintained for the recorded
already includes a BitTorrent protocol implementation [14, simulation results, this is in order to statistically validate their
60]. This allowed us to focus only on the adaptation of the consistency. Simulations were ran with network size of 100
protocol to our approach, while retaining the original version nodes, and varied number of malicious nodes, to determine
for comparison. the effect in each case. Different attacks were simulated in-
The simulation runs on two virtual machines each with 16 cluding sibyl, fake-block and collusion attacks, with the goal
CPUs at 2500 MHz and 64GB RAM. Each machine runs of determining how efficiently such attacks are mitigated by
OpenJDK Runtime Environment 1.8, and Python 3.4.3 which FBit compared to other methods. The original BitTorrent
is used for scripting. PeerSim has a configuration file that method [60] and another Trust Management System (TMS)
allows parameters to be adjusted as desired. Some of such [3] were adopted for comparison. For TMS, we implemented
parameters include; it using the information provided in [3]. TMS was chosen for
comparison because it addressed similar attacks (such as fake-
& [Link]; used to specify the network size. This was block attack), and was also tested on BitTorrent platform.
set to 100. The simulation began with a single seeder in each case, and
& [Link].direct_weight; this is a new addition, used runs until a 95 percentage confidence level is attained, after
to specify the weight of direct scores (that is, IR and DT). It which an average result is gathered. Each simulation can run
was set to 60%. for a maximum of 30 times. The file size is 20mb for all
& [Link] was set to BUniformRandomTransport^, experiments. This work did not address the implications relat-
which is the transport protocol used by the simulator. ed to churn, nodes stay in the network throughout the simula-
& [Link].file_size; this is used to specify the tion. The presented results were obtained with network size
size of file to be shared in the network. The process is 100 and varied percentages (0, 10, 20, 30, 40, and 50, 60, 70,
completely successful if every peer downloads a complete 80) of attackers.
file before the process ends. It was set to 20mb in the Figure 2 presents a result of how the network responded
simulation. to Sybil attackers, who also distribute fake-blocks when
& [Link].duplicated_requests; this was set to 1, they are able to gain access. The result compares FBit to
meaning that a node can only send one request for a par- the original tit-for-tat based BitTorrent and TMS. As
ticular block at a time. It could be set to any other value if shown, non-malicious nodes suffer less attack with FBit
desired. compared to other methods; they are able to download at
& [Link].seeder_number; this was set to 1, so that each a significantly faster rate. The proposed bootstrapping
simulation begins with one seeder. There are other method helps to minimize the introduction of fake identities
variables that are initialized at the start of the simulation (IDs) into the network. Introducing a fake ID is made cost-
such as the number of attackers. When a type of attack is ly and thus a Sybil attacker can only introduce a limited
not present, its value is set to 0 (e.g. [Link]. number, based on its capacity. FBit further fishes out such
nCollusionAttacker 0). There are also some controls that limited number of fake identities through reputation and
allow us to observe and get feedback from the simulation familiarity checks.
964 Peer-to-Peer Netw. Appl. (2019) 12:951–968

based BitTorrent and TMS. A careful look at the result reveals

that FBit can cope with collusion attacks. Although collusion
attackers appear to have higher impact compared to a non-
collusion scenario such as Fig. 2, FBit nodes are still able to
complete download at considerably fair rate. The noticed de-
cline in download rate (with higher percentage of attackers) is
expected, because finding reliable nodes become more diffi-
cult and more time consuming. The amount of genuine pieces
available in the network also declines as the number of genu-
ine nodes decrease. The TMS method felt more collusion
impact, while the original method was completely
overwhelmed.
To guard against collusion attack, TMS uses recommenda-
tions from top 10 nodes to compute the scores of the other
peers. From the result shown, this does not appear effective
Fig. 2 FBit vs other methods; showing the difference in download rate because malicious nodes also stand a chance of joining the top
for non-malicious nodes. FBit allows them to download at higher rate nodes, especially with exaggerated scores from other collud-
amidst Sybil attackers ing nodes. Tit-for-tat also does not effectively combat collu-
sion attack because nodes are overwhelmed by malicious traf-
When the number of attackers rose beyond 50% of the fic from the attackers. For example they can be trapped in a
network size, the graph (Fig. 2) indicates that their effect on cycle of downloading, verifying and discarding fake blocks;
the FBit network became stronger, and mitigating them led to making it impossible for them to successfully complete trans-
a sharp decrease in the download rate of legitimate nodes. This actions. Moreover, in TMS and original methods, attackers are
is expected because, with such high percentage, there will be able to steal resources from seeders through bandwidth attack.
more failed and repeated transactions. Transactions fail when Some models have applied neighbor similarity to detect
nodes suspect that their neighbor is likely an attacker, and attackers in P2P. For example, in [61], if recommendations
decline its offers. When this repeats, more time will be needed collected from various neighbors concerning a peer, lack sim-
to find the right nodes, and thus the overall transaction time ilarity, then such peer is regarded as an attacker. Their ap-
will increase. proach was designed for e-commerce, and it requires coordi-
Reputable nodes which are already in the network do not nation from some form of central agents such as group leaders,
share in the cost of introducing or validating newcomers, ex- which can be seen as a limitation when considering more
cept for slight ‘transaction time trade-off’ that may arise as a distributed platforms. However, we tapped from their idea of
result of routing some chunks or queries through the newcom- similarity, and applied it (with modifications) to tackle collu-
er. Such tradeoff is however compensated by the gain in rep- sion attack.
utation that the trustor stands to get after successfully intro-
ducing a new node. The delay caused by forwarding some
packets (or queries) through the newcomers appears mild. If
legitimate existing nodes had to spend computational re-
sources for challenge verification, as would be the case in
puzzle based methods, the impact would be more significant
(at-least from logical point of view).
TMS could not cope with Sybil attackers because of the
earlier mentioned flaw in the bootstrapping method. If fake
IDs can be introduced almost at no cost, then an attacker can
easily introduce them in numerous number and hijack the
network at early stage. In tit-for-tat, new comers are admitted
without checks via optimistic unchoke, giving room for at-
tackers who sap the available resources and frustrates the net-
work with fake blocks.
FBit was also exposed to collusion attacks, where fake-
block attackers cooperate to favor themselves and downgrade
the reputation of others that are not in their clique. Figure 3
captures the performance of FBit in comparison with tit-for-tat Fig. 3 Collusion attack
Peer-to-Peer Netw. Appl. (2019) 12:951–968 965

(a) Original (b)TMS

(c) FBit
Fig. 4 The download rate of genuine nodes versus attackers in the download, especially from seeders. TMS did better than the original
original (a), TMS (b) and FBit (c) methods. A Resilient system is method, but was still tricked by the attackers. FBit successfully stopped
expected to frustrate attackers and allow non malicious nodes to the attackers from stealing resources (from seeders), showing resilience
download faster. In the original and TMS methods, attackers are able to against bandwidth attack

When a peer is sending a request for recommendation, it Ideally, non-malicious nodes are expected to beat the attackers
includes a randomly selected trusted neighbor(s) from its and maintain a clearly higher download rate. Figure 4 illus-
neighbor list (which must be different from the neighbor being trates this, with non-malicious nodes downloading clearly at
inquired about, and the one from whom recommendation is higher rate in FBit, while the collusion attackers were domi-
required). So it requests recommendation for the actual unfa- nating in the other methods. The gap is more in the original
miliar peer, and at least one familiar fellow that would be used method and less in TMS, indicating that TMS is more resilient
to check similarity. to collusion attack than the original method.
If the recommendation giver is in a collusion clique with
the unfamiliar peer, then it will give it high score, and down-
grade the reputable one. A malicious recommendation giver
can also decide to simply exaggerate both scores, but it will 7 Conclusion
still be noticed in the similarity check. When recommenda-
tions from various neighbors are gathered, priority is given to We have devised a bootstrapping approach for BitTorrent and
the ones that are most similar, based on the known peers that similar P2P protocols. It is distributed and appears efficient
have been inquired about. Line 12 of algorithm 1 triggers the with the simulation test cases. In contrast to the popular meth-
similarity check. od of assigning default reputation scores to newcomers, our
To measure how successful an attack is, we captured how method provides them with a distributed avenue to work for
the malicious nodes fared compared to non-malicious ones. their initial reputation, before they are able to fully join the
966 Peer-to-Peer Netw. Appl. (2019) 12:951–968

network and request services. No central entity or pre-existing 9. Qureshi, A. Rifa-Pous, H. Megıas, D.:Electronic Payment and
Encouraged Cooperation in a Secure and Privacy-Preserving P2P
relationship is required.
Content Distribution System. In: The 7th International Conferences
Similarly, the proposed algorithm adequately shields seeders on Advances in Multimedia, pp. 8–14. MMEDIA(2015)
from the effects of bandwidth attacks. This is possible through a 10. Kamvar SD, Schlosser MT, Garcia-Molina H (2003) The eigentrust
modified familiarity approach that makes seeders aware of algorithm for reputation management in P2P networks. In:
Proceedings of the 12th international conference on world wide
peers’ leecher-to-leecher relationships. Seeders are important
web, 640–651. ACM press
asset in P2P and need to be protected adequately, but as we 11. Cornelli F, Damiani E, di Vimercati S, Paraboschi S, Samarati P
highlighted, they receive minimal attention before now and (2002) Choosing rep- utable servents in a P2P network. In:
therefore they face exploitation. The proposed model promises Proceedings of the 11th international conference on world wide
improved network stability, security, fairness and efficiency. web, pp. 376–386. ACM press
12. Dhungel P, Hei X, Wu D, Ross KW (2008) The seed attack: can
We are continuing research on distributed P2P along sev- bittorrent be nipped in the bud?. Technical report, Department of
eral directions. As a follow up to this work we are exploring Computer and Information Science. In: Polytechnic institute of NYU
the concept of Root Cause Assessment (RCA) [62], to see 13. Dhungel P, Hei X, Wu D, Ross KW (2011) A measurement study of
how they can empower nodes to deal with irregular behaviors, attacks on bittorrent seeds. In: 2011 IEEE international conference
on communications (ICC), pp. 1–5. IEEE
such as cases where nodes alternate between good and bad
14. Montresor A, Jelasity M (2009) PeerSim: A scalable P2P simulator.
behaviors irregularly. There is also an ongoing plan to fit FBit In: 9th IEEE international conference on peer-to-peer computing,
into an edge cloud platform such as [63, 64]. pp. 99–100. IEEE
15. Nwebonyi FN, Ani UP (2015) DanielBYOD network: enhancing se-
Acknowledgements This work is partially funded by project curity through trust– aided access control mechanisms. International
“NanoSTIMA: Macro-to-Nano Human Sensing: Towards Integrated Journal of Cyber-Security and Digital Forensics 4:272–290
Multimodal Health Monitoring and Analytics/NORTE-01-0145-FEDER- 16. Gambetta D (2000) Can we trust trust?. Trust: making and breaking
000016” financed by the North Portugal Regional Operational Programme cooperative relations. In: Gambetta, Diego (ed.) trust: making and
(NORTE 2020), under the PORTUGAL 2020 Partnership Agreement, and breaking cooperative relations, electronic edition, Department of
through the European Regional Development Fund (ERDF). Sociology, University of Oxford, pp. 213–237. University of Oxford
17. Jøsang A, Ismail R, Boyd C (2007) A survey of trust and reputation
Publisher’s Note Springer Nature remains neutral with regard to jurisdic- systems for online service provision. Decis Support Syst 43:618–
tional claims in published maps and institutional affiliations. 644
18. England P, Shi Q, Askwith B, Bouhafs F (2012) A survey of trust
management in mobile ad-hoc networks. In: Proceedings of the
13th annual post graduate symposium on the convergence of tele-
References communications, networking, and broadcasting. PGNET
19. Lilien L, Al-Alawneh A, Ben Othmane L (2010) The pervasive
1. Khan, A.M., Freitag, F. Rodrigues, L.: Current trends and future trust foundation for security in next generation networks. In:
directions in community edge clouds. In: 4th IEEE International Proceedings of the 2010 workshop on new security paradigms,
Conference on Cloud Networking (CloudNet), pp. 239–241. pp. 129–142. ACM
IEEE, Niagara Falls (2015) 20. Resnick P, Zeckhauser R, Swanson J, Lockwood K (2006) The
2. Baqer K, Anderson R (2015) Do you believe in tinker bell? The value of reputation on eBay: a controlled experiment.: experimental
social externalities of trust. In: Cambridge international workshop economics, pp 79–101. Springer
on security protocols, pp. 224–236. Springer 21. Gregg DG (2009) Outline reputation scores: how well are they
3. Sarjaz BS, Abbaspour M (2013) Securing BitTorrent using a new understood?: journal of computer information systems, pp 90–97.
reputation-based trust management system. Peer-to-Peer Taylor & Francis
Networking and Applications 6:86–100 22. Venkanna U, Agarwal JK, Velusamy RL (2015) A Cooperative
4. Konrath, M. A. Barcellos, M. P. Mansilha, R. B. : Attacking a Routing for MANET Based on Distributed Trust and Energy
swarm with a band of liars: evaluating the impact of attacks on Management. In: A cooperative routing for MANET based on dis-
bittorrent. In: 7th IEEE international conference on peer-to-peer tributed trust and energy management.: wireless personal commu-
computing, pp. 37–44. IEEE (2007) nications, pp. 961–979. Springer
5. Naghizadeh A, Razeghi B, Radmanesh I, Hatamian M, Atani RE, 23. Josang A, Ismail R (2002) The beta reputation system. In:
Norudi ZN (2015) Counter attack to free-riders: filling a security Proceedings of the 15th bled electronic commerce conference, pp.
hole in BitTorrent protocol. In: 12th IEEE international conference 2502–2511. Bled
on networking, sensing and control, pp. 128–133. IEEE 24. Skopik F, Schall D, Dustdar S (2009) Start trusting strangers?
6. Dhungel P, Wu D, Ross KW (2009) Measurement and mitigation of Bootstrapping and prediction of trust. In: International conference
BitTorrent leecher attacks. Comput Commun 32:1852–1861 on web information systems engineering, pp. 275–289. Springer
7. Wong KY, Yeung KH, Choi YM (2009) Solutions to swamp poi- Berlin Heidelberg
soning attacks in BitTorrent networks. In: 1st international 25. Yahyaoui H, Zhioua S (2011) Bootstrapping trust of web services
MultiConference of engineers and computer scientists, pp. 360– through behavior observation. In: International conference on web
363. IMECS engineering, pp. 652–659 springer Berlin Heidelberg
8. Aringhieri R, Damiani E, Vimercati D, De Capitani S, Paraboschi 26. Sherchan W, Loke SW, Krishnaswamy S (2006) A fuzzy model for
S, Samarati P (2006) Fuzzy techniques for trust and reputation reasoning about reputa- tion in web services. In: Proceedings of the
management in anonymous peer-to-peer systems. J Am Soc Inf 2006 ACM symposium on applied computing, pp 1886–1892.
Sci Technol 57:528–537 ACM
Peer-to-Peer Netw. Appl. (2019) 12:951–968 967

27. Benincasa, C., Calden, A., Hanlon, E., Kindzerske, M., Law, K., 46. Chen K, Liu G, Shen H, Qi F (2015) Sociallink: utilizing social
Lam, E., Rhoades, J., Roy, I., Satz, M., Valentine, E., Whitaker, N.: network and transaction links for effective trust management in P2P
Page Rank Algorithm. : Department of Mathematics and Statics, file sharing systems. In: IEEE international conference on peer-to-
University of Massachusetts, Amherst, Research (2006) peer computing (P2P). IEEE Press, Boston, pp 1–10
28. Josang A (1999) Trust-based decision making for electronic trans- 47. Clarke I, Sandberg O, Toseland M, Verendel V (2010) Private commu-
actions. In: Proceedings of the 4th Nordic workshop on secure nication through a network of trusted connections: The dark freenet.
computer systems, pp. 496–502. NORDSEC [Link]
29. Pouwelse J, Garbacki P, Epema D, Sips H (2005) The bittorrent p2p 228552753_Private_Communication_Through_a_Network_of_
file-sharing system: measurements and analysis. In: International Truste d_Connect ions_The_Da rk_Freenet /links/
workshop on peer-to-peer systems, pp. 205–216. Springer 02e7e525f9eb66ba13000000/Communication-Through-a-Network-
30. Fattaholmanan A, Rabiee HR, Large-Scale Active A (2016) [Link]. Accessed 2 Mar 2017
Measurement study on the effectiveness of piece-attack on 48. Danezis G, Lesniewski-Laas C, Kaashoek MF, Anderson R (2005)
BitTorrent networks. IEEE Trans Dependable Secure Comput 13: Sybil-resistant DHT routing. In: European symposium on research
509–518 in computer security, pp. 305–318. Springer
31. Wang L, Kangasharju J (2013) Measuring large-scale distributed 49. Yu Y, Xia C, Li Z (2015) A trust bootstrapping model for defense
systems: case of bittorrent mainline dht: IEEE thirteenth interna- agents. In: IEEE international conference on communication soft-
tional conference on peer-to-peer computing (P2P), pp. 1–10. IEEE ware and networks (ICCSN), pp. 77–84. IEEE press
32. Dhungel, P., Wu, D., Schonhorst, B., Ross, K. W.: A measurement 50. Tavakolifard M, Knapskog SJ (2011) Trust evaluation initialization
study of attacks on BitTorrent leechers. In: 7th international confer- using contextual in- formation. In: Proceedings of the international
ence on peer-to-peer systems, pp. 7–15. ACM (2008) conference on Management of Emergent Digital EcoSystems, pp.
33. Adamsky F, Khayam SA, Jäger R, Rajarajan M (2014) Stealing 1–8. ACM
bandwidth from BitTorrent seeders. Computers & Security 46: 51. Jiao H, Liu J, Li J, Liu C (2011) A framework for reputation
126–140 bootstrapping based on reputation utility and game theories. In: 10th
34. Douceur JR (2002) The Sybil attack. In: International workshop on IEEE international conference on trust, security and privacy in com-
peer-to-peer systems, pp. 251–260. Springer Berlin Heidelberg puting and communications (TrustCom), pp. 344–351. IEEE press
35. Alice C, Eric F (2005) Sybilproof reputation mechanisms. In: 52. Malik Z, Bouguettaya A (2009) Reputation bootstrapping for trust
Proceedings of the 2005 ACM SIGCOMM workshop on econom- establishment among web services. IEEE Internet Comput 13:40–47
ics of peer-to-peer systems. ACM Press, USA, pp 128–132 53. Oram A (2001) Peer-to-peer: harnessing the power of disruptive
36. Kong J, Cai W, Wang L (2010) The evaluation of index poisoning technologies. O’Reilly me- dia. In: Inc
in bittorrent. In: Second international conference on communication 54. Mónica D, Leitao J, Rodrigues L, Ribeiro C (2009) On the use of
software and networks, pp. 382–386. IEEE radio resource tests in wireless ad hoc networks. Technical report,
37. Kong J, Cai W, Wang L, Zhao Q (2010) A study of pollution on proc. In: 3rd WRAITS
BitTorrent. In: The 2nd international conference on computer and 55. Borisov N (2006) Computational puzzles as Sybil defenses. In: 6th
automation engineering (ICCAE), pp. 118–122. IEEE IEEE international con- ference on peer-to-peer computing, pp.
38. Su, M., Zhang, H., Fang, B., Du, X.: DDoS vulnerability of 171–176. IEEE press
BitTorrent peer exchange extension: analysis and Defense In: 56. Ping W, Jing Q (2007) A mathematical trust model in e-commerce.
2012 IEEE International Conference on Communi- cations (ICC), In: International conference on multimedia and ubiquitous engi-
pp. 1048–1052. IEEE(2012) neering (. MUE’07), pp. 644–649. IEEE press
39. Saini, N. K., Chaturvedi, A., Yadav, R.: Identifying Collusion 57. Yager RR (1988) On ordered weighted averaging aggregation op-
Attacks in P2P Trust and Reputation systems.: Int J Comput erators in multicriteria decision making. IEEE Transactions on sys-
Appl(IJCA) (2014) tems, Man, and Cybernetics 18:183–190
40. Ragab-Hassen, H., Jones, O., Galanis, N.: Rabit: a reputation archi- 58. Xinxing Z, Zhihong T, Luchen Z (2016) A measurement study on
tecture for BitTorrent. In: 2012 IEEE global communications con- mainline DHT and magnet link: IEEE international conference on
ference (GLOBECOM), pp. 850–855. IEEE (2012) data science in cyberspace (DSC), pp. 11–19. IEEE
41. Ormándi R, Hegedus I, Csernai K, Jelasity M (2010) Towards in- 59. Ripeanu M, Foster I, Iamnitchi A (2002) Mapping the gnutella
ferring ratings from user behavior in BitTorrent communities. In: network: properties of large- scale peer-to-peer systems and impli-
19th IEEE international workshop on enabling technologies: infra- cations for system design. In: arXiv preprint cs/0209028
structures for collaborative enterprises (WETICE), pp. 217–222. 60. Fabrizio F, Pedrolli M (2008) A BitTorrent module for peersim.
IEEE University of Trento, Technical report
42. Santos FR, da CC, Weverton L, Gaspary LP, Barcellos MP (2011) 61. Wang G, Musau F, Guo S, Abdullahi MB (2015) Neighbor simi-
Funnel: choking polluters in bittorrent file sharing communities. In: larity trust against sybil attack in P2P e-commerce.: IEEE transac-
8th IEEE transactions on network and service management, pp. tions on parallel and distributed systems, pp. 824–833. IEEE
310–321. IEEE, vol 8, pp 310–321 62. Ferreira A, Huynen J, Lenzini G, Koenig V (2015) In cyber-space
43. Riccardo P (2016) A trust and reputation method to mitigate a Sybil no one can hear you S-CREAM: a root cause analysis of technique
attack in Kademlia. Comput Netw 94:205–218 for socio-technical attacks. In: 11th workshop on security and trust
44. Wang J, Wu X, Guo N (2010) Ullrich, C.,Luo, H.: discouraging management, pp. 255–264. ESORICS
improper exploitation against seeds in BitTorrent swarms. In: 63. Marinelli E (2009) E.: hyrax: cloud computing on mobile devices
International conference on cyber-enabled distributed computing using MapReduce. Carnegie-mellon univ Pittsburgh PA school of
and knowledge discovery (CyberC), pp. 235–242. IEEE press computer. science
45. Singh A, Liu L (2003) TrustMe: anonymous Management of Trust 64. Rodrigues J (2017) Marques, E. RB: lopes, L.: Silva, F.: towards a
Relationships in Decen- tralized P2P systems. In: Proceedings of middleware for mobile edge-cloud applications. In: Proceedings of
the 3rd international conference on peer-to-peer computing (P2P the 2nd workshop on middleware for Edge Clouds & Cloudlets. Pp.
2003), pp. 142–149. IEEE press 1. ACM
968 Peer-to-Peer Netw. Appl. (2019) 12:951–968

Francis N. Nwebonyi completed tolerance in such systems. He is a former member of the the Intel Science
his masters degree, MSc Computer and Technology Center (ISTC), where he was involved in both Cloud
security and forensics, from Computing and Embedded Computing centers, and Parallel Data Lab
University of Bedfordshire, United (PDL) at Carnegie Mellon University (CMU). At the same time, he was
Kingdom. His MSc thesis was on also a computer research scientist at YinZcam, a spinoff from CMU that
trust based approach for security in provided mobile applications for the NBA, NHL, NFL and MLS, where
BYOD networks. He obtained his he was involved on cloud computing, content management systems,
first degree, BSc computer OAuth and video streaming. He is currently an invited assistant professor
Science, from Ebonyi State at the department of Computer Science at FCUP and researcher at
University in Nigeria. Francis CRACS (Center for Research in Advanced Computing Systems) part of
worked shortly as an assistant lec- INESC-TEC.
turer at Ebonyi State University –
Nigeria, after his Msc, before mov-
ing to Portugal where he is currently
undertaking his PhD, in the depart-
ment of computer science, University of Porto. He is a member of CRACS
(Center for Research in Advanced Computing Systems), under INESC-TEC.
Manuel Eduardo Correia has a
He is currently researching on trust based security for distributed networks,
Phd in Computer Science from
such as P2P, and edge cloud.
the University of Porto and a
MSc in Computer Engineering
from Imperial College. He is one
of the Co-Founders of HLTSYS
and is a Professor at the computer
science department of the Faculty
Rolando Martins studied at of Science at Porto University. He
Faculty of Science of the is also the director of the Masters
University of Porto (FCUP), on Informatics security, member
where he also obtained his [Link] of the executive committee of
in Informatics: Networks and the computer science department
Systems. He also worked at and member of the digital admin-
EFACEC as a software architect istration council of the University.
and later as a systems researcher. As a security expert, he is also a member of the CT 199 Portuguese
He obtained his Ph.D in normative group, responsible for the translation and adoption of ISO
Computer Science from FCUP, and CEN eHealth related standards in Portugal. He has an extensive
as a part of a collaborative effort experience in research projects, at the national and European level, some
between FCUP, EFACEC and of them as PI. He has also acted as consultant for the Portuguese Ministry
Carnegie Mellon University, under the supervision of Prof. Fernando of Health, in (1) European projects Epsos and SEHGovIA; (2) National
Silva, Prof. Luís Lopes and Prof. Priya Narasimhan. His Ph.D. research security normatives and policies for Health Institutions; (3) Electronic
topic arose from his employment at EFACEC, where he was exposed to prescription system security and for the Ministry of Justice, where he
the difficulties underlying today’s railway systems and light-rail deploy- his responsible for the development of the biometric match-on-card sys-
ments, and came to understand the scientific challenges and the impact, of tem, currently being deployed into the Portuguese citizen card. (http://
addressing the issues of simultaneously supporting real-time and fault- [Link]/0000-0002-2348-8075).