CHAPTER 6

Agent Security in MANET

6.1 Introduction
MANET is more vulnerable to security risks because of its intrinsic dynamic nature.
Unlike its wired cousin, its open and shared communication channel attracts new types
of vulnerabilities. A mobile agent is dependent on the host platform since it operates as
a process on that platform when it visits a host site. Therefore, it is difficult to secure
an agent when it is visiting a host. But in order to deliver a dependable service, mobile
nodes and the agents they deploy must be protected. Therefore, protecting the nodes
and, therefore, the agents from malevolent actors not only increases MANET
dependability but also boosts the distributed application's efficient performance.
As noted in [88], the security of a mobile agent paradigm focuses on using
cryptographic functions to shield and stop a mobile agent from assaults by malevolent
hosts. However, these defenses are ineffective in an environment that frequently
experiences ongoing topological changes, which disrupts the flow of information
along the current channels. Preventing an agent from visiting or migrating through a
malicious site is sometimes the best strategy to safeguard them in a MANET.
A basic idea that involves interactions between people that lack mutual confidence is
reputation. It is created by the nodes sharing thoughts on trust. The degree of belief
regarding the behavior of mobile nodes is known as trust. It is discovered that the
reputation-based trust paradigm works well for protecting MAS and, consequently,
MANET. In this chapter, a few trust models are created to safeguard the same.
According to the trust model, an agent will be required to complete a job by visiting
only trustworthy host sites. However, this method works best for applications (agent
spawning) that allow for smooth performance decrease, such service discovery.
However, in e-commerce applications, if a node appears questionable, it is impossible
to get an agent to visit it even if they are specifically instructed to do so. The potential
risks to mobile agents in MANET are covered first in the section that follows. The
suggested trust models are then described and then verified by simulation results.

107
 [Link] Security in MANET
6.2 Security Issues
Let's talk about who we are protecting our agents from and why before moving on to
countermeasures. A MAS's threats fall into one of the following categories [113]:
• Dangers posed by mobile agents to the host platform: A malevolent agent may try denial
of service (DoS), corrupt data and software, infiltrate viruses or worms, and then take action
repudiation [113]. Additionally, it could steal some of the hosts' confidential data.

• Host platform threats to mobile agents: A host platform can attack an agent in a number
of ways, such as disclosing a private or sensitive action taken by a mobile agent, executing an
agent's code incorrectly, sending an agent to an unexpected location, or deceiving an agent
with false information or repudiating an action [79].
• Threats from mobile agents to mobile agents: Lastly, an agent may be threatened by other
agents inside the system, such as via illegal access, DoS attacks, fraudulent information
transmission, additional messages, and agent information theft [79], [113].
Unfortunately, there are several vulnerabilities associated with the MANET environment,
such as wormhole [44], grayhole [44], and blackhole [44] attacks. Routing protocols that are
often used [44] are unable to stop these kinds of assaults. In these situations, agents are either
sent elsewhere (wormhole) or dumped by a host (blackhole or grayhole). Agents will never be
able to return to their owner in a timely manner in any scenario. Therefore, an agent will be
essentially lost if it occurs to transit via such a host.
However, the majority of the risk factors are resolved when a mobile agent is prevented from
contacting a rogue node. As a result, this method prevents communication between the agents
and their owner, MN, and the malicious nodes. For this, reputation-based trust models can be
a useful tool. Threats to reputation systems, however, include purposefully malevolent hosts
[115] and strategic raters [114].
• Strategic rater: One rater or a group of raters intentionally gives a series of unjust
comments with the goal of damaging (enhancing) the reputation of a peer or its partner [114].
• Strategically malevolent host: By collaborating or defecting from its partners in an
acceptable range, a host can maintain its reputation above a lower bound and continue to
interact with them in the future.
• Whitewasher: In an effort to hide any negative reputation associated with their prior
identity, entities intentionally depart or enter the system under a new name [116].

108
 [Link] Security in MANET
The threat model, which illustrates the kind of risks our trust model will address, is covered
before moving on to the trust model.
6.3 Threat Model and Assumptions
An adversary may position hostile (wormhole, blackhole, or grayhole) nodes at random
locations throughout the network, according to the threat model taken into consideration in
this study. A communication route that is invisible to other nodes connects these nodes. These
nodes either destroy agents or deceive them so that they never return to their owners on time
(within a predetermined time-out limit). Therefore, no expertise is required on the part of the
attacker to trick the nodes into thinking that their agents have been lost because of
unfavorable MANET circumstances. (ii) Agent to Host Attack: In order to execute a denial-
of-service attack, a hacked node may transmit malicious agents to trick another node or send
many agents to a trustworthy node to block its traffic.
(iii) Agent code modification attack: Any unencrypted part of a visiting agent's code and/or
data can be altered by a rogue node. We make the assumption that
(i) mobile agents are deployed by distributed applications such as service discovery,
where performance degradation is acceptable due to the possibility of rogue nodes. However,
in our model, the operation cannot be accomplished if an agent has to access a certain node in
MANET (like in e-commerce) and that node is corrupted.
(ii) No mobile node has the ability to act in a Whitewasher manner [116].

6.4 Modeling Reputation Based Trust

We employ the idea of trust, which has drawn a lot of attention in the literature on
information security, to impose security on the mobile nodes and their agents. Since a system
is trusted if it is secure, and a system is seen as secure if it is trusted, trust and security are
essentially two sides of the same coin [117].
Because of this discovery, we see trust as a subjective opinion that arises from evaluating a
system and its surroundings, and security as a desirable feature of a system in a particular
context. According to a particular agreement derived from the results of the prior encounters,
both direct and indirect, trust is characterized as a subjective quantifiable predictor of the
predicted future behavior of a trustee, as stated in [117]. The term "reputation" refers to
specific traits associated with a host's dependability. In a mobile agent system, reputation may
be derived from a collection of interaction feedbacks in which mobile agents explain how well
a visited host performs in carrying out its responsibilities. It is also possible to take into
109
 [Link] Security in MANET
account indirect experiences that are obtained from other reliable nodes. Through the agents,
the MANET nodes may exchange the list of suspect nodes, accelerating convergence.
6.4.1 Modeling MAS on MANET
Data collection from networks, such as in service discovery [6] in MANET, may be a
significant use for mobile agents. This may also apply to e-commerce systems where agents
are supposed to visit every node in the network [118]. Let's consider a scenario in which
participants at a meeting would like to exchange real-time data. In this case, the participants
have created an ad hoc network to connect and maintain communication, and the devices they
use for communication (such as laptops or PDAs) may execute an agent code, meaning that
any node could serve as a possible host for the agents. It is now presumed that person 1
(MNA) has started a mobile agent with the intention of collecting certain data from other
members. That agent will go between nodes, gather information, and then deliver the
information to its owner—that is, the node that initiated it. As a result, an agent begins its trip
with a specific owner and travels at its own pace between nodes. For the application that
deployed that specific agent, the owner gives the agent a Priority List (PL) that includes a list
of node ids that are the most advantageous migration locations. As a result, an agent's top
priority is to visit the nodes in the priority list. However, this movement is effective provided
the routing table is appropriately updated to reflect the path and the two nodes are connected
by a path with the necessary connection quality. Thus, the movement has a probability
measure attached to it. As a result, there is a chance of pt that an agent living at node MNA
would successfully transfer to node MNB (which is linked to MNA). In this case, pt stands for
the issue of erratic background noise levels impacting link quality or the absence of routing
table updates in a highly volatile MANET. For instance, a lot of rain may make the noise level
higher.

110
 [Link] Security in MANET

6.4.2 Basic Trust Model

Each node changes its reputation value based on agent feedback and assigns it to the other
nodes in the network. The agents it installs are given access to a mobile node's priority list
(PL) of nodes. Since they could provide important information for the application (that
deployed the agent), the PL comprises the node ids that are most helpful for this agent. After
visiting the nodes listed in PL, an agent moves throughout the network and reports back to its
owner. The owner can identify harmful nodes and alter the reputation values of the nodes in
PL based on this input. The owner notifies the network if any malicious nodes are found,
assisting other users in updating their perception of MANET.
Table 6.1: Data Structures for Basic Trust Model

Name Desciption
PLj It has two fields: nodeId and trustLevel
(unvisited 0; suspected -1; trusted +1)
Trust Threshold k (a positive integer)
Default trust level TS (> k)
Trust level view of (Trust level1, Trust level2, Trust level3,..)i
the MANET at MNi where Trust level1 represents the trust
value assigned to MN1 by the current
node

Table 6.1 lists the data structures required to describe the model. At first, unvisited node ids are
represented by a trust level of 0 for each node id in each agent's priority lists (PL). There are two
components to the workflow:
• The agent-executed algorithm (AgentCode() in Algorithm 11) gathers firsthand data on the nodes
the agent visited;

• The nodes' algorithm (MNCode() in Algorithm 12) modifies the trust level view of the MANET
that a node maintains using direct information from the agents it spawns as well as any broadcast
messages it receives (indirect information). Newer agents' path is therefore impacted by this.
It is expected in this fundamental trust model that a dependable routing protocol is in place to
guarantee that, after being deployed, the agents finally return to their respective owners. As a result,
host to agent attacks—which are covered in the threat model in Section 6.3—are not taken into
111
 [Link] Security in MANET
account here. However, the following part (part 6.4.3) addresses it. According to our approach, a
node's trust value increases gradually yet fast at the owner based on agent input. This is done to prevent
agents from ever migrating to compromised sites. Agents in our system function as watchdogs, as is
evident [87]. For the reputation system operating at the nodes (in Algorithm 12), their feedbacks (stored
in the PL status) function similarly to direct information [87]. For the receivers, the broadcast messages
sent by a trustworthy node (in Algorithm 12) to others serve as indirect information [87]. Based on this
data, the reputation system at each node modifies its perception of the network and directs (providing
PL) the agents it deploys.

Algorithm 11 : AgentCode(). An algorithm for collecting node status from the PL.
Input: PL containing unvisited nodes provided by the owner
Output: PL showing the agent’s experience with the nodes in PL
begin
1 while task given to the agent is not completed
2 Move to a yet unvisited host from the PL provided.
3 if that destination falls in the same cluster as it is now
residing then
4 The agent moves to the new destination with
probability p.
5 Before processing, take hashcode of the agent’s own code and data.
6 if the hashcode matches with the one stored in a
secured way in the agent’s data then
7 Share information regarding the visited nodes with
the host platform.
8 Set the trust value of this node to +1 in the PL.
9 Gather information needed by the owner application.
10 Update the computed results.
11 Compute hashcode of the code and updated data and
store it in a secured way.
12 else
13 Put the trust level of this node to -1 in
its PL and retract back to owner.
// inference: most likely agent data has been changed.
112
 [Link] Security in MANET
14 Retract back to the owner.
end

Algorithm 12 : MNCode(). An algorithm for updating trust based reputation at the nodes.
Input: Initial position, initial speed and maximum acceleration of each node
Output: The updated trust level view of MANET
begin
1 Input network configuration.
2 for t=t0 to T do
3 Software reliability of agent ri(t) is calculated.
4 if this node fails then stop.
5 Use srmmMANET() in Algorithm 7 to find out
connected components.
6 if an agent comes to this site/node (MNj)
7 if the visit frequency of agent from a particular
node (MNk) reaches threshold
8 The agent is killed. // preventing DoS attack
9 A message is broadcast stating MNk to be compromised.
10 Delete the current trust level view stored at MNj.
11 else update the trust level of the nodes.
12 if the agent is found to trust a node (MNk)// +ve trust level in PL
13 Increment the trust value of (MNk) in the
trust level view of MNj by 0.5.
14 if the agent is found to suspect a node (MNk)// -ve trust level in PL
15 Kill that agent.
16 Decrease the trust level of its owner.
17 Learn not to migrate an agent via this node.
18 if an agent owned by this node comes back containing at
most one suspected node in its PL
19 Update the results.
113
 [Link] Security in MANET
20 Update the trust level view of the network
according to the agent’s PL // Increase by 0.5 or decrease by 1
21 if a node is found to be suspected
22 Learn to avoid the existing route followed by the agents.
23 Kill the agent.
24 if the resulting trust level for any node falls below TrustThreshold
25 Advertise that node to be suspected to the rest of the nodes.
26 if a message regarding suspected node is received from a trusted sender
27 Relevant information is updated depending on how much the
receiver trusts the sender.
28 The PL for each agent is formed and kept with the owners.
29 Deploy agent, if needed by the application that follows
AgentCode() listed in Algorithm 11.
end

Code modification can occasionally change an agent's behavior. The host can readily infer
information about the agent's state since the control flow of agent execution cannot be
completely secured. Additionally, a time-sensitive agent could be needlessly stored on the
host platform [119]. It is possible to sign the code since the owners determine the agent's
code and it is not anticipated to be altered while traveling. The hashcode for the agent's
own code is computed and securely saved in step 5 of AgentCode() (see Algorithm 11).
The owner of the agent signs the portion of the code that is used to compute the hashcode
(i.e., hashcode computation algorithm such as MD5 [120]) of the data and the agent itself.
Additionally, public key cryptography is used to encrypt information in order to conceal it
while it is being transmitted. As a result, every agent has the following
ENCRYPTpublicKey[SIGNATUREowner(code for hashcode computation) + hashcode]
+ code of agent + data(except hashcode)
Here, "code of agent" alludes to the reason its owner has deployed it. When an agent reaches a host site,
it uses its own hash code to determine if it was attacked by the present site or during transit. After
authentication, it runs the application code and modifies its data. then swaps out the old hashcode for a
new one. If the agent discovers anything suspect in the interim, it notifies its owner (setting its trust level
to -1 in PL) so that the owner may adjust it appropriately. It is not recommended to destroy the agent at
114
 [Link] Security in MANET
the suspected host site in order to conserve network traffic and enhance MAS performance. The owner
node therefore learns about a questionable region in the network when any agent returns to its owner
with at most one node id in its PL having a bad status (step 18 of MNCode() in Algorithm 12). The agent
switches to a new host site in accordance with the job assigned if no questionable activity is found at the
host site [120].
It is fairly logical to believe that by counting the agents' own experiences, the effect (if any) of any
strategic group of raters on a node (agent owner) might finally be eliminated. A strategically malevolent
host may find it challenging to maintain the same trust rating regarding itself across all MANET nodes
in practice. This is due to the fact that the trustworthy community of nodes can ultimately detect those
deliberately harmful ones by gathering indirect input from neighbors.
As a result, Dempster-Shafer belief theory, which is covered in the next section, may be used to
successfully integrate direct and indirect information.
6.4.3 Extended Trust Model
This work's primary goal is to shield a MANET's nodes and agents—which they deploy—
from network layer assaults like wormholes and blackholes, which cause the impacted agents
to fail to return to their owner. It is impossible to determine with certainty whether a host is
malicious or not because MANET nodes can only know a limited amount about other hosts.
However, opinions about the host can be formed, which can be translated into degrees of
belief (how trustworthy the host is) or disbelief (how suspicious the host is), as well as
uncertainty in the event that both beliefs and disbelief are lacking. Mathematically, this may
be stated as

b +d +u = 1 (6.1)

115
 [Link] Security in MANET

Figure 6.1: Trust evaluation framework at hosts taking feedbacks

Here, the symbols for belief, unbelief, and doubt are b, d, and u, respectively. Figure 6.1
depicts the layout of our reputation system. It focuses on how to utilize the data gathered to
measure a node's reputation in order to make sure an agent never gets caught in a wormhole,
grayhole, or blackhole [41]. Direct observations—the agent's experience at various nodes—
and indirect observations—feedback from neighboring nodes and others, gathered via
agents—are used to update parameters (b, d, and u) in order to measure trust. To measure trust
from b, d, and u, both observations are merged. The technique that takes network dynamics
into account also takes aging into consideration. Digital signatures can also be used to stop or
at least identify attempts to alter the agent's static code [120]. The following data will be
entered by the agents:
The list of agents' priorities. Node id and the owner's perceived trust level of that node
(unvisited 0; suspicious -1; trusted +1; recent visit by an agent of the same owner +2) are its
two fields.
• Agent J's suspected node list. Node id and provider node id are its two parameters.
This informs the agent about this questionable node. Only when the provider node is not the
owner of agent j does the optional provider node id become significant.
A node The following is how MNi changes its observations for any additional nodes based on
agent feedback:
1. An agent visits MNi: The agent's suspicious node list is exchanged with the node's
when an agent visits this node.

116
 [Link] Security in MANET
2. 2. An MNi-owned agent returns: Upon returning to its owner, an agent's feedback is
updated based on the owner's firsthand observations.
The following describes how direct and indirect observations are updated in the view
of any node.
[Link] Direct Observation
Depending on its priority list, an agent moves between nodes. After arriving at a host, an
agent runs the agent code after verifying its validity as outlined in Section 6.4.2. The agent
provides the host's owner with positive feedback if the host successfully carries out the agent's
duties. If every node in the agent's priority list is either visited or suspected, the agent reverts
to its owner. The agents' comments on the nodes they visited are regarded as firsthand
observations made by the owner. If the legitimacy of the agent's code cannot be verified, an
agent provides a node with negative feedback. Even if an agent is attacked while in route, it
could not be discovered until it arrives at the host site and performs self-checking.
Additionally, a node may behave aggressively toward others later on while initially serving as
a decent host site for an agent. As a result, the agent's observation carries some degree of
ambiguity.
When an agent needs to identify its owner, we expect that it will ultimately do so. Because the
features are comparable, we use the Beta(α,β) distribution here, much like in [120], [121]. The
number of successful transactions between the agents that Owneri and MNj have deployed is
denoted by αij. Therefore, αij is increased with every good agent feedback. If not, βij is
increased. The uncertainty of some random variables is quantified here using a method
suggested in [87], which draws on the Dempster-Shafer Belief Theory [30] to address
uncertainty (as previously indicated). Therefore, the uncertainty (uij) in MNi's prediction of
MNj's nature is [87]:

12 × αij × βij (6.2)

uij
=
(αij + βij)2 × (1 + αij + βij)

117
 [Link] Security in MANET

For each positive feedback from agents, αij is incremented as follows

αij(new) = w × αij(old) + (1 — w) × pk j
(6.3)

where pjk stands for agentk's MNj observation. Here, a weighted average is calculated, where w (0<
w<1) denotes the absolute trust in each agent's observation, which may fluctuate over time due to
network dynamics. Additionally, a malevolent host may act logically for a while in order to win over
its colleagues. W should be around 1 to address this. Once more, for values around 0, w acts as the
aging factor. Furthermore, it's possible for an agent to visit several hosts successfully before stumbling
into a trap. As a result, each node keeps track of the last Z owner IDs that dispatched agents to it.
Therefore, the owner of agentk increases pjk in equation 6.3 if the agent discovers its owner id in Z
when visiting MNj, suggesting that another agent from the same owner has recently visited this node.
Due to network latency or the existence of wormholes or blackholes, an agent could not return to its
owner in a timely manner. In these situations, the owner deploys n (part) agents and splits the job into
n subtasks (the value of n depends on network capacity) in order to pinpoint the precise reason. These
(part) agents should return more quickly since their trails are short (there are fewer nodes to visit).
Additionally, the likelihood of getting lost at a malicious node is decreased because of fewer trails.
This makes it possible to identify the neighborhood's trustworthy or dangerous areas more precisely.
When an agentk fails to return, its owneri increases βij for each of the j nodes (that an agent is
requested to visit) in the manner shown below.

βij(new) = w × βij(old) + (1 — w) × qk j (6.4)

118
 [Link] Security in MANET

In this case, qjk stands for the likelihood of misbehavior at MNj with agentk. An agent may also
exchange and update its suspected list with the host while on the host's website. The list is used to
update the agent owner's current perception of the network, and any changes made to it will be
regarded as indirect observations. This is done in order to keep a node from containing any
misleading data. An agent kills itself if it discovers that it cannot go back in time, meaning that its
owner may have time-out. Agents are able to recognize that it is gone in this way, and it ends its
own life.
The reputation system receives the values of αij and βij and converts them into a tuple (bij, dij, uij).
Here, bij demonstrates MNi's confidence in MNj's conduct as a secure host location for MNi-
deployed agents. Similarly, uij shows MNi's hesitancy to forecast MNj as a secure host site for its
agents, while dij shows MNi's incredulity. Here, equation 6.2 is used to determine uij. According to
equation 6.1, complete certainty (= (1-uij)) is thus separated into dij and bij based on the relative
amount of supporting evidence as follows (the first observation is derived from [87]):
αij
b = (1 — u ), initially
ij ij
αij + βij
αij
(1 — uij) × w1 + bij(t — Δt) × w2
αij +βij
= , otherwise (6.5)
w1 + w2

βij
dij = (1 — uij), initially
αij + βij
βij
(1 — uij) × w1 + dij(t — Δt) × w2
αij +βij
= , otherwise (6.6)
w1 + w2
To represent the behavior of n component agents in the same tuple (bij, dij, uij), a weighted
average is required. The weight of w1 is assigned to the new observation (bij in terms of αij,
βij, and uij), whereas w2 is assigned to the old observations (bij(t — Δt) and dij(t — Δt)).In
order to simulate aging, older values of bij and dij are given lower weights (w2 < w1) than
more recent values.
119
 [Link] Security in MANET
In this sense, even if complete accuracy might not be attained, uncertainty can be greatly
decreased with the aid of Dempster-Shafer Belief Theory [30].
[Link] Indirect Observation
For faster convergence of trust view, nodes share information about malicious node/s among each
other via the agents. A node is suspected (not marked as malicious yet) if its b<u<d. This
information indirectly influences a node’s view of the network. The influence is indirect as an agent
suspects a node based on another (preferably trusted) node’s observation without ever visiting that
node. This second-hand information helps a node to cope with long delays and frequent partitions
(formation of disconnected clusters) which are characteristics of MANET. Let bli:j represent
belief (b) of MNi on MNl while taking indirect observation from MNj. So this parameter
depends on two factors-
1. MNi’s belief on MNj and
2. MNj’s observation about MNl that it shares (suspicious node list) with the agents of owneri.
Thus following the approaches proposed in [13] (bli:j,dli:j,uli:j) can be formulated as

i:j j (6.7)
b = bi × b
l j l

i:j j (6.8)
d = di × d
l j l
i:j j (6.9)
u = ui × u + di + ui
l j l j j

Here bj=trust threshold, dj=1-trust threshold and uj=0. Trust threshold is fixed and is
l l l

input to the reputation system. If any node’s trust value goes below trust threshold, it
is treated as malicious (trust calculation is detailed later). It may be noted that MNi’s disbelief in
MNj’s observation becomes an uncertainty in prediction about MNl. Also MNi’s uncertainty on
MNj amounts to the uncertainty of MNi in predicting MNl’s future behavior.
No deployed agents will return if MNi reaches a new network and is trapped by its neighbors. Then,
MNi would rather hold off till it moves. Furthermore, MNi will prefer to ask its trusted neighbors for
information on suspicious nodes if a sizable portion of agents fail to return any indications of wormhole
or blackhole traps in transit. Regarding the nodes they suspect, the neighbors reply with their last
observations (bjl, djl, ujl). As a result, a node makes predictions about its future behavior based on

120
 [Link] Security in MANET
indirect input from all agents that recently retracted to the owner (∆t) and/or from neighbor responses.
MNi makes the following adjustments to its perspective (b, d, u) [13].

bi:k (6.10)

kes
|S|
(6.11)
di:k
di:l = ∑ l
(6.12)
kes

bi × bk + di + ui
i:l
kes |S|
Here bi:l represents the indirect belief of MNi about MNl. S denotes the set of nodes that
shared its view of the network (that MNi received) with the agents deployed by MNi.
[Link] Combining Direct and Indirect Observation
A node tries to use first- and second-hand knowledge gathered from the agents and trusted
neighborhood to reach a consensus on the nodes' future behavior. Accordingly, the following
equations, as in [13], are used to obtain the comprehensive belief (bji(f)), disbelief (dji(f)), and
uncertainty (uji(f)) of MNi on MNj.

i( f )
bj = φ1 × bij + φ2 × bi:j (6.13)
i( f )
d = φ1 × dij + φ2 × di:j (6.14)
j
(6.15)
i( f ) i( f ) i( f )
u = 1 —b —d
j j j

Where
γ × ui:j
φ1 = (6.16)
(1 — γ) × uij + γ × ui:j — 0.5 × uij × ui:j
(1 — γ × uij)
φ2 = (6.17)
(1 — γ) × uij + γ × ui:j — 0.5 × uij × ui:j

Here, a node's trust in the agents it deployed is shown by γ (0< γ <1). A node that has larger values
121
 [Link] Security in MANET
of γ (>0.5) is more likely to believe its agents, whereas a node with lesser values (<0.5) is more
likely to trust the suggestions of others. As demonstrated in [117], [87], trust may now be measured
using the whole range of belief, unbelief, and doubt.

Tij = bi( f ) + σ × ui( f ) (6.18)

j j

Hence, according to the principle of indifference, σ is relative atomicity. Here, the likelihood that an
agent would visit a host safely or unsafely denotes two states that are mutually exclusive and
collectively exhaustive. According to the principle of indifference, each alternative should be given a
probability equal to 1/n if all (let's say n) possibilities are identical save for their names. There is a
50% probability that an agent will be safe out of all the unknowns surrounding their visit. Hence, σ is
assumed to be 0.5. However, this parameter can be adjusted more precisely so that σ <0.5 may occur
for greater disbelieve values.
Therefore, an owner determines an agent's task path and may request that it avoid suspect host sites
based on the trust values determined by equation 6.18 and the safety requirements of the applications
(operating at the nodes) that deploy agents.
Data collection from networks, such as service discovery [6], MANET clustering [60], e-commerce
applications [118], etc., is a significant use for mobile agents. Starting from a certain owner, an agent
travels at its own pace between nodes. A list of node ids that are the most advantageous migration
locations (for the application that deployed that specific agent) is included in the PL that the owner
gives the agent. Additionally, a Suspicious Node List (SL) is provided that suggests possible black
holes or Wormhole points. Once an agent reaches a trustworthy site, it communicates and updates its
knowledge about questionable nodes. Therefore, nodes from the (Priority List-updated Suspicious
Node List) set will always be attempted to be visited by an agent. However, if the two nodes are
connected in accordance with the two-ray propagation model, the environment is free of transient
errors, and the received signal can be separated from background noise, then this movement is
successful. As a result, there is a chance pt that an agent living at node MNA will relocate to node
MNB, which is linked to MNA.
Our agent-based system in MANET uses the suggested method with the data structures listed in
Table 6.2.
Table 6.2: Data Structures for Extended Trust Model

Name Desciption

122
 [Link] Security in MANET
PLj two fields: nodeId and trustLevel (unvis-
ited 0; suspected -1; trusted +1; recent visit
by an agent of same owner +2)
SLj two fields: nodeId and optional providerId
if not given by the owner of agentj
α, β positive integers to be kept at node
Cagent-id number of part agents sent for the lost
agent designated by ’agent-id’
X maximum number of malicious nodes in
the network
Tagent-id maximum time an agent can be enroute
Trust Threshold same as in Table 6.1
Default trust level same as in Table 6.1
Trust level view at MNi same as in Table 6.1

At first, the default trust value TS for each node id is included in the PLs of all agents. As a
result, MNi will see the network as (TS1,TS2,)i. An owner gives its tasks to the agents it
generates. Therefore, a distinct collection of node ids is present in the PLs issued to one owner's
agents. We make the assumption that the network's maximum number of malicious nodes (X) is
known. It can be set to N in the worst situation. Maximum X agents might become caught at the
X malicious nodes if each agent's PL is unique. However, it is obvious that there are in-transit
assaults or inadequate connection between the nodes if more than X agents are lost at any time.
The suggested method also addresses this.
The workflow can be divided into two parts

123
 [Link] Security in MANET

Algorithm 13 : SecureAgentCode(). An algorithm for collecting reputation information.

Input: PL containing unvisited nodes, SL containing malicious nodes
Output: PL and SL showing the agent’s experience with the nodes
begin
1 while task given to the agent is not completed
2 Move to an agent site i from PL if status(i)=0 and
site i is not in the appended SL.
3 if destination site falls in the same cluster as it is now residing
4 The agent moves to the new destination with probability p.
5 Before processing, hashcode is used to detect any attempt to
change agent’s code/data by the node.
6 if hashcode matches
7 Gather information needed by the application that
deployed this agent.
8 Update computed results.
9 Hash code should also be computed to take care of updated data.
10 Share and update SL (if any) with this host
11 Appended entry (if any) is marked by the id of this host.
12 else go to next step. // inference:most likely agent’s visit was not safe
13 Retract back to the owner.
end

• Computation/Action in mobile node: To update the distributed trust model and,

consequently, the node's trust level view of the network, an evolutionary algorithm based on
MC simulation is operating at the nodes. It receives input from SecureAgentCode(), which is
listed as Algorithm 13, as well as any messages received from trusted neighbors (second-hand
information). This update is carried out in accordance with method 15 of the UpdateTrust()
method. Newer agents' path is influenced by the trust level perspective. Algorithm 14
summarizes this as SecureMNCode(). Here, it is possible to measure algorithm performance

124
 [Link] Security in MANET
(in terms of false negatives, etc.) by repeating steps 2–30 Q times after MC simulation.
• The agents' functions: Se-cureAgentCode(), which is listed in Algorithm 13, summarizes
the actions that an agent takes. This algorithm is responsible for gathering first-hand
information about the trustworthiness of a node (the node it is visiting) and second-hand
information about the nodes that the hosts (the agent visited) mistrust.
However, this study does not take node fault tolerance into account. In this case, a node
failure is considered irreparable. A host is thought to finally identify a rogue node. Until all of
them return or make a decision, the creation of part agents will continue.
Algorithm 14 SecureMNCode(). An algorithm for updating trust based reputation at the nodes.
Input: Initial position, initial speed and maximum acceleration of each node
Output: The updated trust level view of the MANET
begin
1 Input network configuration.
2 for t=t0 to T do
3 Find software reliability of agents.
4 Simulate mobility and find connected components
using srmmMANET() listed in Algorithm 7.
5 if an agent (not owned) comes to this site/node (MNj)
6 Kill the agent if it is found to suspect a node (MNk).
7 else allow the agent to compute
8 Looking at the agent’s SL update indirect observation using
equations 6.10 through 6.12.
9 Share own (if nonempty) SL with the current visitor.
10 if an agent owned by this node comes back having at most one
suspected node in its PL then
11 Call UpdateTrust() listed in Algorithm 15.
12 if an agent does not come back and time out occurs
13 Divide the job of that agent into n parts and spawn n agents which
carry n priority sub lists.
14 Start Tagent-id timer for these n new agents.
15 Set Cagent-id to n.
16 if a part agent comes back

125
 [Link] Security in MANET
17 Decrease Cagent-id by one.
18 Call UpdateTrust() method listed in Algorithm 15.
19 if a Tagent-id expires
20 Find its corresponding Cagent-id.
21 if Cagent-id>X then
22 Deploy the lost agents again asking them to
follow different route.
23 else if 0< Cagent-id<X then
24 Ask recommendation from trusted neighborhood
about the ones from PLs of Cagent-id lost agents.
25 Receive information from trusted neighborhood and update the
indirect observation following equations 6.10 through 6.12.
26 Hence update final (b,d,u) using equations 6.13 through 6.17.
27 Compute trust for each node following equation 6.18.
28 if the resulting trust of any node <Trust threshold demanded by the
deployer application then
29 append the node id to SL.
30 Deploy the agents with the SL (which nodes to avoid) and a PL
(which nodes to follow).
end

126
 [Link] Security in MANET

Algorithm 15 UpdateTrust(). An algorithm for updating observation at the nodes from agent
feedbacks.

Input: Agent feedback about nodes in PL

Output: The updated trust level view of the MANET
begin
1 Update the results.
2 Update direct observation of this node.
3 if a node is found to be trusted then
4 α is incremented according to equation 6.3.
5 else
6 β is updated according to equation 6.4.
7 Learn to avoid the existing route towards this node.
8 Update values of bij, dij and uij using equations 6.5, 6.6 and 6.2
respectively ∀ j nodes visited by the agent spawned by MNi.
9 Update indirect observation of this node.
10 if any new entry is found in the suspected node list then
11 Update this information depending on how much the owner trusts
the information provider according to
equations 6.7 through 6.12
12 Kill the agent
return

Agents in our system migrate and gather input on the trustworthiness of the nodes they visit,
as is evident. They so function as watchdogs [87]. Using first- and second-hand information,
the reputation system at the nodes refreshes its perception of the network and directs the
agents the node deploys by giving a priority list and a list of suspicious nodes.

6.5 Experimental Results

The simulation may run on any platform and is implemented in Java. The MANET
environment is configured in accordance with our explanation in Chapter 4, Section 4.2.2.
The network architecture is dynamic since the nodes adhere to the SRMM. To keep things
simple, the PL in our simulation instructs the agents on which nodes to visit. The agent
127
 [Link] Security in MANET
returns to its owner once it has successfully visited every node from the PL. Below are the
experimental findings for the two reputation models that were discussed in the previous
sections.
6.5.1 Results for Basic Trust Model
Six nodes make up the network in the example we've chosen. Four distinct owners (nodes)
deploy two mobile agents. Starting from nodes MN0 and MN1, respectively, agents 0 and 1
go across the network to complete their assigned tasks. Agent 1 is therefore deployed by an
application (like service discovery) that is executing on MN1. It is our responsibility to
safeguard the agents against malevolent hosts and to promptly eliminate any compromised
agents. At first, a default trust level is set for each node. The owners of each agent assign
them a specific PL (agent 0 must visit MN1 and MN2, whereas agent 1 must visit MN2 and
MN3). For instance, agent 0 will benefit most by visiting nodes MN1 and MN2, and so on.

Figure 6.2: MANET configuration with 6 nodes and corresponding agent locations
(a)Initially; (b)After 3 seconds; (c)In next 3 seconds indicating end of agent 1’s journey

128
 [Link] Security in MANET
As seen in Figure 6.2(a), the nodes are brought near enough to one another to first create a linked
network. The nodes' placements are modified in accordance with SRMM every three seconds. The
simulation runs for one hundred and twenty seconds. Figure 6.2 displays the network architecture at
three consecutive time instants (a, b, and c). Additionally, callouts and a digit to represent agent ids
are used to display agents in Figure 6.2. The bold ones (callouts) indicate the destination of their
voyage at that moment, while the dotted ones (callouts) indicate the beginning place. The figure also
displays their PL's current state. Since MN3 attempts to alter the data that an agent is carrying, it is
presumed to be malevolent.
Table 6.3: Trust Level View of MN1

MN0 MN2 MN3 MN4 MN5

5 6 4 5 5

Table 6.4: Default Values of Simulation Parameters

Parameter Name Value

Mobility Model SRMM
M 20
N 25
Trust View default 5
TrustThreshold 3
Minimum required signal 18dBm
power
Length of priority list 0.5N
Q 100

When both agents 0 and 1 migrate to MN2 at time instant t (let's say) (Figure 6.2(a)), they
perform the required calculations, compare the hash code, update the results, obtain a new hash
code (AgentCode() in Algorithm 11 in Section 6.4.2), and proceed to the next node in their PL.
As a result, agent 0 moves to MN1, calculates and compares hash codes, and communicates its
MN2 belief (Figure 6.2(b)). As a result, MN2's confidence level at MN1 rises by 0.5. Agent 1
chooses to return without calculating the findings at MN3 since he suspects MN3 in the interim.
Therefore, before constructing a new agent, MN1 lowers MN3's trust level in the subsequent
time instant after finding agent 1 again (Figure 6.2(c)). Agent 0 was unable to migrate
129
 [Link] Security in MANET
successfully this time due to temporary issues and remains at MN1. Following this period,
Table 6.3 displays MN1's trust view. By first visiting agent 0 and then agent 1, the trust value
for MN2 is raised by 0.5, totaling 6. The PL of agent 1 shows that the trust value for MN3 has
dropped by 1. As the procedure progresses, a message is broadcast when the trust value of MN3
falls below 4 at MN1, updating the trust view of MN3 at MN0. This process continues, and only
when nodes are created or visited by agents do they finally receive a consistent image of the
network.

Figure 6.3: (a)System performance in noisy environments; (b)System performance as threat to the
agents increases
To demonstrate the robustness of the suggested algorithm, we conducted a number of tests. Table 6.4
displays the experiments' default values. It is made clear if these values alter with certain trials.
First, Figure 6.3(a) illustrates the impact of the intrinsic background noise. A stronger signal is required
for successful transmission as background noise rises. This reduces a node's coverage region by raising
the minimum necessary pr. As a result, it takes longer to identify network nodes that are hacked. The
more infected nodes there are in the network, the longer it takes to find them. The more background
noise there is, the greater the timing difference. Therefore, it takes longer for the trust views of the nodes
in MANET to stabilize in a very noisy environment.
The time to identify every rogue node in the network grows even more if the background noise level is
maintained at a specific amount, which is the minimum needed pr. Every time an agent locates a
suspicious node, it returns to its owner without learning more about the MANET thanks to the
AgentCode() algorithm (Algorithm 11). Although this method conserves bandwidth, it takes a long time
to find more rogue nodes in the network. Therefore, Figure 6.3(b) illustrates that the time required to
detect every compromised node grows as the number of compromised nodes increases.

130
 [Link] Security in MANET
However, Figure 6.4(a) displays the outcome if the MANET's size is doubled while maintaining the
same values for the other parameters. In this case, the 84% trustworthy node proportion is maintained
nearly constant. The agents' PL thus increases in proportion (Table 6.4). Because of their intrinsic
mobility, bigger networks get divided into several components, which makes it hard for agents to move
about in some areas of the network. Delays in agent migration can hinder the process of calculating and
spreading trust. Therefore, it takes longer to locate all suspicious nodes in bigger MANETs.

Figure 6.4: (a)System performance for bigger networks; (b)Ratio of agents passed where MN3
becomes compromised in run time
A new metric called the ratio of agents passed is introduced in this work that is
defined as follows
No. o f agents going through malicious nodes till time t
Ratio o f Agents Passed(t) =
Total no. o f agents deployed till time t
(6.19)
It is presumed that MN2 and/or MN3 are hacked, with MN3 becoming penetrated during simulation
but MN2 acting maliciously from the start (see Figure 6.4(b)). It has been noted that when a node is
compromised, the ratio of agents passed after a specific amount of time (513 units) becomes
independent of the reference point. Since the trustworthy nodes may eventually identify all
malicious nodes, this explains the resilience of the suggested basic trust architecture (Section 6.4.2).
6.5.2 Results for Extended Trust Model
In this example, the network consists of three agents and six nodes. Figure 6.5 displays the
agents, the connection graph, and the associated PL. No significant change in the connection
graph can be seen in later time instants because of the nodes' smooth mobility (per SRMM).
In this instance, MN4 is regarded as a malevolent node capable of initiating a routing assault
that stops visitor agents from returning to their owners. Agents 1, 2, and 3 finally become
trapped at MN4, as can be shown.

131
 [Link] Security in MANET

Figure 6.5: MANET configuration with 6 nodes and corresponding agent locations:
(a)Initially; (b)After 3 seconds; (c)In next 3 seconds indicating end of the agents’ journey
As a result, the owners MN1, MN2, and MN3 split the PL of their lost agents into two unequal
portions and spawn two agents in accordance with the SecureMNCode() specified in Algorithm
14 time out (6×average propagation delay). In order to aggregate all suspicious nodes into a single
sublist, the division is done using a factor that is initially set at 0.5 and is reduced by 0.15 eac h
time an agent is lost until it reaches 0.2. When an agent with 10 nodes in its PL disappears, for
instance, the PL is split evenly (ratio = 0.5) into two sublists, each of which has (0.5 × 10) = 5
nodes, and it is distributed to two part agents. The PL is split into two again with ratio (0.5-
0.15)=0.35 in the event that both component agents disappear. As a result, one PL has three nodes
(10 × 0.35), while the remaining seven nodes are allocated to the other portion agent. Nodes that
have (dij(f)-bij(f))> e(=0.0028) are moved to the smaller sublist in this case. Agent 1 must now
visit MN2 and MN3 in this simulation scenario, while Agent 4 must visit MN4. Additionally,
agent 1 discovers that an agent from the same owner (MN1) has recently visited MN2 and MN3.
The state of agent 1's PL (=2 instead of 1) reflects this finding.

132
 [Link] Security in MANET

Table 6.5: Default Values of Simulation Parameters

Parameter Name Value

Mobility Model SRMM
M 20
N 25
Trust View default(b,d,u) (0,0,1)
TrustThreshold 0.49
Minimum required signal power 18dBm
Length of priority list 10
Time 80min
Q 100

This time, it is evident that the final observation

(b12(f)=0.05298,d12(f)=0.02796,u12(f)=0.91906) of its owner's (MN1) trust perspective
reflects the direct observation (b12=0.2, d12=0.11, u12=0.7) of agent 1. This procedure
continues. Old and new values are given identical weights when updating direct observations in
equations 6.5 and 6.6 for simplicity's sake (a significant change is not anticipated with
simulation period = 80min). Any node that has a trust value less than 0.49 is deemed malicious
and added to the suspicious list of agents (which is also deleted from its PL) that the detector
node has created. As a result, the nodes attempt to evade routing assaults without using any
extra control messages.
In order to validate the extended trust model (Section 6.4.3), we conducted a number of tests
and discovered some intriguing findings. As seen in the example, two agents are produced
whenever one agent disappears for simplicity's sake. Table 6.5 provides a summary of the
simulated parameters. Any modifications are stated clearly.

133
 [Link] Security in MANET

Figure 6.6: (a)Timely variation of ratio of agents attracted by the malicious nodes; (b)Variation
of ratio of agents attracted by the malicious nodes as network gets bigger
When the MANET has three malicious nodes (MN3, MN4, and MN5) and five malicious nodes
(MN3, MN4, MN5, MN11, and MN13), experiments are conducted to demonstrate the timely
modification of the ratio of agents conveyed. It is evident from the results displayed in Figure
6.6(a) that agents progressively overcome network enmity. The curve's constant slope, particularly
after T=8min, makes this clear. More agents are impacted as the number of malicious nodes rises,
but ultimately the agents are able to identify them using trust calculation. In our studies, the
simulation time is kept at 80 minutes since the curve well stabilizes at around that time with three
malevolent nodes.
Additionally, Figure 6.6(b) illustrates how the ratio (equation 6.19) changes with the number of
nodes (N) during the blackhole/wormhole assault launched by MN3 and MN4. It is evident that
the ratio steadily decreases with network size (due to more indirect observation) and finally finds
a stable state (N=35 onwards). Furthermore, a larger number of agents (M=20) suggests greater
direct observation, which accelerates the convergence of trust. With considerable precision, the
steady state's arrival for both M=10 and M=20 shows that our technique is scalable.
Another metric called ratio of successful agents is defined as follows

No. o f agents came back to owner till time t (6.20)

Ratio o f Success f ul Agents(t) =
Total no. o f agents deployed till time t
Because some agents may be diverted by malicious nodes (wormhole), consumed by them (blackhole),
or lost as a result of network segmentation, not all agents launched by an owner may return within the
allotted period. The owner can identify any modifications to the agent's code or data by producing and
verifying hashcode [120]. The impact of MANET size on agent success is determined by treating MN3
and MN4 as malicious nodes. In Figure 6.7(a), a brief decline in agent success is shown when the M, N,
and L values are almost equal. However, agents are able to maintain a consistent success rate as
MANET grows. Figures 6.6(b) and 6.7(a) both attest to the fact that, provided the degree of antagonism
stays constant, larger networks do not hinder agent success.
The next experiment again introduces another metric called the node success ratio
defined as
Nodes that can prevent their agents f rom attacks till time t
Node Success Ratio(t) =
Total number o f nodes working till time t

134
 [Link] Security in MANET

Figure 6.7: (a)Variation of agent success rate with [Link] nodes(N); (b)Variation of node’s
success ratio with number of agents(M)

The effective identification and subsequent removal of malicious nodes from PL determines the value
of this percentage. Figure 6.7(b) shows how this ratio changes with the number of agents deployed. Up
to three malicious nodes can be effectively identified with 50 agents in 80 minutes, and in that
scenario, no nodes will be sending their agents to the malicious nodes (MN3, MN4, or MN5). It is also
evident that when the number of agents is about equal to the number of nodes (=25) (> L), all curves
approach a local maxima. This is due to the fact that all nodes are now directly observed by agents,
which means that agents typically monitor the whole network.
In the next experiment the proposed model is tested with increasing MAS size. A
metric called ratio of false negatives is introduced that is defined as follows

No. o f undetected malicious nodes (6.22)

Ratio o f False Negatives =
Total No. o f malicious nodes

135
 [Link] Security in MANET

Figure 6.8: Success of the reputation model proposed in detecting malicious nodes

Assume for the moment that we are aware of the total number of malicious nodes (X) in the
network. Therefore, the effectiveness of the suggested approach in identifying every rogue
node is examined. According to the findings (Figure 6.8), more malicious nodes are
eventually found when more nodes volunteer for jobs and send out agents—who also get
firsthand experience—to go across different areas of the network. As a result, the ratio
eventually falls to 0 for larger MAS sizes, signifying that all malicious nodes were
successfully detected. To get the same number of false negatives in a larger network, more
agents are required. Remarkably, the percentage of false negative hits 0 when M=2×N. The
fact that all rogue nodes may be found by deploying an adequate number of agents further
demonstrates the accuracy of our approach. In this case, it is expected that the underlying
network's capacity would adequately handle such agent migrations.
6.6 Conclusion
This chapter offers potential methods for protecting mobile agents in MANET from potential
risks of hacked nodes altering agent data and/or code. In order to prevent agents deployed by
trusted nodes from further visiting compromised nodes, it looks for a distributed trust model
for the network. This will allow each trusted node to eventually have a consistent view of the
network's trust level. Here, the idea of hashing is applied to identify potential changes to an
agent's code and data. Our architecture offers a way for securing both the agents and their
owners, or nodes. Integrity and authenticity are among the top security services it offers. The
task of eliminating malevolent agents and producing new ones falls to the agent owners. A
node's entry is eliminated from the PL of new agents if it is determined to be malicious. MNs
136
 [Link] Security in MANET
can change their trust levels by using the techniques described in this chapter, which allow an
agent to communicate information about MANET to the nodes it trusts. Eventually, it is also
possible to detect changes made to the agent's code and/or data while it is in transit. A node
communicates this information upon discovery. Only broadcast messages from senders they
trust are listened to by the nodes, which also update their trust level. The impact of this
broadcast on the receiver's trust level view increases with the node's level of confidence in the
sender.
The suggested trust mechanisms allow the agents and their owners to gradually learn and
avoid the malicious ones, even in the case that agents are lost in transit due to routing layer
assaults like blackhole, grayhole, or wormhole in MANET. The previous section displays the
results of the models' validation. It is evident that bigger MANETs require more time to
identify every compromised node. However, it has been discovered that the suggested trust
mechanisms can identify any alteration in node behavior, even if it takes place during runtime.
A node may exhibit dynamic behavior changes for reasons other than an adversarial assault.
Due to network and device limitations, a node may begin acting selfishly. In the next chapter
these issues are addressed in order to make agents more dependable.

137