A Novel Coalitional Game Model for Security Issues in Wireless Networks Xiaoqi LiMichael Lyu Computer Science and Engineering Department The Chinese University of Hong Kong IEEE GLOBECOM December 2008, New Orleans, LA, USA

GLOBECOM December 2008 Outline Related Work Motivation Our Coalitional Game Model Coalition Formation Procedure Theoretical Analysis Conclusions and Future Work

GLOBECOM December 2008 Related Work Selfishness Study  Approaches rewarding cooperative node: Nodes get monetary incentives for forwarding data packets.  Approaches punishing non-cooperative nodes: Nodes are identified based on a reputation system and circumvented in the routing process. Security Study  In non-cooperative way Form as a two-player dynamic non-cooperative game with incomplete information.  In cooperative way Nodes are clustered on the largest payoff defined by cooperation, reputation and quality of security.

GLOBECOM December 2008 Motivation Because of the cooperation nature of wireless networks, modeling them as cooperation game will not destroy this nature but make full use of it. Although several cooperative models have been studied, no effective coalitional model has been proposed. No effective game theory model (cooperative or non- cooperative) has been proposed on the security issue.

GLOBECOM December 2008 Overview 1. We will propose a novel coalitional game model for wireless networks. 1. The model can be applied to not only mobile ad hoc networks but also wireless sensor networks. 1. We define a new throughput characteristic function, on the basis of which nodes are enforced to cooperate and form coalitions. 1. The payoff share is given by Shapley Value after proving the feasibility of this method. 1. A set of game rules is presented and a threatening mechanism is established to all players. 1. We then describe the coalition formation procedure and the integration of this model with available wireless routing protocols.

GLOBECOM December 2008 Basic Idea The game is,where  N is the set of nodes (players)‏  v is the throughput characteristic function that associates with every nonempty subset S of N a real number v(S)‏ The physical meaning of v(S) is the maximal throughput and the most reliable traffic that a coalition can achieve. v(S) is the foundation of the coalition forming procedure and it confines the coalition to admit or exclude a node. Nodes that cannot join into any coalition are under very high suspicion of being malicious.

GLOBECOM December 2008 Assumptions We assume that there is a Watchdog mechanism in each node, by which it can detect whether its neighbors are forwarding data packets for it or not. We also assume that a time synchronization mechanism has been implemented in the system so that we can schedule the coalition formation process synchronously.

GLOBECOM December 2008 Our Coalitional Game Model The throughput characteristic value for any coalition S,, is 0 where |S| = 1 and |S| = 0. For other coalition S where |S| >= 2, the throughput characteristic function v(S) is defined as: Definition: Throughput Characteristic Function

GLOBECOM December 2008 Throughput Characteristic Function (1)‏ where 1. Δt is a certain time interval 2. SD = {(a,b) | (a,b) is a source - destination pair } 3. Q ab is the required number of data packets transmitting between pair (a,b)‏ 4. P ab (S) is the set of routing paths inside coalition S which connect pair (a,b)‏ 5. is one of the path in P ab (S) and k = {(i, j) | i, j are the adjacent nodes on the same routing path } 6. t(k) stands for the reliability evaluation of routing path k 7. p ij is the trustworthiness of path (i, j)‏ 8. D ij is the distance between node i and j □

GLOBECOM December 2008 Throughput Characteristic Function (2)‏ P(S): For each coalition S, we generate a weighted directed graph G(S), where  Vertexes are nodes inside the coalition  Edges represent routing direction between two nodes  Weights are trustworthiness of this edge Perform routing discovery procedure on the graph and discover the first several possible routing paths P(S) for each source-destination pair inside S. The number of routing paths is related to |S|. When |S| increases, more possible paths can be found and more reliable routing and forwarding transmission can be obtained.

GLOBECOM December 2008 Throughput Characteristic Function (3)‏ t(k): For every possible routing path between source- destination pair, we get a trustworthiness evaluation t(k). The maximal value of t(k) over all k indicates the maximal payoff that the source-destination pair can benefit from the coalition.

GLOBECOM December 2008 Throughput Characteristic Function (4)‏ pij : Trustworthiness of routing path from i to j is obtained from two ways: Direct experience: Fraction of observed successful transmission times by all the transmission times between i and j. Indirect recommendation: Comes from node i ’s neighbors. Each neighbor of i returns probability opinions about both i and j, then i combines them together.

GLOBECOM December 2008 Throughput Characteristic Function (5)‏ Indirect Recommendation:  Note that we consider not only neighbors’ recommendations towards j but also towards i, which represents the opinions towards the routing path from i to j.  Multiplying by node i ’s own evaluation to its neighbors, we then get the more believable indirect probability p’ of communication from i to j. Direct experience and indirect recommendation have different weights, we then present the combined probability like this:

GLOBECOM December 2008 Payoff Allocation Inside the Coalition (1)‏ How to fairly distribute the gains among all the coalition members  Some members contribute more than others  Shapley value is applicable to this problem if v(S) satisfies: whenever S and T are disjoint subsets of N. The share amount that player i can gets is:

GLOBECOM December 2008 Proof: 1. From definition of v(S), we get v() = On the basis of v(S), we have: Payoff Allocation Inside the Coalition (2)‏ Shapley Value method is applicable to the payoff allocation inside coalitions given our proposed throughput characteristic function v(s). Theorem

GLOBECOM December 2008 Payoff Allocation Inside the Coalition (3)‏ The larger the coalition becomes, the more number of possible routing paths can be discovered. Accordingly, the maximal reliability increases when obtained from a larger set. So we get

GLOBECOM December 2008 Game Rules 1. A node will join into a coalition only if it can get more payoff share than it stands individually. 1. A node will deviate from the current coalition and join into another coalition only if it can get more payoff share there than that of here. 1. A coalition will refuse to admit a node if the node cannot increase the total payoff of the coalition. 1. A coalition will exclude a node if the node cannot benefit the coalition or even damage the total payoff of the coalition. 1. Nodes who are finally failed to join into any coalition will be denied from the network.

GLOBECOM December 2008 Coalition Formation Procedure Overview:  Introduce Gale-Shapley Deferred Acceptance Algorithm to help nodes forming coalitions. It was proposed to solve the stable marriage problem It was proven that at the end of the algorithm, no one wants to switch partners to increase his/her happiness.  The coalition formation procedure is conducted iteratively by all nodes. It is described in the following algorithms.

GLOBECOM December 2008 Coalition Formation Algorithm (1)‏

GLOBECOM December 2008 Coalition Formation Algorithm (2)‏

GLOBECOM December 2008 Integration with Wireless Routing Protocols (1)‏ The model can be integrated with all kinds of routing protocols (AODV, DSR, DSDV, etc) in many types of wireless network (mobile ad hoc network, wireless sensor network, etc). We take AODV for example. Extend the original routing table of AODV protocol by adding four fields: 1. Number of nodes in the coalition that the concerned entry has joined into; 2. Direct communication probability from the current node to the concerned entry; 3. Indirect communication probability from the current node to the concerned entry; 4. Distance between the current node with the concerned entry.

GLOBECOM December 2008 Integration with Wireless Routing Protocols (2)‏ New control packet types are created:  MREQ/MREP: Matching request and reply packets to exchange the matching preference list and notify the matching result.  PREQ/PREP: Collect neighbors’ recommendation of communication probability. New dedicated timer is set up to control the iteration of coalition formation procedure.

GLOBECOM December 2008 Analysis by Game Theory (1)‏ Speed of convergence and size of coalition:  From the coalition formation algorithm we can see that at each round of formation, every coalition member tries to find a partner.  So the coalition size is increased almost at a rate of two times.  Therefore, the speed of coalition formation is fast which means the convergence time of formation is short.  And the size will keep growing until grand coalition is reached or all misbehavior nodes are identified.

GLOBECOM December 2008 Analysis by Game Theory (2)‏ Non-emptiness of CORE:  The stable status of coalitional game is that no coalition can obtain a payoff that exceeds the sum of its members’ current payoffs, which means no deviation is profitable for all its members.  The core is the set of imputation vectors which satisfies the following two conditions:

GLOBECOM December 2008 Analysis by Game Theory (3)‏ Let an allocation profile The relation between x(S) and v(S) has two situations. 1. x(S) < v(S)‏  In this situation, the core is empty.  But our model still provide incentive for nodes to cooperate. When |S| = 1, the node do not belong to any coalition. It cannot form a source-destination pair and consequently no throughput can be obtained. While considering the Shapley value, the payoff share in the coalition is always larger than 0  The above reasons imply that rational nodes always have incentive to cooperate with each other.

GLOBECOM December 2008 Analysis by Game Theory (4)‏ 2. x(S) >= v(S)‏  If this situation can be reached, the core is nonempty.  The stable outcome will last for a certain time under certain conditions.  In the mobile ad hoc network, the current equilibrium may be destroyed and enforce the network to re-form again. Not all the nodes are reasonable The incompleteness of information due to the nodes mobility, underlying detection mechanism and so on.

GLOBECOM December 2008 Analysis by Game Theory (5)‏ 2. x(S) >= v(S) (con’d)‏  If that is the case, we can observe x(S) − v(S). The difference between them means how hard the core status will be destroyed.  The larger the difference, the low probability that the S will deviate. Then we can get the probability of the core keeps as follows: where p deviate (x(S) − v(S) can be approximated as an exponential distribution for further investigation.

GLOBECOM December 2008 Conclusions and Future Work 1. We novelly bring the idea of applying a coalitional game model to the security issues of wireless networks. 2. We show that the cooperation is enforced among all the node players. 3. A throughput characteristic function is defined which not only describes the network performance metric but also expresses the quantification of security metric. 4. A fair payoff distribution method inside the coalition is given. 5. A coalition formation algorithm is designed and can be integrated with any current wireless routing protocol. 6. We conclude that the convergence of coalition formation is fast and the coalition size can be large. 7. We also find that the core in wireless networks is hard to achieve and easy to be destroyed. We then give the node deviation probability for future applications.

GLOBECOM December 2008 Q & A Thank You!