Toward Trust and Reputation Based Web Service Selection - CiteSeerX

Toward Trust and Reputation Based Web Service Selection: A Survey Yao Wang, Julita Vassileva Department of Computer Science University of Saskatchewan {yaw181, jiv}@cs.usask.ca Abstract Using trust and reputation mechanisms offers a promising way to solve the web service selection problem. The investigation of trust and reputation systems in other areas can provide valuable observations and approaches that can be used in web service systems. Therefore, this paper presents a systematic review of various trust and reputation systems and proposes a typology to classify them from three aspects, centralized vs. decentralized, persons/agents vs. resources, global vs. personalized. These aspects are important not only in that they clarify the difference between various existing trust and reputation systems, but also in that they point out the potential research directions for using trust and reputation in web services and provide some reference systems for them.

Keywords Web service selection, trust, reputation

To appear in Multi-agent and Grid Systems (MAGS) Journal, special issue on "New tendencies on Web Services and Multi-agent Systems (WS-MAS)"

1. Introduction The Service Oriented Architecture (SOA) is “an architecture that represents software functionality as discoverable services on the network” [13]. As an implementation of SOA, web services are defined as a set of standards, SOAP, UDDI, WSDL, which enable a flexible way for applications to interact with each other over networks. SOAP (Simple Object Access Protocol) is the protocol for applications to communicate with each other. UDDI (Universal Description Discovery Integration) defines a registry for service providers to publish their services. WDSL (Web Services Description Language) is used to describe a web service’s capabilities and the interface to invoke it. A WDSL document is self-describing so that a service consumer can examine the functionality of the web service at runtime and generate corresponding code to automatically invoke the service. All these standards are XML-based (EXtensible Markup Language), which allows applications to interact with each other over networks, no matter what languages and platforms they are using. The two features, self-description and language- / platform-independence, distinguish web services from other distributed computing technologies, like CORBA (Common Object Request Broker Architecture) and DCOM (Distributed Component Object Model). Web services have won an increasing popularity. Although the future of web services looks very promising, there are still some challenging problems. Web service selection is one of them. The focus of current web service techniques is on the functional aspect of a service. A service provider publishes its service function description by which a service consumer can find the service. But a service consumer faces a dilemma in having to making a choice from a bunch of services offering the same function. At this time, a service consumer needs to know not only what a service can do, but also how well a service can do, evaluated according to some quality of service (QoS) metrics. Current web service technology can not support QoS or other non-functional aspects of a service. A service consumer is forced to either make a selection manually at the design time depending on some external information resources or just make a random choice. A random choice is a blind choice. In an open environment where anyone can publish services a consumer may select a poor quality, time-consuming, expensive, or even harmful service. Therefore, mechanisms are needed to help consumers to distinguish good from bad services. The web service selection can be done by people, who could be software developers and/or the members of the community that software developers are serving, according to their requirements and the service information (functional and non-functional) from a web service system [9]. But this task becomes very tedious and time-consuming when people have to examine lots of various services that have different features and varying levels of QoS. The variety of services can be expected to grow very fast with the seamless integration of networks [6], which could overwhelm a human person. This situation could become worse when it comes to a complex task that is composed of several simple tasks. For example, a task of a trip planning may include simple tasks like flight booking, hotel reservation, car rental, sightseeing planning, and so on [4]. Things can get even worse when changes happen constantly, like a change in a flight, which will cause to redo all the simple tasks. Therefore, this calls for automatic selection of web services, which can make the fulfillment of a task much easier and faster. This raises the question of how to make a good web service selection again. Various trust and reputation mechanisms have been proposed and implemented in many other open systems for the same purpose, like

2

e-commerce, peer-to-peer systems, and multi-agent systems. Recently trust and reputation mechanisms have also been applied to web service systems [17, 20, 22-25]. In this review paper, we are going to discuss current solutions for web service selection and investigate various trust and reputation mechanisms both for web services and other systems. Two web service selection scenarios are presented in next section. Section 3 discusses related web service selection criteria. Section 4 presents some other methods for web service selection. Section 5 introduces various trust and reputation systems and a topology is given to classify them. A conclusion is given in Section 6. 2 Web service usage scenarios The main application of web services is in business-to-business interactions. But with the popularization of web services and the maturing of the technology, human users can be direct clients as well. No matter whether web services are used for business-to-business interactions or business-to-consumer interactions, the scenarios that a business/consumer uses a web service can be classified into two types: direct selection and mediated selection. Direct selection means that the client gets directly the result of the service, i.e. a computation result, for example, a weather report from the web service provider, as shown in Figure 1 A. In this scenario, the selection of web service is mainly determined by the properties of the web service itself. The mediated scenario is to use a web service to get (indirectly) a result from another service, called “general service” in Figure 1 B to differentiate it from the intermediary web service. For example, a consumer uses the flight booking web service like Expedia.com to get a flight service (the general service) from an airline company like Air Canada. For the scenario B, the major part of selecting a web service is decided by the general service properties, for example, the quality of the flight service. The properties of the intermediary web service (the flight booking service in the example) only play a small part in the web service selection since the web service is just a tool to acquire the general service.

3. The criteria for web service selection The current web service selection research mainly deals with the first scenario (direct selection). QoS has been discussed a lot in the literature [20, 21, 26, 42, 39, 43, 44] and seen as the major criteria for selecting web services. QoS is defined in various ways and measured by different metrics, which causes confusion sometimes. After examining existing research efforts in the area of web services, the W3C group gives a summarized guide about defining QoS and its metrics. They clarify that QoS refers to the quality aspects of a web service [19], such as performance, reliability, and scalability. The “cost” of a web service is not a part of QoS. The reason we mention this is because in quite a few papers, the definition of QoS has been expanded. It includes “cost” and other metrics that do not relate to the quality of a web service. We stick with the W3C definition since it reflects the general recognition of QoS. As Figure 2 shows, the QoS metrics are grouped into four classes, “performance”, “dependability”, “security”, and “application-specific metrics”. The metrics specified in the groups of “performance” and “security” follow the W3C guidelines. The “dependability” group is composed of the rest of the metrics listed by W3C group, which is based on the taxonomy about dependability in [5, 44]. The reason for using

3

this group is to make the metrics more organized and look simpler and clearer. The metrics mentioned in [19] are common ones, which can be applied to most domains. Since web services are so diverse, it is impossible to capture all QoS metrics for all of the domains in a single model. Therefore, the fourth group, “application-specific metrics”, is reserved for the metrics that are specific to a certain domain. In the scenario B, a general service could be a hotel service, or a flight service, or any other service. It is so diverse that it is very hard to generalize a list of common QoS metrics applicable for most services. Each domain has its own related QoS metrics. The cost of a service is another key factor that influences a service consumer’s selection. A high quality service usually costs more than a low quality service with the same function. A service consumer needs to balance the service cost and service quality. Trust and reputation also play an important role in a service selection. It is natural that a service consumer would like to choose a service that is trusted or a service with a high reputation. That is just why trust and reputation mechanisms are used for making a good selection. There are some other aspects that may impact a service selection, such as payment methods, penalty rate, location, and so on. No matter whether web services are used for business-to-business interactions or business-to-consumer interactions, web service selection may need to be customized according to users’ different constrains and preferences. Although a business may not serve a user directly in a business-to-business interaction, the final customer of a business may still be an individual user through a business-to-customer link as shown in Figure 3 A. Figure 3 B gives an example of a business-to-customer link. The web service selections for flight booking and hotel reservation have to be personalized according to the user’s constrains and preferences. Most approaches proposed in the literature about personalized selection concentrate on how to rank web services according to users’ preferences on various QoS metrics. However, Balke and Wagner [6] approach this problem from a different angle. They show how to personalize the selection of web services with semantic support for service description and discovery. The algorithm can be illustrated through the example of flight booking. A user wants to book a flight and has set her hard constrains (departure, arrival, arrival date and class). The approach first performs a keyword-based search on the semantic service descriptions to find matched services. In this case, the keyword is “flight booking”. Table 1 shows the discovered services for flight booking from [6]. The next step is to check the discovered services and remove the services that do not meet the user’s hard constrains. The “Air Travel Economy” service will be discarded since it has no “class” input parameter. The third step is to get additional parameters beyond the hard constrains. They are “departure time”, “airline”, “price” and “non-stop”. The fourth step is to use the user’s long-term profile combined with some general knowledge from the domain to decide the values for these additional parameters. For instance, according to the profile, the user prefers non-stop flights. The general knowledge of the domain can be expressed in rules like “everyone prefers a short traveling time and a low price”.

4

4 Other methodologies for web service selection Figure 4 shows activities of different parties in the process of web service selection. It relates to different solutions for automatic WS selection from a high level. The central QoS registry in Figure 4 is a central node used to collect and store QoS information in a web service system. A provider may advertise a service with a QoS description. Therefore the most common solution for service selection depends on the QoS information from service providers [20]. Although the provider is supposed to deliver the service with the described quality, it is not an agreement or obligation. A provider can deliver a service not according to its published QoS description. A provider may also exaggerate its capability of providing good QoS on purpose to attract consumers to get more benefits, such as money. A consumer is vulnerable to inaccurate QoS information. Therefore, in order to get a service with a guaranteed quality, a consumer can negotiate with a provider to make an agreement, called a Service Level Agreement (SLA) which specifies the quality that a service should meet. A SLA may also include the methods of how to measure different QoS metrics. A third party may be involved to supervise the service and do the justice. The SLA expresses an obligation of a service provider, who may have to pay a penalty when the service is not delivered according to SLA. However, making a SLA comes with a cost, such as time, expenses. This method relies on the establishing of a common ontology so that providers and consumers have the same understanding of various QoS metrics. No matter whether a service advertisement comes with QoS information or not, a central node or a third party [35, 43] can be used to provide a service’s QoS information. They can either actively monitor QoS, or collect consumers’ QoS feedback, or use both ways. Sensors can be deployed to monitor web services and constantly report QoS data to the central node or third party [44]. This method is very costly since each web service needs a sensor to monitor it. It is only suitable for a small system. In a large open system, there may be hundreds and thousands of web services. It is very hard to deploy each sensor for each service since the cost will be huge. In addition, in a dynamic environment where new services may often come in and old services may disappear, it also creates a lot of overhead to install or remove sensors. Even though the central node/third party can actively monitor each web service by itself to collect QoS information, this method is not suitable for large systems since it puts too much burden on the central node/third party. Maximilien and Singh proposed a method where the central node just takes part of the responsibility of monitoring web services [24]. In their method, agents are used to interact with each other on behalf of their users providing or consuming services. The central node can actively create consumer agents, called explorer agents, to consume services that have a negative reputation for their quality. Once the explorer agents find that the service quality has been improved, they can help the services gain positive reputation so that they have a chance to be selected by other consumer agents. Therefore the purpose for the central node to monitor services with a negative reputation is just to give the services a chance to be selected when they improve their service quality. Another way that the central node/third party acquires QoS information is to collect feedback from consumers who actually consume the services [20, 24]. The feedback from consumers may have two kinds of information. One is quality information

5

collected from actual execution monitoring, such as response time and execution time. The other is ratings about the quality of the service, especially the QoS aspects like accuracy that can not be acquired through execution monitoring. This method has three advantages over the method using a central QoS registry/third party to do the monitoring. First, it can greatly lower the burden of the central node. The central node does not need to check the QoS of each service constantly. Secondly, it is much easier to implement. Thirdly, and most importantly, it allows capturing QoS information directly from consumers that can not be obtained by a central monitor. Because of these advantages, researchers are showing more and more interest in applying trust and reputation mechanisms for web service selection since they are exactly the mechanisms relying on consumers’ feedbacks to identify services (good or bad). Although several trust and reputation methods have been proposed for web services (discussed in Section 5.2), the research on trust and reputation in the area of web services is still new and limited. In other areas, like eCommerce, multi-agent systems, peer to peer systems, trust and reputation mechanisms have been studied for a long time. These studies can provide valuable observations and theories for the studies in the area of web services. An overview of these studies is provided in next section. 5. Trust and reputation Trust and reputation mechanisms are used for large open systems. In general, reputation is the public’s opinion about the character or standing (such as honesty, capability, reliability) of an entity, which could be a person, an agent, a product or a service. It is objective and represents a collective evaluation of a group of people/agents, while trust is personalized and subjective reflecting an individual’s opinion. They are closely related. Trust can be gained from a person/agent’s own experiences with an entity or the reputation of the entity, while an entity’s reputation relies on the aggregation of each individual person/agent’s experiences with it. They are both used to evaluate a person/agent’s trustworthiness. They also share some common characteristics. z Context specific. Trust and reputation both depend on some context. For example, Mike trusts John as his doctor, but he does not trust John as a mechanic to fix his car. So in the context of seeing a doctor, John is trustworthy, but in the context of fixing a car, John is untrustworthy. z Multi-faceted. Even in the same context, there is a need to develop differentiated trust in different aspects of a service. The same applies for reputation. For instance, a user might evaluate a web service from different QoS aspects, such as response time, accuracy, execution time. For each aspect, she develops a kind of trust. The overall trust depends on the combination of the trusts in each aspect. While the context-specificity accentuates that trust or reputation can be different in different situations, the characteristic, multi-faceted, emphasizes that trust has multiple aspects, which can play a role in deciding whether a service is trustworthy to use. z

Dynamic. Trust and reputation can increase or decrease with further experiences (interactions or observation). They also decay with time. New experiences are more important than old ones since old experiences may become obsolete or irrelevant with time passing by. 6

5.1 Classification of trust and reputation systems Various trust and reputation systems have been proposed or implemented in different areas. Some proposed classifications use their application areas [30], algorithms [15] or some combined characteristics [40] as criteria. These classifications allow looking at trust and reputation systems from different perspectives. But none of them allows comparing trust and reputation systems depending on their system structures, which are nontrivial in determining the underlying trust and reputation mechanisms. In this section, we will show how to classify trust and reputation systems by their system structures, which provides a complementary perspective to the existing classifications. Instead of using a flat structure, we use three criteria to analyze existing trust and reputation systems, resulting in a classification as a three-level hierarchy as shown in Figure 5. The leaf-level represents examples of various trust and reputation systems. Each upper level in the tree is associated with one criterion used for classifying reputation systems. The three criteria are explained below. z

Centralized vs. decentralized. Whether a trust and reputation system is centralized or decentralized determines the feasibility and complexity of a trust and reputation mechanism. In a centralized system, a central node will take all the responsibilities of managing reputations for all the members. In a decentralized system, e.g. a peer-to-peer system, there is no central node. The members in the system have to cooperate and share the responsibilities to manage reputation. Generally speaking, the mechanisms in centralized systems are less complex and easier to implement than those in decentralized systems. But they need powerful and reliable central servers and a lot of bandwidth for computing, data storage, and communication. The current trust and reputation mechanisms proposed for web services [17, 20, 22-25] are almost centralized where a central QoS registry is deployed to collect and store QoS data from web service consumers. It is based on a classical web service framework where a central UDDI server is used to publish and search services for web service providers and consumers. It is inevitable that this server-centric framework will suffer a single point of failure. Moreover, the information stored in the UDDI server may become outdated in a dynamic networking environment where a service may fail or become unreachable. Therefore, peer to peer web services are proposed [13, 18, 46], which leads to the need to learn decentralized trust and reputation techniques.

z

Person/agent vs. resource. Trust and reputation systems can be classified as person/agent systems or resource systems. In person/agent systems, the focus is modeling the reputation of people or agents, acting on behalf of people. In resource systems, the focus is modeling reputation of resources, which could be products or services. Many resource systems also involve dealing with the reputation of people/agents, but it serves for the purpose of building representation of the reputation of resources. This criterion draws the line between the eBay-like reputation systems and the reputation systems, such as Amazon, Epinions, and Google.

7

In a trust and reputation web service system, it is obvious that trust and reputation need to be established for web services themselves. There is also a need to build trust and reputation for service providers, which has been neglected in current trust and reputation approaches for web services. A good reputation of a service provider can enhance a consumer’s confidence in its services. In addition, a provider may provide several services at the same time. If it has a good reputation for providing good quality services, it is easy for a consumer to believe that the new service has good quality too. z

Global vs. personalized. In global reputation systems, the reputation of a person/agent/product/service is based on the opinions from the general population, which is public and visible to all the system members, while in personalized reputation systems, the reputation of a person/agent/product/service is built on the opinions from a group of particular people, which may be different in the eyes of different members and influenced by many factors, such as these members’ social networks, environmental uncertainties. It is much harder and more complicated to design a global reputation mechanism in a decentralized system than in a centralized system. In web service systems, for some kinds of web services (e.g. weather forecast services), personalization is not important, so a global reputation system is sufficient. However, if the selection includes subjective factors, which have to do with a consumer’s special needs or interests, the problem of web-service selection becomes similar to the problem of generating personalized recommendations and personalized reputation systems are required.

In the following sub-sections, we are going to investigate each trust and reputation system on the leaf level as shown in the classification in Figure 5. We start with trust and reputation mechanisms for web services, the systems written in bold and underlined in Figure 5, then introduce other systems. 5.2 Trust and reputation mechanisms for web services Several trust and reputation approaches have been proposed for web service selection. Most of these approaches depend on a central QoS registry to collect and store feedbacks from consumers. The general idea of these methods is that consumers report the data acquired from executing a web service (e.g. execution time, response time) and/or their ratings on other QoS metrics as shown in Figure 3 to the central QoS registry. According to the QoS information and a consumer’s profile that shows the consumer’s preference over different QoS metrics (i.e. how these QoS metrics are important to a consumer), the QoS registry will calculate an overall rating for each web service that matches the consumer’s search request. Then the consumer will select the web service with the highest rating. Although these approaches share the same idea, they are different in their focuses and calculation algorithms. Maximilien and Singh [23-26] put a lot of effort on building a QoS ontology, the basis for service providers to advertise their services and for consumers to express their preferences and provide ratings. Liu, Ngu and Zeng [20] proposed an algorithm about how to combine different QoS metrics to get a fair overall rating for a web service. Manikrao and Prabhakar [22] use the collaborative filtering technology (see Section 5.4.3) in their web service selection method. Karta [17] also proposed to apply collaborative filtering techniques to web service selection. He concentrated on the technical details

8

of the collaborative filtering method, for example the selection of similarity calculation algorithm (Pearson correlation algorithm vs. Vector Similarity algorithm). In Day’s thesis [9], he suggested two algorithms for web service selection, a rule-based expert system and naïve Bayesian networks. As far as we know, the only trust and reputation approach for decentralized web service system is proposed by Vu, Hauswirth and Aberer [47]. They use some dedicated QoS registries to collect QoS feedbacks from consumers. Although these QoS registries are organized in a P2P way, they are based on a specially designed P-Grid structure (see section 5.5.2). Each registry is responsible for managing reputation for a part of service providers. An algorithm is introduced to detect and deal with dishonest feedbacks by comparing the QoS data from dedicated monitoring agents with the data from consumers to filter out dishonest feedbacks. This approach is much more complicated than those centralized trust and reputation methods and involves a lot of communication and calculation because of the use of the complicated P-Grid structure. 5.3 Centralized person/agent trust and reputation systems Centralized person/agent trust and reputation systems are mainly seen in the area of e-commerce. These mechanisms are relatively simple. No matter whether a person’s reputation is global or not, it is a function of the number of the ratings received from his/her partners. There are some common characteristics in these systems. z A centralized node acts as the system manager responsible for collecting feedback (ratings and textual comments) from both sides in a transaction. z A person’s/agent’s reputation is built by the system. There is no explicit trust model between persons/agents. z Less communication is required between persons. A person/agent only communicates with the centralized node to find out other persons’/agents’ reputations. 5.3.1 eBay eBay [10] is the largest and most popular auction website. It has a global reputation system. After each transaction, sellers and buyers can give each other a positive, negative or neutral rating, which adds 1, -1, or 0 points to their reputations. They can also leave comments about each other. Especially when people give negative ratings, they probably will also explain the reasons in their comments. A person’s reputation is calculated as the sum of the ratings given by his/her past transaction partners in the last six months, no matter whether s/he is rated as a seller or a buyer. A newcomer starts with a reputation value 0. Despite the simplicity of the reputation mechanism, empirical results [38] show that it does encourage transactions between sellers and buyers. Sellers with better reputations are more likely to sell their items. This mechanism can also prevent collusions of people artificially increasing each other’s reputation. In such feedback-based reputation systems, people usually can collude in two ways. One way is that people can create fake identities and use them to give themselves high ratings. eBay allows only the two participants in a transaction to rate each other. Of course, two friends can perform dozens of fake transactions and rate each other with high ratings so that they both increase their reputation values. To prevent this, eBay charges sellers a fee for selling an item and conducting fake transactions will be costly. But the system does have some problems: 1. People are usually reluctant to give negative ratings since they can see each other’s ratings and are afraid of revenge. In eBay, only 1% of the ratings are

9

negative and less than 0.5% of the ratings are neutral. Neutral ratings are typically used for slightly problematic transactions, such as delays, poor communication, while negative ratings are used for serious problems in transactions. For example, the item is never shipped, arrives broken, or is different (fraudulence). 2. People can change their identities. If they get a bad reputation, they can discard their old identities, choose new ones, and start as beginners to get rid of their poor reputation. 3. In the reputation system, a person’s reputation is represented by a single numeric value. It fails to convey many important subtleties of online transactions. For example, is a person’s reputation built on low-value transactions or high-value transactions? Is a person reputable as a seller or as a buyer? 4. The system calculates the reputation treating all the ratings equally without taking into account the reputation of the people who give these ratings. So the ratings provided by dishonest persons are still counted. 5.3.2 Sporas Sporas [62] is also a global reputation system based on feedback, similar to eBay. It is designed to tackle problems 2 and 4 above. To solve problem 2, it uses a carefully crafted algorithm to calculate a person’s reputation so that a person’s reputation will never fall below the reputation of a beginner. Therefore, persons with bad reputations have no motivation to change their identities. In the system, two persons can only rate each other once. If they interact more than once, only the latest rating is used. A rater’s rating will be weighed by his/her reputation when it is used to calculate the reputation of his/her partner. So the ratings from persons with high reputations are weighed more than the ratings from beginners or persons with low reputations, thus solving problem 4. There is another consideration in the system. Unlike in eBay, the reputation value in Sporas cannot be increased infinitely. People with high reputation values experience smaller rating changes after each update. Compared with that in eBay, the reputation mechanism in this system is more complex. 5.3.3 Histos In both eBay and Sporas, the reputation of a person is global, i.e. every person’s inquiry about someone’s reputation will obtain the same number. In human society, one’s reputation is often viewed from a personal perspective. A common practice in real life of finding a person’s reputation is from one’s own experiences and/or asking for opinions one’s friends or friends’ friends, who share similar criteria or have knowledge about one’s needs. In this way, a personalized bias is created on the reputation, called personalized reputation. Histos [62] is a personalized reputation system. A centralized node keeps all the recent ratings between persons and constructs a directed graph to represent ratings and persons, where nodes represent persons and weighted edges represent the most recent rating given by one person to another with arrows pointing from the rater to the rated person. Suppose there are two persons A and C. If there is an edge from A to C, which means that person A has rated person C directly, and in the eyes of person A, person C’s reputation is just the rating given by himself (i.e. by A). If the two persons are not directly connected, there may be multiple paths between them. From person A’s viewpoint, the reputation of person C is an average rating from the raters on these paths weighed by these raters’

10

reputations. A recursive process is used to calculate the raters’ reputations. This algorithm is more complex than that in Sporas. The time complexity is O(NM), where N is the number of the paths between the two persons and M is the average length of these paths. Each update on reputation involves a lot of computation. All the reputation systems above are based on users’ feedback toward their interaction partners. The reputation is calculated as a numerical value by combining the ratings. Such reputation systems are called feedback-based reputation systems. The advantage of this kind of reputation system is that it is very intuitive and easy to be understood and implemented. But the disadvantage is that they require the frequent involvement of users who are expected to give ratings explicitly. Ensuring a sufficient number of ratings is critical to the system. An alternative method that does not need user involvement is proposed by using the social network topology to deduce reputation. 5.3.4 Trust and reputation systems based on social network topology analysis A social network is a network consisting of a group of people who are connected through various social relationships, such as acquaintance, friendship, cooperation, familial bonds, or similarity of interests. The underlying idea of deducing a member’s reputation from social network topology is that reputable members in a social network tend to be well-known and highly connected nodes that can be easily identified, for example experts and people who share a lot of valuable resources. Pujol and Sanguesa [34] modeled a social network based on the information derived from users’ personal web pages. This social network is represented by a directed graph, where each node represents a member and each edge represents a relationship weighed by the strength of the relationship between two connected nodes. Each node has a degree of authority. Initially, all the nodes are assumed to have the same authority. Then following the NodeRanking algorithm, the authorities of nodes are redistributed. The main idea of the NodeRanking algorithm is that the authority of each node is proportionally propagated to the nodes reached by its out-going edges, which are the edges that point to other nodes. Starting with a randomly selected node, this algorithm continues to explore other nodes in the graph using a stochastic algorithm. Finally the authorities of the nodes will converge to constant numbers, which represent these nodes’ reputations. This algorithm is similar to the Pagerank algorithm [32], which is used in Google to deduce the authorities of web pages, but the NodeRanking algorithm deduces the reputation of people using the social network topology, not the topology of web page links. Although the method of using the social network topology information to calculate users’ reputation does not require involvement of users, it does require the prerequisite knowledge of relationships between users on which a social network is based. How to acquire such knowledge to build a representation of the social network is critical to the success of the system. Often this knowledge is not available for a brand new system where users do not know each other. Another problem is that updating the system is tedious involving a lot of computation of updating users’ reputation as well as the social network topology. 5.4 Centralized resource reputation systems A resource reputation system is used to build up the reputation of resources, which can serve as a guide for users to select resources. The reputation of a resource is often represented by an overall rating derived from the ratings from different users. 5.4.1 Epinions

11

Epinions [11, 14] is a web site where users can rate and review various items, such as cars, books, movies, and computers. Users can also rate reviews in Epinions. These reviews and ratings are public. Items are organized by categories. In each category, users are classified into 5 levels, ranging from category leaders, top reviewers, advisors, most popular reviewers, to ordinary members. •

Category leaders are Epinions members who are in charge of a particular category. Their major responsibilities include rating new reviews, selecting top reviewers and advisors for their category and working to increase high-quality reviews for key products in their category. • Top reviewers are Epinions members who write high quality reviews to help shoppers find the best products in the category and whose reviews have received the highest ratings from the Epinions community. • Advisors are Epinions members who help shoppers find the best content on Epinions by rating reviews and provide constructive feedback via comments to reviewers on how to improve content quality. • Most popular reviewers are Epinions members whose reviews are most popular, which is determined by the number of total visits to their reviews. • Ordinary members are the default users In Epinions, members with different statuses have different responsibilities and influences. In contrast to other websites, like Amazon [3], where all the members are treated equally, Epinions heavily depends on the member’s status in the following aspects: ¾ The ratings on an item from members with higher status will be more heavily weighed in the overall rating for the item; ¾ The ratings on a review from members with higher status will be more heavily weighed in the overall rating for the review; ¾ The reviews from members with higher status will be placed more prominently in the review list. Because of the importance of the member’s status, the determination of a member’s status not only depends on the quality and quantity of a member’s reviews in the category, but also is manipulated by Epinions managers or category leaders. Category leaders are critical for a specific category. They can decide the other member’s status, such as top reviewers or advisors. In order to be category leaders, they have to be nominated by the members in their category, and then they have to pass through interviews with Epinions managers to show they are indeed qualified. The determination of other members’ statuses is conducted by the category leaders. The reputation mechanism in Epinions is shown in Figure 6. The overall rating on an item depends on Epinions members’ ratings and their statuses. Epinions is successful in motivating users to provide ratings and reviews. In eBay, users rate their trading partners either as a reward for good services of their partners or just for airing their opinions. In Epinions, users need stronger motivation to provide reviews, especially high quality reviews, since it requires much more effort. One possible motivation is that users want to talk about products that they love. The second possible motivation is that they want to help others and get satisfaction by sharing information about the products they consider themselves experts on. This may give them “a sense of power”, since their member status shows publicly their

12

authority. They can also get paid for the high quality reviews they write depending on how often their reviews are read, which may be strong motivation for some users. 5.4.2 Google Google has become the most powerful and popular web search engine. The algorithm Google uses to rank web pages is called PageRank [32]. Each web page has some forward links and back links. For a web page, its back links are the links that point to it, while its forward links are the links in the page pointing to other web pages. The basic idea of PageRank is that a web page with more back links is more important than a webpage with few back links and that a webpage has a high PageRank if it is pointed to by web pages with high PageRanks. Initially, all the web pages have the same ranks. The rank of a web page is divided evenly among its forward links and distributed to the web pages pointed by the forward links. The rank of a web page will be recalculated as the sum of ranks coming from its back links. Figure 7 shows a simple example of the propagation of ranks. This process is recursive until the ranks of a set of web pages converge. In Google, the PageRank of a web page can be viewed as its reputation. Unlike other rating-based reputation systems, it does not need the participation of users. This algorithm is important. It has been modified and applied to social networks to deduce the reputation of people [34] or agents [53]. Although Google is very successful in using the algorithm in large scale, it requires a lot of computation and therefore powerful server(s). The algorithm is still too complex and time-consuming and has the problem of scalability. 5.4.3 Collaborative filtering Collaborative filtering [7, 12, and 37] is one of the two major technologies used in recommender systems [41] to suggest items that users might like. Although decentralized recommender systems have been proposed [31], the typical collaborative filtering system is centralized where a centralized node is responsible for collecting ratings from users and storing them in a matrix with a row for each user and a column for each item. A standard collaborative filtering algorithm has three steps [33]: 1. The similarity between a given user and every other user is calculated based on the similarity of their ratings on the items that they have both rated before. The Pearson correlation coefficient is the most popular algorithm for measuring the similarity between two users. 2. The predicted rating of a user on an item that she has not rated is calculated as a function of ratings from the other users who have rated the item weighed by the similarity between the user and the other users. 3. The items with the highest predicted ratings are recommended to the user. This algorithm is quite similar to that used in personalized reputation systems (see Section 5.5.1). The similarity between the two kinds of algorithm is shown in Figure 8. Although the algorithms of collaborative filtering systems and personalized reputation systems look similar, they are different in their focus. Collaborative filtering systems emphasize the similarity of users’ tastes, while personalized reputation systems focus

13

on the trust between users. However, they are both used to measure the reliability of other users’ opinions/ratings. According to some definitions, trust means similarity of users’ tastes [27, 28, 48, 49, and 61] in some contexts. If two users are more similar in their tastes, they can trust each other’s opinions more. Therefore, a collaborative filtering system can be regarded as a variation of a personalized reputation system. A collaborative filtering based recommender system can make good quality recommendations when the system has enough required data. But it is vulnerable to the lack of data, which causes two problems, cold start and data sparseness. The problem of cold start happens when new users enter a system. Since they have not rated anything, the system does not know who are the other users similar to them and therefore cannot make recommendations. The cold start problem is often be solved by asking the new users to provide ratings before the system can make recommendations. In MovieLens [29], a new user will firstly be asked to rate 10 movies. However, before a new user puts effort to rate items, she needs an incentive to do so. Getting good quality recommendations is a good incentive. However, before being convinced of the usefulness of her effort, the user may not be willing to do it, which is like the chicken and egg problem. Data sparseness is another problem for collaborative filtering. In the matrix of collaborative filtering, there may be millions of users and millions of items. A user can only rate a few items, so most of the matrix cells are empty. For example, the percentage of empty cells in the dataset of Movielens is 95.8%. This causes a serious problem that any two users may have very low overlap in their ratings, which results in inaccuracy of prediction. Paolo and Bobby [33] suggest a method of using trust to tackle the problem. Users can explicitly express who they trust. Then trust can be propagated to other users. Say a user A trusts a user B and the user B trusts a user C. Then the user A can trusts the user C more or less. So even if the users A and C have not rated anything in common, A can still take recommendations based on C’s ratings into account. Although this method can alleviate the cold-start and the data sparseness problems, it cannot solve them. The weakness of the method is how a user finds out who he can trust among millions of other users. 5.5 Decentralized trust and reputation systems A trust and reputation system can often be modeled as a multi-agent system where agents are used to manage and reason about trust and reputation on behalf of their users. No matter whether a reputation system is centralized or decentralized, it is an open system where agents can join or leave at any time. Agents are also heterogeneous. They represent different individuals interested in maximizing their own benefits. Some agents might act honestly. Some may be malicious by cheating or harming others to get more benefits. In a centralized reputation system, the centralized node is not only responsible for computing and storing reputation for all the agents, but also serves as an authority to supervise agents’ behaviours and punish agents that behave badly by dispelling them from the system. But in decentralized systems, there is no such authority and the risk of encountering dishonest or malicious agents is higher. Agents have to help each other to find out who is trustworthy and who is not and punish the untrustworthy ones by isolating them. They develop and manage their reputation together by communicating and sharing their experiences.

14

5.5.1 Decentralized person/agent personalized trust and reputation systems In decentralized person/agent personalized trust and reputation systems, each agent is responsible for developing its trust in other agents based on their direct interactions. No global or public reputation exists. If agent A wants to know agent B’s reputation, it has to proactively ask other agents for their evaluations of B, then synthesize the evaluations together to compute agent B’s reputation. The reputation of agent B developed by A is personalized because agent A can choose which agents it will ask for evaluations about B, e.g. its trustworthy friends or all known agents. Agent A can also decide how to combine the collected evaluations together to get agent B’s reputation. For example, it can only combine the evaluations coming from trusted agents. Alternatively, it can weight differently the evaluations from trusted agents, unknown agents and even untrustworthy agents when combining them. In the system, agent A can get agent B’s reputation based on its own knowledge of truthfulness of the agents that make recommendations for agent B. In this way, it would be hard for agent B to increase its reputation by shilling. Since only agent A can see the recommendations, the references can express their feelings truthfully, not worried about potential revenges. But the tradeoff is that agents have to conduct a lot of communication and computation. In decentralized trust and reputation systems, agents model each other and usually build two kinds of trust. One is an agent’s trust in another agent’s capability in providing services. The other one is the agent’s trust in another agent’s ability in providing recommendations. In Yu and Singh’s model [56], the two kinds of trust are called respectively an agent’s expertise and sociability. An agent’s expertise refers to the agent’s ability to provide required services. An agent’s sociability is the agent’s ability of being good referrals, i.e. being able to suggest agents that can provide the required service. For example, in Figure 9, when agent A sends a service query to agent B, agent B recommends agent C, and then agent C recommends agent D, and finally agent D recommends agent E, the agent providing the service, agents B, C, and D are all referrals. The agent’s overall trust in another agent is just the linear combination of the agent’s trust in the expertise and sociability of another agent. In our model [49] of trust and reputation in peer-to-peer file sharing systems, the second kind of trust is used to judge the reliability of recommendations from other agents, which can help the querying agent decide whose recommendation should be considered and whose should not. The reliability of an agent’s recommendation includes two aspects, truthfulness and similarity. Truthfulness means whether an agent is honest in telling its recommendations. Similarity implies whether two agents are similar in preferences and ways of judging issues. Since agents are heterogeneous, if they are not like-minded, they may disagree with each other most of time. One’s recommendation is of no use for the other. If two agents are similar in this sense, their recommendations may be valuable for each other. The procedure in these models usually follows these six steps: 1. Send queries An agent starts a query for a specific service. When other agents receive the query, they will check whether they can provide the required service. If yes, they will send answer messages to the inquiring agent to tell it that they provide the required service. Otherwise, they just simply forward the query.

15

2. Ask for recommendations When the inquiring agent receives the answer messages, it can get a list of providers that offer the required service. Then it can choose one of the providers that it trusts most. If the agent cannot decide which provider is trustworthy to provide good services, it can send another query to ask about the trustworthiness of these providers. If the agents that receive the query have interacted with these providers before or have computed reputation values for them, they can send recommendations to the inquiring agent. 3. Select provider According to the received recommendations and its own experience, the inquiring agent can decide from whom to get the service. How an agent weighs the recommendations of other agents and its own experience to make a decision is an open question, related to the agent’s subjective way of managing trust and how the agents deals with trust dynamics. Some agents may prefer to trust their own experiences more even if they had very few interactions with the service provider. Others may rely entirely on the recommendations. 4. Interaction The inquiring agent gets the service and evaluates it. 5. Update trust Based on the result of the interaction, the inquiring agent updates its trust in the provider’s ability to provide good services and also the trust in the agents who provided recommendations. 6. Update neighbors The inquiring agent selects agents that it trusts most as its neighbors in terms of the overall trust, which usually is a linear combination of the two kinds of trust, the trust in an agent as a service provider and the trust in the agent as a recommender. In Yu & Singh’s model, this step is before the step of sending a query. After an agent generates a query, it will decide to which agents it will send the query by considering the agents’ abilities in answering the query and their sociality learned from previous experiences. In a decentralized trust and reputation system, the agents gather information and learn the reputation of others using social networks. Agents build up their social networks by learning. Initially agents just randomly connect with each other without knowing anything about other agents. After some interactions, they know which agents are trustworthy and which are not. Then they select the agents that they think are trustworthy as their “neighbors” in the social networks. An agent’s social network is a network that starts from the agent and is extended to its trustworthy agents and their trustworthy agents, and so on. The entire social network of a system with many agents is represented as a network where some agents may be highly connected by trust relationships and some may be isolated. This is because agents that provide good services are gradually recognized by more agents as trustworthy and connected, while the agents that offer poor services will eventually lose connections from other agents. In [51-53], Yolum and Singh investigated the structure of the social network proposed by Yu and Singh [59]. They used PageRank, the metric used by Google to rank web pages, to measure the authoritativeness of agents. If an agent has more agents connected to it and these agents have high authoritativeness, the agent will have a high authoritativeness and a high PageRank. Yolum and Singh show that the percentage of agents with high PageRanks and the variance of the PageRank values are influenced not only by the percentage of agents with high expertise, but also by the referral selection policy, i.e. the way an agent weights an agent’s expertise and

16

sociability, and the policy of whom an agent asks for recommendations, for example, asking all the referrals, asking some referrals, or asking the best referral. 5.5.2 Decentralized person/agent global reputation systems In the systems discussed in the previous sections, in order to know the other agent’s reputation, an agent has to ask around, collect evidence about the trustworthiness of the other agent, and calculate the reputation of the other agent by itself according to the evidence collected. The calculated reputation is personalized and only visible to the agent that does the calculation. If several agents want to find the reputation of the same agent, each of them has to repeat the same procedure to calculate its individual reputation representation of the agent in question. It is possible to build instead a decentralized reputation system where an agent’s reputation is public and global, showing how all agents trust an agent. Such systems are proposed in [2, 16, 50], which we call decentralized global reputation systems. Two major questions are addressed in the systems: z How to manage reputation storage and access Unlike in a centralized system where the central node acts as an authority to calculate and store agents’ reputations, in a decentralized system, there is no central node. The task of a central node is carried by all agents, so each agent is responsible for calculating and storing some agents’ reputations. An agent’s reputation should be also calculated and stored by several agents independently to ensure redundancy in case of existence of malicious agents, who can mislead other agents about reputations of agents that they are responsible for. Who is responsible to handle whose reputation? Two methods have been proposed. ¾

Distributed hash tables (DHT). Multiple hash functions are used to map a single agent ID to several positions where corresponding agents will calculate and store this agent’s reputation individually [16].

¾

P-Grid [1, 2, 50]. The idea of this method is to divide the whole big set of agents into small subsets in a top-down way according to the structure of a binary search tree. Initially, all the agents belong to a big set. Each of them is responsible for managing all the agents’ reputations. Each agent in the same set has the same responsibility. When two agents in the same subset meet, they can divide the subset that they belong to into two sub-subsets as shown in Figure 10 (a). At the same time, they divide their responsibility into half so that each agent only handles the reputations of half of the agents in the set. Each agent also keeps a reference to an agent in the other sub-subset in its routing table in order to cover the search space of the other sub-subset. Agents in the same subset will individually calculate and store the reputations of the agents whose index prefixes match the search path of the subset. An agent’s index is a binary string encoded from its ID. For example, in Figure 10 (b), agent 3’s index is 011. It is responsible for calculating and storing the reputations of agents whose indices have a prefix 10, which are agent 4 and 5 denoted by P4 and P5, whose indices are 100 and 101 respectively. According to the routing table, agent 3 is also responsible for forwarding queries for agents with an index prefix 0 to agent 2 (P2) and agents with an index prefix 11 to agent 5 (P5).

17

z How to calculate an agent’s global reputation In a decentralized global reputation system, each agent’s global reputation is computed and stored by some other agents designated by the method of DHT or P-Grid. We call agent A agent B’s reputation manager if agent A is responsible for computing and storing agent B’s global reputation. In order to calculate an agent’s global reputation, the agent’s reputation manager has to aggregate all the other agents’ evaluations in the target agent and weigh these agents’ evaluations by their reputations. Initially, all the agents start with a default reputation. Suppose there are three agents, A, B, C. Agent B is a service provider. Agent C is agent B’s reputation manager. After A gets a service from B, it can tell C its evaluation about B. Then C will re-compute B’s reputation based on A’s evaluation and propagate the new reputation to other agents. Other agents will also update the reputations that they are responsible for based on the received reputation of B and then propagate the new computed reputations to others. This procedure goes on until agents’ reputation values converge. The whole process involves a lot of iterations. Compared with the algorithms used for calculating personalized reputations, computing agents’ global reputation is much more complicated and expensive and involves a lot of communication and calculation. Although Kamvar [16] and Xiong [50] suggested some ways to reduce the high cost of this algorithm in communication and calculation, such as using cache mechanisms or predefining some trustworthy agents, this algorithm is hard to implement in real systems. There are still some problems unaddressed. For example, there are multiple agents responsible for a single agent’s reputation in the system. They may reach different reputation values about the same agent based on the information they receive individually. The problem is how to decide which reputation values are more reliable. Aberer and Despotovic [2] have addressed this problem in their complaint-based reputation system, where an agent’s reputation managers are responsible for collecting other agents’ complaints about the agent. If there are more complaints against an agent, the agent’s reputation will be worse. Since the agent’s reputation managers may be offline or online, the number of complaints that they have received may be different. If agent A wants to know agent B’s reputation, it may get several different answers about agent B’s reputation, i.e. a different number of complaints. Then agent A will weigh these numbers by the frequencies that these reputation managers appear to be online during a period of time. The assumption is that the numbers reported by the reputation managers that have been more often offline is less reliable and therefore should be weighed less. 5.5.3 Decentralized person/agent resource personalized reputation systems As in centralized systems, agents in decentralized systems care about both good agents and good resources. The reason for building reputation of resources is that when agents search for resources, they usually get a long list of resources that match their requirements. Some of them may be bad, damaged, or even dangerous, for example, files with viruses. A public representation of the reputations of the resources can prevent agents from selecting bad resources and bad resources from being propagated in the networks, since even honest agents sometimes may share bad resources without knowledge. In Damiani et al.’s [8] and Wang et al.’s reputation systems [48], reputations of resources are explicitly computed for P2P file sharing systems. In Damiani et al.’s approach [8], an agent searches for resources using the standard Gnutella protocol. After the agent gets as a result a list of resources and their

18

providers, it will send another query to ask for evaluations not only about the agents who provide the resources, but also about the resources themselves. After getting the evaluations, the agent will go further to check these evaluations’ truthfulness through a series of steps. Then, after aggregating all the valid evaluations, the agent can finally make a decision from which agent to download which resources. The authors do not propose an exact algorithm for aggregating and calculating agents’ or resources’ reputation. They focus on various attacks that could happen in such reputation systems and the ways to prevent them. Different from Damiani’s approach, where agents have to discover other agents’ reputation or resources’ reputation by themselves, our approach [48] uses communities to facilitate agents to discover reputation of agents or resources. In this approach, agents will self-organize to form communities according to their common interests. A community is an organization consisting of multiple creators and agents. Creators are self-selected agents who have high computing ability and bandwidth. They organize other agents with common interests together and collect information from these agents, including their ratings about each other and ratings about resources shared among them. Then the creators will aggregate all the information together and generate an overview of agents’ reputations and resources’ reputations. So from the community’s creators, agents can quickly find out what resources are shared in the community and whether these resources or agents are good or not. In this approach, the reputations of agents and resources are calculated as the average of received ratings. Figure 11 shows the structure of a community. There are three lists, the creator list, the agent list, and the paper list. The creator list stores the information about the creators. The agent list includes the information about agents and their reputations. The paper list provides information about papers and their ratings. 6. Discussion and conclusion Trust and reputation mechanisms have been used in many large open systems to solve the problem of selecting services/resources or their providers. A web service system is a large open system, too. Using trust and reputation mechanisms offers a promising way to solve the web service selection problem. The investigation of trust and reputation systems in other areas can provide valuable observations and approaches that can be used in web service systems. Therefore, this paper presents a systematic review of various trust and reputation systems and proposes a typology to classify them from three aspects, centralized vs. decentralized, persons/agents vs. resources, global vs. personalized. These aspects are important not only in that they clarify the difference between various existing trust and reputation systems, but also in that they point out the potential research directions for using trust and reputation in web services and provide some reference systems for them. As Figure 5 shows, most of the current trust and reputation mechanisms proposed for web services [17, 19, 21-24] belong to one branch in the classification - centralized, resources-based, and personalized trust and reputation mechanisms, which leaves space to research the suitability of many other types of mechanisms for web services. z Decentralized trust and reputation mechanisms for peer-to-peer based web service systems Various peer to peer based web service techniques have been proposed [13, 18, 46], which require decentralized mechanisms for trust and reputation. As far as we know, the only trust and reputation approach for decentralized web service

19

z

z

system is proposed by Vu, Hauswirth and Aberer [47]. But their approach is based on the complex P-Grid structure they developed. It is very complicated and hard to implement. Other solutions are still expected. Trust and reputation mechanisms for web service providers rather than just for web services Building trust and reputation for web service providers is beneficial for web service selection, and has been neglected in current trust and reputation approaches for web services. A good reputation of a service provider can enhance a consumer’s confidence in its services. More importantly, for the service for which the trust and reputation has not been established, e.g. a new service or a service that has not been selected by consumers, the trust and reputation of the service provider, accumulated by the provider from providing other services, can be used for the selection since if a provider has a good reputation for providing good quality services, a consumer would like to believe that its new service has good quality too. Application of existing global/personalized trust and reputation techniques to web services In a web service system, personalization is important so that the selected service meets the consumer’s special needs. Collaborative filtering is a good example for using the recommender system technology to personalize web service selection in a centralized system. The decentralized methods proposed by Yu & Singh [54-60] and Wang & Vassileva [49] can be easily modified to apply to peer-to-peer based web service systems. Since not all web services need personalization, for example, a currency converter or a weather forecast service [6], some global reputation mechanisms that are simple and effective are also applicable to web service systems, like the one used in eBay. The mechanisms used by Google and Epinions may be suitable, too. There may be possibilities of applying other methods to web service systems. Further studies are needed.

References [1] K. Aberer, P-Grid: A self-organizing access structure for P2P information systems Proc. of the Ninth International Conference on Cooperative Information Systems (CoopIS 2001), 2001 [2] K. Aberer and Z. Despotovic, Managing trust in a peer-to-peer information system. In 2001 ACM CIKM International Conference on Information and Knowledge Management, 2001. Information Agents, 7th International Conference, CoopIS 2000, 2000. [3] Amazon: Available online at: http://www.amazon.com [4] N. Apte, T. Mehta, Web Services: An Introduction. Available online at: http://www.phptr.com/articles/article.asp?p=25442&seqNum=1&rl=1, Last accessed on Nov. 30, 2006 [5] A. Avizienis, J. Laprie, and B. Randell. Fundamental concepts of dependability. Technical Report N01145, LAASCNRS, 2001. [6] W. T. Balke and M. Wagner. Towards personalized selection of web services. In Proceedings of the 12th International World Wide Web Conference (WWW 2003), Budapest, Hungary, 2003. ACM. [7] S. J. Breese, D. Heckerman, and C. Kadie, “Empirical Analysis of Predictive Algorithms for Collaborative Filtering”. MSRTR-98-12. May 1998. [8] E. Damiani, C. Vimercati, S. Paraboschi, P. Samarati and F. Violante, A Reputation-Based Approach for Choosing Reliable Resources in Peer-to-Peer

20

[9] [10] [11] [12]

[13] [14]

[15] [16]

[17]

[18]

[19]

[20] [21] [22]

[23]

[24]

[25]

[26]

Networks, In Proceedings of the 9th ACM conference on Computer and Communications Security (CCS’02), pages 207–216. ACM, 2002. J. Day, A Framework for Autonomic Web Service Selection, Master thesis, University of Saskatchewan 2005 eBay Available online at: http://www.eBay.com Epinions Available online at: http://www.epinions.com N. Good, J. Schafer, J. Konstan, A. Borchers, B. Sarwar, J. Herlocker and J. Riedl, Combining Collaborative Filtering with Personal Agents for Better Recommendations, Proceedings of the 1999 National Conference of the American Association of Artificial Intelligence, pp 439-436. W. Han, Integrating Peer-to-Peer into Web Services, Master thesis, University of Saskatchewan 2006 Y. Jin, P. Bloch and G. Cameron, A Comparative Study: Does the Word-of-mouth Communications and Opinion Leadership Model Fit Epinions on the Internet?, Proceedings of the Hawaii International Conference on Social Sciences 2002. A. Jøsang, R. Ismail, and C. Boyd, A Survey of Trust and Reputation Systems for Online Service Provision . Decision Support Systems, 2005. D. S. Kamvar, T. M. Schlosser, and H. Garcia-Molina. “The Eigentrust Algorithm for Reputation Management in P2P Networks”. In Proc. of the twelfth International Conference on World Wide Web, 2003 K. Karta, An Investigation on Personalized Collaborative Filtering for Web Service Selection, technical report, Available online at (last accessed on Nov. 30, 2006): http://www.csse.uwa.edu.au/%7Ewei/honours/2005/cshonours-ken.pdf, F. B. Kashani, C. C. Chen, and C. Shahabi. WSPDS: Web Services Peer-to-Peer Discovery Service. In Proceedings of the International Conference on Internet Computing, pages 733–743, 2004. K.-C. Lee et al., “QoS for Web Services: Requirements and Possible Approaches,” World Wide Web Consortium (W3C) note, Nov. 2003; Available online at (last accessed on Nov. 30, 2006): www.w3c.or.kr/kr-office/TR/2003/ws-qos/, Y. Liu, A. Ngu, and L. Zheng. QoS computation and policing in dynamic web service selection (to appear). In Proceedings of the WWW 2004, May 2004. A. Mani, A. Nagarajan, "Understanding Quality of Service for Web Services", IBM developerWorks, January 2002. U. S. Manikrao, T.V. Prabhakar, Dynamic Selection of Web Services with Recommendation System, International Conference on Next Generation Web Services Practices, August 2005, Seoul, Korea. E. M. Maximilien and M. P. Singh. Toward autonomic web services trust and selection. In Proceedings of the 2nd international conference on Service oriented computing. ACM press, New York, NY , USA, 2004, 212-221. E. M. Maximilien and M. P. Singh, Multiagent System for Dynamic Web Services Selection, In Proceedings of 1st Workshop on Service-Oriented Computing and Agent-Based Engineering (SOCABE at AAMAS), July 25-29, 2005, Utrecht, The Netherlands E. Michael Maximilien and Munindar P. Singh. Conceptual Model of Service Reputation. Special Section on Semantic Web and Data Management, SIGMOD Record, 4, December 2002. E. M. Maximilien and M. P. Singh. A Framework and. Ontology for Dynamic Web Services Selection. IEEE. Internet Computing, 8(5):84–93, Sept. 2004 21

[27] M. Montaner and B. L´opez. Opinion based filtering through trust”. In

[28]

[29] [30]

[31]

[32]

[33]

[34]

[35]

[36] [37]

[38]

[39]

[40] [41]

[42]

[43]

[44]

Proceedings of the 6th International Workshop and Trust. Computational Intelligence, Vol. 18, no. 4, 2002. M. Montaner, B. López, de la Rosa, J. Ll., “Developing Trust in Recommender Agents”. Proceedings of the First International Joint Conference on Autonomous Agents and Multiagent Systems (AAMAS'02), Palazzo Re Enzo (Italy), 2002. MovieLens, Available online at: http://movielens.umn.edu L. Mui, A. Halberstadt. and M. Mohtashemi, Notions of reputation in multi-agents systems: A review. In Proceedings of Autonomous Agents & Multiagent Systems (AAMAS’02), 280–287, Bologna, Italy, 2002. T. Olsson, Bootstrapping and Decentralizing Recommender Systems, Licentiate Thesis 2003-006, Department of Information Technology, Uppsala University and SICS, 2003 L. Page, S. Brin, R. Motwani, and T. Winograd, The PageRank Citation Ranking: Bringing Order to the Web, Technical report, Stanford Digital Library Technologies Project, 1998 M. Paolo, B. Bobby. “Using Trust in Recommender Systems: an Experimental Analysis”. Second International Conference on Trust Management, Oxford, England, 2004 M. J. Pujol, R. Sanguesa, and J. Delgado, 2002. Extracting reputation in multi agent systems by means of social network topology, In Proc. of Int'l Conf. on Autonomous Agents and Multi-Agents Systems (AAMAS-02), pp. 467-474. Ran S, A Framework for Discovering Web Services with Desired Quality of Service Attributes. In L.-J. Zhang, editor, Proc. of the International Conference on Web Services, pp. 208–213, Las Vegas, NV, June 2003. IEEE Computer Society. Ran S., “A Model for Web Services Discovery with QoS,” SIGEcom Exchanges, vol. 4, no. 1, 2004, pp. 1–10. P. Resnick, N. Iacovou, M. Sushak, P. Bergstrom, and J. Riedl, GroupLens: An open architecture for collaborative filtering of netnews, Proceedings of the 1994 Computer Supported Collaborative Work Conference. (1994) P. Resnick and R. Zeckhauser Trust Among Strangers in Internet Transactions: Empirical Analysis of eBay’s Reputation System. NBER Workshop on Empirical Studies of Electronic Commerce, 2000. B. Sabata et al., Taxonomy for QoS Specifications, Workshop on Object-Oriented Real-Time Dependable Systems (WORDS ‘97), IEEE CS Press, 1997.5. J. Sabater (2003), Trust and Reputation for Agent Societies, PhD thesis, Institute for Artificial Intelligence Research, Bellaterra. J. Schafer, J. Konstan, and J. Riedl, Recommender Systems in E-Commerce. ACM Conference on Electronic Commerce (EC-99), November 3-5, 1999, Denver, CO. R. Sumra, D. Arulazi, "Quality of Service for Web Services-Demystification, Limitations, and Best Practices", March 2003, Available online at (last accessed on Nov. 30, 2006): http://www.developer.com/services/article.php/2027911 M. Tian, A. Gramm, T. Naumowicz, H. Ritter, and J. Schiller. A Concept for QoS Integration in Web Services. In Proc. of the First Web Services Quality Workshop, Rome, Italy, Dec. 2003. IEEE Computer Society. H. L. Truong, R. Samborski, T. Fahringer, Towards a Framework for Monitoring and Analyzing QoS Metrics of Grid Services, 2nd IEEE International Conference

22

[45]

[46]

[47]

[48]

[49]

[50]

[51]

[52]

[53]

[54]

[55]

[56]

[57]

[58]

[59]

on e-Science and Grid Computing, (c) IEEE Computer Society Press, Dec. 4- 6, 2006, Amsterdam, Netherlands. K. Verma; A. Sheth; M. Zaremba; C. Bussler, User Preference based Automated Selection of Web Service Compositions ICSOC Workshop on Dynamic Web Processes, pp. 1-12. IBM, Amsterdam, Netherlands, December 2005 L.-H. Vu, M. Hauswirth, K. Aberer, Towards P2P-based Semantic Web Service Discovery with QoS Support, Proceeding of Workshop on Business Processes and Services (BPS), Nancy, France, 2005. L.-H. Vu, M. Hauswirth, K. Aberer, QoS-based service selection and ranking with trust and reputation management, Proceedings of OTM'05, R. Meersman and Z. Tari (Eds.), LNCS 3760, p.p. 466-483, 2005. Y. Wang, J. Vassileva, Trust-Based Community Formation in Peer-to-Peer File Sharing Networks, Proc. of IEEE/WIC/ACM International Conference on Web Intelligence (WI 2004),September 20-24, 2004, Beijing, China. Y. Wang, J. Vassileva, Trust and Reputation Model in Peer-to-Peer Networks. Proc. of The Third IEEE International Conference on Peer-to-Peer Computing, September 1-3, 2003, Linköping, Sweden. L. Xiong and L. Liu , PeerTrust: Supporting Reputation-Based Trust for Peer-to-Peer Electronic Communities, IEEE Transactions on Knowledge and Data Engineering, Vol.16, No. 7 (July 2004). Special issue on Peer to Peer Based Data Management. pp 843-857. P. Yolum and P. M. Singh, Locating Trustworthy Services In Proceedings of the First International Workshop on Agents and Peer-to-Peer Computing (AP2PC), 2002. P. Yolum and P. M. Singh, Emergent Personalized Communities in Referral Networks. IJCAI Workshop on Intelligent Techniques for Web Personalization (ITWP), 2003. P. Yolum and P. M. Singh, Self-Organizing Referral Networks: A Process View of Trust and Authority, AAMAS Workshop on Engineering Self-Organising Applications, 2003. Lecture Notes in Computer Science, Vol.2977, pp.195-211, Springer Verlag. B. Yu, M. Venkatraman and P. M. Singh, An Adaptive Social Network for Information Access: Theoretical and Experimental Results, Journal of the Applied Artificial Intelligence, Volume 17, Number 1, pages 21-38, 2003 B. Yu and P. M. Singh, Distributed Reputation Management for Electronic Commerce, Computational Intelligence, Volume 18, Issue 4, pages 535-549, 2002 B. Yu and P. M. Singh, Searching Social Networks, Proceedings of Second International Joint Conference on Autonomous Agents and Multi-Agent Systems, pages 65-72, 2003. B. Yu and P. M. Singh, Detecting Deception in Reputation Management, Proceedings of Second International Joint Conference on Autonomous Agents and Multi-Agent Systems, page 73-80, 2003. B. Yu and P. M. Singh, An Evidential Model of Distributed Reputation Management, Proceedings of First International Joint Conference on Autonomous Agents and Multi-Agent Systems, pages 294-301, 2002 (26% acceptance rate) B. Yu and P. M. Singh, A Social Mechanism of Reputation Management in Electronic Communities, Proceedings of Fourth International Workshop on Cooperative Information Agents, pages 154-165, 2000 (36% acceptance rate)

23

[60] B. Yu, P. M. Singh, and K. Sycara, Developing Trust in Large-Scale Peer-to-Peer

Systems, Proceedings of First IEEE Symposium on Multi-Agent Security and Survivability, 2004. [61] N. C. Ziegler, and G. Lausen, Analyzing Correlation Between Trust and User Similarity in Online Communities. Proc. of the 2nd International Conference on Trust Management, 2004. [62] G. Zacharia, A. Moukas, and P. Maes, Collaborative Reputation Mechanisms in Electronic Marketplaces In 32nd Annual Hawaii International Conference on System Science (HICSS-32), 1999.

24

The authors Yao Wang is a PhD candidate in the Department of Computer Science at the University of Saskatchewan. Her research interests include multi-agent systems, web services, peer-to-peer systems, trust and reputation systems. _____________________________________________________________________ Dr. Julita Vassileva is Associate Professor of Computer Science at the University of Saskatchewan. She received her Ph.D. degree in Mathematics and Computer Science from the University of Sofia, Bulgaria in 1992. Dr. Vassileva has contributed to the areas of artificial intelligence in education, adaptive hypertext and hypermedia and multi-agent systems. More recently, her research has focused on ways to encourage participation in online communities, personal information management as well as recommendation systems using trust and reputation mechanisms. She has authored over hundred technical papers and has co-edited two books.

25

Table 1. Discovered services for flight booking [6]

26

Fig 1. Two web service usage scenarios Fig 2. Web service selection criteria Fig 3. A business-to-customer link Fig 4. Activities model Fig 5. Trust and reputation system classification Fig 6. Epinions’s reputation mechanism Fig 7. The propagation of ranks [32] Fig 8. The similarities between collaborative filtering and personalized reputation systems Fig 9. Referral graph Fig 10. An example of P-Grid Fig 11. The structure of a community from [48]

27

Fig 1. Two web service usage scenarios

28

Processing Time/ Execution Time Throughput

Response Time Performance Latency

Availability Accessibility QoS for general services Accuracy Dependability Reliability QoS Capacity Scalability Stability/Exception Handling

QoS for web services

Users’ constrains and preferences

Robustness/ Flexibility Cost

Data Integrity Integrity Regulatory/ Interoperability

Trust/ Reputation

Transactional Integrity

Accountability Security Authentication

Other aspects

Anthorization Applicationspecific metrics

Tranceability/ Auditability Non-Repudiation Confidentiality/Privacy Encryption

Fig 2. Web service selection criteria

29

Fig 3. A business-to-customer link

30

Fig 4. Activities model

31

Trust and Reputation System

Centralized

Decentralized

Person|agent

Global

eBay

Resources

Personalized

Sporas

Reputation systems based on social network topology analysis

Histos

Global

Google

Person|agent

Personalized

Epinions

Amazon

Global

Collaborative filtering

Resources

Personalized

Global

B. Yu & M. Singh P. Yolum & M. Singh

Person|agent/resource

Personalized

E. Damiani Y. Wang & J. Vassileva

K. Aberer & Z. Despotovic L. Xiong & L. Liu D. S. Kamvar, T. M. Schlosser & H. Garcia-Molina

E. M. Maximilien & M. P. Singh Y. Liu & A. Ngu & L. Zeng U. S. Manikrao & T. V. Prabhakar J. Day K. Karta

L.-H. Vu, M. Hauswirth, & K. Aberer

Fig 5. Trust and reputation system classification

32

Fig 6. Epinions’s reputation mechanism

33

Fig 7. The propagation of ranks [32]

34

Fig 8. The similarities between collaborative filtering and personalized reputation systems

35

Fig 9. Referral graph

36

(a)

(b) Fig 10. An example of P-Grid

37

Fig 11. The structure of a community from [48]

38