RepuScore Algorithm

The RepuCollector’s reputation is calculated based on the reputation of all the RepuServers it maintains. We first demonstrate how each RepuCollector calculates the reputation of peer RepuServers. We then discuss the reputation computation of peer RepuCollectors. Finally, we demonstrate how a global reputation is calculated. With the help of reputation, administrators in an organization can evaluate the compliance of the domain by checking their organization’s reputation services. If the domain’s reputation is lower than expected that would imply that there might be bots on the server.


RepuServer Reputation Calculation

RepuServer’s reputation is calculated by peer RepuServers. The reputation in RepuScore is always in the open interval (0, 1). A score of 1 indicates a highly reputable sender whereas a score of 0 indicates a sender with a low reputation. For all sender RepuServers, each receiving RepuServer maintains the number of emails received and the number among those marked as spam. The reputation of a RepuServer is computed as the number of good emails over the number of emails sent by a RepuServer in a particular interval. The reputation is calculated based on the modified time sliding window exponentially weighted moving average (TSW-EWMA) algorithm.

Equation 1 displays the weighted moving average. The RepuServer Reputation is based on the reputation in the previous interval and the reputation in the present interval. Correlation factor a indicates the amount of previous reputation considered for computation of the RepuServer’s reputation in the new interval. If the correlation factor is high, the reputation of a sender takes a long time to increase or decrease, as a lot of weight is given to the previous reputation. However, if the correlation factor is low, the reputation increases or decreases very quickly since current actions are given additional weight.


RepuCollector Reputation Calculation

Based on the change in a RepuServers’ reputation, the RepuCollector’s reputation can be updated. Equation 2 shows the local reputation computation of a RepuCollector. The local RepuCollector reputation is the average reputation of all of its RepuServers.

Each RepuServer transmits the reputation of the peer RepuCollectors to the central authority. The central authority considers the votes only from the RepuCollectors whose reputation is greater than the participation threshold. We demonstrate that such a mechanism helps in the creation of a trusted group of reputable senders. The central authority calculates the global reputation of the RepuCollectors based on a modified Weighted Majority Algorithm (WMA) called WMA Continuous (WMC) proposed by Yu et al. The WMC algorithm has been used in peer-to-peer systems to detect deception. We provide the participation threshold as a mechanism to remove domains that propagate spam and increase reputations of other senders. Equation 3 demonstrates the Global RepuCollector reputation as the reputation-weighted average of the local RepuCollector reputation computed by each peer. The new reputation is computed once every reputation aggregation interval and is valid for one Aggregation Interval.


Modified RepuServer Algorithm

If the sender does not propagate spam, the reputation should increase slowly, which indicates a long past history. Hence the high value of a implies an association for a long history of good actions. If the sender propagatesspam, the reputation should decrease immediately, reflecting the current actions of the sender. A low value of a guarantees an immediate reduction when the sender propagates spam. Equation 4 demonstrates our change in the reputation algorithm to accommodate this behavior in RepuScore.