Re: Defining Trust and Reputation

The problem we are facing is best described in a draft by the IAB 
(http://www.iab.org/documents/drafts/draft-iab-e2e-futures-05.txt):

"Perhaps the single most important change from the Internet of 15 years 
ago is the lack of trust between users ... While the end to end 
principle does not require that users implicitly trust each other, the 
lack of trust in the Internet today requires that application and system 
designers make a choice about how to handle authentication, whereas that 
choice was rarely apparent 15 years ago."

With all of this in mind, I took some time to read through the following 
three papers:

http://www.stanford.edu/~sdkamvar/papers/eigentrust.pdf
http://lsirpeople.epfl.ch/despotovic/CIKM2001-trust.pdf
http://nma.com/mcg-mirror/trustdef.htm

The first two papers talk about P2P systems, the third paper is 
describing the general concept of trust on the Internet. I am going to 
summarize some of my thoughts below, comments are welcome.

------------------------------
The main intent of any kind of trust system in the spam world is to make 
sure that less spam is sent and received. This is the key point to keep 
in mind at all times. While other side benefits may develop, we are 
trying to gauge the cost of solutions against how well they can reduce spam.

What we want to do is to establish some form of trust between two 
entities (networks, MTAs, users, domains, etc.). The good question is 
what that trust is. This is very complicated because simply basing trust 
on "spam" values will not work very well as John pointed out 
(http://article.gmane.org/gmane.ietf.asrg.smtpverify/266), since 
everyone has a different definition of spam.

In the Eigen paper described above they are attacking a problem of P2P 
nodes that provide bad downloads. Yet the issue of a definition of a bad 
download vs. a good download is not addressed and it is binary. The 
second P2P paper, bases its calculation of trust on complaints. The 
problem is the same as above - the complaints are based on different 
definitions of spam. In our case, the very fact that the trust is based 
on is in dispute, with multiple definitions of spam possible. As John 
stated, a scoring system might work but then again the definitions are 
very divergent. This is why we went over to discussing non-controversial 
metrics such as volume, activity length, etc. instead of trust to send 
non-spam or spam emails.

In Ed Gerck's paper, trust is defined as:

"trust is that which is essential to a communication channel but cannot 
be transferred from a source to a destination using that channel"

I think what this implies is that trust cannot be proven by the sender, 
but must be calculated using external sources. The sender may hint to a 
specific trust services used but we still have to get that information 
from these services. There is also another definition of trust in the paper:

"trust is that which an observer has estimated with high-reliance at 
epoch T, about an entity's behavior on matters of x",

In our case this would mean that trust is what the receiver determines 
at a specific time frame based on previous behavior by a specific sender.

The problem of course is how do you determine trust, especially with all 
the different definitions of spam possible.
------------------------------

Yakov