Eventual Convergence of the Reputation-Based Algorithm in IoT Sensor Networks

Uncertainty in dense heterogeneous IoT sensor networks can be decreased by applying reputation-inspired algorithms, such as the EWMA (Exponentially Weighted Moving Average) algorithm, which is widely used in social networks. Despite its popularity, the eventual convergence of this algorithm for the purpose of IoT networks has not been widely studied, and results of simulations are often taken in lieu of the more rigorous proof. Therefore the question remains, whether under stable conditions, in realistic situations found in IoT networks, this algorithm indeed converges. This paper demonstrates proof of the eventual convergence of the EWMA algorithm. The proof consists of two steps: it models the sensor network as the UOG (Uniform Opinion Graph) that enables the analytical approach to the problem, and then offers the mathematical proof of eventual convergence, using formalizations identified in the previous step. The paper demonstrates that the EWMA algorithm converges under all realistic conditions.


Introduction
Let us consider a dense Internet of Things network, consisting mostly of inexpensive sensors that collectively measure a certain physical phenomenon. By design, this network may comprise some high-quality nodes (characterized, among others, by the low level of uncertainty) as well as a number of nodes of high or unknown uncertainty. In order to improve the overall quality of its measurement, the network may want to learn about the quality of its nodes to decrease the impact of the low-quality ones. In the absence of external reference sources, the network must rely on opinions randomly issued by one node about the other to be converted into a reputation of those nodes. Note that the notion of quality applies equally well to nodes that provide incorrect readings due to the use of low-quality sensors and nodes that provide such readings due to their failure or the failure of their communication links. This makes this approach potentially attractive to IoT networks that use wireless communication.
One of the popular algorithms to perform such conversion is the EWMA one (Exponentially Weighted Moving Average), which is widely used, e.g., in social networks. The algorithm tends to perform well under simulated conditions, but, to the author's knowledge, there is no proof that it eventually converges, i.e., that the algorithm eventually delivers the stable value (or, e.g., asymptotically approaching the stable value) of the reputation of the node, provided that the network itself is in a stable situation. Undesired behavior of the algorithm may include oscillations (where a stable value is only momentarily achieved), or false assessment (where the algorithm gradually diverges from the assessment), or the failure to provide the assessment (where the outcome of the algorithm becomes unrealistic).
The key contribution of this paper is proof of the eventual convergence of the EWMA algorithm, as applied to IoT sensor networks. The proof is also applicable to other uses of

The EWMA Algorithm in IoT Networks
The use of the EWMA algorithm to decrease the uncertainty in IoT sensor networks has been introduced in the work of [15]. It is characteristic for the IoT networks, in contrast with professional measurement networks, that they may contain sensors of varied quality and that the maintenance protocols, as well as communication protocols, may not be up to high standards. Consequently, measurement results obtained from such networks tend to bear higher uncertainty, so that the ability to contain this uncertainty is important.
Reference nodes (i.e., nodes of assured high quality) are often used to contain the growth of uncertainty by acting two ways: to provide the set of quality readings and also to judge other nodes and eliminating those that seem to be faulty. However, those solutions are both expensive in operation and sensitive to the failure of one of the reference nodes.
The approach proposed in the work of [15] disposes of the need for reference nodes, but it requires nodes to be over-provisioned. Considering that the cost of the lower-quality node can be significantly lower than the cost of the reference node, such a trade-off can be quite attractive. This approach is based on the ability to tell sensors of low uncertainty from those of high uncertainty, so the high uncertainty of some of them does not overly taint the measurements performed by the network. As the network is autonomous, it cannot use external sources or reference nodes to perform the assessment of nodes to learn about their uncertainty. Instead, it must rely on opinions issued by nodes within the network about each other. Those opinions are issued by nodes on the basis of their assessment of whether other nodes perform as expected. As the node can issue the opinion only based on its own performance, high-quality nodes tend to issue correct opinions while low-quality nodes tend to issue incorrect ones. What the opinions contain is traditionally called the level of trust, by analogy to subjective trust [1] used in social networks.
The network can employ the algorithm that computes those opinions into the reputation of each node, where the weight of opinion of the node depends on its current reputation at the time the opinion has been issued. That is, the higher the reputation of the node, the more influential its opinion is. One of the formalizations of this algorithm is known as the EWMA, and this is the one analyzed here. This formalization combines weighted averaging of opinions with their decay so that older opinions weigh less toward the current reputation. This formalization, as used through this paper, can be expressed as where: • w τ a reputation of the sensor a at the moment τ • n number of opinions about a that are known to the algorithm and that were provided before or at the time τ • u τ i b→a level of trust that the sensor b, providing the i-th opinion, had in sensor a at the time the opinion has been provided, τ i . • con f τ i b confidence in the i-th opinion, being the confidence in the sensor b that provided this opinion, calculated for the time the opinion has been provided, τ i . This confidence is calculated as con f b→b self-confidence of the sensor b that provided the i-th opinion in its own judgment at the time the opinion has been issued (i.e., τ i ); this self-confidence is used when calculations made by the sensor include elements of doubt. • w τ i b reputation of the sensor b that provided the i-th opinion at the time the opinions has been issued, ] the decay function that decreases the influence of opinions that are less current; the function takes as its parameters the time moment τ when the calculation was performed and time moment τ i when the i-th opinion was issued; for EWMA, the exponential decay function is used so that f d = e −λ(τ−τ i ) where λ is the decay constant.
There are few families of algorithms that can be used to establish what, in fact, is a reputation of the node, out of opinions about such a node, coming from unreliable peers [12]. The EWMA algorithm is a prominent example of the deterministic approach, where the resulting reputation bears no uncertainty. Alternatively, the Bayesian approach can be used (e.g., the work of [25]) so that the reputation of the node can bear its own measure of uncertainty. Fuzzy systems are also used to better reflect the human perception of reputation (e.g., the work of [26]). Machine learning (where examples of various quality are presented to the algorithm) is used as well [27], but usually in the context of determining malicious nodes, not just low-quality ones.
The EWMA is one of the simplest deterministic algorithms, where only direct (firstlevel) opinions are considered, i.e., opinions resulting from the direct observation of one node by others or from observing the same phenomenon. More complex algorithms may take into account also second-and third-level opinions, i.e., opinions about opinions provided by nodes. The choice of this was dictated by the desire to avoid the second-order considerations about the uncertainty (i.e., the uncertainty introduced by the algorithm itself), while neither the similarity to human reasoning nor the ability to learn from examples was particularly important. Further, as the research interest was in demonstrating eventual convergence, the EWMA algorithm forms the natural starting point, being both less complicated and better understood than other algorithms.
The decrease in uncertainty provided by the use of the EWMA algorithm is contingent on the IoT network being reasonably "dense", i.e., on situations where the neighbors of the given node can-at least from time to time-provide opinions about the given node. The underlying assumption is that the network is over-provisioned, i.e., that there are significantly more sensors in the network than would have been normally used. This concept is explained in detail in the work of [15]. It is worth mentioning that examples provided throughout this paper tend to use the over-provisioning of about four, thus assuming a grid-like structure of sensors. Such a level of over-provisioning can be reasonably achieved in networks that measure physical phenomena such as air pollution. Additional costs can be compensated by using lower-quality sensors.
Note that the research presented in this paper demonstrates that the convergence itself is not contingent on any particular level of over-provisioning, but the speed of such convergence is. The convergence is only contingent on opinions being provided, i.e., on the ability of one node to assess the other node.
Modern implementations of IoT networks may rely on wireless multi-hop communication (e.g., mesh networks [28]) to deliver the readings from the sensors to the central processing platform. Such networks may employ their own routing algorithms to optimize their operation and to eliminate misbehaving nodes, e.g., trust-based routing, using their own algorithms. The EWMA algorithm described here neither suffer from nor leverage such solutions. It assumes that the underlying communication network eventually delivers results but requires neither timeliness nor reliability. It is generally immune to delays and incidental omissions, including the disappearance and re-appearance of nodes. Further, it is intended to be implemented at the central processing platform so that it does not increase the workload on the network or on the nodes themselves.
Note that this paper assumes that all the nodes are benevolent. This paper does not study the convergence under adversary attacks where, e.g., malicious nodes are added to the network or benevolent ones became malicious.

The Uniform Opinion Graph (UOG)
The realistic model of the IoT sensor network is a random graph, with nodes representing sensors and edges representing opinions. While nodes remain unchanged, edges are created and disappear randomly in time, as new opinions are created, and old ones are discarded.
The interest of this paper focuses on a directed random graph with a specific average density. Such a graph is a variant of the Erdos-Renyi or Gilbert graphs. It is known that the probability distribution of the degree of the node follows the binomial distribution and reaches its maximum for the degree being equal to twice the average density, evenly split between inbound and outbound edges. If there is a fixed proportion of nodes of specific colors (types), this proportion is also reflected in the distribution of inbound and outbound edges.
The number and the distribution of antecedents are of interest in this paper. For example, using simulated results (see Figure 1.) for random graphs of 20 nodes that have only two types of nodes: 12 nodes of type 1 and 8 nodes of type 2, with the average density of 5, the dominant configuration of a node is that the node has five antecedents of which three are of type 1, and two are of type 2. only two types of nodes: 12 nodes of type 1 and 8 nodes of type 2, with the average density of 5, the dominant configuration of a node is that the node has five antecedents of which three are of type 1, and two are of type 2. Figure 1. The simulated probability density distribution of antecedents of the node as a function of the number of "type 1" and "type 2" nodes in random graphs.
Therefore, for the purpose of the analysis presented here, the simple model of a random graph is used that assumes that every node of the graph has exactly the same configuration that follows the dominant one. This model is called the UOG (Uniform Opinion Graph).

•
Taking this model further, one can assume that there is a limited set of types of nodes (called further "roles"), each type representing a node of a certain quality. Assuming the uniform and fixed distribution of opinions within the UOG, it is enough to analyze only as many nodes that there are roles, each node being a faithful representative of all nodes with the same role. Further simplifications lead to the UOG graph, whose properties are suitable for mathematical analysis; • There are only two roles: trustworthy nodes and faulty ones. Trustworthy nodes are of high quality, and faulty nodes are of low quality. Note that the phrase "faulty" does not imply that they failed in any way but that their quality is significantly inferior to those considered trustworthy; • The complete UOG is defined by three parameters: p-number of trustworthy nodes that provide an opinion about the given one; q-number of faulty nodes that provide an opinion, and a multiplier that allows constructing graphs of different sizes; • Roles of nodes are fixed; there are p · multiplier trustworthy nodes and q · multiplier faulty ones; neither those roles nor their allocation to nodes change, allowing for stable conditions; • The graph density is fixed to + ; each node receives opinions exactly from p trustworthy and q faulty nodes; • Opinions can carry only one of two values: t or f; those values represent the value → . from the same Equation (1). The value t is reported by a node about the node of the same role (i.e., trustworthy about trustworthy, faulty about faulty); f is reported otherwise; • Self-confidence of any node is set to 1, i.e., from Equation (1); → = 1; • Initial reputation of the node is the same for all nodes, set mid-point between t and f; • The analysis is performed in steps, identified by the index i, where i identifies the current assessment, i − 1 the previous one, and so on; • In each step, the analysis calculates the new reputation for the representative trustworthy node (value x) and for the representative faulty node (value y). Therefore, for the purpose of the analysis presented here, the simple model of a random graph is used that assumes that every node of the graph has exactly the same configuration that follows the dominant one. This model is called the UOG (Uniform Opinion Graph).

•
Taking this model further, one can assume that there is a limited set of types of nodes (called further "roles"), each type representing a node of a certain quality. Assuming the uniform and fixed distribution of opinions within the UOG, it is enough to analyze only as many nodes that there are roles, each node being a faithful representative of all nodes with the same role. Further simplifications lead to the UOG graph, whose properties are suitable for mathematical analysis; • There are only two roles: trustworthy nodes and faulty ones. Trustworthy nodes are of high quality, and faulty nodes are of low quality. Note that the phrase "faulty" does not imply that they failed in any way but that their quality is significantly inferior to those considered trustworthy; • The complete UOG is defined by three parameters: p-number of trustworthy nodes that provide an opinion about the given one; q-number of faulty nodes that provide an opinion, and a multiplier that allows constructing graphs of different sizes; • Roles of nodes are fixed; there are p · multiplier trustworthy nodes and q · multiplier faulty ones; neither those roles nor their allocation to nodes change, allowing for stable conditions; • The graph density is fixed to p + q; each node receives opinions exactly from p trustworthy and q faulty nodes; • Opinions can carry only one of two values: t or f ; those values represent the value u τ i b→a . from the same Equation (1). The value t is reported by a node about the node of the same role (i.e., trustworthy about trustworthy, faulty about faulty); f is reported otherwise; • Self-confidence of any node is set to 1, i.e., from Equation (1); c Initial reputation of the node is the same for all nodes, set mid-point between t and f; • The analysis is performed in steps, identified by the index i, where i identifies the current assessment, i − 1 the previous one, and so on; • In each step, the analysis calculates the new reputation for the representative trustworthy node (value x) and for the representative faulty node (value y).  Figure 2 shows two fragments of the UOG, where = 2 and = 1. On the left side, nodes A, B, and C provide opinions about the trustworthy node X. On the right side, nodes P, Q, and R provide opinions about the faulty node Y. In both cases, all the nodes also provide opinions to other nodes and are assessed by other nodes, but those opinions are not shown. It is characteristic to this UOG that only those two configurations are possible: either the node is trustworthy, or it is faulty, and its role fully determines its behavior. This observation, together with some simplifications already introduced into the UOG, allows for simplifications in the description of the behavior of the reputation of its nodes.

•
There are only two types of nodes, and they always receive the same amount of opinions from nodes of known types at regular intervals. Therefore, if the reputation of nodes at step i is known, it is possible to calculate the reputation of nodes at step i + 1 by calculating the reputation of one representative node from each type; • Opinions depend solely on the type of nodes that provide and receive those opinions, so that trust expressed by those opinions can be determined in advance and is identical for every step; • As the situation does not change between iterations, long-term decay can be incorporated into levels of trust that nodes report in opinions.
As a result of those simplifications, the original Equation (1), as applied to the UOG, becomes a set of two equations: one applicable for the iterative assessment of the reputation of trustworthy nodes and another for faulty ones.
where • reputation of a representative "trustworthy" node at the i-th iteration, which is also the reputation of every trustworthy node in the graph • reputation of a representative faulty node at the i-th iteration, which is also the reputation of every faulty node in the graph • the number of trustworthy nodes that provide opinions about the node • the number of faulty nodes that provide opinions about the node It is characteristic to this UOG that only those two configurations are possible: either the node is trustworthy, or it is faulty, and its role fully determines its behavior. This observation, together with some simplifications already introduced into the UOG, allows for simplifications in the description of the behavior of the reputation of its nodes.

•
There are only two types of nodes, and they always receive the same amount of opinions from nodes of known types at regular intervals. Therefore, if the reputation of nodes at step i is known, it is possible to calculate the reputation of nodes at step i + 1 by calculating the reputation of one representative node from each type; • Opinions depend solely on the type of nodes that provide and receive those opinions, so that trust expressed by those opinions can be determined in advance and is identical for every step; • As the situation does not change between iterations, long-term decay can be incorporated into levels of trust that nodes report in opinions.
As a result of those simplifications, the original Equation (1), as applied to the UOG, becomes a set of two equations: one applicable for the iterative assessment of the reputation of trustworthy nodes and another for faulty ones.
where • x i reputation of a representative "trustworthy" node at the i-th iteration, which is also the reputation of every trustworthy node in the graph • y i reputation of a representative faulty node at the i-th iteration, which is also the reputation of every faulty node in the graph • p the number of trustworthy nodes that provide opinions about the node • q the number of faulty nodes that provide opinions about the node • t the level of trust that is reported either by the trustworthy node about another trustworthy node or by the faulty node about another faulty node • f the level of trust that is reported either by the trustworthy node about the faulty node or by the faulty node about the trustworthy one.
Note that there are additional limitations on the values that variables can assume that come from the coding convention used throughout the literature [29], as well as from the application area. Therefore: As the equation describes the graph, there is the requirement that this graph contains at least one node. For empty graphs or for graphs without any edge, the convergence is not assured, yet those graphs hardly represent any useful IoT network; There is a choice of coding conventions for expressing the level of trust. The one chosen here assumes that the level of trust is represented by the real number between 0 and 1 and that "trustworthy" is coded as the value higher than "faulty". For other conventions, convergence has not been studied; The outcome of the calculation should be the reputation of the node, and the coding of such reputation should follow the same limitations as the coding of trust.

The Analysis of Convergence in the UOG
The simplification provided by the UOG allowed for the calculation of the convergence of the EWMA algorithm. Figure 3. shows subsequent values of x i and y i for the first 15 iterations of the algorithm defined by Equation (2), where parameters are p = 3, q = 1, t = 1, and f = 0, with the decay constant λ set to 0.7. Both functions seem to converge on values that do not seem to be far off from the values of t and f, respectively. node or by the faulty node about the trustworthy one.
Note that there are additional limitations on the values that variables can assume that come from the coding convention used throughout the literature [29], as well as from the application area. Therefore: • ≥ 0; ≥ 0; + > 0. As the equation describes the graph, there is the requirement that this graph contains at least one node. For empty graphs or for graphs without any edge, the convergence is not assured, yet those graphs hardly represent any useful IoT network; There is a choice of coding conventions for expressing the level of trust. The one chosen here assumes that the level of trust is represented by the real number between 0 and 1 and that "trustworthy" is coded as the value higher than "faulty". For other conventions, convergence has not been studied; The outcome of the calculation should be the reputation of the node, and the coding of such reputation should follow the same limitations as the coding of trust.

The Analysis of Convergence in the UOG
The simplification provided by the UOG allowed for the calculation of the convergence of the EWMA algorithm.  The overall shape is very similar to the one presented in simulations provided in the work of [15], except for the lack of fluctuations, as there is no randomness in this analysis. Comparing with simulations using the same set of parameters, the difference between simulated and calculated results rapidly diminishes. The loss function, e.g., the MSE (Mean Squared Error), rapidly decreases, as shown in Figure 4.
While the comparison of analytical data with simulation can provide only limited assurance, this comparison demonstrates that, indeed, the UOG can serve as a suitable model of what occurs in the random graph when the EWMA algorithm is used.
Note that while there is a visible convergence in the assessment of both trustworthy and faulty nodes, they do not converge at t and f, respectively. Actual values (x*, y*) that The overall shape is very similar to the one presented in simulations provided in the work of [15], except for the lack of fluctuations, as there is no randomness in this analysis. Comparing with simulations using the same set of parameters, the difference between simulated and calculated results rapidly diminishes. The loss function, e.g., the MSE (Mean Squared Error), rapidly decreases, as shown in Figure 4.
While the comparison of analytical data with simulation can provide only limited assurance, this comparison demonstrates that, indeed, the UOG can serve as a suitable model of what occurs in the random graph when the EWMA algorithm is used.
Note that while there is a visible convergence in the assessment of both trustworthy and faulty nodes, they do not converge at t and f, respectively. Actual values (x*, y*) that the analytical formula derived from the UOG converges to can be determined by solving the set of Equation (3).
x * = px * t+qy * f px * +qy * y * = px * f +qy * t px * +qy * where • x* the convergence value for the reputation of the representative trustworthy ("good") node, which is also the convergence value of every trustworthy node in the UOG; • y* the convergence value for the reputation of the representative faulty (bad) node, which is also the convergence value of every faulty node in the UOG.
where • x* the convergence value for the reputation of the representative trustworthy ("good") node, which is also the convergence value of every trustworthy node in the UOG; • y* the convergence value for the reputation of the representative faulty (bad) node, which is also the convergence value of every faulty node in the UOG.

The Proof of Convergence
This section demonstrates that for a non-trivial, realistic set of parameters, the set of functions (2) is convergent to its fixed point. The value of this fixed point is determined by the function's parameters, but it always lies within their useful range. For reference, those ranges were defined as ≥ 0; ≥ 0; + > 0, 0 ≤ ≤ 1; 0 ≤ ≤ 1, and 0 ≤ ≤ 1; 0 ≤ ≤ 1. They refer to the real-life limitations already described earlier in this paper.
Referring back to the model, "trivial" cases are those that effectively preclude the use of the algorithm in the first place because of the lack of differentiation. These are the cases where either there is no differentiation between nodes (all are of the same type) or where there is no differentiation between opinions about nodes (i.e., both t and f are zero). Otherwise, the ability to converge for all non-trivial cases depends only on the choice of t and f, both being a coding convention only. In practice, t is assumed to be greater than f; e.g., throughout most of this paper, it was usually assumed that = 1 and = 0.

The Proof of Convergence
This section demonstrates that for a non-trivial, realistic set of parameters, the set of functions (2) is convergent to its fixed point. The value of this fixed point is determined by the function's parameters, but it always lies within their useful range. For reference, those ranges were defined as p ≥ 0; q ≥ 0; p + q > 0, 0 ≤ t ≤ 1; 0 ≤ f ≤ 1, and 0 ≤ x i ≤ 1; 0 ≤ y i ≤ 1. They refer to the real-life limitations already described earlier in this paper.
Referring back to the model, "trivial" cases are those that effectively preclude the use of the algorithm in the first place because of the lack of differentiation. These are the cases where either there is no differentiation between nodes (all are of the same type) or where there is no differentiation between opinions about nodes (i.e., both t and f are zero). Otherwise, the ability to converge for all non-trivial cases depends only on the choice of t and f, both being a coding convention only. In practice, t is assumed to be greater than f ; e.g., throughout most of this paper, it was usually assumed that t = 1 and f = 0.
The proof defines the interval where • M the interval within which the function converges so that all subsequent values of x i and y i belong to this interval; • max{}, min{} maximum and minimum functions over the set of parameters.
It demonstrates that for f = 0 and t = 0, the sequence (x i ) i=0...∞ starting from any x 0 ∈ M is convergent to a single fixed point in M. For t = 0 (and f = 0), the sequence (x i ) i=0...∞ oscillates around a single fixed point and is convergent only when it is constant and starts exactly from that fixed point. For f = 0 (and t = 0) and p = q the sequence (x i ) i=0...∞ is always convergent to one end of the interval M (attractive fixed point), while the other end is also a fixed point, but only reachable by the constant sequence starting exactly from this point (repulsive fixed point). For f = 0 (and t = 0) and p = q every point of the interval M is a fixed point and every sequence (x i ) i=0...∞ starting from any x 0 ∈ M is always constant and converges to this point. For all cases, if the starting point x 0 lies outside the interval M (but is greater than zero), the first iteration, x 1 , will fall into the interval M. Identical conclusions also apply to the sequence (y i ) i=0...∞ .
The proof starts with the reformulation of the problem, moving it from analyzing a set of two iterative functions into one iterative function (Section 6.1). Section 6.2, after dealing with trivial cases and potential truncation, demonstrates that the function has a support over the range M. The monotonicity of the function is then demonstrated, together with its two fixed points. It is demonstrated that only one of them lies within M and that it is the point to which the function converges (for f = 0 and t = 0). The remaining part of the proof (Section 6.3 onwards) demonstrates the convergence by demonstrating that values returned by the function from its subsequent iterations form a Cauchy sequence in a complete metric space M.

The Formulation of the Problem
The starting point of the proof is Equation (2), which contains a pair of iterative functions x i and y i representing the reputation of a trustworthy (high-quality) and a faulty (low-quality) node, respectively. Those functions have four parameters: p, q, t, and f, described earlier in this paper. The parameters meet the following conditions: p ≥ 0, q ≥ 0, and p + q > 0 (there is at least one node), and t, f ∈ [0, 1]. Additionally, we assume that This pair of functions is a special case of a pair of linear fractional transformations that belong to the family of homographic functions. The behavior of this class of functions is known to strongly depend on the actual values of parameters. Therefore, the proof will concentrate on the behavior of those functions with respect to the values of their parameters.
Conversion. Note that x i+1 + y i+1 = t + f for i = 0 . . . ∞. This means that it is enough to analyze the one-dimensional sequence (x i ) i=0...∞ that starts at x 0 , defined as Truncation. Note, that x i + y i = t + f for i > 0. However, this does not always apply to (x 0 , y 0 ). This irregularity is limited only to (x 0 , y 0 ) as (x 1 , y 1 ) always satisfy the equation. It has been already mentioned, as an observation, earlier in this paper. It is, therefore, enough to disregard the first element of a sequence without losing the generality.
Trivial cases. Let us consider the following trivial cases (for i = 0 . . . ∞, for any x 0 ≥ 0, y 0 ≥ 0): In all these cases, the sequences (x i ) i=0...∞ and (y i ) i=0...∞ are constant from i = 1 onwards and converge to x 1 and y 1 , respectively. Therefore, in further considerations, these cases can be excluded. Support over the range. It is possible now to determine that the sequence (x i ) i=0...∞ operates over a certain range in . It has been already assumed that x i , y i ≥ 0; i = 0 . . . ∞ and p, q > 0, and t, f ∈ [0, 1], but they cannot be zero at the same time (i.e., t + f > 0). These conditions lead to the following inequalities: Expressions in both inequalities are nominators and denominators of (2), respectively. This means that 0 ≤ By replacing y i+1 in the second inequality with the expression of x i+1 , an additional condition can be obtained 0 ≤ This leads to the following bracketing condition that must be satisfied by every x i for i = 1 . . . ∞: m − lower bracket (i.e., the minimum bracketing value) for any x i ; • m + upper bracket (i.e., the maximum bracketing value) for any x i .
With the truncation in mind, it is convenient to assume that m − ≤ x 0 ≤ m + as well. To simplify further the analysis, this paper will use the symbol M to denote the interval [m − , m + ].

The Introduction of the Function
Note that for p = q the equation that defines the sequence (x i ) i=0...∞ determines the function g defined as follows. This is the function that captures the iterative calculation of x i and y i from their previous values, but without cross-referencing, so that x i+1 depends only on x i while y i+1 depends only on y i For p = q the function g becomes linear (as it was assumed that t + f > 0):

Support over M
It was already established that it is enough to consider the interval m − ≤ x ≤ m + and a function with a support restricted to this interval. If p > q, then the zero of the g's denominator For p = q there is no risk of zero in the denominator (if only t + f = 0). Therefore, zero of the g's denominator is never inside the interval M = [m − , m + ] and we can consider the function g in this interval without further considering its denominator equal to zero. Therefore, g : M → M, g(x) = (pt−q f )x+q(t+ f ) f (p−q)x+q(t+ f ) .

Monotonicity
For p = q, the function g is a homographic transformation continuous in the interval M. Therefore, the function g and its first and second derivatives g and g" can be defined as follows: are strictly monotone in the domain M. Hence, extreme values (maximum and minimum) of both derivatives are reached at the ends of the interval M: for m − and m + . Further, if p = q then g is linear, and its first derivative is constant, so its second derivative is equal to zero

Fixed Points
Fixed points of the equation x = g(x) that are in M are as follows. For p = q and f = 0 there is one fixed point x * = t+ f 2 ∈ M as a solution of a linear equation x = t− f t+ f x + f . For p = q and f = 0, t = 0 the function g is an identity function g(x) ≡ x, and the whole interval M becomes a set of fixed points. For p = q there can be no more than two fixed points on the real numbers axis because the function g is a homographic transformation. Solving the equation x = g(x), i.e., leads to the formula: It remains to be demonstrated that for a minus sign before the square root, the fixed point x * − / ∈ M, assuming f > 0; for a plus sign x * + ∈ M. Note that throughout the rest of the text, fixed points will be denoted as follows: • x * + the fixed point calculated by using the plus sign in the above equation, • x * − the fixed point calculated by using the minus sign in the above equation, • x * ± the pair of x * + and x * − .
6.2.4. x * − , x * + ∈ M for f = 0 For f = 0 the fixed points of function g are equal to: and they are the ends of the interval M, which is equal to [0, t] when f = 0: To demonstrate that x * − / ∈ M for f > 0, let us assume the opposite: We introduce ξ as ξ = 4pq f − (p − q) 2 t + (p + q) 4pq f 2 + (p − q) 2 t 2 . We estimate the expression described by a square root 4pq f 2 + (p − q) 2 t 2 ≥ |p − q|t. Hence for p > q: ξ ≥ 4pq f − (p − q) 2 t + (p + q)(p − q)t = 4pq f + 2qt(p − q) > 0 and for p < q (p = q does not apply to this case): , if only f > 0, but a product of two non-negative numbers cannot be negative. It means that for f > 0, there must be x * − / ∈ M.
. It means that we should prove: m − = max{0, t + f − 1} ≤ x * + ≤ min{1, t + f } = m + . We will prove in turn that (1) x * + ≥ 0, and (2) x * + ≥ t + f − 1, and (3) x * + ≤ t + f and finally (4) x * + ≤ 1. We will prove each of these inequalities for two cases: p > q and p < q (bearing in mind that the case p = q has been considered separately, and now it can be omitted).
For p > q, we obtain estimates (notice that then p > √ pq > q): For p < q, we obtain estimates (notice that then p < √ pq < q): This lemma will be considered in two steps: for p > q; t + f > 1; and for p < q; t + f > 1. Let us notice first that the proof is necessary only for t + f > 1; as for the opposite, Lemma 1 applies. For the case of p > q and t + f > 1, it is possible to write (because all subtractions provide non-negative results): Because 4pq f 2 + (p − q) 2 t 2 ≥ 0, square root can be applied to both sides of the last inequality: For the case of p < q (and t + f > 1) it is possible to write (because only p − q < 0 and all other subtractions provide non-negative results): Because 4pq f 2 + (p − q) 2 t 2 ≥ 0 and (p − q)(t -2) + 2pf = (q − p)(2 − t) + 2pf ≥ 0 square root can be applied to both sides of the last inequality hence, x * + ≥ t + f − 1. Lemma 1 and Lemma 2 demonstrate that x * + ≥ m − = max{0, t + f − 1}. Now it remains to show that x * + ≤ m + . It is performed in two steps: Lemma 3 and Lemma 4.
It has been shown that x * + ≤ t + f , so to show that x * + ≤ 1 it is enough to consider t + f > 1. Note that for p > q and t + f > 1, we can write (because all subtractions provide non-negative results): For p < q and t + f > 1, we can write (because only pq < 0 and all other subtractions provide non-negative results): Moreover, for f > 0, x * + is the only fixed point of the function g in the interval M.

Convergence
Now it is possible to prove that for t = 0 and f = 0, any sequence (x i ) i=0 . . . ∞ starting with x 0 ≥ 0 is convergent to a single fixed point x * + ∈ M, denoted below as x*. Of course, this also implies the convergence of the sequence (y i ) i=0 . . . ∞ starting with y 0 ≥ 0 to y* = t + f − x* ∈ M.
One has to remember that we have assumed that x i ≥ 0 (where i = 0 . . . ∞) and p, q > 0, and t, f ∈ [0, 1], but they cannot be zero at the same time (i.e., t + f > 0). Because we demonstrated that x 1 ∈ M for any x 0 ≥ 0, we can limit our considerations to x 0 ∈ M (in a way, we can treat x 1 as x 0 ). The proof of convergence applies different methods depending on the ranges of values of parameters. It starts from some simple cases and then demonstrates convergence either by determining that the function is a concave function or by demonstrating that subsequent iterations form a Cauchy sequence. This case uses the coding that is not typical, with "good" being reported as zero and "bad" as non-zero (effectively as greater than zero). This kind of coding leads to the lack of convergence and should be excluded.
It will be now demonstrated that for t = 0 and f = 0, subsequent values of x i alternate between two values so that the function does not converge. It will allow excluding this case from further considerations. Note that this case counters the assumption about the rationality of the coding: trustworthiness is here encoded as zero, and fault as a value greater than zero. We have: So for t = 0, the iteration sequence takes the form of x 0 , x 1 , x 0 , x 1 , x 0 , x 1 ... and is not convergent unless it is constant, i.e., x i = x * for i = 0 . . . ∞. All the subsequent cases assume that t = 0. 6.3.2. The Case of f = 0 and t = 0 and p = q This case refers to the situation where the coding scheme has been chosen in a rational way and where the number of "good" nodes is not equal to the number of "bad" ones. Therefore, it is the case that may be considered typical. Note that it is not relevant for the convergence whether there are more "bad" or "good" nodes, even though it may lead to unexpected results.
In order to demonstrate the convergence of g(x) for f = 0 and t = 0 and p = q, the sequence (α i ) i=0...∞ is introduced. For f = 0 and the sequence (x i ) i=0...∞ , where x i+1 = g(x i ), it is possible to describe its every element belonging to the interval M = [0, t] as The corresponding sequence (α i ) i=0...∞ is as follows: To prove the convergence of the sequence (x i ) i=0...∞ for any x 0 = α 0 ·t ∈ M = [0, t] it is enough to show the convergence of the sequence (α i ) i=0...∞ for any α 0 ∈ [0, 1]. The sequence (α i ) i=0...∞ can also be defined without resorting to recursion: which is easy to prove by mathematical induction. If α 0 = 0 (x 0 = 0) then α i = 0 for i = 0 . . . ∞, which is easy to prove by mathematical induction.
If For α i ∈ (0, 1), two cases should be considered (note the assumption that p = q): Combining both cases together, we obtain that for p = q and 0 < x 0 < t, the sequence (x i ) i=0 . . . ∞ is always convergent to x * + . It means that for f = 0 and t = 0 and p = q the sequence ( The Case of f = 0 and t = 0 and p = q This is the case of the rational coding scheme, but of the specific network where the number of "good" and "bad" nodes is equal. For reference, the actual simulation (not the UOG) shows that the function randomly "wobbles" around a certain fixed level.
For f = 0 and t = 0 and p = q, the function g is an identity function g(x) ≡ x, and a set of fixed points is the whole interval M. This means that any sequence x i+1 = g(x i ) for i = 0 . . . ∞ is constant and convergent to x * x 0 = x 0 .
6.3.4. The Case of f = 0 and t = 0 and p = q This case considers the situation of the network with equal numbers of "good" and "bad" nodes, where the coding is rationally chosen. In a manner similar to the previous case, the actual simulation shows the function "wobbles" around a certain value. For the UOG, this value can be determined from the following analysis.
We have shown previously that for f = 0 and t = 0 and p = q, a fixed point is x* = t+ f 2 ∈ M. However, we have not shown how the sequence (x i ) i=0 . . . ∞ behaves for this case: This sequence can also be defined not recursively: This case of the current concern is f = 0. We have already considered separately the case t = 0, so now we can assume that t = 0. For t, f > 0 we have −t − f < t − f < t + f and t− f t+ f < 1. This means that: Hence for the case f = 0 and t = 0 and p = q: For α i ∈ (0, 1), two cases should be considered (note the assumption that p = q): Combining both cases together, we obtain that for p = q and 0 < x 0 < t the sequence (x i ) i=0 . . . ∞ is always convergent to x * + . It means that for f = 0 and t = 0 and p = q, the sequence ( 6.3.5. The Case of f = 0 and t = 0 and p = q This case describes the network with an unequal number of "good" and "bad" nodes. In reference to Section 6.3.2, this case can also be called a typical one. Note that the fact of convergence does not depend on the choice of a coding scheme. To prove the convergence of the sequence (x i ) i=0 . . . ∞ for f = 0 and t = 0 and p = q, it is enough to show that the sequence (x i ) i=0 . . . ∞ is a Cauchy sequence (because M is a complete metric space).
First, we calculate (g(x)): Let us estimate a distance between x i+2 and x i+1 according to the distance between x i+1 and x i : It is obvious for p > q, while for p < q, it results from the inequality: It is necessary at this point to break down the analysis into four more specific subcases, provided below as Sections 6.3.6-6.3.9. It is because the way the convergence occurs depends on both the coding scheme as well as on the relative number of "good" and "bad" nodes.
6.3.6. The Case of t < f and p > q This is the case of the ill-chosen (yet possible) coding, where "good" is indicated by the lower value than "bad". Further, the network has more "good" nodes than "bad" ones.
For p > q (and x i ≥ 0, p ≥ 0, q ≥ 0, t > 0): If t < f (and p + q > 0, t > 0) then It means that for p > q and t < f, the sequence (x i ) i=0 . . . ∞ is a Cauchy sequence in the interval M, i.e., |x i+2 − x i+1 | < k + |x i+1 − x i | for i = 0 . . . ∞ and some k + < 1, and it is convergent. 6.3.7. The Case of t < f and p < q This is the case of the ill-chosen (yet possible) coding, where "good" is indicated by the lower value than "bad". Further, the network has more "bad" nodes than "good" ones. This situation may be hard for the outcome of the algorithm (as the excess of "bad" nodes may not allow for the correct identification of the quality of nodes), but it is important that the convergence still occurs.
For p < q (and x i ≤ t + f, p ≥ 0, q ≥ 0, t > 0) we have: If t < f (and p + q > 0, t > 0), then It means that for p < q and t < f the sequence ( . . ∞ and some k − < 1, and it is convergent.
6.3.8. The Case of t > f and p > q This is the case of the coding that may be considered a rational one, where "good" is indicated by a higher value than "bad". Further, the network has more "good" nodes than "bad" ones. In a way, this is a typical and the desired situation.
We still have to consider case t > f and p = q. Unfortunately, it is a bit more complicated and has to be split again into two cases, for p > q and p < q.
For p > q and t > f, the fixed point is x * > t+ f 2 . From the obvious fact that for t > f : it is easy to show that For p > q and t > f the function h(x) = g(x) − x is a concave function in the interval M. Indeed, its second-degree derivative is equal to g"(x) and negative in this interval: Now assuming t > f, we can write for x i < t+ f 2 : If t > f and x i < 1 2 (t + f ), then It means that for p < q and t > f, the sequence ( . . ∞ and some k ∓ < 1, and it is convergent. To recapitulate, the paper shows that for f = 0 and t = 0, the sequence (x i ) i=0 . . . ∞ starting from any x 0 ∈ M is convergent to a single fixed point in M, but for f = 0 or t = 0, it is not true. For t = 0, the sequence (x i ) i=0 . . . ∞ generally oscillates around a single fixed point and is convergent only when it is constant and starts exactly from the fixed point. For f = 0 and p = q, the sequence (x i ) i=0 . . . ∞ is always convergent to one of the specific ends of the interval M, while the other end is also a fixed point but only reachable by the constant sequence starting exactly from this point. For f = 0 and p = q, every point of the interval M is a fixed point, and every sequence (x i ) i=0 . . . ∞ starting from any x 0 ∈ M is always constant and converges to this point.
If the starting point x 0 lies outside the interval M (but is greater than zero), its first iteration x 1 will fall into the interval M, so the above conclusions are also valid for x 0 ≥ 0. Identical conclusions also apply to the sequence (y i ) i=0 . . . ∞ .

Discussion
It is of special interest to wireless multi-hop IoT networks to see whether the process of convergence can be negatively affected by the dynamics of the transport layer. Specifically, phenomena such as delays and repetitions of opinions, as well as the disappearance of nodes, are of certain concern.
The convergence itself seems to be resilient to the majority of such negative cases. Neither the algorithm nor its convergence makes any assumption about the timeliness or order of appearance of opinions. It also makes no assumption about the continuity of the existence of nodes so that it is resilient to the appearance and disappearance of nodes. The eventuality of convergence implies that delays in the delivery of opinions should make no impact on the process of convergence, barring the decrease in the speed of this process.
The algorithm itself relies on benevolent nodes having stable identities and sharing the approximately correct clock. It shares those assumptions with several reputation-based schemes. Consequently, attacks on identity may have an impact on the calculation of reputation. The assurance regarding the identity can be achieved, e.g., by using cryptography (see, e.g., the work of [30]). Note, however, that those attacks should not have an impact on the convergence itself, only on the value the algorithm converges to.

Conclusions
This paper presents the analysis and the proof of eventual convergence for the EWMA algorithm, as used in IoT sensor networks. Such an algorithm can be used in over-provisioned ("dense") sensor networks to decrease the uncertainty of measurements reported by the networks, even if low-cost sensors are used, and no reference nodes are present. The novelty of this paper lies in the demonstration of the proof of the convergence of the EWMA algorithm, as it can be used in IoT sensor networks. The convergence of the EWMA algorithm has been studied before, but those results are not directly applicable to the way this algorithm can be used in IoT sensor networks. For uses cases similar to the IoT networks, the convergence is usually assumed and demonstrated through the simulation. The demonstration of the mathematical proof means that the algorithm can be safely used in situations where the assurance of convergence is required.
The paper starts by describing the EWMA algorithm in a way applicable to IoT sensor networks. Then the UOG is introduced as a model of random graphs that well represents IoT sensor networks while allowing for formalization. It is the formalization provided by the UOG that bridges the application and the mathematics of the EWMA. The preliminary analysis of the convergence of the EWMA for the UOG is then conducted. From there, the mathematical proof follows. It demonstrates that, apart from some inapplicable cases, the algorithm assures eventual convergence.
The EWMA algorithm, as described in this paper, does not rely on any particular configuration of the transport layer. The sensitivity of the convergence to the variability of the IoT network is currently being studied. It is already visible that the eventuality of the convergence makes it resilient to negative aspects of the dynamics of wireless multi-hop networks, such as delays, repetitions, disappearance, and non-delivery. The suggested implementation does not require a significant increase in the computing power of the nodes, and its impact on the required bandwidth can be contained as well. Models such as the work of [31] can be used to further optimize the energy consumption, if required.
The algorithm assumes that all the nodes are benevolent, even though some of them may be faulty or of lower quality. The behavior of the algorithm suggests that in case of an adversary attack where, e.g., malicious nodes are added to the network or benevolent ones became malicious, the algorithm may still deliver convergence, but it may not converge on the correct vector of values. The behavior of the algorithm in such situations is currently being studied.