# Evidential Cyber Threat Hunting

Frederico Araujo Dhilung Kirat Xiaokui Shu Teryl Taylor Jiyong Jang
IBM Research, Yorktown Heights, NY, USA

###### Abstract

A formal cyber reasoning framework for automating the threat hunting process
is described. The new cyber reasoning methodology introduces an operational
semantics that operates over three subspaces—knowledge, hypothesis, and
action—to enable human-machine co-creation of threat hypotheses and protective
recommendations. An implementation of this framework shows that the approach
is practical and can be used to generalize evidence-based multi-criteria
threat investigations.

##  1 Introduction

Traditional attack detection and defense mechanisms often operate as separate,
loosely-connected activities in threat hunting and mitigation contexts. When a
suspicious event is detected in the monitoring data, the conventional course
of action is to generate an intrusion alert in order to notify a security
analyst about a potential threat. In response to the incident, the analyst
correlates the alert to different sources of intelligence (both internal and
external to the organization) to determine an appropriate mitigation strategy
to counter the threat. The outcome is the execution of one or more defensive
actions, such as blacklisting a remote DNS domain, patching a software
vulnerability, or isolating potentially affected assets for further
investigation.

This semi-manual process is onerous and requires that cyber combatants connect
spatially and temporally scattered security alerts in order to comprehend
threat scenarios, assess the impact of an attack, and defend against it.
Figure 1(a) illustrates this concept. In this model, threat detectors are
_partial functions_ mapping collected _data_ (e.g., network packets, system
traces, logs) to security _alerts_ , and detection responses are denoted by
the hyperplane relating alerts to _defenses_ —the protective measures
available to the defendant. Such a reactive approach is insufficient for
effective threat hunting because (a) it fails to capture the high-dimensional
features of advanced attacks (local, global, and offense contexts), yielding
too many false positives, (b) it imposes a _cognitive overload_ [14] on
security analysts, and (c) it misses the larger attack campaign, because
defensive actions respond to single, out-of-context events, therefore
promoting a “whack-a-mole” threat detection methodology.

Recent automated approaches employ provenance tracking to discover causality
between alerts [8], prune search trees [9, 7] and link low-level data to
domain knowledge [16, 10]. However, while useful in combating threat alert
fatigue, these approaches lack support for iterative reasoning, and do not
offer a framework for integrating data from various telemetry and intelligence
sources, and making explainable decisions from such data.

To better characterize the dynamics of advanced cyber threats, this paper
formalizes a cyber reasoning framework based on _multi-functors_ that define
structure-preserving mappings (a.k.a. morphisms) on threat knowledge,
hypothesis, and action subspaces. Unlike the _first-order_ threat detection
and response capabilities of traditional cyber security models, such decision
_manifolds_ , depicted in Figure 1(b), connect cyber-hunting operations in a
high-dimensional space—where each subspace comprises many dimensions—thus
coping with the cognitive overload problem (by enriching sensor data with
threat information that can be used to automatically reject or accept threat
hypotheses) and adversarial targeting (by embedding attack models into the
decision space).

Our framework introduces three high-dimensional subspaces, which shape
decision boundaries and augment the threat hunting process with contextual
information, evidence-based reasoning, and a defense capability model.

(a)

(b)

Figure 1: Illustration of (a) traditional first-order functions in threat
detection and response, and (b) high-dimensional decision manifolds in cyber
threat hunting.

Knowledge Subspace defines the scope of what is _known_ about the _internal_
and _external_ environments. Internal knowledge includes monitoring events
(e.g., firewall and system logs, network packets and flows, system traces),
network and assets information (e.g., sensors, services, version,
configuration), and internal threat information (e.g., vulnerability
assessment reports, verified threats). External knowledge includes threat
intelligence [15] (e.g., security feeds, threat reports, malicious domains)
and security analytics information (e.g., security knowledge graphs, file
reputation and analysis services).

Hypothesis Subspace defines the domains of _detection hypotheses_ and _threat
hypotheses_. A detection hypothesis defines an attack proposition (e.g.,
“host${}_{\textnormal{A}}$ is vulnerable to reflected server XSS”,
“host${}_{\textnormal{B}}$ and client${}_{\textnormal{X}}$ beacon every two
hours”), which can be substantiated by the type of detection analysis
employed—encoding a notion of detection precision, or confidence level in the
hypothesis. A threat hypothesis embeds the higher-level reasoning performed by
threat hunters, serving as cognitive glue and trigger for the next step of the
hunting process. Examples of threat hypotheses include propositions about
threat type (e.g., “downloaded binary in client${}_{\textnormal{Y}}$ is
trojan${}_{\textnormal{Z}}$”, “beaconing behavior between
host${}_{\textnormal{B}}$ and client${}_{\textnormal{X}}$ is part of a C&C
protocol”) and impact assessment (e.g., “clients who accessed
host${}_{\textnormal{B}}$’s web server have been infected with
trojan${}_{\textnormal{Z}}$”, “trojan${}_{\textnormal{Z}}$ has spread
laterally in the network”).

Action Subspace encodes the space of _defense mechanisms_ and _protective
measures_ available to cyber defendants. Examples of defense mechanisms
include proactive monitoring (e.g., update a sensor’s policy), blocking (e.g.,
updating firewall rules), statically analysing deployed software for malware
and vulnerabilities [11], sandboxing [13, 12], and deploying deceptive
responses across the software stack [3, 19, 21]. Protective measures include
disseminating detection models and policies across endpoints, and sharing
hunting outcomes with partner organizations.

To reduce the impact of false positives, our framework enriches this decision
model with threat intelligence and domain-specific information to weed out
legitimate behaviors and identify new attack patterns. Upon verification, each
malicious hypothesis elicits a protective measure harnessed from the action
subspace. Our implementation shows that this model is practical and can
automate hypothesis generation for threat hunting tasks.

##  2 Cyber Threat Hunting Model

Our cyber threat hunting model (CTHM) conceptualizes threat detection,
analysis, and response as first-class components of the threat hunting
process. In this model, a _hunt_ is the tuple
$(K,\mathcal{H},\Delta,\Phi,\Psi,\Gamma,\mathcal{A})$, where:

  * •

$K=\Sigma\cup\mathcal{I}$ is a set comprising _internal data_ $\Sigma$,
sourced from monitoring and asset management infrastructures, and
_intelligence_ data $\mathcal{I}$, sourced from _external threat intelligence_
, _domain knowledge_ , or derived from hypotheses _verified_ during the threat
hunting process.

  * •

$\mathcal{H}=\mathcal{H_{D}}\cup\mathcal{H_{T}}$ is a set comprising detection
($\mathcal{H_{D}}$) and threat ($\mathcal{H_{T}}$) hypotheses. A hypothesis
$h\in\mathcal{H}$ can optionally define a confidence level, which can be
derived from a detection event or predefined by the the threat analysis.

  * •

$\Delta$ is a set of _detectors_ , comprising threat detection analyses,
$\delta\in\Delta,\delta:K\rightharpoonup\mathcal{H_{D}}$

  * •

$\Phi$ is a set of _case manifolds_ , or hypothesis generators,
$\phi\in\Phi,\phi:\mathcal{H_{D}}\times K\rightharpoonup\mathcal{H_{T}}$

  * •

$\Psi$ is a set of _decision manifolds_ , $\psi\in\Psi,\psi:\mathcal{H}\times
K\rightharpoonup\mathcal{A}$, where $\mathcal{A}$ denotes the _action
subspace_ of $\psi$.

  * •

$\Gamma$ is a set of _hypothesis verifiers_ accepting or rejecting hypotheses,
$\gamma\in\Gamma,\gamma:\mathcal{H}\times K\rightharpoonup\mathcal{I}$

A _case graph_ $\mathcal{G}$ stores the state of a hunt, including the history
of executed hunting steps and the outcomes produced during the execution of a
hunt. Hunts and case graphs are two central concepts in our threat hunting
model, analogous to programs and computation in traditional programming
languages. Similarly, knowledge and hypotheses compare to abstract data types.

A vector-valued objective _cost function_
$\mathcal{C}:\mathcal{A}\rightarrow\mathbb{R}^{k}$,
$\mathcal{C}(a)=(\mathcal{C}_{1}(a),\cdots,\mathcal{C}_{k}(a))$ maintains the
cost values associated with the execution of each protective action
$a\in\mathcal{A}$, where $k\geq 1$ is the number of cost estimators, which can
be derived from context-specific proxies (e.g., financial losses, liability
risks) or computed as intrinsic functions of the action (e.g., employed
resources, analysis time). Since $\mathcal{C}$ depends on the environment and
can change during the course of a hunt, we write
$\mathcal{G}{[\\![\mathcal{C}]\\!]}$ to denote the cost function associated
with a given hunt state. This choice of design for $\mathcal{C}$ explicitly
models cost as a _situation-specific_ and _user-specific_ concept, and enables
the application of _normative_ (i.e., prescriptive) theories to drive
hypothesis generation in threat hunting scenarios.

Manifold Selection. CTHM enforces that its different analysis components
(detectors, manifolds, and verifiers) operate on well-defined abstractions
(knowledge, hypotheses, actions) and interfaces. This ensures that hunts are
always _consistent_ by construction—the model doesn’t allow type mismatches.
The choice of candidate manifolds and actions to be executed therefore reduces
to the predefined semantics of each component, which may involve weighting
uncertainty, costs estimations, and context associated with the state of the
hunt.

Figure 2: Attack scenario

Attack Scenario. Figure 2 depicts an attack campaign, which comprises malware
distribution servers and C&C endpoints ( 0). The targeted attack starts with
delivering a malicious web link via a spear phishing tactic ( 1). When the
victim is tricked to follow the web link ( 2), the attacker’s malicious web
server exploits the browser’s vulnerability to install malware ( 3). Once the
malware infects the user’s device, it establishes a communication channel with
a C&C server using DGAs and/or fast-fluxing techniques ( 4). The malware moves
laterally to other devices to locate critical assets in the company network
(e.g., by leveraging a zero-day exploit ( 5). The malware also beacons to a
C&C server to report its presence and receive further instructions ( 6), and
conducts internal reconnaissance to identify and gain access to critical
assets (e.g., code repositories) using stolen credentials ( 7). Finally, the
malware exfiltrates sensitive information to an attacker-controlled remote
server ( 8).

##  3 Evidential Threat Hunting Semantics

To illustrate these concepts, let
$(K,\mathcal{H},\Delta,\Phi,\Psi,\Gamma,\mathcal{A})^{(0)}$ be the initial
_hunt state_ of the threat hunting scenario depicted in Figure 3. This example
describes an attack campaign where an adversary has successfully compromised a
small network of 10 client endpoints with a customized variant of Zeus [1].
Both network and endpoints are monitored for HTTP/S flows and system logs.
Protective actions available to defenders include quarantining compromised
endpoints to impede threat propagation across the network, containing and
monitoring suspicious processes into a transparent sandbox, misdirecting
attackers to decoys, actively seeking and hardening vulnerable targets in the
network, and sharing threat information with partner organizations.

$\displaystyle\textit{Internal\quad}\Sigma$
$\displaystyle=\\{endpoints:\\{\textnormal{clients${}_{1-10}$}\\},$
$\displaystyle monitoring:\\{\textnormal{{HTTP\raise
1.2pt\hbox{\scriptsize/}S}~{}records, syslogs}\\}\\}$
$\displaystyle\textit{Intelligence\quad}\mathcal{I}$
$\displaystyle=\\{{c{\textnormal{\sf\&}}c}:\\{{1.2.3.4}\\},$ $\displaystyle
malware:\\{(\textnormal{zeus},\textnormal{014e7...7bbb})\\}\\}$
$\displaystyle\textit{Hypotheses\quad}\mathcal{H}$ $\displaystyle=\bot$
$\displaystyle\textit{Detectors\quad}\Delta$
$\displaystyle=\\{\delta_{beacon}:~{}\textnormal{{HTTP\raise
1.2pt\hbox{\scriptsize/}S}}\rightharpoonup\mathcal{H_{D}}^{beacon}\\}$
$\displaystyle\textit{Cases\quad}\Phi$
$\displaystyle=\\{\phi_{KGE}:~{}\mathcal{H_{D}}^{beacon}\times
K\rightharpoonup\mathcal{H_{T}}^{{c{\textnormal{\tiny\sf\&}}c},malware},$
$\displaystyle\hskip 13.29997pt\phi_{impact}:~{}\underline{\hskip
7.00002pt}\times
K\rightharpoonup\mathcal{H_{T}}^{{c{\textnormal{\tiny\sf\&}}c},malware}\\}$
$\displaystyle\textit{Decisions\quad}\Psi$
$\displaystyle=\\{\psi_{{c{\textnormal{\tiny\sf\&}}c}}:~{}\mathcal{H_{T}}^{{c{\textnormal{\tiny\sf\&}}c}}\times
K\rightharpoonup\mathcal{A},$ $\displaystyle\hskip
13.29997pt\psi_{malware}:~{}\mathcal{H_{T}}^{malware}\times
K\rightharpoonup\mathcal{A}\\}$ $\displaystyle\textit{Verifiers\quad}\Gamma$
$\displaystyle=\\{\gamma_{forensics}:~{}\mathcal{H_{T}}^{malware}\times
K\rightharpoonup$ $\displaystyle\hskip
70.00015pt\\{\mathcal{H_{T}}^{malware}_{accepted},\mathcal{H_{T}}^{malware}_{rejected}\\},$
$\displaystyle\hskip
13.29997pt\gamma_{analytics}:~{}\mathcal{H_{T}}^{{c{\textnormal{\tiny\sf\&}}c}}\times
K\rightharpoonup$ $\displaystyle\hskip
70.00015pt\\{\mathcal{H_{T}}^{{c{\textnormal{\tiny\sf\&}}c}}_{accepted},\mathcal{H_{T}}^{{c{\textnormal{\tiny\sf\&}}c}}_{rejected}\\}$
$\displaystyle Actions\quad\mathcal{A}$ $\displaystyle=\\{\textsc{quarantine,
contain, misdirect, fortify, share}\\}$ Figure 3: An initial hunt state for a
threat hunting scenario

Case Fragment 1: From beaconing to malware detection

The hunt begins when $\delta_{beacon}$ observes beaconing behavior between
remote host 1.2.3.4 and client1, resulting in a new detection hypothesis (step
0– 1).

$(K,\mathcal{H},\Delta,\Phi,\Psi,\Gamma,\mathcal{A})^{(0)}{\mathrel{\xrightarrow[]{\delta_{beacon}}}_{\mathrm{1}}}\\\
(K,\mathcal{H}^{\textit{\tiny{i}}}\mapsto\mathcal{H}::{beacon({1.2.3.4},\textnormal{client}_{1})},\Delta,\Phi,\Psi,\Gamma,\mathcal{A})^{(1)}$

A case manifold $\phi_{KGE}$ explores a cognitive knowledge graph to generate
two threat hypotheses, which predicate that (a) host 1.2.3.4 is a C&C server
(step 1– 2), and that (2) client1 is infected with Zeus (step 2– 3).

$(K,\mathcal{H}^{\textit{\tiny{i}}},\Delta,\Phi,\Psi,\Gamma,\mathcal{A})^{(1)}{\mathrel{\xrightarrow[]{\phi_{KGE}}}_{\mathrm{1}}}\\\
(K,\mathcal{H}^{\textit{\tiny{ii}}}\mapsto\mathcal{H}^{\textit{\tiny{i}}}::{{c{\textnormal{\tiny\sf\&}}c}({1.2.3.4})},\Delta,\Phi,\Psi,\Gamma,\mathcal{A})^{(2)}$

$\hskip 92.70018pt{\mathrel{\xrightarrow[]{\phi_{KGE}}}_{\mathrm{1}}}\\\
(K,\mathcal{H}^{\textit{\tiny{iii}}}\mapsto\mathcal{H}^{\textit{\tiny{ii}}}::{infected(\textnormal{client}_{1},\textnormal{zeus})},\Delta,\Phi,\Psi,\Gamma,\mathcal{A})^{(3)}$

To verify these hypotheses, the threat hunter leverages an automated security
analytics tool $\gamma_{analytics}$ (e.g., a Security Knowledge Graph) to
assert that 1.2.3.4 indeed belongs to a known C&C server (step 3– 4).
Meanwhile, an endpoint forensics analysis $\gamma_{forensics}$ reveals that
client1 has been infected by a specific self-propagating variant of Zeus (step
4– 5). The analyst accepts these threat hypotheses, which become new
knowledge.

$(\cdots)^{(3)}{\mathrel{\xrightarrow[]{\gamma_{analytics}}}_{\mathrm{1}}}(K^{\textit{\tiny{i}}}\mapsto
K::{{c{\textnormal{\tiny\sf\&}}c}({1.2.3.4})},\\\
\mathcal{H}^{\textit{\tiny{iv}}}\mapsto\mathcal{H}^{\textit{\tiny{iii}}}/{{c{\textnormal{\tiny\sf\&}}c}({1.2.3.4})},\cdots)^{(4)}$

$\hskip
28.80002pt{\mathrel{\xrightarrow[]{\gamma_{forensics}}}_{\mathrm{1}}}(K^{\textit{\tiny{ii}}}\mapsto
K^{\textit{\tiny{i}}}::{infected(\textnormal{client}_{1},\textnormal{zeus})},\\\
\mathcal{H}^{\textit{\tiny{v}}}\mapsto\mathcal{H}^{\textit{\tiny{iv}}}/{infected(\textnormal{client}_{1},\textnormal{zeus})},\cdots)^{(5)}$

Case Fragment 2: Lateral movement assessment

To assess the scope and impact of this attack campaign, a case manifold
$\phi_{impact}$ hypothesizes whether the trojan spreads itself laterally to
other clients in the network (step 5– 6). Using information acquired in prior
hunts about this specific variant of Zeus, $\phi_{impact}$ gathers a list of
all the clients whose system logs reveal network file system access from
client1 (e.g., SMB), and performs a forensics analysis on each client to
confirm the propagation of the trojan. The outcome of this analysis reveals
that while client2 has been compromised, no evidence of this particular
variant of Zeus was found in client7 (step 6– 7).

$(\cdots)^{(5)}{\mathrel{\xrightarrow[]{\phi_{impact}}}_{\mathrm{1}}}(K^{\textit{\tiny{ii}}},\mathcal{H}^{\textit{\tiny{vi}}}\mapsto\mathcal{H}^{\textit{\tiny{v}}}\cup\\{infected(\textnormal{client}_{2},\textnormal{zeus}),\\\
infected(\textnormal{client}_{7},\textnormal{zeus})\\},\cdots)^{(6)}$

$\hskip
28.80002pt{\mathrel{\xrightarrow[]{\gamma_{forensics}}}_{\mathrm{1}}}(K^{\textit{\tiny{iii}}}\mapsto
K^{\textit{\tiny{ii}}}::{infected(\textnormal{client}_{2},\textnormal{zeus})},\\\
\mathcal{H}^{\textit{\tiny{vii}}}\mapsto\mathcal{H}^{\textit{\tiny{vi}}}/{infected(\textnormal{client}_{7},\textnormal{zeus})},\cdots)^{(7)}$

Table 1: Cost valuations for $\mathcal{G}^{(7)}{[\\![\mathcal{C}]\\!]}$ and action deliberation considerations Type |  Action | $\mathcal{C}_{1}$ | $\mathcal{C}_{2}$ | $\mathcal{C}_{3}$ | $\mathcal{C}_{4}$ | $\mathcal{C}_{5}$ | $\mathcal{C}_{6}$ | Deliberation
---|---|---|---|---|---|---|---|---
threat mitigation |  quarantine | ● | ○ | ○ | ◐ | ○ | ○ | if target is a crown jewel
contain | ○ | ○ | ◐ | ◐ | ◐ | ◐ | if target can’t tolerate downtime
proactive hunting |  misdirect | ○ | ○ | ○ | ● | ○ | ● | if defender is resource-constrained
fortify | ○ | ● | ○ | ○ | ◐ | ◐ | if defender is averse to risk
intelligence |  share | ○ | ◐ | ○ | ○ | ◐ | ○ | to inform partners
key: ○=low ◐=moderate ●=high (values in red represent attacker cost)

Case Fragment 3: Deployment of protective measures

Following this initial assessment, action manifolds subscribing to the new
facts generated in prior hunt steps start a deliberation process to decide on
the next hunt step. In this case, the optimality criteria for the decision
combine threat hunting _goals_ set beforehand by the threat hunter,
_constraints_ imposed by the current hunt state $\mathcal{G}^{(7)}$, and
_cost_ and _risk_ estimations derived from a simple, yet relevant cost model.
For explanatory precision, let
$\mathcal{G}^{(7)}{[\\![\mathcal{C}]\\!]}=(\overline{\mathcal{C}_{1}\cdots\mathcal{C}_{6}})$
denote the cost function associated with the hunt, where:

$\mathcal{C}_{k}:\mathcal{A}\rightarrow{\\{low,moderate,high\\}}$,
$k=1\cdots 6$, and $\left\\{\begin{tabular}[]{@{}l@{}}$\mathcal{C}_{1}:$
system downtime\\\ $\mathcal{C}_{2}:$ allocated resources\\\
$\mathcal{C}_{3}:$ analysis time\\\ $\mathcal{C}_{4}:$ defender risk\\\
$\mathcal{C}_{5}:$ threat intel acquisition\\\ $\mathcal{C}_{6}:$ attacker
risk\\\ \end{tabular}\right\\}$ cost estimators.

Risk is encoded as cost estimations, and attack cost estimations output
negative costs. For simplicity, cost valuation results fall into one of three
categorical values: $low$, $moderate$, or $high$.

Table 1 summarizes $\mathcal{G}^{(7)}{[\\![\mathcal{C}]\\!]}$’s cost
valuations and the manifold deliberation process. Leveraging this analysis,
action manifold $\psi_{malware}$ performs its deliberation over infected
endpoints client1 (a critical asset) and client2 (a crown jewel), resulting in
the three prescriptive actions to the risk-averse threat hunter (step 7– 8).
Finally, $\psi_{{c{\textnormal{\tiny\sf\&}}c}}$ shares the newly uncovered
attack campaign information $\\{{c{\textnormal{\tiny\sf\&}}c}~{}hunt\\}$ with
its organization’s partners (step 8– 9).

$(\cdots)^{(7)}{\mathrel{\xrightarrow[]{\psi_{malware}}}_{\mathrm{1}}}(K^{\textit{\tiny{iii}}},\mathcal{H}^{\textit{\tiny{vii}}},\cdots,\\{\textsc{contain}[client_{1}],\\\
\textsc{quarantine}[client_{2}],\textsc{fortify}[decoy_{1\textnormal{--}25}]\\})^{(8)}$

$\hskip
28.80002pt{\mathrel{\xrightarrow[]{\psi_{{c{\textnormal{\tiny\sf\&}}c}}}}_{\mathrm{1}}}(K^{\textit{\tiny{iii}}},\mathcal{H}^{\textit{\tiny{vii}}},\cdots,\\{\textsc{share}[\hskip
0.90005pt\\{{c{\textnormal{\tiny\sf\&}}c}~{}hunt\\}\hskip
0.90005pt]\\})^{(9)}$

##  4 Implementation

Threat Hunting Description Language. We implemented a domain-specific language
[17] and data model [20] to facilitate the creation and execution of complex
threat hunting flows. This Threat Hunting Description Language (THDL) allows
security analysts to uniformly i) express domain knowledge, ii) retrieve
observations for further threat hypothesis development, iii) verify hypotheses
against the data, and iv) execute decision manifolds (§2). To support sharing
and reuse of hunt flows, the language satisfies the following design goals:

  * •

Composability: larger, more complex hunts with a compounded effects of
decision manifolds can be created by composition of smaller, simpler hunting
steps and decision manifolds.

  * •

Explainability: each hunt step as well as a collection (code block) of steps
are human-understandable and support rich visual representations to facilitate
quick assimilation of hunt workflows by novice threat hunters.

  * •

Partial updatability: the system minimizes re-execution and caches partial
results when parts of the composed hunt flows is changed and needs to be re-
evaluated.

Automated Reasoning. Our framework also implements a language runtime and hunt
execution pipeline that enables efficient and scalable hunt execution through
automated reasoning and case prioritization (§2). Hunts and case graphs form
the basis of a threat hunting computation model that defines _hunt programs_
orchestrated by the framework. For each case initiated by detection hypotheses
$\mathcal{H_{D}}\subseteq\mathcal{H}$, a corresponding hunt program
$(K,\mathcal{H},\Delta,\Phi,\Psi,\Gamma,\mathcal{A})$ is instantiated. The
framework embodies three main components:

  * •

Semantic steps: The execution of the hunt program emits a sequence of
operational steps called _semantic steps_ (§3). A semantic step represents a
unit of reasoning task in a hunt analysis. These steps may involve simple case
manifold executions, such as retrieving additional data from different data
sources, or performing complex analytics or running other existing hunt
programs.

  * •

Semantic reasoning: To reason about the current case graph and properly
prioritize the execution of the next semantic step out of many potential
steps, our implementation performs a signal propagation analysis called
_signal flow_. Signal flow propagates multiple signals in the case graph
representing different semantic meanings, such as relevance and toxicity
(badness). The flow of a signal is influenced by various factors, such as
behavioral, temporal, and veracity aspects, resulting an annotated case graph
with semantically-relevant hunt paths. By combining signal flow with a _cost
and reward_ strategy, our framework produces a dynamic and adaptive sequence
of steps guided by the reasoning semantics.

  * •

Hypothesis generation: The framework distills competing hypotheses, chains
hypotheses from multiple case manifolds, and ranks and summarizes them before
reporting to a human analyst.

Protective Responses. Automated threat responses generated by our workflows
(§3) must not allow any proactive measure to unwittingly be used to attack the
network it is trying to protect. Moreover, such measures must try to identify
all network hosts involved in an attack campaign and quarantine them at once
so that no backdoors remain open for the attacker. To satisfy these
constraints, our framework augments traditional threat responses with
deceptive capabilities to anticipate and foil attempted attacks. These
deceptive responses include dynamically sandboxing or terminating attacker
sessions [5], implementing filesystem separation [6, 19], altering the network
topology [18], and embedding decoys into software applications [3, 2, 4].
Overall, our proactive measures fall into five categories: _containment_
(e.g., sandboxing), _misdirection_ (e.g., deception), _quarantine_ (e.g.,
isolation), _fortification_ (e.g., vulnerability scanning), and _sharing_
(e.g., threat reports).

##  5 Conclusion

This paper conceptualized and outlined the implementation of an evidential
multi-criteria cyber reasoning framework for threat hunting. We are currently
evaluating this framework with diverse attack scenarios and data to optimize
threat hunting workflows in a large security operations center.

## Acknowledgments

The research reported herein was developed with funding from the Defense
Advanced Research Projects Agency (DARPA) under the U.S. ACC-APG/DARPA award
W912CG-19-C-0003. The views, opinions and/or findings expressed are those of
the author and should not be interpreted as representing the official views or
policies of the Department of Defense or the U.S. Government. The U.S.
Government is authorized to reproduce and distribute reprints for Government
purposes notwithstanding any copyright notation hereon. Approved for Public
Release, Distribution Unlimited.

## References

  * [1] Zeus Trojan.  https://www.avast.com/c-zeus/, 2017.  Acces. March 1, 2021.
  * [2] F. Araujo, G. Ayoade, K. Al-Naami, Y. Gao, K. W. Hamlen, and L. Khan.  Improving intrusion detectors by crook-sourcing.  In Procceedings of the 35th Annual Computer Security Applications Conference (ACSAC), pages 245–256, 2019.
  * [3] F. Araujo, K. W. Hamlen, S. Biedermann, and S. Katzenbeisser.  From patches to honey-patches: Lightweight attacker misdirection, deception, and disinformation.  In Proceedings of the ACM SIGSAC Conference on Computer and Communications Security (CCS), 2014.
  * [4] F. Araujo, S. Sengupta, J. Jang, A. Doupé, K. Hamlen, and S. Kambhampati.  Software deception steering through version emulation.  In Proceedings of the 54th Hawaii International Conference on System Sciences, 2021.
  * [5] F. Araujo and T. Taylor.  Improving cybersecurity hygiene through JIT patching.  In ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering, 2020.
  * [6] F. Araujo, T. Taylor, J. Zhang, and M. Stoecklin.  Cross-stack threat sensing for cyber security and resilience.  In Proceedings of the IEEE/IFIP International Conference on Dependable Systems and Networks Workshops (DSN-W), 2018.
  * [7] X. Han, T. Pasquier, A. Bates, J. Mickens, and M. Seltzer.  Unicorn: Runtime provenance-based detector for advanced persistent threats.  In Network and Distributed Systems Security Symposium (NDSS), 2020\.
  * [8] W. U. Hassan, A. Bates, and D. Marino.  Tactical provenance analysis for endpoint detection and response systems.  In IEEE Symposium on Security and Privacy (SP). IEEE, 2020.
  * [9] W. U. Hassan, S. Guo, D. Li, Z. Chen, K. Jee, Z. Li, and A. Bates.  Nodoze: Combatting threat alert fatigue with automated provenance triage.  In Network and Distributed Systems Security Symposium, 2019.
  * [10] M. N. Hossain, S. M. Milajerdi, J. Wang, B. Eshete, R. Gjomemo, R. Sekar, S. Stoller, and V. Venkatakrishnan.  SLEUTH: Real-time attack scenario reconstruction from COTS audit data.  In USENIX Security Symposium, 2017.
  * [11] J. Jang, A. Agrawal, and D. Brumley.  ReDeBug: Finding Unpatched Code Clones in Entire OS Distributions.  In IEEE Symposium on Security and Privacy (SP), 2012.
  * [12] D. Kirat and G. Vigna.  MalGene: Automatic Extraction of Malware Analysis Evasion Signature.  In Proceedings of the ACM SIGSAC Conference on Computer and Communications Security (CCS), 2015.
  * [13] D. Kirat, G. Vigna, and C. Kruegel.  BareCloud: Bare-metal Analysis-based Evasive Malware Detection.  In USENIX Security Symposium, 2014.
  * [14] D. Kirsh.  A few thoughts on cognitive overload.  Intellectica, 1(30):19–51, 2000.
  * [15] V. G. Li, M. Dunn, P. Pearce, D. McCoy, G. M. Voelker, and S. Savage.  Reading the tea leaves: A comparative analysis of threat intelligence.  In USENIX Security Symposium, 2019.
  * [16] S. M. Milajerdi, R. Gjomemo, B. Eshete, R. Sekar, and V. Venkatakrishnan.  Holmes: real-time apt detection through correlation of suspicious information flows.  In IEEE Symposium on Security and Privacy (SP), 2019.
  * [17] X. Shu, F. Araujo, D. L. Schales, M. P. Stoecklin, J. Jang, H. Huang, and J. R. Rao.  Threat intelligence computing.  In ACM SIGSAC Conference on Computer and Communications Security (CCS), 2018.
  * [18] M. P. Stoecklin, J. Zhang, F. Araujo, and T. Taylor.  Dressed up: Baiting attackers through endpoint service projection.  In Proceedings of the ACM International Workshop on Security in Software Defined Networks & Network Function Virtualization (SDN-NFV), 2018\.
  * [19] T. Taylor, F. Araujo, A. Kohlbrenner, and M. P. Stoecklin.  Hidden in plain sight: Filesystem view separation for data integrity and deception.  In Proceedings of the Conference on Detection of Intrusions and Malware, and Vulnerability Assessment (DIMVA), 2018.
  * [20] T. Taylor, F. Araujo, and X. Shu.  Towards an open format for scalable system telemetry.  In Proceedings of the IEEE International Conference on Big Data, 2020.
  * [21] J. Zhang, Z. Gu, J. Jang, D. Kirat, M. P. Stoecklin, X. Shu, and H. Huang.  Scarecrow: Deactivating evasive malware via its own evasive logic.  In Proceedings of the IEEE/IFIP International Conference on Dependable Systems and Networks (DSN), 2020.


# A counterexample on multiple convergence without commutativity

Wen Huang  ,  Song Shao  and  Xiangdong Ye  School of Mathematical Sciences,
University of Science and Technology of China, Hefei, Anhui, 230026, P.R.
China<EMAIL_ADDRESS><EMAIL_ADDRESS><EMAIL_ADDRESS>
###### Abstract.

It is shown that there exist a probability space $(X,\mathcal{X},\mu)$, two
ergodic measure preserving transformations $T,S$ acting on
$(X,\mathcal{X},\mu)$ with $h_{\mu}(X,T)=h_{\mu}(X,S)=0$, and $f,g\in
L^{\infty}(X,\mu)$ such that the limit

$\lim_{N\to\infty}\frac{1}{N}\sum_{n=0}^{N-1}f(T^{n}x)g(S^{n}x)$

does not exist in $L^{2}(X,\mu)$.

###### 2000 Mathematics Subject Classification:

Primary: 37A05; 37A30

This research is supported by National Natural Science Foundation of China
(12371196, 12031019, 12090012, 11971455).

##  1\. Introduction

In the article, the set of integers (resp. natural numbers $\\{1,2,\ldots\\}$)
is denoted by $\mathbb{Z}$ (resp. $\mathbb{N}$). By a measure-preserving
system (m.p.s. for short), we mean a quadruple $(X,\mathcal{X},\mu,T)$, where
$(X,\mathcal{X},\mu)$ is a Lebesgue probability space and $T:X\rightarrow X$
is an invertible measure preserving transformation.

Let $T,S$ be measure preserving transformations acting on a Lebesgue
probability space $(X,\mathcal{X},\mu)$. Then for $f,g\in L^{\infty}(X,\mu)$,
the existence in $L^{2}(X,\mu)$ of the limit

(1.1) $\lim_{N\to\infty}\frac{1}{N}\sum_{n=0}^{N-1}f(T^{n}x)g(S^{n}x)$

was established in the commutative case by Conze and Lesigne [8], and the
extension to any finite number of transformations spanning a nilpotent group
and to polynomial iterates was established by Walsh [16]. When $T,S$ do not
generate a nilpotent group, then (1.1) may not exist [5]. Moreover, if both
$T$ and $S$ have positive entropy, (1.1) may fail to exist [9, Proposition
1.4]. Recently, Frantzikinakis and Host [9] gave the following beautiful
multiple convergence theorem without commutativity.

Theorem F-H. Let $T,S$ be measure preserving transformations acting on a
probability space $(X,\mathcal{X},\mu)$ such that the system
$(X,\mathcal{X},\mu,T)$ has zero entropy. Let also $p\in\mathbb{Z}[t]$ be a
polynomial with $\deg(p)\geq 2$. Then for every $f,g\in L^{\infty}(X,\mu)$,
the limit

(1.2) $\lim_{N\to\infty}\frac{1}{N}\sum_{n=0}^{N-1}f(T^{n}x)g(S^{p(n)}x)$

exists in $L^{2}(X,\mu)$.

It is unknown that whether Theorem F-H holds when one replaces the iterates
$n,p(n)$ by the pair $n,n$ or $n^{2},n^{3}$ or arbitrary polynomials
$p,q\in\mathbb{Z}[t]$ with $p(0)=q(0)=0$ (except the case covered by the above
theorem), see [9, Problem] and the sentence below it. In [13], we showed that
for polynomials $p_{1},p_{2}\in\mathbb{Z}[t]$ with $\deg p_{1},\deg p_{2}\geq
5$ there exist a probability space $(X,\mathcal{X},\mu)$, two ergodic measure
preserving transformations $T,S$ acting on $(X,\mathcal{X},\mu)$ with
$h_{\mu}(X,T)=h_{\mu}(X,S)=0$, and $f,g\in L^{\infty}(X,\mu)$ such that the
limit

$\lim_{N\to\infty}\frac{1}{N}\sum_{n=0}^{N-1}f(T^{p_{1}(n)}x)g(S^{p_{2}(n)}x)$

does not exist in $L^{2}(X,\mu)$. In this paper, we show the case
$p_{1}(n)=p_{2}(n)=n$.

To be precise, the main result of the paper is as follows.

Main Theorem. there exist a probability space $(X,\mathcal{X},\mu)$, two
ergodic measure preserving transformations $T,S$ acting on
$(X,\mathcal{X},\mu)$ with $h_{\mu}(X,T)=h_{\mu}(X,S)=0$, and $f,g\in
L^{\infty}(X,\mu)$ such that the limit

$\lim_{N\to\infty}\frac{1}{N}\sum_{n=0}^{N-1}f(T^{n}x)g(S^{n}x)$

does not exist in $L^{2}(X,\mu)$.

### Remark

Before submitting our result to arxiv, we got to know that Austin also
obtained the counterexample in [4]. Exchanging opinions, we think that it is
better to make it separately, as the ideas in the two papers are essentially
different,

##  2\. Proof of the main result

###  2.1. Discrepancy skew product

For a topological space $X$, we use $\mathcal{B}(X)$ denote the
$\sigma$-algebra generated by all open subsets of $X$.

Let $\mathbb{T}=\mathbb{R}/\mathbb{Z}\cong[0,1)$ denote the additive circle.
Consider the function $\varphi:\mathbb{T}\rightarrow\\{-1,1\\}$ defined by

$\varphi(\theta)=2\cdot
1_{[0,\frac{1}{2})}(\theta)-1=\left\\{\begin{array}[]{ll}1,&\hbox{$\theta\in[0,\frac{1}{2})$;}\\\
-1,&\hbox{$\theta\in[\frac{1}{2},1)$.}\end{array}\right.$

Let the skew products
$T_{\alpha}:\mathbb{T}\times\mathbb{Z}\rightarrow\mathbb{T}\times\mathbb{Z}$
be defined for $\alpha\not\in\mathbb{Q}$ by

$T_{\alpha}(\theta,v)=(\theta+\alpha,v+\varphi(\theta)).$

They are measure preserving transformations of the $\sigma$-finite measure
space
$(\mathbb{T}\times\mathbb{Z},\mathcal{B}(\mathbb{T}\times\mathbb{Z}),m_{\mathbb{T}}\times\\#)$,
where $m_{\mathbb{T}}$ is the Lebesgue measure on $\mathbb{T}$ and $\\#$ is
counting measure on $\mathbb{Z}$.

We have that for $n\in\mathbb{N}$,
$T^{n}_{\alpha}(\theta,v)=(\theta+n\alpha,v+\varphi_{n}(\theta))$ where

$\varphi_{n}(\theta)=\sum_{k=0}^{n-1}\varphi(\theta+k\alpha).$

We call the function $(n,\theta)\mapsto\varphi_{n}(\theta)$ the discrepancy
cocycle and $T_{\alpha}$ the discrepancy skew product [2] (it is called
deterministic random walk in [1]).

Ergodicity of the discrepancy skew product $T_{\alpha}$ was established in
[7]. For each $n\in\mathbb{N}$, define
$\Psi_{n}:\mathbb{T}\rightarrow\mathbb{N}$ by

(2.1)
$\Psi_{n}(\theta)=\sum_{k=0}^{n-1}1_{\mathbb{T}\times\\{0\\}}\Big{(}T^{k}_{\alpha}(\theta,0)\Big{)}=\\#\\{0\leq
k\leq n-1:\varphi_{k}(\theta)=0\\}.$

The ergodicity of $T_{\alpha}$ tells us that

(2.2) $\Psi_{n}(\theta)\rightarrow\infty,\
a.e.\quad\text{and}\quad\frac{\Psi_{n}(\theta)}{n}\rightarrow 0,\ a.e.,\
n\to\infty.$

We call $\alpha\not\in\mathbb{Q}$ badly approximable if
$\inf\\{q^{2}|\alpha-\frac{p}{q}|:q\in\mathbb{N},p\in\mathbb{Z}\\}>0$. For
$a,b>0,M>1$, $a=M^{\pm 1}b$ means $\frac{1}{M}\leq\frac{a}{b}\leq M$.

######  Theorem 2.1.

[2] If $\alpha$ is badly approximable, then there is some $M>1$ such that

(2.3) $\|\Psi_{n}\|_{L^{\infty}(\mathbb{T},m_{\mathbb{T}})}\leq
M\int_{\mathbb{T}}\Psi_{n}(\theta)dm_{\mathbb{T}}(\theta),\quad\text{and}\quad\int_{\mathbb{T}}\Psi_{n}(\theta)dm_{\mathbb{T}}(\theta)=M^{\pm
1}\frac{n}{\sqrt{\log{n}}}.$

In the case $\alpha\not\in\mathbb{Q}$ is quadratic, the result was established
in [1].

###  2.2. The ratio ergodic theorem

The ratio ergodic theorems, which are generalizations of Birkhoff’s ergodic
theorem, were given by Hopf and Stepanov for infinite measure preserving
transformations [12, 15], Hurewicz for non-singular transformations[14], and
Chacon and Ornstein for operators [6]. Hochman studied the ratio ergodic
theorem for group actions in [10, 11].

######  Theorem 2.2 (Hopf-Stepanov ergodic Theorem).

[12, 15] Let $T$ be a conservative, measure preserving transformation of a
$\sigma$-finite measure space $(X,\mathcal{X},\mu)$. If $f$ and $g$ are
functions in $L^{1}$ and $g$ is nonnegative, then the limit

$\lim_{n\to\infty}\frac{\sum_{k=0}^{n-1}T^{k}f}{\sum_{k=0}^{n-1}T^{k}g}$

exists and is finite almost everywhere on the set $\\{x\in
X:\sum_{k=0}^{\infty}T^{k}g(x)>0\\}$.

When $T$ is ergodic and $\int_{X}gd\mu\neq 0$,
$\displaystyle\lim_{n\to\infty}\frac{\sum_{k=0}^{n-1}T^{k}f}{\sum_{k=0}^{n-1}T^{k}g}=\frac{\int_{X}fd\mu}{\int_{X}gd\mu}$.

For any $n\in\mathbb{N},v\in\mathbb{Z}$, define
$\Psi_{n}^{(v)}:\mathbb{T}\rightarrow\mathbb{N}$ by

(2.4)
$\Psi_{n}^{(v)}(\theta)=\sum_{k=0}^{n-1}1_{\mathbb{T}\times\\{v\\}}\Big{(}T^{k}_{\alpha}(\theta,0)\Big{)}=\\#\\{0\leq
k\leq n-1:\varphi_{k}(\theta)=v\\}.$

Note that $\Psi_{n}^{(0)}=\Psi_{n}$.

In the sequel we fix a badly approximable $\alpha\not\in\mathbb{Q}$. Since
$(\mathbb{T}\times\mathbb{Z},\mathcal{B}(\mathbb{T}\times\mathbb{Z}),m_{\mathbb{T}}\times\\#,T_{\alpha})$
is ergodic, by Hopf-Stepanov ergodic Theorem for each $v\in\mathbb{Z}$ we have

(2.5)
$\frac{\Psi^{(v)}_{n}(\theta)}{\Psi_{n}(\theta)}=\frac{\sum_{k=0}^{n-1}1_{\mathbb{T}\times\\{v\\}}\Big{(}T^{k}_{\alpha}(\theta,0)\Big{)}}{\sum_{k=0}^{n-1}1_{\mathbb{T}\times\\{0\\}}\Big{(}T^{k}_{\alpha}(\theta,0)\Big{)}}\longrightarrow\frac{\int_{\mathbb{T}\times\mathbb{Z}}1_{\mathbb{T}\times\\{v\\}}dm_{\mathbb{T}}\times\\#}{\int_{\mathbb{T}\times\mathbb{Z}}1_{\mathbb{T}\times\\{0\\}}dm_{\mathbb{T}}\times\\#}=1,n\to\infty,$

for $m_{\mathbb{T}}$-a.e. $\theta\in\mathbb{T}$. By Egoroff’s Theorem, for
every $\epsilon_{v}>0$, there exists $B_{v}\in\mathcal{B}(\mathbb{T})$ such
that $m_{\mathbb{T}}(\mathbb{T}\setminus B_{v})<\epsilon_{v}$ and
$\frac{\Psi^{(v)}_{n}(\theta)}{\Psi_{n}(\theta)}\to 1$ uniformly on $B_{v}$.
In particular, there is some $N_{v}\in\mathbb{N}$ such that
$|\Psi^{(v)}_{n}(\theta)/\Psi_{n}(\theta)-1|<1$ for all $n\geq N_{v}$ and
$\theta\in B_{v}$. Thus $\Psi^{(v)}_{n}(\theta)<2\Psi_{n}(\theta)$ for all
$n\geq N_{v}$ and $\theta\in B_{v}$. By Theorem 2.1, there is some $M_{0}>1$
such that $\Psi_{n}(\theta)\leq M_{0}\frac{n}{\sqrt{\log{n}}}$ for all
$n\in\mathbb{N}$ and $m_{\mathbb{T}}$-a.e. $\theta\in\mathbb{T}$. It follows
that $\Psi^{(v)}_{n}(\theta)<2\Psi_{n}(\theta)\leq
2M_{0}\frac{n}{\sqrt{\log{n}}}$ for all $n\geq N_{v}$ and
$m_{\mathbb{T}}$-a.e. $\theta\in B_{v}$. Without loss of generality, we assume
that $\Psi^{(v)}_{n}(\theta)<2M_{0}\frac{n}{\sqrt{\log{n}}}$ for all $n\geq
N_{v}$ and for all $\theta\in B_{v}$. Choose an $M_{v}>1$ such that
$\Psi^{(v)}_{n}(\theta)\leq M_{v}\frac{n}{\sqrt{\log{n}}}$ for all
$n\in\mathbb{N}$ and for all $\theta\in B_{v}$.

To sum up, we have:

######  Lemma 2.3.

Let $\alpha\not\in\mathbb{Q}$ be badly approximable and $v\in\mathbb{Z}$. For
any $\epsilon_{v}>0$, there is some $B_{v}\in\mathcal{B}(\mathbb{T})$ with
$m_{\mathbb{T}}(\mathbb{T}\setminus B_{v})<\epsilon_{v}$ and $M_{v}>1$ such
that

(2.6) $\Psi^{(v)}_{n}(\theta)\leq M_{v}\frac{n}{\sqrt{\log{n}}},\ \text{for
all}\ n\in\mathbb{N},\theta\in B_{v}.$

###  2.3. Construction of the m.p.s. $(X,\mathcal{X},\mu,T)$

#### 2.3.1.

Let $\mathbb{T}=\mathbb{R}/\mathbb{Z}$ be the circle. Let
$(\mathbb{T},\mathcal{B}(\mathbb{T}),m_{\mathbb{T}},R_{\alpha})$ be the circle
rotation by an irrational number $\alpha$, where $m_{\mathbb{T}}$ is the
Lebesgue measure on $\mathbb{T}$ and

$R_{\alpha}:\mathbb{T}\rightarrow\mathbb{T},\
\theta\mapsto\theta+\alpha\pmod{1}.$

Let $\Sigma=\\{-1,1\\}^{\mathbb{Z}}$, and
$\big{(}\Sigma,\mathcal{B}(\Sigma),\nu,\sigma\big{)}$ be the
$(\frac{1}{2},\frac{1}{2})$-shift. That is,
$\nu=(\frac{1}{2}\delta_{-1}+\frac{1}{2}\delta_{1})^{\mathbb{Z}}$ is the
product measure on $\Sigma=\\{-1,1\\}^{\mathbb{Z}}$ and for each sequence
$\omega\in\Sigma$,

$(\sigma\omega)(n)=\omega(n+1),\quad\forall n\in\mathbb{Z}.$

Now let
$(X,\mathcal{X},\mu)=(\mathbb{T}\times\Sigma,\mathcal{B}(\mathbb{T}\times\Sigma),m_{\mathbb{T}}\times\nu)$,
and define

(2.7)
$T:\mathbb{T}\times\Sigma\rightarrow\mathbb{T}\times\Sigma,\quad(\theta,\omega)\mapsto(\theta+\alpha,\sigma^{\varphi(y)}\omega).$

Since $\varphi:\mathbb{T}\rightarrow\mathbb{Z}$ is measurable, it is easy to
verify that $(X,\mathcal{X},\mu,T)$ is a m.p.s. It is easy to verify that for
all $n\geq 1$ and $(\theta,\omega)\in X$, we have

(2.8)
$T^{n}(\theta,\omega)=(R_{\alpha}^{n}(\theta),\sigma^{\varphi_{n}(y)}\omega)=(\theta+n\alpha,\sigma^{\varphi_{n}(\theta)}\omega).$

#### 2.3.2.

For $a,b\in\mathbb{Z}$ with $a\leq b$ and
$(s_{1},s_{2},\ldots,s_{b-a+1})\in\\{-1,1\\}^{b-a+1}$, let

(2.9)
$_{a}[s_{1},s_{2},\ldots,s_{b-a+1}]_{b}:=\\{\omega\in\Sigma:\omega(a)=s_{1},\ldots,\omega(b)=s_{b-a+1}\\}.$

And for $i\in\\{-1,1\\}$, $j\in\mathbb{Z}$ let

$[i]_{j}:={{}_{j}[i]_{j}}=\\{\omega\in\Sigma:\omega(j)=i\\}.$

#### 2.3.3.

The fact that $(X,\mathcal{X},\mu,T)$ is ergodic and has zero entropy should
be well known. Since we can not find a reference, we give a proof for
completeness.

######  Proposition 2.4.

$(X,\mathcal{X},\mu,T)$ is an ergodic m.p.s. with $h_{\mu}(X,T)=0$.

###### Proof.

First we show that $(X,\mathcal{X},\mu,T)$ is ergodic. Let
$A_{1},A_{2}\in\mathcal{B}(\mathbb{T})$ with
$m_{\mathbb{T}}(A_{1})m_{\mathbb{T}}(A_{2})>0$ and
$B_{j}={{}_{-M_{j}}}[s^{j}]_{M_{j}}\in\mathcal{B}(\Sigma)$, where
$s^{j}\in\\{0,1\\}^{2M_{j}+1}$ with some $M_{j}\in\mathbb{N}$, $j=1,2$. By
(2.8),

$\begin{split}&\mu\big{(}(A_{1}\times B_{1})\cap T^{-n}(A_{2}\times
B_{2})\big{)}\\\ =&\int_{\Sigma}\int_{\mathbb{T}}1_{R_{\alpha}^{-n}A_{2}\cap
A_{1}}(\theta)\cdot 1_{\sigma^{-\varphi_{n}(\theta)}B_{2}\cap
B_{1}(\omega)}dm_{\mathbb{T}}(\theta)d\nu(\omega)\\\
=&\int_{\mathbb{T}}1_{R_{\alpha}^{-n}A_{2}\cap
A_{1}}(\theta)\cdot\nu({\sigma^{-\varphi_{n}(\theta)}B_{2}\cap
B_{1}})dm_{\mathbb{T}}(\theta).\end{split}$

Note that when $|q|>M_{1}+M_{2}$, $\nu(\sigma^{-q}B_{1}\cap
B_{2})=\nu(B_{1})\nu(B_{2})$. Thus

(2.10) $\begin{split}&\mu\big{(}(A_{1}\times B_{1})\cap T^{-n}(A_{2}\times
B_{2})\big{)}\\\ \geq&\int_{\mathbb{T}}1_{R_{\alpha}^{-n}A_{2}\cap
A_{1}}(\theta)\cdot\nu({\sigma^{-\varphi_{n}(\theta)}B_{2}\cap
B_{1}})1_{\\{k\in\mathbb{N}:|\varphi_{k}(\theta)|>M_{1}+M_{2}\\}}(n)dm_{\mathbb{T}}(\theta)\\\
=&\int_{\mathbb{T}}1_{R_{\alpha}^{-n}A_{2}\cap
A_{1}}(\theta)\cdot\nu(B_{1})\nu(B_{2})1_{\\{k\in\mathbb{N}:|\varphi_{k}(\theta)|>M_{1}+M_{2}\\}}(n)dm_{\mathbb{T}}(\theta)\\\
=&\int_{\mathbb{T}}1_{R_{\alpha}^{-n}A_{2}\cap
A_{1}}(\theta)\cdot\nu(B_{1})\nu(B_{2})\big{(}1-1_{\\{k\in\mathbb{N}:|\varphi_{k}(\theta)|\leq
M_{1}+M_{2}\\}}(n)\big{)}dm_{\mathbb{T}}(\theta)\\\
\geq&m_{\mathbb{T}}(R_{\alpha}^{-n}A_{2}\cap
A_{1})\nu(B_{1})\nu(B_{2})-\int_{m_{\mathbb{T}}}1_{\\{k\in\mathbb{N}:|\varphi_{k}(\theta)|\leq
M_{1}+M_{2}\\}}(n)dm_{\mathbb{T}}(\theta).\end{split}$

Note that

$\begin{split}&\frac{1}{N}\sum_{n=0}^{N-1}1_{\\{k\in\mathbb{N}:|\varphi_{k}(\theta)|\leq
M_{1}+M_{2}\\}}(n)=\frac{1}{N}\sum_{n=0}^{N-1}\sum_{v=-(M_{1}+M_{2})}^{M_{1}+M_{2}}1_{\\{k\in\mathbb{N}:\varphi_{k}(\theta)=v\\}}(n)\\\
=&\sum_{v=-(M_{1}+M_{2})}^{M_{1}+M_{2}}\frac{1}{N}\sum_{n=0}^{N-1}1_{\\{k\in\mathbb{N}:\varphi_{k}(\theta)=v\\}}(n)=\sum_{v=-(M_{1}+M_{2})}^{M_{1}+M_{2}}\frac{\Psi_{N}^{(v)}(\theta)}{N}\end{split}$

Thus

$\begin{split}&\frac{1}{N}\sum_{n=0}^{N-1}\mu\big{(}(A_{1}\times B_{1})\cap
T^{-n}(A_{2}\times B_{2})\big{)}\\\
\geq&\frac{1}{N}\sum_{n=0}^{N-1}m_{\mathbb{T}}(R_{\alpha}^{-n}A_{2}\cap
A_{1})\nu(B_{1})\nu(B_{2})-\sum_{v=-(M_{1}+M_{2})}^{M_{1}+M_{2}}\int_{\mathbb{T}}\frac{\Psi_{N}^{(v)}(\theta)}{N}dm_{\mathbb{T}}(\theta).\end{split}$

By (2.2) and (2.5), we have for each $v\in\mathbb{Z}$,
$\displaystyle\lim_{N\to\infty}\frac{\Psi_{N}^{(v)}(\theta)}{N}=0$ for
$m_{\mathbb{T}}$-a.e. $\theta\in\mathbb{T}$. By the Dominated Convergence
Theorem, we have for each $v\in\mathbb{Z}$

$\lim_{N\to\infty}\int_{\mathbb{T}}\frac{\Psi_{N}^{(v)}(\theta)}{N}dm_{\mathbb{T}}(\theta)=0.$

By the ergodicity of
$(\mathbb{T},\mathcal{B}(\mathbb{T}),m_{\mathbb{T}},R_{\alpha})$, we deduce

$\begin{split}&\lim_{N\to\infty}\frac{1}{N}\sum_{n=0}^{N-1}\mu\big{(}(A_{1}\times
B_{1})\cap T^{-n}(A_{2}\times B_{2})\big{)}\\\
\geq&\lim_{N\to\infty}\frac{1}{N}\sum_{n=0}^{N-1}m_{\mathbb{T}}(R_{\alpha}^{-n}A_{2}\cap
A_{1})\nu(B_{1})\nu(B_{2})-\sum_{v=-(M_{1}+M_{2})}^{M_{1}+M_{2}}\lim_{N\to\infty}\int_{\mathbb{T}}\frac{\Psi_{N}^{(v)}(\theta)}{N}dm_{\mathbb{T}}(\theta)\\\
=&m_{\mathbb{T}}(A_{1})m_{\mathbb{T}}(A_{2})\nu(B_{1})\nu(B_{2})=\mu(A_{1}\times
B_{1})\mu(A_{2}\times B_{2}).\end{split}$

Then it is standard to prove that for all $D_{1},D_{2}\in\mathcal{X}$, we have
that

$\lim_{N\to\infty}\frac{1}{N}\sum_{n=0}^{N-1}\mu\big{(}D_{1}\cap
T^{-n}D_{2}\big{)}\geq\mu(D_{1})\mu(D_{2}).$

In particular, we have that for any $D_{1},D_{2}\in\mathcal{X}$ with
$\mu(D_{1})\mu(D_{2})>0$, there is some $n\in\mathbb{N}$ such that
$\mu\big{(}D_{1}\cap T^{-n}D_{2}\big{)}>0$, which means that
$(X,\mathcal{X},\mu,T)$ is ergodic.

Now we use Abramov-Rokhlin formula to show that $h_{\mu}(T)=0$. The proof of
this part is almost the same to the proof of Proposition 2.2 in [13].

For any finite measurable partition $\beta$ of $\Sigma$, we have

$h_{\mu}(T|R_{\alpha},\beta)=\lim_{n\to\infty}\frac{1}{N}\int_{\mathbb{T}}H_{\nu}(\bigvee_{n=0}^{N-1}\sigma^{-\varphi_{n}(\theta)}\beta)dm_{\mathbb{T}}(\theta),$

where $\varphi_{0}(\theta)\equiv 0$.

For $\theta\in\mathbb{T}$ and $N\in\mathbb{N}$, we denote $a_{N}(\theta)$ the
cardinality of the set $\\{\varphi_{n}(\theta):0\leq n\leq N-1\\}$, i.e.

$a_{N}(\theta)=|\\{\varphi_{n}(\theta):0\leq n\leq N-1\\}|.$

Then $a_{N}$ is a measurable function from $\mathbb{T}$ to
$\\{1,2,\cdots,N\\}$, and the cardinality of
$\bigvee_{n=0}^{N-1}\sigma^{-\varphi_{n}(\theta)}\beta$ is not greater than
$|\beta|^{a_{N}(\theta)}$ for any $\theta\in\mathbb{T}$, and hence

$\frac{1}{N}\int_{\mathbb{T}}H_{\nu}(\bigvee_{n=0}^{N-1}\sigma^{-\varphi_{n}(\theta)}\beta)dm_{\mathbb{T}}(\theta)\leq\frac{1}{N}\int_{\mathbb{T}}\log|\beta|^{a_{N}(\theta)}dm_{\mathbb{T}}(\theta)=\int_{\mathbb{T}}\frac{a_{N}(\theta)}{N}\log|\beta|dm_{\mathbb{T}}(\theta).$

We claim that for $m_{\mathbb{T}}$-a.e. $\theta\in\mathbb{T}$,

(2.11) $\lim_{N\to\infty}\frac{a_{N}(\theta)}{N}=0.$

We now show the claim. Since
$(\mathbb{T},\mathcal{B}(\mathbb{T}),m_{\mathbb{T}},R_{\alpha})$ is ergodic
and $\int_{\mathbb{T}}\varphi dm=0$, by Birkhoff ergodic theorem, for
$m_{\mathbb{T}}$-a.e. $\theta\in\mathbb{T}$,

$\frac{\varphi_{n}(\theta)}{n}=\frac{1}{n}\sum_{k=0}^{n-1}\varphi(R^{k}_{\alpha}\theta)\to\int_{\mathbb{T}}\varphi
dm_{\mathbb{T}}=0,\ n\to\infty.$

Thus for $m_{\mathbb{T}}$-a.e. $\theta\in\mathbb{T}$, for any $\epsilon>0$
there is some $M(\theta,\epsilon)\in\mathbb{N}$ such that when $n\geq
M(\theta,\epsilon)$, we have $|\frac{\varphi_{n}(\theta)}{n}|\leq\epsilon$.
Thus for $N>M(\theta,\epsilon)$, we have $|\varphi_{n}(\theta)|\leq\epsilon
n\leq\epsilon N$ for all $M(\theta,\epsilon)\leq n\leq N$. It follows that
$a_{N}(\theta)\leq M(\theta,\epsilon)+2\epsilon N+1,$ and

$\lim_{N\to\infty}\frac{a_{N}(\theta)}{N}\leq\lim_{N\to\infty}\frac{M(\theta,\epsilon)+2\epsilon
N+1}{N}\leq 2\epsilon.$

Since $\epsilon$ is arbitrary, we have (2.11), i.e. for $m_{\mathbb{T}}$-a.e.
$\theta\in\mathbb{T}$, $\lim\limits_{N\to\infty}\frac{a_{N}(\theta)}{N}=0.$
This ends the proof of the claim.

Thus by the Dominated Convergence Theorem,

$\displaystyle h_{\mu}(T|R_{\alpha},\beta)$
$\displaystyle=\lim_{N\to\infty}\frac{1}{N}\int_{\mathbb{T}}H_{\nu}(\bigvee_{n=0}^{N-1}\sigma^{-\varphi_{n}(\theta)}\beta)dm_{\mathbb{T}}(\theta)$
$\displaystyle\leq\log|\beta|\lim_{N\to\infty}\int_{\mathbb{T}}\frac{a_{N}(\theta)}{N}dm_{\mathbb{T}}(\theta)=\log|\beta|\int_{\mathbb{T}}\lim_{N\to\infty}\frac{a_{N}(\theta)}{N}dm_{\mathbb{T}}(\theta)$
$\displaystyle=0.$

As $\beta$ is an arbitrary finite measurable partition of $\Sigma$, we have
$h_{\mu}(T|R_{\alpha})=0$. Then by Abramov-Rokhlin formula,

$h_{\mu}(T)=h_{m_{\mathbb{T}}}(R_{\alpha})+h_{\mu}(T|R_{\alpha})=0.$

The proof is complete. ∎

###  2.4. Construction of $(X,\mathcal{X},\mu,S)$

#### 2.4.1.

We will choose a measurable subset $B\subseteq\mathbb{T}$ with
$m_{\mathbb{T}}(B)>0$ and $E\subseteq\mathbb{Z}$ later. And given such
$B\subseteq\mathbb{T}$ and $E\subseteq\mathbb{Z}$, we define a map
${\pi_{E}}:\Sigma\rightarrow\Sigma$ by

$({\pi_{E}}\omega)(s)=\left\\{\begin{array}[]{ll}\omega(s),&\hbox{$s\in
E$;}\\\ -\omega(s),&\hbox{$s\not\in E$.}\end{array}\right.$

And define $\pi:\mathbb{T}\times\Sigma\rightarrow\mathbb{T}\times\Sigma$ as
follows:

$R(\theta,\omega)=(\theta,\pi_{E}\omega).$

We define a transformation $S:X\rightarrow X$ by $S:=\pi^{-1}\circ T\circ\pi.$

$\textstyle{\mathbb{T}\times\Sigma\ignorespaces\ignorespaces\ignorespaces\ignorespaces\ignorespaces\ignorespaces\ignorespaces\ignorespaces}$$\scriptstyle{\pi}$$\scriptstyle{S}$$\textstyle{\mathbb{T}\times\Sigma\ignorespaces\ignorespaces\ignorespaces\ignorespaces}$$\scriptstyle{\pi}$$\textstyle{\mathbb{T}\times\Sigma\ignorespaces\ignorespaces\ignorespaces\ignorespaces}$$\scriptstyle{T}$$\textstyle{\mathbb{T}\times\Sigma}$

####  2.4.2. Choosing $B$ and $E$

Let $\alpha\not\in\mathbb{Q}$ be badly approximable. By Lemma 2.3, for each
$v\in\mathbb{Z}$ and any $\epsilon_{v}>0$, there is some
$B_{v}\in\mathcal{B}(\mathbb{T})$ with $m_{\mathbb{T}}(\mathbb{T}\setminus
B_{v})<\epsilon_{v}$ and $M_{v}>1$ such that

$\Psi^{(v)}_{n}(\theta)\leq M_{v}\frac{n}{\sqrt{\log{n}}},\ \text{for all}\
n\in\mathbb{N},\theta\in B_{v}.$

Choose $\epsilon_{v}$ such that $\sum_{v\in\mathbb{Z}}\epsilon_{v}<1$, and let
$B=\bigcap_{v\in\mathbb{Z}}B_{v}$. Then

$m_{\mathbb{T}}(B)=m_{\mathbb{T}}(\bigcap_{v\in\mathbb{Z}}B_{v})\geq
1-\sum_{v\in\mathbb{Z}}\epsilon_{v}>0.$

And for all $\theta\in B$, we have

(2.12) $\Psi^{(v)}_{n}(\theta)\leq M_{v}\frac{n}{\sqrt{\log{n}}},\ \text{for
all}\ n\in\mathbb{N},v\in\mathbb{Z}.$

For all $v\in\mathbb{N}$, set

(2.13) $C_{v}=\max\\{M_{u}:-v\leq u\leq v\\}.$

Then $1<C_{1}<C_{2}<\cdots$.

Now we define $\displaystyle E=\bigcup_{m=1}^{\infty}\pm[l_{m},l_{m}+r_{m}]$
such that

  1. (a)

$l_{1}>1$;

  2. (b)

for all $m\in\mathbb{N}$, $r_{m}>l_{m}$ such that
$\displaystyle\frac{C_{l_{m}}l_{m}}{\sqrt{\log{(l_{m}+r_{m})}}}<\frac{1}{m}$;

  3. (c)

for all $m\in\mathbb{N}$, $l_{m+1}>r_{m}+l_{m}$ such that $\displaystyle
C_{l_{m}+r_{m}}\frac{l_{m}+r_{m}+1}{\sqrt{\log{l_{m+1}}}}<\frac{1}{m}$.

###  2.5. Proof of the Main Theorem

Let

$A_{1}=B\times\Sigma,\quad A_{2}=A_{3}=\mathbb{T}\times[1]_{0}.$

We will show that the limit

(2.14) $\frac{1}{N}\sum_{n=0}^{N-1}\mu(A_{1}\cap T^{-n}A_{2}\cap S^{-n}A_{3})$

does not exist. Then we have our main theorem.

Note that for all $n\in\mathbb{N}$, we have

$T^{n}(\theta,\omega)=(\theta+n\alpha,\sigma^{\varphi_{n}(\theta)}\omega),$

and

$S^{n}(\theta,\omega)=\pi^{-1}\circ
T^{n}\circ\pi(\theta,\omega)=(\theta+n\alpha,\pi_{E}^{-1}\circ\sigma^{\varphi_{n}(\theta)}\circ\pi_{E}(\omega)),$

It follows that $(\theta,\omega)\in A_{1}\cap T^{-n}A_{2}\cap S^{-n}A_{3}$ if
and only if

$\theta\in B,\ \omega(\varphi_{n}(\theta))=1,\ \text{and }\
(\pi_{E}\omega)(\varphi_{n}(\theta))=1.$

By the definition of $\pi_{E}$, we have

$(\pi_{E}\omega)(\varphi_{n}(\theta))=1\Longleftrightarrow\left\\{\begin{array}[]{ll}\omega(\varphi_{n}(\theta))=1,&\hbox{if
$\varphi_{n}(\theta)\in E$;}\\\ \omega(\varphi_{n}(\theta))=-1,&\hbox{if
$\varphi_{n}(\theta)\not\in E$.}\end{array}\right.$

Thus

$A_{1}\cap T^{-n}A_{2}\cap
S^{-n}A_{3}=\bigcup\\{\\{\theta\\}\times[1]_{\varphi_{n}(\theta)}\in
X:\theta\in B,\varphi_{n}(\theta)\in E\\}.$

And by Fubini’s Theorem

$\mu(A_{1}\cap T^{-n}A_{2}\cap S^{-n}A_{3})=\int_{\theta\in
B\atop{\varphi_{n}(\theta)\in
E}}\nu([1]_{\varphi_{n}(\theta)})dm_{\mathbb{T}}=\frac{1}{2}m_{\mathbb{T}}(\\{\theta\in\mathbb{T}:\varphi_{n}(\theta)\in
E\\}).$

Hence

(2.15) $\begin{split}&\frac{1}{N}\sum_{n=0}^{N-1}\mu(A_{1}\cap T^{-n}A_{2}\cap
S^{-n}A_{3})\\\
=&\frac{1}{2}\int_{B}\Big{(}\frac{1}{N}\sum_{n=0}^{N-1}1_{E}(\varphi_{n}(\theta))\Big{)}dm_{\mathbb{T}}\\\
=&\frac{1}{2}\int_{B}\frac{\\#\\{0\leq n\leq N-1:\varphi_{n}(\theta)\in
E\\}}{N}dm_{\mathbb{T}}.\end{split}$

####  2.5.1. The case when $N=l_{m+1}$

Let $m\in\mathbb{N}$. Note that for $0\leq n\leq l_{m+1}-1$,
$|\varphi_{n}(\theta)|\leq l_{m+1}-1$, and $[l_{m}+r_{m}+1,l_{m+1}-1]\cap
E=\emptyset$. Thus we have

$\begin{split}&\\#\\{0\leq n<l_{m+1}:\varphi_{n}(\theta)\in E\\}\\\
\leq&\\#\\{0\leq n<l_{m+1}:|\varphi_{n}(\theta)|\leq l_{m}+r_{m}\\}\\\
\leq&\sum_{k=-(l_{m}+r_{m})}^{l_{m}+r_{m}}\Psi_{l_{m+1}}^{(k)}(\theta)\leq(2l_{m}+2r_{m}+1)C_{l_{m}+r_{m}}\frac{l_{m+1}}{\sqrt{\log{l_{m+1}}}}.\end{split}$

The last inequality is from (2.12) and (2.13). By (2.15)

(2.16) $\begin{split}&\frac{1}{l_{m+1}}\sum_{n=0}^{l_{m+1}-1}\mu(A_{1}\cap
T^{-n}A_{2}\cap S^{-n}A_{3})\\\ =&\frac{1}{2}\int_{B}\frac{\\#\\{0\leq n\leq
l_{m+1}-1:\varphi_{n}(\theta)\in E\\}}{l_{m+1}}dm_{\mathbb{T}}\\\
\leq&\frac{1}{2}\int_{B}\frac{(2l_{m}+2r_{m}+1)C_{l_{m}+r_{m}}}{l_{m+1}}\frac{l_{m+1}}{\sqrt{\log{l_{m+1}}}}dm_{\mathbb{T}}\\\
\leq&C_{l_{m}+r_{m}}\frac{l_{m}+r_{m}+1}{\sqrt{\log{l_{m+1}}}}\leq\frac{1}{m}.\quad\quad(\text{by
the condition}\ (c))\end{split}$

####  2.5.2. The case when $N=l_{m}+r_{m}+1$

Let $m\in\mathbb{N}$. Since $[l_{m},l_{m}+r_{m}]\subseteq E$, for $0\leq n\leq
l_{m}+r_{m}$, $\varphi_{n}(\theta)\not\in E$ implies that
$\varphi_{n}(\theta)\leq l_{m}-1$. Hence we have

$\begin{split}&\\#\\{0\leq n\leq l_{m}+r_{m}:\varphi_{n}(\theta)\in E\\}\\\
\geq&l_{m}+r_{m}+1-\\#\\{0\leq n\leq l_{m}+r_{m}:\varphi_{n}(\theta)\not\in
E\\}\\\ \geq&l_{m}+r_{m}+1-\\#\\{0\leq n\leq
l_{m}+r_{m}:|\varphi_{n}(\theta)|\leq l_{m}-1\\}\\\
\geq&l_{m}+r_{m}+1-\sum_{k=-(l_{m}-1)}^{l_{m}-1}\Psi_{l_{m}+r_{m}}^{(k)}(\theta)\\\
\geq&l_{m}+r_{m}+1-C_{l_{m}-1}(2l_{m}-1)\frac{l_{m}+r_{m}}{\sqrt{\log{(l_{m}+r_{m})}}}.\end{split}$

The last inequality is from (2.12) and (2.13). By (2.15)

(2.17)
$\begin{split}&\frac{1}{l_{m}+r_{m}+1}\sum_{n=0}^{l_{m}+r_{m}}\mu(A_{1}\cap
T^{-n}A_{2}\cap S^{-n}A_{3})\\\ =&\frac{1}{2}\int_{B}\frac{\\#\\{0\leq n\leq
l_{m}+r_{m}:\varphi_{n}(\theta)\in E\\}}{l_{m}+r_{m}+1}dm_{\mathbb{T}}\\\
\geq&\frac{1}{2}\int_{B}\Big{(}1-\frac{C_{l_{m}-1}(2l_{m}-1)}{l_{m}+r_{m}+1}\frac{l_{m}+r_{m}}{\sqrt{\log{(l_{m}+r_{m})}}}\Big{)}dm_{\mathbb{T}}\\\
\geq&\frac{1}{2}\Big{(}1-2\frac{C_{l_{m}}l_{m}}{\sqrt{\log{(l_{m}+r_{m})}}}\Big{)}\quad\quad\quad(\text{since}\
C_{l_{m}-1}\leq C_{l_{m}})\\\
\geq&\frac{1}{2}-\frac{C_{l_{m}}l_{m}}{\sqrt{\log{(l_{m}+r_{m})}}}\geq\frac{1}{2}-\frac{1}{m}.\quad\quad(\text{by
the condition}\ (b))\end{split}$

By (2.16) and (2.17), we have that the limit

$\frac{1}{N}\sum_{n=0}^{N-1}\mu(A_{1}\cap T^{-n}A_{2}\cap S^{-n}A_{3})$

does not exist. The proof of Main Theorem is complete.

## References

  * [1] J. Aaronson and M. Keane, The visits to zero of some deterministic random walks, Proc. London Math. Soc., 44 (1982), no. 3, 535–553.
  * [2] J. Aaronson, M. Bromberg, and H. Nakada, Discrepancy skew products and affine random walks, Israel J. Math., 221 (2017), no. 2, 973–1010.
  * [3] L. Abramov and V. Rokhlin, The entropy of a skew product of measurepreserving transformations, Amer. Math. Soc. Transl. Ser., 48 (1966), 255–265.
  * [4] T. Austin, Non-convergence of some non-commuting double ergodic averages, arXiv:2407.08630.
  * [5] V. Bergelson and S. Leibman, A nilpotent Roth theorem, Invent. Math., 147 (2002), no.2, 429–470.
  * [6] R.V. Chacon and D.S. Ornstein, A general ergodic theorem, Illinois J. Math. 4 (1960), 153–160.
  * [7] J. Conze and M. Keane, Ergodicité d’un flot cylindrique, (French) Séminaire de Probabilités, I (Univ. Rennes, Rennes, 1976), Exp. No. 5, 7 pp. Dépt. Math. Informat., Univ. Rennes, Rennes, 1976.
  * [8] J. Conze and E. Lesigne, Sur un théorème ergodique pour des mesures diagonales. (French) [On an ergodic theorem for diagonal measures], Bull. Soc. Math. France 112 (1984), no. 2, 143–175.
  * [9] N. Frantzikinakis and B. Host, Multiple recurrence and convergence without commutativity, J. Lond. Math. Soc. (2) 107 (2023), no. 5, 1635–1659.
  * [10] M. Hochman, A ratio ergodic theorem for multiparameter non-singular actions, J. Eur. Math. Soc., 12 (2010), 365–383.
  * [11] M. Hochman, On the ratio ergodic theorem for group actions, J. London Math. Soc., 88 (2013), 465–482.
  * [12] E. Hopf, Ergodentheorie, Ergeb. Math. Grenzgeb. 5, Heft 2, Springer (1937).
  * [13] W. Huang, S. Shao and Xiangdong Ye, A counterexample on polynomial multiple convergence without commutativity, Bull. Soc. Math. France, 152(2024), No. 1, 149–168.
  * [14] W. Hurewicz, Ergodic theorem without invariant measure, Ann. of Math. (2) 45 (1944), 192–206.
  * [15] V.V. Stepanov, Sur une extension de theoreme ergodique, Compositio Math., 3 (1936), 239–253.
  * [16] M. Walsh, Norm convergence of nilpotent ergodic averages, Ann. of Math., 175 (2012), 1667–1688.