∎

11institutetext: Y. Lin 22institutetext: School of Mathematics and Statistics,
Chongqing Technology and Business University, Chongqing 400067, PR China
22email<EMAIL_ADDRESS>
# The Petty projection inequality for sets of finite perimeter

Youjiang Lin

###### Abstract

The Petty projection inequality for sets of finite perimeter is proved. Our
approach is based on Steiner symmetrization. Neither the affine Sobolev
inequality nor the functional Minkowski problem is used in our proof.
Moreover, for sets of finite perimeter, we prove the Petty projection
inequality with respect to Steiner symmetrization.

###### Keywords:

Petty projection inequality set of finite perimeter Steiner symmetrization

###### MSC:

52A20

11footnotetext: Research of the author is supported by National Natural
Science Foundation of China NSFC 11971080 and Natural Science Foundation
Projection of Chongqing cstc2018jcyjAX0790.

##  1 Introduction

Within the Brunn-Minkowski theory, the two classical inequalities which
connect the volume of a convex body with that of its polar projection body are
the Petty and Zhang projection inequalities. Unlike the classical
isoperimetric inequality (see, e.g., MR3585546 ; MR0043486 ; MR2456887 ;
MR2672283 ), the Petty and Zhang projection inequalities are affine
isoperimetric inequalities in that they are inequalities between a pair of
geometric functionals whose product is invariant under affine transformations.
Many important results about affine isoperimetric inequalities and their
functional forms have been found (see, e.g., MR3250365 ; MR3128983 ; MR3418448
; MR2551138 ; MR2530600 ; MR2545028 ; MR4008006 ; MR2885586 ; MR1863023 ). The
Petty projection inequality strengthens and directly implies the classical
isoperimetric inequality, but it can be viewed as an optimal isoperimetric
inequality. It is the geometric core of the affine Sobolev-Zhang inequality
MR1776095  which strengthens the classical sharp Euclidean Sobolev inequality.
The $L_{p}$ version of Petty’s inequality by Lutwak et al. MR1863023  and its
Orlicz extension by the same authors MR2563216  both represent landmark
results in the evolution of the Brunn-Minkowski theory first towards an
$L_{p}$ theory and, more recently, towards an Orlicz theory of convex bodies.
The $L_{p}$ and Orlicz theories of convex bodies have expanded rapidly (see,
e.g., MR1901248 ; MR1898210 ; MR2251886 ; MR3194492 ; MR2652209 ; MR1725817 ;
MR2680490 ; MR1942402 ; MR2159706 ; MR2067123 ; MR1378681 ; MR2785767 ;
MR1987375 ; MR2211138 ; MR2652465 ; MR1231704 ; MR3488132 ; MR3128983 ;
MR2652213 ; MR3695895 ; MR4018310 ; MR2873887 ).

Affine isoperimetric inequalities referring to convex bodies have been
extended to certain classes of non-convex domains such as star bodies and sets
of finite perimeter. The Petty projection inequality has been generalized
first to compact domains with smooth boundary by Zhang MR1776095  and to sets
of finite perimeter by Wang MR2927377 . Recently, Haberl and Schuster
MR4008006  show every even, zonal measure on the Euclidean unit sphere gives
rise to an isoperimetric inequality for sets of finite perimeter which
directly implies the classical Euclidean isoperimetric inequality. The
strongest member of this large family of inequalities was shown to be the only
affine invariant one among them–the Petty projection inequality. In MR2927377
, Wang used the functional Minkowski problem on $BV(\mathbb{R}^{n})$ and an
approach to the affine Sobolev-Zhang inequality for compactly supported
$C^{1}$ functions developed by Lutwak et al. MR2211138  to establish the
affine Sobolev-Zhang inequality of $BV$ functions. As a consequence, the Petty
projection inequality for sets of finite perimeter was established. Using the
same ideas, Haberl and Schuster MR4008006  obtained the large family of sharp
Sobolev type inequalities which can be seen as the functional form of the
large family of isoperimetric inequalities.

In this paper, we give a direct proof of the Petty projection inequality for
sets of finite perimeter. Our approach is based on Steiner symmetrization.
Neither the affine Sobolev inequality nor the functional Minkowski problem is
used in our proof. Moreover, for sets of finite perimeter, we prove the Petty
projection inequality with respect to Steiner symmetrization.

Let $\mathcal{C}^{n}$ denote the set of compact sets of finite perimeter in
$\mathbb{R}^{n}$ with nonempty interior. For $E\in\mathcal{C}^{n}$, let
$\partial^{\ast}E$ and $\nu^{E}=(\nu_{1}^{E},\dots,\nu_{n-1}^{E},\nu_{y}^{E})$
denote the reduced boundary and the generalized inner normal to $E$,
respectively (see Section 3.2 for precise definitions). We define the
projection body $\Pi E$ of $E$ to be the convex set with support function

$\displaystyle h(\Pi
E,z)=\frac{1}{2}\int_{\partial^{\ast}E}|z\cdot\nu^{E}(x)|d\mathcal{H}^{n-1}(x),\;\;z\in\mathbb{R}^{n}.$
(1.1)

This extension of Minkowski’s classical notion of the projection body of a
convex body was first given by Wang MR2927377 , who generalized a definition
of Zhang MR1776095  for compact sets with piecewise $C^{1}$ boundary.

For the polar (see Section 2.1 for definitions) of $\Pi E$ we will write
$\Pi^{\ast}E$. The $\mathcal{L}^{n}$ Lebesgue measure of a set of finite
perimeter $E\in\mathcal{C}^{n}$ will be denoted by $|E|$, and for the volume
of the unit ball in $\mathbb{R}^{n}$ we use $\omega_{n}$.

We assume that $E\in\mathcal{C}^{n}$ satisfies the condition

$\displaystyle\mathcal{H}^{n-1}(\\{x\in\partial^{\ast}E:\;\nu_{y}^{E}(x)=0\\})=0.$
(1.2)

###### Theorem 1.1

Let $E\in\mathcal{C}^{n}$ satisfy (1.2) and $E^{s}$ denote its Steiner
symmetrization. Then

$\displaystyle|E|^{n-1}|\Pi^{\ast}E|\leq|E^{s}|^{n-1}|\Pi^{\ast}E^{s}|.$ (1.3)

###### Theorem 1.2

Let $E\in\mathcal{C}^{n}$. Then

$\displaystyle|E|^{n-1}|\Pi^{\ast}E|\leq(\omega_{n}/\omega_{n-1})^{n}.$ (1.4)

Note that since the absolute value function $|\cdot|$ is not strictly convex,
we cannot characterize the cases of equality in (1.3) and (1.4) using the
methods in the paper.

In section 2, we set up notation and terminology and compile some basic facts
about the Brunn-Minkowski theory of convex bodies and the theory of functions
of bounded variation. In Section 3, we prove that for any a set of finite
perimeter $E$, there exists a sequence of unit directions $\\{u_{i}\\}$ such
that there exists a subsequence of the successive Steiner symmetrizations
$E_{i}:=S_{u_{i}}\cdots S_{u_{1}}E$ of $E$ which converges to an origin-
symmetric ball with same volume. The main difficulty in proving the
convergence is that every direction $u_{i}$ of Steiner symmetrization is
related to $E_{i-1}$. Section 4 is devoted to the study of some basic
properties of projection bodies of sets of finite perimeter. For example, the
continuity and the affine invariance of the Petty projection operator. It is
worth pointing out that the proofs of these properties are new and did not
appear in the known literatures.

In Section 5, we give the proofs of main theorems. First, we prove the
monotonicity of the volumes of projection bodies with respect to Steiner
symmetrization. To prove the monotonicity, we make critical use of a beautiful
fact found by Lutwak et al. in MR2563216 . The fact gives a useful way to
imply the inclusion relation between the Steiner symmetrization of a convex
body and another convex body. In the remarkable paper MR2178968 , Chlebík et
al. characterized the sets of finite perimeter whose perimeter is preserved
under Steiner symmetrization and proved the monotonicity of the perimeter of
sets of finite perimeter with respect to Steiner symmetrization. The ideas and
techniques of Chlebík et al. MR2178968  play a critical role in this paper.
Comparing to the paper MR2178968 , the perimeter of sets of finite perimeter
is replaced by the volume of the projection body of sets of finite perimeter,
which is a function of the volume of the unit ball of an $n$-dimensional
Banach space. Finally, using the convergence of Steiner symmetrization,
monotonicity and continuity of the projection operator, we prove the Petty
projection inequality for sets of finite perimeter.

##  2 Preliminaries

Let $\mathbb{N}$ denote the set of positive integers. Let
$\\{e_{1}$,…,$e_{n}\\}$ denote the standard orthonormal basis of the Euclidean
space $\mathbb{R}^{n}$. A point $x\in\mathbb{R}^{n}$, $n\geq 2$, will be
usually labeled by $(x^{\prime},y)$, where
$x^{\prime}=(x_{1},\dots,x_{n-1})\in\mathbb{R}^{n-1}$ and $y\in\mathbb{R}$. To
emphasize the different role of the variable $y$, we shall also write
$\mathbb{R}^{n}=\mathbb{R}^{n-1}\times\mathbb{R}_{y}$. We shall use
$\mathbb{R}^{+}$ and $\mathbb{R}^{-}$ to denote $[0,+\infty)$ and
$(-\infty,0]$, respectively. For $u\in S^{n-1}$, let $u^{\perp}$ denote the
codimension $1$ subspace of $\mathbb{R}^{n}$ that is orthogonal to $u$. If $E$
is a measurable subset of $\mathbb{R}^{n}$ and $E$ is contained in an
$i$-dimensional affine subspace of $\mathbb{R}^{n}$ but in no affine subspace
of lower dimension, then $|E|$ will denote the $i$-dimensional Lebesgue
measure of $E$. Two measurable sets $E$ and $F$ are equivalent if the Lebesgue
measure of their symmetric difference $E\triangle F$ is zero. Let $B^{n}$
denote the Euclidean unit ball centered at the origin in $\mathbb{R}^{n}$. Let
$B_{r}(x)$ denote the ball, centered at $x$, having radius $r$. If
$x\in\mathbb{R}^{n}$ then by abuse of notation we will write $|x|=\sqrt{x\cdot
x}$.

###  2.1 Convex bodies.

We develop some notation and, for quick later reference, list some basic facts
about convex bodies. Good general references for the theory of convex bodies
are provided by the books of Gardner MR2251886 , Gruber MR1242983 ; MR2335496
, Webster MR1443208  and Schneider MR3155183 .

We write $\mathcal{K}^{n}$ for the set of convex bodies (compact convex
subsets) of $\mathbb{R}^{n}$. We write $\mathcal{K}^{n}_{0}$ for the set of
convex bodies that contain the origin in their interiors. For
$K\in\mathcal{K}^{n}$, let
$h(K;\cdot)=h_{K}:\mathbb{R}^{n}\rightarrow\mathbb{R}$ denote the support
function of $K$; i.e.,

$h(K;x)=\max\\{x\cdot z:\;z\in K\\}.$

For $K\in\mathcal{K}_{0}^{n}$, its polar body $K^{\ast}$ is defined by

$K^{\ast}=\\{x\in\mathbb{R}^{n}:x\cdot z\leq 1\;{\rm for\;all}\;z\in K\\}.$

For $A\in SL(n)$ and $K\in\mathcal{K}_{0}^{n}$,

$\displaystyle(AK)^{\ast}=A^{-t}K^{\ast}.$ (2.1)

For $K\in\mathcal{K}_{0}^{n}$, its radial function $\rho_{K}$ is defined as

$\displaystyle\rho_{K}(x)=\max\\{\lambda\geq 0:\;\lambda x\in
K\\},\;\;x\in\mathbb{R}^{n}\backslash\\{0\\}.$ (2.2)

It is easily verified that

$\displaystyle\rho_{K^{\ast}}(x)=\frac{1}{h_{K}(x)},\;\;x\in\mathbb{R}^{n}\setminus\\{0\\}.$
(2.3)

###  2.2 Functions of bounded variation and Sets of finite perimeter

In this section, we review some basic definitions and facts about functions of
bounded variation and sets of finite perimeter on $\mathbb{R}^{n}$. Good
general references are Ambrosio et al. MR1857292 , Cianchi MR2723814 , Evans
MR3409135 , Ma${\rm z}^{\prime}$ya MR817985 ,MR2777530  and Ziemer MR1014685 .

The space of functions of bounded variation in $\mathbb{R}^{n}$ is denoted by
$BV(\mathbb{R}^{n})$. Recall that a function $f\in L^{1}(\mathbb{R}^{n})$ is
said to be of bounded variation in $\mathbb{R}^{n}$ if it is integrable and
its distributional gradient $Df$ is a vector-valued Radon measure in
$\mathbb{R}^{n}$ whose total variation $|Df|$ is finite in $\mathbb{R}^{n}$;
thus

$BV(\mathbb{R}^{n})=L^{1}(\mathbb{R}^{n})\cap\\{f:\;Df\;{\rm
is\;a\;measure},\;|Df|(\mathbb{R}^{n})<\infty\\}.$

For $f\in L^{1}(\mathbb{R}^{n})$, let $f^{\ast}$ denote the precise
representative of $f$, i.e.

$f^{\ast}(x)=\left\\{\begin{aligned} &\lim_{r\rightarrow
0}\frac{1}{r^{n}\omega_{n}}\int_{B_{r}(x)}f(z)dz&{\rm
if\;this\;limit\;exists}\\\ &0&{\rm otherwise}.\end{aligned}\right.$ (2.4)

For $f_{i},f\in BV(\mathbb{R}^{n})$, $i\in\mathbb{N}$, we say that $f_{i}$
weakly∗ converges in $BV(\mathbb{R}^{n})$ to $f$ if $f_{i}$ converges to $f$
in $L^{1}(\mathbb{R}^{n})$ and $Df_{i}$ weakly∗ converges to $Df$ in
$\mathbb{R}^{n}$.

A measurable subset $E$ of $\mathbb{R}^{n}$ is said to be of finite perimeter
if its characteristic function $\chi_{E}$ is a bounded variation function in
$\mathbb{R}^{n}$. Let $\mathcal{C}^{n}$ denote the set of compact sets of
finite perimeter in $\mathbb{R}^{n}$ with nonempty interior. The perimeter of
$E$ in $\mathbb{R}^{n}$ denoted by $P(E)$ is defined by

$\displaystyle P(E)=|D\chi_{E}|(\mathbb{R}^{n}).$ (2.5)

The Hausdorff distance of the sets $E,F\in\mathcal{C}^{n}$ is defined by

$d_{H}(E,F)=\min\\{\lambda\geq 0:\;K\subset L+\lambda B^{n},\;L\subset
K+\lambda B^{n}\\}.$

For $K,L\in\mathcal{K}^{n}$, the Hausdorff distance of $K$ and $L$ (see, e.g.,
(MR3155183, , Lemma 1.8.14))

$d_{H}(K,L)=\sup_{u\in S^{n-1}}\left|h_{K}(u)-h_{L}(u)\right|.$

For $E,F\in\mathcal{C}^{n}$, we define $L_{1}$ or also the symmetric-
difference distance (sometimes also called Nikodým distance, as in MR1242983 )
as follows,

$d_{1}(E,F)=\mathcal{L}^{n}(E\triangle F).$

Let $E\in\mathcal{C}^{n}$ and let $D_{i}\chi_{E}$ denote the $i$-th component
of the distributional gradient $D\chi_{E}$. We denote by $\nu_{i}^{E}$,
$i=1,\dots,n$, the derivative of the measure $D_{i}\chi_{E}$ with respect to
$|D\chi_{E}|$. The reduced boundary $\partial^{\ast}E$ of $E$ is the set of
all points $x\in\mathbb{R}^{n}$ such that the vector
$\nu^{E}(x)=(\nu_{1}^{E}(x),\dots,\nu^{E}_{n}(x))$ exists and satisfies
$|\nu^{E}(x)|=1$. The vector $\nu^{E}(x)$ is called the generalized inner
normal to $E$ at $x$. Throughout this paper, let $\nu^{E}_{x^{\prime}}$ and
$\nu^{E}_{y}$ denote the front $n-1$ components and the $n$-th component of
$\nu^{E}$, respectively.

We have (see (MR1857292, , Theorem 3.59))

$\displaystyle D\chi_{E}=\nu^{E}\mathcal{H}^{n-1}\llcorner\partial^{\ast}E.$
(2.6)

Eq. (2.6) implies that

$\displaystyle|D\chi_{E}|=\mathcal{H}^{n-1}\llcorner\partial^{\ast}E$ (2.7)

and that

$|D_{i}\chi_{E}|=|\nu_{i}^{E}|\mathcal{H}^{n-1}\llcorner\partial^{\ast}E,\;\;i=1,\dots,n.$

For any $E\in\mathcal{C}^{n}$ and $u\in S^{n-1}$, define, for $x^{\prime}\in
u^{\perp}$,

$E_{x^{\prime},u}=\\{x^{\prime}+tu:\;t\in\mathbb{R},\;x^{\prime}+tu\in E\\}$

and

$\ell_{E,u}(x^{\prime})=|E_{x^{\prime},u}|.$

For $u=e_{n}$, let $E_{x^{\prime}}$ and $\ell_{E}$ denote
$E_{x^{\prime},e_{n}}$ and $\ell_{E,e_{n}}$, respectively. $E$ will be
suppressed when clear from the context, and thus we will often denote
$\ell_{E}(x^{\prime})$ by $\ell(x^{\prime})$.

Let $\pi_{u}(E)$ denote the orthogonal projection of $E\subset\mathbb{R}^{n}$
onto $u^{\perp}$. In what follows, the essential projection of a set
$E\subset\mathbb{R}^{n}$ onto $u^{\perp}$ is defined as

$\pi_{u}(E)^{+}=\\{x^{\prime}\in u^{\perp}:\;\ell_{E,u}(x^{\prime})>0\\}.$

For $u=e_{n}$, let $\pi_{n-1}(E)$ and $\pi_{n-1}(E)^{+}$ denote
$\pi_{e_{n}}(E)$ and $\pi_{e_{n}}(E)^{+}$, respectively.

The following theorem is a special case of the co-area formula for rectifiable
sets (see(MR1857292, , Theorem 2.93 and Remark 2.94)).

###### Theorem 2.1

Let $E\in\mathcal{C}^{n}$. Let $g:\mathbb{R}^{n-1}\rightarrow[0,+\infty)$ be
any Borel function. Then

$\displaystyle\int_{\partial^{\ast}E}g(x)|\nu^{E}_{y}(x)|d\mathcal{H}^{n-1}(x)=\int_{\mathbb{R}^{n-1}}dx^{\prime}\int_{(\partial^{\ast}E)_{x^{\prime}}}g(x^{\prime},y)d\mathcal{H}^{0}(y).$
(2.8)

Next, we give a theorem concerning one-dimensional sections of sets of finite
perimeter, it can be easily deduced from (MR1857292, , Theorem 3.108).

###### Theorem 2.2

Let $E$ be a set of finite perimeter in $\mathbb{R}^{n}$. Then, for
$\mathcal{L}^{n-1}$-a.e. $x^{\prime}\in\mathbb{R}^{n-1}$,

$\displaystyle E_{x^{\prime}}\;has\;finite\;perimeter\;in\;\mathbb{R}_{y},$
(2.9)
$\displaystyle(\partial^{\ast}E)_{x^{\prime}}=\partial^{\ast}(E_{x^{\prime}}),$
(2.10) $\displaystyle\nu^{E}_{y}(x^{\prime},y)\neq
0\;for\;every\;y\;such\;that\;(x^{\prime},y)\in\partial^{\ast}E,$ (2.11)
$\left\\{\begin{aligned} \lim_{\eta\rightarrow
y^{+}}\chi^{\ast}_{E}(x^{\prime},\eta)=1,\;\;\lim_{\eta\rightarrow
y^{-}}\chi^{\ast}_{E}(x^{\prime},\eta)=0\;\;{\rm
if}\;\nu_{y}^{E}(x^{\prime},y)>0,\\\ \lim_{\eta\rightarrow
y^{+}}\chi^{\ast}_{E}(x^{\prime},\eta)=0,\;\;\lim_{\eta\rightarrow
y^{-}}\chi^{\ast}_{E}(x^{\prime},\eta)=1\;\;{\rm
if}\;\nu_{y}^{E}(x^{\prime},y)<0.\end{aligned}\right.$ (2.12)

In particular, a Borel set $G_{E}\subset\pi_{n-1}(E)^{+}$ exists such that
$\mathcal{L}^{n-1}(\pi_{n-1}(E)^{+}\setminus G_{E})=0$ and (2.9)-(2.12) are
fulfilled for every $x^{\prime}\in G_{E}$.

###### Remark 2.1

By (MR1857292, , Prop. 3.52), if $E\subset\mathbb{R}$ is a measurable set,
then $E$ has finite perimeter in $\mathbb{R}$ if and only if there exist
$-\infty\leq a_{1}<b_{1}<\dots<b_{m}\leq+\infty$ such that

$E=\bigcup_{i=1}^{m}(a_{i},b_{i})$

up to a set of measure zero.

In Theorem 2.2, if $E$ is a set of finite perimeter in $\mathbb{R}^{n}$ and
$\mathcal{\ell}_{E}(x^{\prime})<\infty$ for $\mathcal{L}^{n-1}$-a.e.
$x^{\prime}\in\mathbb{R}^{n-1}$, then for every $x^{\prime}\in G_{E}$,
$E_{x^{\prime}}$ has finite perimeter in $\mathbb{R}^{n}_{x^{\prime}}$ and
$E_{x^{\prime}}$ is bounded. Thus,

$E_{x^{\prime}}\;\;is\;equivalent\;to\;\\{x^{\prime}\\}\times\bigcup^{m(x^{\prime})}_{i=1}(a_{i},b_{i})$

where

$m(x^{\prime})=\frac{\mathcal{H}^{0}(\partial^{\ast}(E_{x^{\prime}}))}{2},\;\;\;\;(x^{\prime},a_{i}),\;(x^{\prime},b_{i})\in\partial^{\ast}(E_{x^{\prime}})$

and

$\nu_{y}^{E}(x^{\prime},a_{i})>0\;\;and\;\;\nu_{y}^{E}(x^{\prime},b_{i})<0.$

The approximation theorem was proved by Maggi in (MR2402947, , Theorem 2.4).

###### Theorem 2.3

(Density of smooth or polyhedral sets). If $E$ is a set of finite perimeter in
$\mathbb{R}^{n}$, then a sequence $E_{i}$ of bounded open sets with with
smooth or polyhedral boundary can be found so that $E_{i}\rightarrow E$ in the
$L^{1}$ distance and $P(E_{i})\rightarrow P(E)$.

###  2.3 Steiner symmetrization and spherical symmetrization

Steiner symmetrization is a classical and very well-known device, which has
seen a number of remarkable applications to problems of geometric and
functional nature (see, e.g., MR3581298 ; MR1475547 ; MR1394967 ; MR2079885 ;
MR2178968 ; MR1947097 ; MR2228056 ; MR3723145 ; MR1322313 ; MR1465371 ;
MR3018162 ).

For $E\in\mathcal{C}^{n}$ and $u\in S^{n-1}$, we define the Steiner
symmetrization, $S_{u}E$, of $E$ about the hyperplane $u^{\perp}$ as

$S_{u}E=\\{x^{\prime}+tu\in\mathbb{R}^{n}:x^{\prime}\in\pi_{u}(E),\;|t|\leq\ell_{E,u}(x^{\prime})/2\\}.$

For $u=e_{n}$, let $SE$ (or $E^{s}$) denote $S_{e_{n}}E$.

For $E\in\mathcal{C}^{n}$, we define the spherical symmetrization,
$E^{\star}$, of $E$ is the close ball centered at the origin which has the
same Lebesgue measure as $E$.

Specially, for $K\in\mathcal{K}_{0}^{n}$, we have

$K^{s}=\left\\{\left(x^{\prime},\frac{1}{2}y_{1}+\frac{1}{2}y_{2}\right)\in\mathbb{R}^{n-1}\times\mathbb{R}_{y}:(x^{\prime},y_{1}),\;(x^{\prime},-y_{2})\in
K\right\\}.$

In this paper, we shall make critical use of the following fact that was
provided by Lutwak et al. in (MR2563216, , Lemma 1.1).

###### Lemma 2.1

Suppose $K,L\in\mathcal{K}_{0}^{n}$ and consider
$K,L\subset\mathbb{R}^{n-1}\times\mathbb{R}_{y}$. Then

$SK^{\ast}\subset L^{\ast},$

if and only if

$h_{K}(x^{\prime},t)=1=h_{K}(x^{\prime},-s),\;\;with\;t\neq-s\;\;\Longrightarrow\;\;h_{L}(x^{\prime},t/2+s/2)\leq
1.$

In addition, if $SK^{\ast}=L^{\ast}$, then
$h_{K}(x^{\prime},t)=1=h_{K}(x^{\prime},-s)$, with $t\neq-s$ implies that
$h_{L}(x^{\prime},t/2+s/2)=1$.

The following properties of Steiner symmetrization were summarized by Talenti
in (MR1242977, , P.107).

###### Theorem 2.4

If $E\in\mathcal{C}^{n}$, then $E^{s}\in\mathcal{C}^{n}$ and

$P(E^{s})\leq P(E).$

##  3 The convergence of Steiner symmetrization

For $E\in\mathcal{C}^{n}$ and $u\in S^{n-1}$. Let

$\partial^{\ast}_{u}E=\\{x\in\partial^{\ast}E:\;u\cdot\nu^{E}(x)=0\\}$

and

$\displaystyle T(E)=\\{u\in
S^{n-1}:\;\mathcal{H}^{n-1}(\partial_{u}^{\ast}E)=0\\}.$ (3.1)

###### Theorem 3.1

Let $E\in\mathcal{C}^{n}$. Then there exits $\\{u_{i}\\}_{i=1}^{\infty}\subset
S^{n-1}$ such that $u_{1}\in T(E)$, $u_{i}\in T(E_{i-1})$ when $i\geq 2$,
where $E_{i}=S_{u_{i}}\dots S_{u_{1}}E$, and there exists a subsequence of
$\\{E_{i}\\}$, denoted by $\\{E_{i_{j}}\\}$, satisfying $E_{i_{j}}\rightarrow
E^{\star}$ in the Hausdorff distance.

In order to prove Theorem 3.1, we need the following Lemmas 3.1-3.3.

###### Lemma 3.1

(MR4018310, , Lemma 6.12) Let $E\in\mathcal{C}^{n}$ and $T(E)$ as in (3.1).
Then

$\mathcal{H}^{n-1}\left(S^{n-1}\backslash T(E)\right)=0.$

###### Lemma 3.2

Let $E_{i}\in\mathcal{C}^{n}$, $i\in\mathbb{N}$, and let $E$ be a compact set
in $\mathbb{R}^{n}$. If

$d_{H}(E_{i},E)\rightarrow 0\;\;when\;\;i\rightarrow\infty,$

then

$\max_{x\in E_{i}}|x|\rightarrow\max_{x\in E}|x|.$

Proof. Since $d_{H}(E_{i},E)\rightarrow 0$ when $i\rightarrow\infty$, for any
$\varepsilon>0$, there exists a positive integer $N_{\varepsilon}$ such that
for any $i>N_{\varepsilon}$,

$E_{i}\subset E+\varepsilon B^{n}\;\;{\rm and}\;\;E\subset E_{i}+\varepsilon
B^{n}.$

Thus

$\max_{x\in E_{i}}|x|\leq\max_{x\in E+\varepsilon B^{n}}|x|\leq\max_{x\in
E}|x|+\varepsilon$

and

$\max_{x\in E}|x|\leq\max_{x\in E_{i}+\varepsilon B^{n}}|x|\leq\max_{x\in
E_{i}}|x|+\varepsilon.$

Therefore,

$\left|\max_{x\in E}|x|-\max_{x\in E_{i}}|x|\right|\leq\varepsilon.$

This completes the proof of the lemma.∎

###### Corollary 3.1

Let $E$, $E_{i}$, $i\in\mathbb{N}$, be compact sets satisfying $E_{i+1}\subset
E_{i}$ and

$\displaystyle E=\bigcap_{i=1}^{\infty}E_{i}.$ (3.2)

Then

$\max_{x\in E_{i}}|x|\rightarrow\max_{x\in E}|x|.$

Proof. By (3.2) and the compactness of $E_{i}$, the sequence $E_{i}$ converges
to $E$ in the Hausdorff distance. This and Lemma 3.2 yield the desired result.
∎

###### Lemma 3.3

Let $E$, $E_{i}$, $i\in\mathbb{N}$, be compact sets satisfying $E_{i+1}\subset
E_{i}$ and

$E=\bigcap_{i=1}^{\infty}E_{i}.$

Then

$\displaystyle SE=\bigcap_{i=1}^{\infty}SE_{i}.$ (3.3)

Proof. First, we prove that the orthogonal projections of $SE$ and
$\cap_{i=1}^{\infty}SE_{i}$ onto $\mathbb{R}^{n-1}$ are same, i.e.,

$\displaystyle\pi_{n-1}(SE)=\pi_{n-1}(\cap_{i=1}^{\infty}SE_{i}).$ (3.4)

If $x^{\prime}\in\pi_{n-1}(\cap_{i=1}^{\infty}SE_{i})$, then for any $i$,
$x^{\prime}\in\pi_{n-1}(SE_{i})$. Since $\pi_{n-1}(E_{i})=\pi_{n-1}(SE_{i})$,
$x^{\prime}\in\pi_{n-1}(E_{i})$. Thus there exists $x^{i}\in E_{i}$,
$i=1,2,\dots$, such that the orthogonal projection of $x^{i}$ onto
$\mathbb{R}^{n-1}$ is $x^{\prime}$. Since $E_{i+1}\subset E_{i}$,
$x^{i}\subset E_{1}$ for any $i\in\mathbb{N}$. Thus for the sequence
$\\{x^{i}\\}$, there exist a subsequence $\\{x^{i_{j}}\\}$ and
$x^{0}\in\mathbb{R}^{n}$ such that

$x^{i_{j}}\rightarrow x^{0}\;\;{\rm when}\;j\rightarrow\infty.$

It is clear that the orthogonal projection of $x^{0}$ onto $\mathbb{R}^{n-1}$
is also $x^{\prime}$. Since $E_{i+1}\subset E_{i}$ and the compactness of
$E_{i}$, we have $x^{0}\in E_{i}$ for any $i$. Thus,
$x^{0}\in\cap_{i=1}^{\infty}E_{i}$. This implies

$x^{\prime}\in\pi_{n-1}(\cap_{i=1}^{\infty}E_{i})=\pi_{n-1}(E)=\pi_{n-1}(SE).$

Therefore,

$\pi_{n-1}(\cap_{i=1}^{\infty}SE_{i})\subset\pi_{n-1}(SE).$

Moreover, $\pi_{n-1}(SE)\subset\pi_{n-1}(\cap_{i=1}^{\infty}SE_{i})$ is clear.
Thus, (3.4) is established.

Next, we prove that for any $x^{\prime}\in\pi_{n-1}(SE)$,

$\displaystyle(SE)_{x^{\prime}}=\left(\cap_{i=1}^{\infty}SE_{i}\right)_{x^{\prime}}.$
(3.5)

Since $E_{i+1}\subset E_{i}$,
$(E_{i+1})_{x^{\prime}}\subset(E_{i})_{x^{\prime}}$. By the limit theorem with
respect to sequences of measurable sets (see (MR3409135, , Theorem 1.2 (iv))),
we have

$\displaystyle|(SE)_{x^{\prime}}|=|(E)_{x^{\prime}}|=|(\cap_{i=1}^{\infty}E_{i})_{x^{\prime}}|=|\cap_{i=1}^{\infty}(E_{i})_{x^{\prime}}|=\lim_{i\rightarrow\infty}|(E_{i})_{x^{\prime}}|=\lim_{i\rightarrow\infty}|(SE_{i})_{x^{\prime}}|=|\left(\cap_{i=1}^{\infty}SE_{i}\right)_{x^{\prime}}|.$

This and the symmetry and compactness of $SE$ and $\cap_{i=1}^{\infty}SE_{i}$
yield (3.5). The desired equality (3.3) now follows from (3.4) and (3.5).∎

Proof of Theorem 3.1. Define

$\Gamma_{E}=\\{S_{u_{k}}\dots S_{u_{1}}E:\;k\in\mathbb{N},\;u_{1}\in
T(E),\;u_{2}\in T(E_{1}),\dots,u_{k}\in T(E_{k-1})\\},$

where $T(E)$ is defined as in (3.1) and $E_{j}=S_{u_{j}}\dots S_{u_{1}}E$,
$j=1,\dots,k-1$.

For $E\in\mathcal{C}^{n}$, let $r_{E}=\max_{x\in E}|x|$, which is the minimal
radius of balls centered at the origin that contain $E$. Let $r_{1}$ be the
infimum of all $r_{C}$, where $C\in\Gamma_{E}$. Then there is a sequence of
$\\{C_{i}\\}\subset\Gamma_{E}$ so that $r_{C_{i}}\rightarrow r_{1}$.
Obviously, the sequence $\\{C_{i}\\}$ is bounded, because each $C_{i}\subset
r_{E}B^{n}$. By (MR3155183, , Theorem 1.8.5), there is a subsequence
$C_{i_{k}}$ that converges to a compact set $\bar{E}$ in the Hausdorff
distance. By Lemma 3.2, $r_{\bar{E}}=r_{1}$. Denote $r_{1}B^{n}$ by $B_{1}$,
it is clear that $\bar{E}\subset B_{1}$.

Next we prove $\bar{E}=B_{1}$. Assume it is not true. There is a small open
cap $U$ on $\partial B_{1}$ so that $U\cap\bar{E}=\emptyset$. For any line
$\xi$ such that $\xi\cap U\neq\emptyset$, either $\xi\cap\bar{E}=\emptyset$ or
the line $\xi$ intersects a longer chord in $B_{1}$ than in $\bar{E}$; that
is, $|\xi\cap B_{1}|>|\xi\cap\bar{E}|$. After taking a Steiner symmetrization
$S_{u}\bar{E}$ for some $u\in S^{n-1}$, the symmetrization $S_{u}\bar{E}$
fails to intersect both $U$ and a new cap $U^{\prime}$ given by the reflection
of $U$ with respect to the hyperplane $u^{\perp}$. One can continue to take
symmetrizations with respect to an appropriate finite family of hyperplanes
with normals $v_{1},\dots,v_{m}\in S^{n-1}$ that generate finitely many caps
covering the whole sphere $\partial B_{1}$ and generate a compact set of
finite perimeter about origin $\tilde{E}=S_{v_{m}}\dots S_{v_{1}}\bar{E}$ so
that $|\xi\cap B_{1}|>|\xi\cap\tilde{E}|$ for any line such that
$\xi\cap\partial B_{1}\neq\emptyset$. Thus, $r_{\tilde{E}}<r_{1}$.

By the above analysis, $S^{n-1}\subset\bigcup_{i=1}^{m}U_{v_{i}}$, where
$U_{v_{i}}$ is the reflection of $U$ with respect to the hyperplane
$v_{i}^{\perp}$. Since the cap $U$ is open and $S^{n-1}$ is compact, there
exist sufficiently mall $\delta_{1},\dots,\delta_{m}>0$ such that any
$u_{i}\in B_{\delta_{i}}(v_{i})\cap S^{n-1}$, $i=1,\dots,m$, we have
$S^{n-1}\subset\bigcup_{i=1}^{m}U_{u_{i}}$. By the analysis of the above
paragraph, for any $u_{i}\in B_{\delta_{i}}(v_{i})\cap S^{n-1}$,
$i=1,\dots,m$, let $\bar{E}_{1}=S_{u_{m}}\dots S_{u_{1}}\bar{E}$. Then

$\displaystyle r_{\bar{E}_{1}}<r_{1}.$ (3.6)

For the above $\delta_{1},\delta_{2},\dots,\delta_{m}$, by Lemma 3.1, there
exits $u_{1}\in B_{\delta_{1}}(v_{1})\cap S^{n-1}$ such that

$u_{1}\in\bigcap_{k=1}^{\infty}T(C_{i_{k}}).$

Similarly, there exists $u_{2}\in B_{\delta_{2}}(v_{2})\cap S^{n-1}$ such that

$u_{2}\in\bigcap_{k=1}^{\infty}T(S_{u_{1}}C_{i_{k}}).$

Continue to take the process, we can get $u_{1},\dots,u_{m}$ such that
$u_{j}\in B_{\delta_{j}}(v_{j})\cap S^{n-1}$, $j=1,\dots,m$, and

$u_{j}\in\bigcap_{k=1}^{\infty}T(S_{u_{j-1}}\dots S_{u_{1}}C_{i_{k}}).$

Denote $\tilde{C}_{i_{k}}=S_{u_{m}}\cdots S_{u_{1}}C_{i_{k}}$. Since
$C_{i_{k}}\rightarrow\bar{E}$ in the Hausdorff distance. For any positive
integer $i$, there exists a positive integer $N$ such that any $k>N$

$C_{i_{k}}\subset\bar{E}+\frac{1}{i}B^{n}.$

Thus

$S_{u_{m}}S_{u_{m-1}}\dots S_{u_{1}}C_{i_{k}}\subset S_{u_{m}}S_{u_{m-1}}\dots
S_{u_{1}}\left(\bar{E}+\frac{1}{i}B^{n}\right),$

which implies that

$\displaystyle\max\left\\{|x|:\;x\in S_{u_{m}}S_{u_{m-1}}\dots
S_{u_{1}}\left(\bar{E}+\frac{1}{i}B^{n}\right)\right\\}\geq\max\\{|x|:\;x\in
S_{u_{m}}S_{u_{m-1}}\dots S_{u_{1}}C_{i_{k}}\\}\geq r_{1}.$ (3.7)

By Lemma 3.3, Corollary 3.1 and (3.7), we have

$\displaystyle\max\\{|x|:\;x\in S_{u_{m}}S_{u_{m-1}}\dots S_{u_{1}}\bar{E}\\}$
$\displaystyle=$ $\displaystyle\max\left\\{|x|:\;x\in
S_{u_{m}}S_{u_{m-1}}\dots
S_{u_{1}}\bigcap_{i=1}^{\infty}\left(\bar{E}+\frac{1}{i}B^{n}\right)\right\\}$
$\displaystyle=$
$\displaystyle\max\left\\{|x|:\;x\in\bigcap_{i=1}^{\infty}S_{u_{m}}S_{u_{m-1}}\dots
S_{u_{1}}\left(\bar{E}+\frac{1}{i}B^{n}\right)\right\\}$ $\displaystyle=$
$\displaystyle\lim_{i\rightarrow\infty}\max\left\\{|x|:\;x\in
S_{u_{m}}S_{u_{m-1}}\dots
S_{u_{1}}\left(\bar{E}+\frac{1}{i}B^{n}\right)\right\\}$ $\displaystyle\geq$
$\displaystyle r_{1}.$

Let $\bar{E}_{1}=S_{u_{m}}\dots S_{u_{1}}\bar{E}$. Then $r_{\bar{E}_{1}}\geq
r_{1}$. This contradicts (3.6).

We have shown that for any $E\in\mathcal{C}^{n}$, there are
$S_{u_{i_{1}}}\cdots S_{u_{1}}E\in\Gamma_{E}$ so that the Hausdorff distance
between $S_{u_{i_{1}}}\cdots S_{u_{1}}E$ and the centered ball $B_{1}$ can be
arbitrarily small.

For a sequence of positive numbers $\varepsilon_{k}\rightarrow 0^{+}$, there
is $D_{1}:=S_{u_{i_{1}}}\cdots S_{u_{1}}E\in\Gamma_{E}$ so that
$d_{H}(D_{1},B_{1})<\varepsilon_{1}$. Similarly, there are
$D_{2}:=S_{u_{i_{2}}}\dots S_{u_{i_{1}+1}}D_{1}\in\Gamma_{D_{1}}$ so that
$d_{H}(D_{2},B_{1})<\varepsilon_{2}$. In general, for $k=3,4,\dots$, there are
$D_{k}:=S_{u_{i_{k}}}\dots S_{u_{i_{k-1}+1}}D_{k-1}\in\Gamma_{D_{k-1}}$ so
that $d_{H}(D_{k},B_{1})<\varepsilon_{k}$. Continue the process, we can get a
sequence $\\{D_{k}\\}_{k=1}^{\infty}$ and $D_{k}\rightarrow B_{1}$ in the
Hausdorff distance. Let

$E_{j}=S_{u_{j}}S_{u_{j-1}}\dots S_{u_{1}}E,\;\;j\in\mathbb{N}.$

Then $\\{D_{k}\\}$ is a subsequence of $\\{E_{j}\\}$ while $\\{D_{k}\\}$ and
$\\{E_{j}\\}$ satisfy the conclusions of the theorem. ∎

##  4 Definition and basic properties of projection bodies

For $E\in\mathcal{C}^{n}$, we define the projection body $\Pi E$ of $E$ to be
the convex set with support function

$\displaystyle h_{\Pi
E}(z)=\frac{1}{2}\int_{\partial^{\ast}E}|z\cdot\nu^{E}(x)|d\mathcal{H}^{n-1}(x),\;\;z\in\mathbb{R}^{n}.$
(4.1)

It is clear that the function $h_{\Pi K}(\cdot)$ is the support function of a
convex body, $\Pi K$, that contains the origin in its interior. The polar body
of $\Pi E$ will be denoted by $\Pi^{\ast}E$, rather than $(\Pi E)^{\ast}$.

The following proposition shows that the Petty projection operator
$\Pi:\mathcal{C}^{n}\rightarrow\mathcal{K}_{0}^{n}$ is continuous when $E_{i}$
converges to $E_{0}$ in the $L_{1}$ distance and $P(E_{i})\rightarrow
P(E_{0})$.

###### Proposition 4.1

Let $E_{0},E_{i}\in\mathcal{C}^{n}$, $i\in\mathbb{N}$. If $E_{i}\rightarrow
E_{0}$ in the $L_{1}$ distance and $P(E_{i})\rightarrow P(E_{0})$, then $\Pi
E_{i}\rightarrow\Pi E_{0}$ in the Hausdorff distance.

Proof. Since $E_{i}$ converges to $E_{0}$ in the $L_{1}$ distance when
$i\rightarrow\infty$, we have

$\chi_{E_{i}}\;{\rm converges\;to}\;\chi_{E_{0}}\;{\rm
with\;respect\;to}\;L^{1}(\mathbb{R}^{n}).$

Since $|D\chi_{E_{i}}|(\mathbb{R}^{n})=P(E_{i})$ and $P(E_{i})\rightarrow
P(E_{0})$, $|D\chi_{E_{i}}|(\mathbb{R}^{n})$ is uniformly bounded. Hence, by
(MR1857292, , Proposition 3.13) one deduces that

$\chi_{E_{i}}\rightharpoonup\chi_{E_{0}}\;\;{\rm weakly^{\ast}}\;{\rm
in}\;\mathbb{R}^{n}\;{\rm when}\;i\rightarrow\infty.$

Thus

$\displaystyle D\chi_{E_{i}}\rightharpoonup D\chi_{E_{0}}\;\;{\rm
weakly^{\ast}}\;{\rm in}\;\mathbb{R}^{n}\;{\rm when}\;i\rightarrow\infty.$
(4.2)

Since $P(E_{i})\rightarrow P(E_{0})$,

$\displaystyle|D\chi_{E_{i}}|(\mathbb{R}^{n})\rightarrow|D\chi_{E_{0}}|(\mathbb{R}^{n}).$
(4.3)

By (4.2), (4.3) and Reshetnyak continuity theorem (see (MR1857292, , Theorem
2.39)), we have

$\displaystyle\lim_{i\rightarrow\infty}\int_{\mathbb{R}^{n}}\left|u\cdot\frac{D\chi_{E_{i}}(x)}{|D\chi_{E_{i}}(x)|}\right|d|D\chi_{E_{i}}|(x)=\int_{\mathbb{R}^{n}}\left|u\cdot\frac{D\chi_{E_{0}}(x)}{|D\chi_{E_{0}}(x)|}\right|d|D\chi_{E_{0}}|(x).$
(4.4)

By (2.6), (2.7) and (4.4), for any $u\in S^{n-1}$, we have

$\displaystyle\lim_{i\rightarrow\infty}\int_{\partial^{\ast}E_{i}}\left|u\cdot\nu^{E_{i}}(x)\right|d\mathcal{H}^{n-1}(x)=\int_{\partial^{\ast}E_{0}}\left|u\cdot\nu^{E_{0}}(x)\right|d\mathcal{H}^{n-1}(x).$
(4.5)

By the definition (4.1) of $\Pi E$ and (4.5), $\lim_{i\rightarrow\infty}h_{\Pi
E_{i}}(u)=h_{\Pi E_{0}}(u)$. Since the support functions $h_{\Pi
E_{i}}\rightarrow h_{\Pi E_{0}}$ pointwise (on $S^{n-1}$) they converge
unifromly (see, e.g., Schneider (MR3155183, , p. 54)) completing the proof.∎

We now demonstrate the affine nature of the Petty projection operator. Our
proof follows along the same lines as that of Lemma 2.6 proved by Lutwak et
al. MR2563216 .

###### Proposition 4.2

If $E\in\mathcal{C}^{n}$ and $A\in SL(n)$, then

$\Pi^{\ast}AE=A\Pi^{\ast}E.$

Proof. We first suppose that $P\in\mathcal{C}^{n}$ is a polyhedra satisfying

$\displaystyle\mathcal{H}^{n-1}(\\{x\in\partial^{\ast}P:\;x\cdot\nu^{P}(x)=0\\})=0.$
(4.6)

Suppose $(n-1)$-dimensional faces of $P$ are $F_{1},\dots,F_{m}$. Let
$u_{1},\dots,u_{m}$ be the outer unit normals to the faces, and let
$h_{1},\dots,h_{m}$ denote the support numbers of the faces of $P$; i.e.,
$h_{i}=|w_{i}\cdot u_{i}|$, where $w_{i}\in F_{i}$. Let $V_{1},\dots,V_{m}$
denote the volumes of the facial cones, so that,
$V_{i}=\frac{1}{n}|h_{i}||F_{i}|$. By (4.6), $h_{i}\neq 0$ for $i=1,\dots,m$.

For $A\in SL(n)$, let $P^{\diamond}=AP=\\{Ax:\;x\in P\\}$. Let
$F_{1}^{\diamond},\dots,F_{m}^{\diamond}$ denote the faces of $P^{\diamond}$,
let $u_{1}^{\diamond},\dots,u_{m}^{\diamond}$ be the outer unit normals of the
faces of $P^{\diamond}$ and let $h_{1}^{\diamond},\dots,h_{m}^{\diamond}$
denote the corresponding support numbers of $P^{\diamond}$. Since $A\in
SL(n)$, obviously the volumes $V_{1}^{\diamond},\dots,V_{m}^{\diamond}$ of the
facial cones of $P^{\diamond}$ are such that $V_{i}^{\diamond}=V_{i}$.

The face $F_{i}$ parallel to the subspace $u_{i}^{\perp}$ is transformed by
$A$ into the face $F_{i}^{\diamond}=AF_{i}$ parallel to
$(A^{-t}u_{i})^{\perp}$ and thus

$\displaystyle u_{i}^{\diamond}=A^{-t}u_{i}/\left|A^{-t}u_{i}\right|.$ (4.7)

For $w_{i}^{\diamond}\in F_{i}^{\diamond}$, there exists $w_{i}\in F_{i}$ such
that $w_{i}^{\diamond}=Aw_{i}$. Thus, from (4.7), we have

$\displaystyle h_{i}^{\diamond}=|w_{i}^{\diamond}\cdot
u_{i}^{\diamond}|=|Aw_{i}\cdot u_{i}^{\diamond}|=|w_{i}\cdot
A^{t}u_{i}^{\diamond}|=|w_{i}\cdot
u_{i}|/\left|A^{-t}u_{i}\right|=h_{i}/\left|A^{-t}u_{i}\right|.$ (4.8)

Since $h_{i}\neq 0$, $h^{\diamond}_{i}\neq 0$ for $i=1,\dots,m$.

Now from definition (4.1), the fact that $V_{i}^{\diamond}=V_{i}$ together
with (4.7) and (4.8), definition (4.1) again, we have, for
$z\in\mathbb{R}^{n}$,

$\displaystyle h_{\Pi AP}(z)$ $\displaystyle=$ $\displaystyle h_{\Pi
P^{\diamond}}(z)=\frac{1}{2}\sum_{i=1}^{m}\left|z\cdot
u_{i}^{\diamond}\right||F^{\diamond}_{i}|=\frac{n}{2}\sum_{i=1}^{m}\left|\frac{z\cdot
u_{i}^{\diamond}}{h^{\diamond}_{i}}\right||V^{\diamond}_{i}|$ $\displaystyle=$
$\displaystyle\frac{n}{2}\sum_{i=1}^{m}\left|\frac{z\cdot
A^{-t}u_{i}}{h_{i}}\right||V_{i}|=\frac{n}{2}\sum_{i=1}^{m}\left|\frac{A^{-1}z\cdot
u_{i}}{h_{i}}\right||V_{i}|$ $\displaystyle=$ $\displaystyle h_{\Pi
P}(A^{-1}z)=h_{A^{-t}\Pi P}(z),$

showing that $\Pi AP=A^{-t}\Pi P$. By (2.1), $\Pi^{\ast}AP=A\Pi^{\ast}P$.
This, together with Proposition 4.1 and Theorem 2.3, completes the proof.∎

##  5 Proof of the main theorems

###### Lemma 5.1

(MR2178968, , Lemma 3.2) Let $E\in\mathcal{C}^{n}$. Then

$\displaystyle\frac{\partial\ell}{\partial
x_{i}}(x^{\prime})=\int_{(\partial^{\ast}E)_{x^{\prime}}}\frac{\nu_{i}^{E}(x^{\prime},y)}{|\nu_{y}^{E}(x^{\prime},y)|}d\mathcal{H}^{0}(y),\;\;\;i=1,\dots,n-1,$
(5.1)

for $\mathcal{L}^{n-1}$-a.e. $x^{\prime}\in\pi_{n-1}(E)^{+}$.

###### Remark 5.1

An application of Lemma 5.1 and of (2.10) to $E^{s}$ yields, in particular,

$\displaystyle\frac{\partial\ell}{\partial
x_{i}}(x^{\prime})=2\frac{\nu_{i}^{E^{s}}(x^{\prime},\frac{1}{2}\ell(x^{\prime}))}{\left|\nu_{y}^{E^{s}}(x^{\prime},\frac{1}{2}\ell(x^{\prime}))\right|}\;{\rm
for}\;\mathcal{L}^{n-1}{\text{-}}{\rm a.e.}\;x^{\prime}\in\pi_{n-1}(E)^{+}.$
(5.2)

###### Lemma 5.2

(MR3055761, , Lemma 4.1) Let $E$ be any set of finite perimeter in
$\mathbb{R}^{n}$, $n\geq 2$, and let $U$ be any Borel subset of
$\mathbb{R}^{n-1}$. Then

$\mathcal{H}^{n-1}(\\{x\in\partial^{\ast}E:\;\nu_{y}^{E}(x)=0\\}\cap(U\times\mathbb{R}_{y}))=0$

if and only if

$P(E;V\times\mathbb{R}_{y})=0\;for\;each\;Borel\;subset\;V\;of\;U\;such\;that\;\mathcal{L}^{n-1}(V)=0.$

###### Lemma 5.3

Let $E\in\mathcal{C}^{n}$ satisfy (1.2). Then

$\displaystyle\left(\Pi^{\ast}E\right)^{s}\subset\Pi^{\ast}E^{s}.$ (5.3)

Proof. We will be appealing to Lemma 2.1 and thus we begin by supposing that

$h_{\Pi E}(x_{0}^{\prime},t)=1\;\;{\rm and}\;\;h_{\Pi
E}(x_{0}^{\prime},-s)=1,$

with $t\neq-s$, or equivalently, by (2.3) and (2.2), that

$(x_{0}^{\prime},t)\in\partial\Pi^{\ast}E\;\;{\rm
and}\;\;(x_{0}^{\prime},-s)\in\partial\Pi^{\ast}E.$

By (4.1)

$\displaystyle\frac{1}{2}\int_{\partial^{\ast}E}|(x_{0}^{\prime},t)\cdot\nu^{E}(x)|d\mathcal{H}^{n-1}(x)=1$
(5.4)

and

$\displaystyle\frac{1}{2}\int_{\partial^{\ast}E}|(x_{0}^{\prime},-s)\cdot\nu^{E}(x)|d\mathcal{H}^{n-1}(x)=1.$
(5.5)

By Lemma 2.1, the desired inclusion (5.3) will have been established if we can
show that

$\displaystyle h_{\Pi
E^{s}}\left(x_{0}^{\prime},\frac{1}{2}t+\frac{1}{2}s\right)\leq 1.$ (5.6)

By (MR2178968, , Proposition 4.2), if (1.2) is established, then

$\displaystyle\mathcal{H}^{n-1}(\\{x\in\partial^{\ast}E^{s}:\;\nu_{y}^{E^{s}}(x)=0\\})=0.$
(5.7)

Let $G_{E}$ and $G_{E^{s}}$ be the sets associated with $E$ and $E^{s}$,
respectively, as in Theorem 2.2. By $G_{E},G_{E^{s}}\subset\pi_{n-1}(E)^{+}$,
$\mathcal{L}^{n-1}(\pi_{n-1}(E)^{+}\setminus G_{E^{s}})=0$,
$\mathcal{L}^{n-1}(\pi_{n-1}(E)^{+}\setminus G_{E})=0$, (1.2), (5.7), Lemma
5.2, (4.1), (5.4) and (5.5), we have that (5.6) is equivalent to

$\displaystyle\int_{\partial^{\ast}E^{s}\cap(G_{E^{s}}\times\mathbb{R})}\left|\left(x_{0}^{\prime},\frac{t+s}{2}\right)\cdot\nu^{E^{s}}(x)\right|d\mathcal{H}^{n-1}(x)$
(5.8)
$\displaystyle\leq\frac{1}{2}\int_{\partial^{\ast}E\cap(G_{E}\times\mathbb{R})}|(x_{0}^{\prime},t)\cdot\nu^{E}(x)|d\mathcal{H}^{n-1}(x)+\frac{1}{2}\int_{\partial^{\ast}E\cap(G_{E}\times\mathbb{R})}|(x_{0}^{\prime},-s)\cdot\nu^{E}(x)|d\mathcal{H}^{n-1}(x).$

We have the following chain of equalities:

$\displaystyle\int_{\partial^{\ast}E^{s}\cap(G_{E^{s}}\times\mathbb{R})}\left|\left(x_{0}^{\prime},\frac{t+s}{2}\right)\cdot\nu^{E^{s}}(x)\right|d\mathcal{H}^{n-1}(x)$
$\displaystyle=$
$\displaystyle\int_{G_{E^{s}}}dx^{\prime}\int_{(\partial^{\ast}E^{s})_{x^{\prime}}}\left|\left(x_{0}^{\prime},\frac{t+s}{2}\right)\cdot\nu^{E^{s}}(x)\right|\frac{d\mathcal{H}^{0}(y)}{\left|\nu^{E^{s}}_{y}(x^{\prime},y)\right|}$
$\displaystyle=$
$\displaystyle\int_{G_{E}}dx^{\prime}\int_{(\partial^{\ast}E^{s})_{x^{\prime}}}\left|\left(x_{0}^{\prime},\frac{t+s}{2}\right)\cdot\left(\frac{\nu_{x^{\prime}}^{E^{s}}(x)}{{\left|\nu^{E^{s}}_{y}(x^{\prime},y)\right|}},\frac{\nu_{y}^{E^{s}}(x)}{{\left|\nu^{E^{s}}_{y}(x^{\prime},y)\right|}}\right)\right|d\mathcal{H}^{0}(y),$

where the first is due to the co-area formula (2.8) and (2.11), the second to
the fact that $\mathcal{L}^{n-1}(G_{E^{s}}\triangle G_{E})=0$.

By (5.2) and (2.10), for $E^{s}$

$\displaystyle\int_{G_{E}}dx^{\prime}\int_{(\partial^{\ast}E^{s})_{x^{\prime}}}\left|\left(x_{0}^{\prime},\frac{t+s}{2}\right)\cdot\left(\frac{\nu_{x^{\prime}}^{E^{s}}(x)}{{\left|\nu^{E^{s}}_{y}(x^{\prime},y)\right|}},\frac{\nu_{y}^{E^{s}}(x)}{{\left|\nu^{E^{s}}_{y}(x^{\prime},y)\right|}}\right)\right|d\mathcal{H}^{0}(y)$
$\displaystyle=$
$\displaystyle\int_{G_{E}}dx^{\prime}\int_{\partial^{\ast}(E^{s})_{x^{\prime}}}\left|\left(x_{0}^{\prime},\frac{t+s}{2}\right)\cdot\left(\frac{1}{2}\nabla\ell(x^{\prime}),\frac{\nu_{y}^{E^{s}}(x)}{{\left|\nu^{E^{s}}_{y}(x^{\prime},y)\right|}}\right)\right|d\mathcal{H}^{0}(y)$
$\displaystyle=$
$\displaystyle\int_{G_{E}}dx^{\prime}\int_{\partial^{\ast}(E^{s})_{x^{\prime}}\cap(G_{E}\times\mathbb{R}^{+})}\left|\left(x_{0}^{\prime},\frac{t+s}{2}\right)\cdot\left(\frac{1}{2}\nabla\ell(x^{\prime}),-1\right)\right|d\mathcal{H}^{0}(y)$
$\displaystyle+\int_{G_{E}}dx^{\prime}\int_{\partial^{\ast}(E^{s})_{x^{\prime}}\cap(G_{E}\times\mathbb{R}^{-})}\left|\left(x_{0}^{\prime},\frac{t+s}{2}\right)\cdot\left(\frac{1}{2}\nabla\ell(x^{\prime}),1\right)\right|d\mathcal{H}^{0}(y)$
$\displaystyle=$
$\displaystyle\frac{1}{2}\int_{G_{E}}\left|\left(x_{0}^{\prime},t+s\right)\cdot\left(\nabla\ell(x^{\prime}),-1\right)\right|dx^{\prime}+\frac{1}{2}\int_{G_{E}}\left|\left(x_{0}^{\prime},t+s\right)\cdot\left(\nabla\ell(x^{\prime}),1\right)\right|dx^{\prime}.$

For $x^{\prime}\in G_{E}$, let

$\displaystyle\partial^{r,\ast}E_{x^{\prime}}:=\left\\{(x^{\prime},y)\in\partial^{\ast}E_{x^{\prime}}:\;\nu^{E}_{y}(x^{\prime},y)<0\right\\}$
(5.11)

and

$\displaystyle\partial^{l,\ast}E_{x^{\prime}}:=\left\\{(x^{\prime},y)\in\partial^{\ast}E_{x^{\prime}}:\;\nu^{E}_{y}(x^{\prime},y)>0\right\\}.$
(5.12)

By Remark 2.1,

$\displaystyle\mathcal{H}^{0}(\partial^{l,\ast}(E_{x^{\prime}}))=\mathcal{H}^{0}(\partial^{r,\ast}(E_{x^{\prime}}))=m(x^{\prime})=\frac{\mathcal{H}^{0}(\partial^{\ast}(E_{x^{\prime}}))}{2}.$
(5.13)

For $k=1,\dots,m(x^{\prime})$, let

$\displaystyle y_{k,l}(x^{\prime})\;{\rm be\;the\;}k{\text{-}}{\rm th}\;{\rm
number}\;y{\rm\;satisfying}\;(x^{\prime},y)\in\partial^{l,\ast}E_{x^{\prime}},$
(5.14) $\displaystyle y_{k,r}(x^{\prime})\;{\rm be\;the\;}k{\text{-}}{\rm
th}\;{\rm
number}\;y{\rm\;satisfying}\;(x^{\prime},y)\in\partial^{r,\ast}E_{x^{\prime}}.$
(5.15)

By (5.1), the monotonicity of $|a+br|+|a-br|$ with respect to $r>0$, where
$a,b\in\mathbb{R}$, (5.13)-(5.15), the last expression of (5)

$\displaystyle\leq$
$\displaystyle\frac{1}{2}\int_{G_{E}}\left|(x_{0}^{\prime},t+s)\cdot\left(\int_{\partial^{\ast}E_{x^{\prime}}}\frac{\nu_{x^{\prime}}^{E}}{|\nu^{E}_{y}|}d\mathcal{H}^{0},-\frac{1}{2}\int_{\partial^{\ast}E_{x^{\prime}}}d\mathcal{H}^{0}\right)\right|dx^{\prime}$
$\displaystyle+\frac{1}{2}\int_{G_{E}}\left|(x_{0}^{\prime},t+s)\cdot\left(\int_{\partial^{\ast}E_{x^{\prime}}}\frac{\nu_{x^{\prime}}^{E}}{|\nu^{E}_{y}|}d\mathcal{H}^{0},\frac{1}{2}\int_{\partial^{\ast}E_{x^{\prime}}}d\mathcal{H}^{0}\right)\right|dx^{\prime}$
$\displaystyle=$
$\displaystyle\frac{1}{2}\int_{G_{E}}\left|(x_{0}^{\prime},t+s)\cdot\left(\sum^{m(x^{\prime})}_{k=1}\left(\frac{\nu_{x^{\prime}}^{E}}{|\nu^{E}_{y}|}(x^{\prime},y_{k,l}(x^{\prime}))+\frac{\nu_{x^{\prime}}^{E}}{|\nu^{E}_{y}|}(x^{\prime},y_{k,r}(x^{\prime}))\right),-m(x^{\prime})\right)\right|dx^{\prime}$
$\displaystyle+\frac{1}{2}\int_{G_{E}}\left|(x_{0}^{\prime},t+s)\cdot\left(\sum^{m(x^{\prime})}_{k=1}\left(\frac{\nu_{x^{\prime}}^{E}}{|\nu^{E}_{y}|}(x^{\prime},y_{k,l}(x^{\prime}))+\frac{\nu_{x^{\prime}}^{E}}{|\nu^{E}_{y}|}(x^{\prime},y_{k,r}(x^{\prime}))\right),m(x^{\prime})\right)\right|dx^{\prime}.$

By the convexity of the absolute value function $|\cdot|$, (5.11), (5.12) and
the co-area formula (2.8), the last expression of (5)

$\displaystyle\leq$
$\displaystyle\frac{1}{2}\int_{G_{E}}\sum_{k=1}^{m(x^{\prime})}\left|(x_{0}^{\prime},t)\cdot\left(\frac{\nu_{x^{\prime}}^{E}}{|\nu^{E}_{y}|}(x^{\prime},y_{k,r}(x^{\prime})),-1\right)\right|dx^{\prime}$
$\displaystyle+\frac{1}{2}\int_{G_{E}}\sum_{k=1}^{m(x^{\prime})}\left|(x_{0}^{\prime},-s)\cdot\left(\frac{\nu_{x^{\prime}}^{E}}{|\nu^{E}_{y}|}(x^{\prime},y_{k,l}(x^{\prime})),1\right)\right|dx^{\prime}$
$\displaystyle+\frac{1}{2}\int_{G_{E}}\sum_{k=1}^{m(x^{\prime})}\left|(x_{0}^{\prime},t)\cdot\left(\frac{\nu_{x^{\prime}}^{E}}{|\nu^{E}_{y}|}(x^{\prime},y_{k,l}(x^{\prime})),1\right)\right|dx^{\prime}$
$\displaystyle+\frac{1}{2}\int_{G_{E}}\sum_{k=1}^{m(x^{\prime})}\left|(x_{0}^{\prime},-s)\cdot\left(\frac{\nu_{x^{\prime}}^{E}}{|\nu^{E}_{y}|}(x^{\prime},y_{k,r}(x^{\prime})),-1\right)\right|dx^{\prime}$
$\displaystyle=$
$\displaystyle\frac{1}{2}\int_{G_{E}}dx^{\prime}\int_{\partial^{\ast}E_{x^{\prime}}}\left|(x_{0}^{\prime},t)\cdot\left(\frac{\nu_{x^{\prime}}^{E}}{|\nu^{E}_{y}|},\frac{\nu^{E}_{y}}{|\nu^{E}_{y}|}\right)\right|d\mathcal{H}^{0}(y)$
$\displaystyle+\frac{1}{2}\int_{G_{E}}dx^{\prime}\int_{\partial^{\ast}E_{x^{\prime}}}\left|(x_{0}^{\prime},-s)\cdot\left(\frac{\nu_{x^{\prime}}^{E}}{|\nu^{E}_{y}|},\frac{\nu^{E}_{y}}{|\nu^{E}_{y}|}\right)\right|d\mathcal{H}^{0}(y)$
$\displaystyle=$
$\displaystyle\frac{1}{2}\int_{\partial^{\ast}E}\left|(x_{0}^{\prime},t)\cdot\nu^{E}\right|d\mathcal{H}^{n-1}+\frac{1}{2}\int_{\partial^{\ast}E}\left|(x_{0}^{\prime},-s)\cdot\nu^{E}\right|d\mathcal{H}^{n-1}.$

From (5), (5), (5) and (5) we get (5.8). This completes the proof of the
lemma.∎

Proof of Theorem 1.1. By Lemma 5.3 and the volume invariance of Steiner
symmetrization, inequality (1.3) is established. ∎

Next, we prove Theorem 1.2. The following lemma was proved in (MR3085623, ,
Lemma 3.1) (also see MR367161 ). We give a different proof here.

###### Lemma 5.4

Let $E,E_{i}\in\mathcal{C}^{n}$, $i\in\mathbb{N}$. If $|E|=|E_{i}|$ and
$E_{i}\rightarrow E$ in the Hausdorff distance, then $E_{i}\rightarrow E$ in
the $L_{1}$ distance.

Proof. Since $E_{i}\rightarrow E$ in the Hausdorff distance, for any
$\varepsilon>0$, there exists a positive integer $N$ such that for $i>N$,

$E_{i}\subset E+\varepsilon B^{n}.$

Thus

$\displaystyle E_{i}\backslash E\subset(E+\varepsilon B^{n})\backslash E.$
(5.18)

For a decreasing sequence of positive numbers $\varepsilon_{k}\rightarrow
0^{+}$, by the limit theorem with respect to sequences of measurable sets (see
(MR3409135, , Theorem 1.2 (iv))), we have

$\displaystyle\lim\limits_{k\rightarrow\infty}\left|(E+\varepsilon_{k}B^{n})\backslash
E\right|=\left|\bigcap_{k=1}^{\infty}(E+\varepsilon_{k}B^{n})\backslash
E\right|=0.$ (5.19)

By (5.18) and (5.19),

$\displaystyle\lim_{i\rightarrow\infty}|E_{i}\backslash E|=0.$ (5.20)

Since $|E|=|E_{i}|$, we have

$\displaystyle|E\backslash E_{i}|=|E|-|E\cap E_{i}|=|E_{i}|-|E\cap
E_{i}|=|E_{i}\backslash E|.$ (5.21)

By (5.20) and (5.21),
$\lim_{i\rightarrow\infty}d_{1}(E_{i},E)=2|E_{i}\backslash E|=0$.∎

The Petty projection operator
$\Pi:\mathcal{C}^{n}\rightarrow\mathcal{K}_{0}^{n}$ is weakly continuous in
some sense when $E_{i}$ converges to $E^{\star}$ in the $L_{1}$ distance
without the assumption that $P(E_{i})\rightarrow P(E^{\star})$.

###### Lemma 5.5

Let $E,E_{i}\in\mathcal{C}^{n}$, $i\in\mathbb{N}$. If
$L_{1}(E_{i},E^{\star})\rightarrow 0$, then there exist a subsequence of
$\\{\Pi E_{i}\\}_{i=1}^{\infty}$, denoted by $\\{\Pi E_{i}\\}_{i=1}^{\infty}$
as well, and a convex body $K$ such that $0\in K$, $d_{H}\left(\Pi
E_{i},K\right)\rightarrow 0$ and $\Pi E^{\star}\subset K$.

Proof. By the definition (4.1) of $\Pi E$, (2.5) and (2.7), for any $u\in
S^{n-1}$,

$h_{\Pi
E_{i}}(u)=\frac{1}{2}\int_{\partial^{\ast}E_{i}}|u\cdot\nu^{E_{i}}(x)|d\mathcal{H}^{n-1}(x)\leq\frac{1}{2}\mathcal{H}^{n-1}(\partial^{\ast}E_{i})=\frac{1}{2}P(E_{i}).$

Since $P(E_{i})$ is decreasing with respect to $i$ (see Theorem 2.4), there
exists a constant $r_{0}>0$ such that $\Pi E_{i}\subset r_{0}B^{n}\;\;{\rm
for\;any}\;i$. By Blaschke selection theorem (see (MR3155183, , Theorem
1.8.7)), there exists a subsequence of $\\{\Pi E_{i}\\}_{i=1}^{\infty}$,
denoted by $\\{\Pi E_{i}\\}_{i=1}^{\infty}$ as well, that converges to a
convex body $K$ in the Hausdorff distance. Since $h_{\Pi E_{i}}(u)>0$ for any
$i$ and $u\in S^{n-1}$ and $h_{\Pi E_{i}}(u)\rightarrow h_{K}(u)$, $h_{K}\geq
0$. Thus, $0\in K$.

Since $\\{E_{i}\\}_{i=1}^{\infty}$ converges to $E^{\star}$ in the $L_{1}$
distance when $i\rightarrow\infty$, we have $\chi_{E_{i}}$ converges to
$\chi_{E^{\star}}$ with respect to $L_{1}(\mathbb{R}^{n})$. Since
$|D\chi_{E_{i}}|(\mathbb{R}^{n})=P(E_{i})$ and $P(E_{i})$ is decreasing with
respect to $i$ (see Theorem 2.4), $|D\chi_{E_{i}}|(\mathbb{R}^{n})$ is
uniformly bounded. Hence, by (MR1857292, , Proposition 3.13) one deduces that

$\displaystyle D\chi_{E_{i}}\rightharpoonup D\chi_{E^{\star}}\;\;{\rm
weakly^{\ast}}\;{\rm in}\;\mathbb{R}^{n}\;{\rm when}\;i\rightarrow\infty.$
(5.22)

By (5.22) and Reshetnyak lower semicontinuity theorem (see (MR1857292, ,
Theorem 2.38)), we have

$\displaystyle\int_{\mathbb{R}^{n}}\left|u\cdot\frac{D\chi_{E^{\star}}(x)}{|D\chi_{E^{\star}}(x)|}\right|d|D\chi_{E^{\star}}|(x)\leq\lim_{i\rightarrow\infty}\int_{\mathbb{R}^{n}}\left|u\cdot\frac{D\chi_{E_{i}}(x)}{|D\chi_{E_{i}}(x)|}\right|d|D\chi_{E_{i}}|(x).$
(5.23)

By (2.6), (2.7) and (5.23), for any $u\in S^{n-1}$, we have

$\displaystyle\int_{\partial^{\ast}E^{\star}}\left|u\cdot\nu^{E^{\star}}(x)\right|d\mathcal{H}^{n-1}(x)\leq\lim_{i\rightarrow\infty}\int_{\partial^{\ast}E_{i}}\left|u\cdot\nu^{E_{i}}(x)\right|d\mathcal{H}^{n-1}(x).$
(5.24)

By the definition (4.1) of $\Pi E$ and (5.24), $h_{\Pi
E^{\star}}(u)\leq\lim_{i\rightarrow\infty}h_{\Pi E_{i}}(u)=h_{K}(u)$. Thus,
$\Pi E^{\star}\subset K$.∎

Proof of Theorem 1.2. By the monotonicity of the projection operator (Theorem
1.1), the convergence of the subsequence $\\{D_{k}\\}$ of $\\{E_{j}\\}$
(Theorem 3.1 ), the weakly continuity of the projection operator (Lemma 5.5),
for $E\in\mathcal{C}^{n}$, the volume $V(E)^{n-1}V(\Pi^{\ast}E)$ is maximized
when $E=E^{\star}$. Since
$V(E^{\star})^{n-1}V(\Pi^{\ast}E^{\star})=(\omega_{n}/\omega_{n-1})^{n}$,
inequality (1.4) is established. ∎

##  6 Open problems

###### Problem 6.1

For $E\in\mathcal{C}^{n}$, if $E_{i}:=S_{u_{i}}\dots S_{u_{1}}E$ for a
sequence of directions $\\{u_{i}\\}$ and there exists a subsequence
$E_{i_{j}}$ converges to $E^{\star}$ in the Hausdorff distance, then does
$E_{i}$ converge to $E^{\star}$ in the Hausdorff distance?

If the answer of Problem 6.1 is positive, then the sequence $\\{E_{i}\\}$ in
Theorem 3.1 converges to $E^{\star}$, which is stronger than the convergence
of its subsequence.

###### Problem 6.2

For $E\in\mathcal{C}^{n}$, if $E_{i}:=S_{u_{i}}\dots S_{u_{1}}E$ for a
sequence of directions $\\{u_{i}\\}$ and $E_{i}\rightarrow E^{\star}$ in the
Hausdorff distance, then does $P(E_{i})$ converge to $P(E^{\star})$?

If the answer of Problem 6.2 is positive, then by Proposition 4.1, the
sequence $\\{\Pi E_{i}\\}$ in Lemma 5.5 converges to $\Pi E^{\star}$, which is
stronger than its convergence to a convex body $K$ satisfying $\Pi
E^{\star}\subset K$.

## References

  * [1] L. Ambrosio, N. Fusco, and D. Pallara.  Functions of bounded variation and free discontinuity problems.  Oxford Mathematical Monographs. The Clarendon Press, Oxford University Press, New York, 2000.
  * [2] M. Barchiesi, F. Cagnetti, and N. Fusco.  Stability of the Steiner symmetrization of convex sets.  J. Eur. Math. Soc. (JEMS), 15(4):1245–1278, 2013.
  * [3] M. Barchiesi, G. M. Capriani, N. Fusco, and G. Pisante.  Stability of Pólya-Szegö inequality for log-concave functions.  J. Funct. Anal., 267(7):2264–2297, 2014.
  * [4] G. A. Beer.  The Hausdorff metric and convergence in measure.  Michigan Math. J., 21:63–64, 1974.
  * [5] G. Bianchi, A. Burchard, P. Gronchi, and A. Volčič.  Convergence in shape of Steiner symmetrizations.  Indiana Univ. Math. J., 61(4):1695–1710, 2012.
  * [6] G. Bianchi, R. J. Gardner, and P. Gronchi.  Symmetrization in geometry.  Adv. Math., 306:51–88, 2017.
  * [7] K. J. Böröczky.  Stronger versions of the Orlicz-Petty projection inequality.  J. Differential Geom., 95(2):215–247, 2013.
  * [8] A. Burchard.  Cases of equality in the Riesz rearrangement inequality.  Ann. of Math. (2), 143(3):499–527, 1996.
  * [9] A. Burchard.  Steiner symmetrization is continuous in $W^{1,p}$.  Geom. Funct. Anal., 7(5):823–860, 1997.
  * [10] A. Burchard and A. Ferone.  On the extremals of the Pólya-Szegö inequality.  Indiana Univ. Math. J., 64(5):1447–1463, 2015.
  * [11] A. Burchard and Y. Guo.  Compactness via symmetrization.  J. Funct. Anal., 214(1):40–73, 2004.
  * [12] S. Campi and P. Gronchi.  The $L^{p}$-Busemann-Petty centroid inequality.  Adv. Math., 167(1):128–141, 2002.
  * [13] M. Chlebík, A. Cianchi, and N. Fusco.  The perimeter inequality under Steiner symmetrization: cases of equality.  Ann. of Math. (2), 162(1):525–555, 2005.
  * [14] A. Cianchi.  On some aspects of the theory of Orlicz-Sobolev spaces.  In Around the research of Vladimir Maz’ya. I, volume 11 of Int. Math. Ser. (N. Y.), pages 81–104. Springer, New York, 2010.
  * [15] A. Cianchi and N. Fusco.  Functions of bounded variation and rearrangements.  Arch. Ration. Mech. Anal., 165(1):1–40, 2002.
  * [16] A. Cianchi and N. Fusco.  Steiner symmetric extremals in Pólya-Szegö type inequalities.  Adv. Math., 203(2):673–728, 2006.
  * [17] A. Cianchi, E. Lutwak, D. Yang, and G. Zhang.  Affine Moser-Trudinger and Morrey-Sobolev inequalities.  Calc. Var. Partial Differential Equations, 36(3):419–436, 2009\.
  * [18] L. C. Evans and R. F. Gariepy.  Measure theory and fine properties of functions.  Textbooks in Mathematics. CRC Press, Boca Raton, FL, revised edition, 2015\.
  * [19] A. Figalli, F. Maggi, and A. Pratelli.  A mass transportation approach to quantitative isoperimetric inequalities.  Invent. Math., 182(1):167–211, 2010.
  * [20] N. Fusco.  The stability of the isoperimetric inequality.  In Vector-valued partial differential equations and applications, volume 2179 of Lecture Notes in Math., pages 73–123. Springer, Cham, 2017.
  * [21] N. Fusco, F. Maggi, and A. Pratelli.  The sharp quantitative isoperimetric inequality.  Ann. of Math. (2), 168(3):941–980, 2008.
  * [22] R. J. Gardner.  The Brunn-Minkowski inequality.  Bull. Amer. Math. Soc. (N.S.), 39(3):355–405, 2002.
  * [23] R. J. Gardner.  Geometric tomography, volume 58 of Encyclopedia of Mathematics and its Applications.  Cambridge University Press, New York, second edition, 2006.
  * [24] P. M. Gruber.  The space of convex bodies.  In Handbook of convex geometry, Vol. A, B, pages 301–318. North-Holland, Amsterdam, 1993.
  * [25] P. M. Gruber.  Convex and discrete geometry, volume 336 of Grundlehren der Mathematischen Wissenschaften [Fundamental Principles of Mathematical Sciences].  Springer, Berlin, 2007.
  * [26] C. Haberl, E. Lutwak, D. Yang, and G. Zhang.  The even Orlicz Minkowski problem.  Adv. Math., 224(6):2485–2510, 2010.
  * [27] C. Haberl and L. Parapatits.  The centro-affine Hadwiger theorem.  J. Amer. Math. Soc., 27(3):685–705, 2014.
  * [28] C. Haberl and F. E. Schuster.  Asymmetric affine $L_{p}$ Sobolev inequalities.  J. Funct. Anal., 257(3):641–658, 2009.
  * [29] C. Haberl and F. E. Schuster.  General $L_{p}$ affine isoperimetric inequalities.  J. Differential Geom., 83(1):1–26, 2009.
  * [30] C. Haberl and F. E. Schuster.  Affine vs. Euclidean isoperimetric inequalities.  Adv. Math., 356:106811, 26, 2019.
  * [31] C. Haberl, F. E. Schuster, and J. Xiao.  An asymmetric affine Pólya-Szegö principle.  Math. Ann., 352(3):517–542, 2012.
  * [32] Y. Lin.  Affine Orlicz Pólya-Szegö principle for log-concave functions.  J. Funct. Anal., 273(10):3295–3326, 2017.
  * [33] Y. Lin.  Smoothness of the Steiner symmetrization.  Proc. Amer. Math. Soc., 146(1):345–357, 2018.
  * [34] Y. Lin.  The affine Orlicz Pólya-Szegö principle on $BV(\Omega)$.  Calc. Var. Partial Differential Equations, 58(5):Paper No. 178, 39, 2019.
  * [35] M. Ludwig.  Projection bodies and valuations.  Adv. Math., 172(2):158–168, 2002.
  * [36] M. Ludwig.  Minkowski valuations.  Trans. Amer. Math. Soc., 357(10):4191–4213, 2005.
  * [37] M. Ludwig.  General affine surface areas.  Adv. Math., 224(6):2346–2360, 2010.
  * [38] M. Ludwig and M. Reitzner.  A characterization of affine surface area.  Adv. Math., 147(1):138–172, 1999.
  * [39] M. Ludwig and M. Reitzner.  A classification of ${\rm SL}(n)$ invariant valuations.  Ann. of Math. (2), 172(2):1219–1267, 2010.
  * [40] M. Ludwig, J. Xiao, and G. Zhang.  Sharp convex Lorentz-Sobolev inequalities.  Math. Ann., 350(1):169–197, 2011.
  * [41] E. Lutwak.  The Brunn-Minkowski-Firey theory. I. Mixed volumes and the Minkowski problem.  J. Differential Geom., 38(1):131–150, 1993.
  * [42] E. Lutwak.  The Brunn-Minkowski-Firey theory. II. Affine and geominimal surface areas.  Adv. Math., 118(2):244–294, 1996.
  * [43] E. Lutwak, D. Yang, and G. Zhang.  $L_{p}$ affine isoperimetric inequalities.  J. Differential Geom., 56(1):111–132, 2000.
  * [44] E. Lutwak, D. Yang, and G. Zhang.  Sharp affine $L_{p}$ Sobolev inequalities.  J. Differential Geom., 62(1):17–38, 2002.
  * [45] E. Lutwak, D. Yang, and G. Zhang.  On the $L_{p}$-Minkowski problem.  Trans. Amer. Math. Soc., 356(11):4359–4370, 2004.
  * [46] E. Lutwak, D. Yang, and G. Zhang.  Optimal Sobolev norms and the $L^{p}$ Minkowski problem.  Int. Math. Res. Not., pages Art. ID 62987, 21, 2006.
  * [47] E. Lutwak, D. Yang, and G. Zhang.  Orlicz centroid bodies.  J. Differential Geom., 84(2):365–387, 2010.
  * [48] E. Lutwak, D. Yang, and G. Zhang.  Orlicz projection bodies.  Adv. Math., 223(1):220–242, 2010.
  * [49] F. Maggi.  Some methods for studying stability in isoperimetric type problems.  Bull. Amer. Math. Soc. (N.S.), 45(3):367–408, 2008.
  * [50] V. G. Maz’ja.  Sobolev spaces.  Springer Series in Soviet Mathematics. Springer-Verlag, Berlin, 1985.  Translated from the Russian by T. O. Shaposhnikova.
  * [51] V. Maz’ya.  Sobolev spaces with applications to elliptic partial differential equations, volume 342 of Grundlehren der Mathematischen Wissenschaften [Fundamental Principles of Mathematical Sciences].  Springer, Heidelberg, augmented edition, 2011.
  * [52] G. Pólya and G. Szegö.  Isoperimetric Inequalities in Mathematical Physics.  Annals of Mathematics Studies, no. 27. Princeton University Press, Princeton, N. J., 1951.
  * [53] R. Schneider.  Convex bodies: the Brunn-Minkowski theory, volume 151 of Encyclopedia of Mathematics and its Applications.  Cambridge University Press, Cambridge, expanded edition, 2014.
  * [54] G. Talenti.  The standard isoperimetric theorem.  In Handbook of convex geometry, Vol. A, B, pages 73–123. North-Holland, Amsterdam, 1993.
  * [55] G. Talenti.  Inequalities in rearrangement invariant function spaces.  In Nonlinear analysis, function spaces and applications, Vol. 5 (Prague, 1994), pages 177–230. Prometheus, Prague, 1994.
  * [56] N. S. Trudinger.  On new isoperimetric inequalities and symmetrization.  J. Reine Angew. Math., 488:203–220, 1997.
  * [57] A. Volčič.  Random Steiner symmetrizations of sets and functions.  Calc. Var. Partial Differential Equations, 46(3-4):555–569, 2013\.
  * [58] T. Wang.  The affine Sobolev-Zhang inequality on $BV(\mathbb{R}^{n})$.  Adv. Math., 230(4-6):2457–2473, 2012.
  * [59] R. Webster.  Convexity.  Oxford Science Publications. The Clarendon Press, Oxford University Press, New York, 1994.
  * [60] D. Xi and G. Leng.  Dar’s conjecture and the log-Brunn-Minkowski inequality.  J. Differential Geom., 103(1):145–189, 2016.
  * [61] G. Zhang.  The affine Sobolev inequality.  J. Differential Geom., 53(1):183–202, 1999.
  * [62] G. Zhu.  The Orlicz centroid inequality for star bodies.  Adv. in Appl. Math., 48(2):432–445, 2012.
  * [63] W. P. Ziemer.  Weakly differentiable functions, volume 120 of Graduate Texts in Mathematics.  Springer-Verlag, New York, 1989.  Sobolev spaces and functions of bounded variation.


#  Leveraging eBPF and AI for Ransomware Nose Out

Arjun Sekar†, Sameer G. Kulkarni† and Joy Kuri‡
†Indian Institute of Technology Gandhinagar, ‡Indian Institute of Science,
India

###### Abstract.

In this work, we propose a two-phased approach for real-time detection and
deterrence of ransomware. To achieve this, we leverage the capabilities of
eBPF (Extended Berkeley Packet Filter) and artificial intelligence to develop
both proactive and reactive methods. In the first phase, we utilize signature-
based detection, where we employ custom eBPF programs to trace the execution
of new processes and perform hash-based analysis against a known ransomware
dataset. In the second, we employ a behavior-based technique that focuses on
monitoring the process activities using a custom eBPF program and the creation
of ransom notes — a prominent indicator of ransomware activity through the use
of Natural Language Processing (NLP). By leveraging eBPF’s low-level tracing
capabilities and integrating NLP based machine learning algorithms, our
solution achieves an impressive 99.76% accuracy in identifying ransomware
incidents within a few seconds on the onset of zero-day attacks.

††copyright: none††copyright: none††conference: Arxiv; June 2024;

##  1\. Introduction

Ransomware has emerged as a highly destructive and pervasive form of malware,
evolving into the preferred weapon for cybercriminals in recent years
(Mansfield-Devine, 2017). As per the Sonicwall Cybersecurity report
(SonicWall, 2024), in 2023 alone, businesses faced a staggering escalation in
ransomware attacks, with over 318 million incidents reported - roughly an
attempt to attack every 0.1 seconds. The threat extends beyond individual
finances, reaching hospitals, power grids, and entire industries, posing a
severe risk to public safety and national security. The severity of threat
posed by ransomwares is highlighted by its reclassification as a top security
concern in the latest White House National Cybersecurity Strategy (nat, 2023).

The most common approach followed by anti-virus solutions includes signature-
based detection which struggles to detect zero-day attacks (Alasli and Ghaleb,
2019). Extended Berkeley Packet Filter (eBPF) strikes the right balance to run
lightweight programs securely in kernel space without the need to modify the
kernel, and facilitates efficient mode of kernel level observability to
implement simple security measures with minimal processing overheads when
compared to the solutions developed as user-space applications. No wonder the
usage of eBPF for application and system level profiling/tracing, network
level monitoring and security is on the rise (Dejaeghere et al., 2023; Lévai
et al., 2023). Hence, we adopt eBPF for kernel level tracing of the
application behavior and to implement security measures that enable to detect
and deter the ransomware.

Figure 1. Classification of Ransomware

Natural language processing (NLP) (Bird et al., 2009a) — a field of artificial
intelligence that enables computers to understand and interpret text
information. NLP encompasses tasks such as sentiment analysis, spam detection,
and topic categorization to automate the organization and understanding of
textual data. We develop a NLP based semantic analysis model to detect
ransomware through analysis of ransom notes. The key contributions of our work
include:

  * •

We perform an exhaustive analysis of existing ransomware to identify their
distinguishing features. This involves running various ransomware samples in a
controlled environment to monitor their system interactions, such as file
operations, CPU usage, and system call invocations. By tracing these
activities using eBPF, we uncovered specific patterns indicative of ransomware
activity. (§3).

  * •

We present a novel two-phased approach for ransomware detection and deterrence
composed of static and dynamic modules. These modules work together to provide
a robust detection framework that operates efficiently at the kernel level.
(§4).

  * •

We develop eBPF modules for static (Algo.3) and dynamic analysis (Algo.4.2).
The static analysis module attaches to various exec syscall tracepoints to log
the execution of new processes for hash-based comparison against known
ransomware samples. The dynamic analysis module monitors and logs file system
activities to detect suspiciously high file creation rates typical of
ransomware operations. (§4.1).

  * •

We develop and train a NLP model to detect ransom notes in real-time (§4.2).
and demonstrate the efficacy of our proposed solution to detect zero-day
attacks in real-time with $\sim{}99.7\%$ accuracy. (§5).

##  2\. Background

In this section, we present a brief background about classification of
ransomwares and eBPF that is relevant to the context of our work.

###  2.1. Classification of Ransomware

Ransomware can be classified based on i) the kind of action it performs
(action-based) and ii) the characteristics of its operation (characteristics-
based) (Beaman et al., 2021). Figure 1 shows the two kinds of ransomware
classifications. The actions of ransomware delineate its immediate impact on
the victim’s system, ranging from encrypting files and locking down access to
outright data exposure threats. Simultaneously, the characteristics of
ransomware delve into its underlying attributes, such as the delivery methods,
sophistication levels, and overarching strategies employed by cybercriminals.
Classification based on Action:

  * •

Locker Ransomware: This type of malicious software denies users access to
their entire systems by locking them out. Instead of encrypting files, it
immobilizes the operating system, demanding a ransom to restore regular
access.

  * •

Crypto-Ransomware: It is a malicious software that encrypts a victim’s files,
making them inaccessible to the user. Threat actors demand a ransom for the
decryption key needed to unlock the files, often causing significant
disruptions and data loss.

  * •

Scareware: Scareware is deceptive software that uses alarming messages or fake
security alerts to trick users into believing their computer is infected with
malware. Its primary goal is to prompt users to purchase unnecessary or
fraudulent security products or services.

  * •

Doxware: Doxware, also known as leakware, is ransomware that threatens to
expose sensitive or private information unless the victim pays a ransom.
Instead of encrypting files, it focuses on extorting personal data,
potentially causing reputational and privacy damage.

Classification based on Characteristics:

  * •

File-less Ransomware: It is a type of malicious software that operates without
leaving traditional executable files on the victim’s system. It often exploits
system vulnerabilities or uses scripts to execute in memory, making detection
and prevention more challenging for traditional antivirus tools.

  * •

File-Based Ransomware: Traditional file-based ransomware is a form of
malicious software that encrypts a victim’s files, rendering them
inaccessible. The attackers then demand a ransom payment, typically in
cryptocurrency, to provide the decryption key to restore access to the
encrypted files.

  * •

Bootloader Ransomware: It is a type of malicious software that targets and
modifies the computer’s bootloader, disrupting the normal boot process. This
ransomware makes the system unbootable by corrupting the bootloader, demanding
a ransom to restore standard boot functionality.

###  2.2. Extended Berkeley Packet Filter eBPF

eBPF is a powerful and resourceful in-kernel virtual machine. Although,
originally designed for network packet filtering, eBPF has evolved into a
universal framework that allows executing custom code snippets in a sandboxed
environment within the kernel without the need to recompile the kernel or
addition of kernel modules (Calavera and Fontana, 2019). This flexibility
enables dynamic and efficient analysis of various aspects of system behavior,
which has lead to widespread adoption of eBPF in areas such as system
profiling, tracing, security, and performance optimization.

##  3\. Design Rationale

Traditional analysis techniques often overlook critical system interactions
and nuances that could provide valuable insights into the complex mechanisms
employed by modern ransomware variants. Hence, we first identify the key
operational characteristics and run-time behavior of file based crypto
ransomwares. We run an ensemble of ransomwares including REvil, HelloKitty,
IceFire and WannaCry on a test virtual machine to unearth the following
distinct, yet common features. Table 1 summarizes our key findings. We discuss
below the following observations.

eBPF based system call tracing: Here, we specifically instrument the Linux
kernel with eBPF to monitor all of the 336 tracepoints available in sys_enter
system call events. This, not only provides an unprecedented level of
visibility into the granular activities occurring during a ransomware
execution111This exhaustive tracing is possible in our test environment where
only the ransomware application is run., but also offers a more reliable and
consistent mechanism than the kernel probes regardless of the variability in
kernel versions. We uncovered several distinctive features and behaviors
prevalent during ransomware operations but relatively uncommon in benign
system activities. Such key features include i) high CPU usage, ii) frequent
invocation of system calls such as  openat, unlinkat, pkill, rename, write,
OpenSSL calls, and iii) extensive use of urandom file.
urandom: Regardless of the specific encryption algorithm or library used, any
encryption process requires a source of random numbers for securely generating
encryption keys. Our analysis revealed that sophisticated advanced ransomware
variants like REvil heavily utilize the ‘/dev/urandom’ pseudo-random number
generator to aid their encryption processes. This distinctive behavior left a
characteristic trace that could not have been identified by merely tracing the
OpenSSL or other existing encryption libraries.

Table 1. Primary Syscall Invocations Across Ransomware Variants During Ransomware Execution Feature | REvil | HelloKitty | WannaCry
---|---|---|---
Unlink usage | High | Med | High
Urandom utilization | High | Low | Low
Pkill invocation | High | High | High
Rename syscall | High | High | High
Write syscall | High | High | High
OpenSSL usage | Low | High | High
CPU utilization | High | High | High
Openat usage | High | High | High

Encryption: Further, we observed that ransomware variants like REvil do not
rely on standard encryption libraries like OpenSSL or mbedTLS, which can be
traced by placing uprobes on libcrypto.so or libmbedtls.so respectively.
Instead, they employ custom-loaded encryption libraries with novel encryption
techniques such as the SALSA-20 cipher observed in REvil. It is important to
note that while sophisticated ransomware like REvil employs custom encryption
techniques and avoids standard libraries, some more primitive variants like
WannaCry and Hellokitty ransomware directly leverage OpenSSL for encryption.
In such cases, placing uprobes on the dynamic symbols of OpenSSL library
(libcrypto.so) i.e. EVP_EncryptInit_ex and EVP_CipherInit_ex, effectively
capture their encryption activities.
File Operations: The reason for high unlink/unlinkat system call usage is
because the ransomware variants often create temporary .lck or .temp files as
intermediary files between the original file and the final encrypted file.
After creating the final encrypted file, the ransomware deletes these
temporary files using the unlink or unlinkat system calls. The high frequency
of pkill system call invocation is observed because ransomware typically uses
pkill to terminate all running processes before encrypting them. Additionally,
the command pkill kills open file handles, ensuring no interruptions occur
during the file encryption process. The renaming of files from their original
names to custom encrypted file extensions leads to the frequent invocation of
the sys_enter_rename system call. This behavior is a characteristic of
ransomware operations, as it renames the encrypted files with specific
extensions to indicate their encrypted state.

Figure 2. Analysis of Syscall Invocation Frequency: Ransomware vs. Benign
Processes

By comprehensively tracing all 336 sys_enter system calls, we uncovered
previously unseen aspects of the ransomware attack process, revealing the
intricate mechanisms and operations employed by these sophisticated malware
variants.

The graph in Fig. 2 illustrates the comparative frequency of system call
invocations observed during ransomware execution versus benign processes. The
data for ransomware processes was collected by running various ransomware
samples for approximately 30 seconds while encrypting 1.5GB of data. The data
for benign processes was obtained from normal system usage over a 30-second
period.

##  4\. Proposed Solution

We propose a novel two-phased approach that combines static and dynamic
behavioral analysis techniques. The key dynamic property we focus on is to
monitor the creation of ransom notes and leverage machine learning to classify
the ransom notes as malicious or benign. Fig. 3 shows the proposed two-phase
ransomware detection pipeline.

Static Analysis: Here, we use eBPF to place a tracepoint on the exec system
calls to capture new processes being executed. We then perform hash-based
detection on the process by comparing its hash with a dataset obtained from
MalwareBazaar (Abuse.ch, 2024), which consists of SHA-256 hashes of about
777,073 malware samples. This static analysis layer serves as the initial line
of defense.
Dynamic Analysis: When the static analysis layer fails to detect any malicious
indicators, i.e. zero-day attacks, the dynamic (second) layer of our approach
takes over, focusing on the behavior-based detection of ransom note creation,
a distinctive and essential step in the ransomware attack lifecycle.
Ransomware typically follows a well-defined sequence of actions, including
file encryption, followed by the creation and delivery of a ransom note
containing instructions for payment and file recovery. While existing
behavior-based techniques may monitor file system activities or system call
patterns, our technique aims to provide a more targeted and effective defense
against ransomware operations by detecting and responding to this critical
step in the ransomware kill chain. After analyzing the system calls invoked
during ransomware operations, we focused on observing and analyzing the file
creation patterns using the openat system call. The tracepoint at
sys_enter_openat has an argument (flags) of type int, which can be decoded
using the definitions in /usr/include/asm-generic/fcntl.h. By understanding
these flag values, we can determine the file access modes being used. For
instance, the flag 0x00000100 corresponds to O_CREAT, indicating a ”create-
only” file access mode. O_RDONLY (0x00000000) represents read-only access, and
so on. While observing the file creation patterns and correlating them with
the fcntl.h definitions, we noticed a crucial pattern: ransom notes were
consistently created with the O_CREAT flag across various ransomware variants.
This observation led to our approach of monitoring the openat system call with
the O_CREAT file access flag to detect the creation of new files, which the
generation of a ransom note would trigger during a ransomware operation. When
a new file is created, its content is analyzed using machine learning models
trained to distinguish between genuine ransom notes and benign files. This
classification is based on various features extracted from the file, such as
textual patterns, keywords, formatting, and other relevant characteristics.

Figure 3. Ransomware Detection Pipeline

If the created file is classified as a potential ransom note, our system can
take immediate action, such as terminating the responsible process or
quarantining the affected system to prevent further damage. By targeting this
critical stage of the ransomware attack chain, our approach aims to disrupt
the ransomware operation before file encryption and extortion demands can be
completed. It is crucial to note that the effectiveness of our technique in
protecting files varies depending on the specific ransomware behavior. The
majority of crypto-ransomware variants primarily fall into two categories:
those that create a ransom note after encrypting each directory and those that
create a ransom note before encrypting any files. In the former case, our
technique may sacrifice a few files and folders before detecting and
disrupting the ransomware operation. However, it can prevent the encryption of
other substantial amounts of files and folders. In the latter case, where the
ransom note is created before any encryption occurs, our technique can protect
all files from being encrypted.

Sophisticated ransomware variants often stay idle for extended periods, slowly
encrypting small volumes of files without drawing attention. In such cases,
detection techniques relying solely on high CPU usage, unlink/write activity,
or high I/O operations may not yield impressive results, as these variants
maintain a low overhead. Therefore, behavioral analysis focused on detecting
ransom note creation after the encryption of a directory becomes an important
aspect of identifying these sophisticated ransomware variants.

[t]  eBPF Pseudocode for Static Analysis [1] // Attach to tracepoints for
exec{v,l,ve,cl,lp,vp} syscalls Function static_analysis() On sys_enter_execve
trigger: pid = get_current_process_id(); comm = get_current_process_name();
log_execution(pid, comm); On sys_enter_execv trigger: pid =
get_current_process_id(); comm = get_current_process_name();
log_execution(pid, comm);
End Function

###  4.1. Real-Time Detection

The real-time ransomware detection system integrates eBPF for dual-layer
security by combining static and behavioral analysis. Initially, eBPF
tracepoints are placed on the exec syscalls to track program executions as
depicted in Algo. 3. A Python script computes the SHA-256 hash of each
executable and checks it against a malware hash dataset, terminating any
malicious process immediately. Concurrently, the same eBPF program also
monitors file creation events, capturing the file path of newly created files
if the number of creation events per process exceeds a threshold value T, with
the flag O_CREAT attribute and the corresponding Process ID (PID) of the
process initiating the creation, i.e. ransomware in the case of ransom note
creation (lines 18,19 Algo. 4.2). A Python script then retrieves these file
contents and uses our pre-trained machine-learning model to classify them as
potential ransomware ransom notes or benign files. Upon detecting a ransom
note, the script swiftly terminates the associated process using the PID
captured earlier. This swift response disrupts ransomware operations within
moments of the ransom note’s creation, preventing further file encryption
attempts. As illustrated in Fig. 3, this integrated system architecture
enables rapid and automated detection and mitigation of ransomware attacks.

###  4.2. ML-based Detector

[t]  eBPF Pseudocode for Dynamic Analysis [1] Function dynamic_analysis()
#include $<$asm-generic/fcntl.h$>$ #define FILE_CREATION_THRESHOLD T config =
{ stack_mode = ”perf”, max_strlen = 128 }; On sys_enter_openat trigger: uid =
get_current_user_id(); comm = get_current_process_name(); flags =
get_syscall_flags(); if !(pid in process_counter_map) then:
process_counter_map[pid] = {0}; if flags & O_CREAT then: pid =
get_current_process_id(); filename = get_syscall_argument(args-¿filename);
process_counter_map[pid].file_creation_count += 1; if
process_counter_map[pid].count $\geq$ T then: log_file_creation(pid,
filename); End Function

We prepare a diverse dataset, comprising both real-world ransomware ransom
notes and a wide variety of benign text files. Using this dataset, we train a
machine-learning model to accurately distinguish between malicious ransom
notes and legitimate files based on their content and characteristics.

To represent the ”ransomware” class, we leveraged the publicly available
”ransomware_notes” dataset on GitHub by Threat_labz (Threatlabz, 2023). From
this repository, we collected 170 unique ransom notes from various ransomware
variants. Additionally, we executed seven different ransomware samples in a
controlled virtual environment to obtain seven more ransom notes, bringing the
total number of unique ransom notes in our dataset to 177. To represent the
”benign” class, we utilized a diverse dataset compiled by Ken Lang (Lang,
1995), consisting of text files covering a wide range of topics, including
technology, sports, politics, business, entertainment, graphics, medicine,
space, and more. We collected 177 such files and complemented this dataset
with 50 README files collected from various public repositories and code
scripts (Python, Shell, C, HTML, etc.) to enrich the benign data diversity.

We then employ the Natural Language Toolkit (NLTK) library (Bird et al.,
2009b), to apply a set of effective pre-processing techniques on the collected
text data as depicted in Fig. 4. These techniques include tokenization,
punctuation removal, stop word removal and word normalization. At this stage,
it is crucial to preserve the keywords that distinguish ransomware notes from
benign text for which we use lemmatization.

After pre-processing, the lemmatized tokens are joined into a single string,
representing the processed content for each sample in the dataset. To extract
meaningful features from the pre-processed text, we employ two techniques,
namely, Term Frequency-Inverse Document Frequency (TF-IDF) and Chi-Squared
Feature Selection. The TF-IDF approach creates a vector representation of the
text, where each dimension corresponds to a word in the corpus, and the values
represent the importance of that word in the given text based on its frequency
and inverse document frequency. Complementing this, the Chi-Squared Feature
Selection method selects the most informative features from the TF-IDF
representation based on their chi-squared statistic, which measures the
dependence between the features and the target classes (ransomware or benign).
We find that using the top 400 features yields the best results in terms of
accuracy. The extracted features are then used to train a Multinomial Naive
Bayes classifier, with a train-data to test-data ratio of 7:3 . The trained
model, TF-IDF vectorizer, and feature selector are saved to a pickle file for
future use in detecting and classifying potential ransom notes.

Figure 4. Machine Learning Pipeline

##  5\. Preliminary Evaluation

Offline testing on collected data: Our ML-based detector’s remarkable accuracy
and effectiveness in detecting ransomware is summarized in table 2. The model
achieved an impressive accuracy of 99.76% on test data, meaning it could
reliably distinguish ransomware ransom notes from benign files. The recall
score of 0.9943, is a testament to the model’s ability to identify nearly
99.43% of the actual ransomware ransom notes present. This high recall rate
gives us confidence that the model can detect the vast majority of ransomware
attacks, minimizing the chances of missing potential threats. Moreover, the
F1-score of 99.7% highlights the model’s achievement of both high precision
and high recall, which are highly desirable traits for a robust ransomware
detection system. Notably, the average cross-validation score of 99.02%,
obtained using a 10-fold cross-validation technique, suggests the model’s
generalization capability to unseen data. A high cross-validation score
indicates a low likelihood of overfitting, as the model’s performance is
consistently evaluated on multiple hold-out subsets of the data. This high
score gives us confidence that the model can maintain its performance when
deployed in real-world scenarios without overfitting to the training set.
Real-time testing on unseen ransomware: In order to validate the efficiency
and robustness of our real-time detection technique, we tested the behavior-
based component of our detection technique with unseen ransomware samples
whose ransom notes were not part of the training data. Our detection model was
able to successfully detect the ransomware operation and kill the ransomware
process in just 5.4 seconds for the IceFire ransomware and in 2.5 seconds for
the REvil ransomware as shown in Table 3. Notably, these ransomware samples
typically take about 1.5 minutes to completely encrypt the sample files in the
VM if not intervened upon. This real-world testing demonstrates the
effectiveness and rapid response capabilities of our solution, minimizing the
potential damage caused by ransomware attacks.

Table 2. NLP Test results Metric | Value
---|---
Accuracy | 0.9976
Precision | 1.0
Recall | 0.9944
F1-Score | 0.9972
Average CV Score (K=10) | 0.9902
Table 3. Real-Time Detection Results Ransomware | Result | Time to Detect (secs) | Affected Files
---|---|---|---
HelloKitty | Success | 1.023 | 0.07%
REvil | Success | 2.529 | 0.39%
IceFire | Success | 5.403 | 0.56%
Kuiper | (FN) | - | 100%

##  6\. Related Works

Existing ransomware detection techniques primarily fall into two categories:
Static and Dynamic approaches. While these methods provide valuable insights
into ransomware activities, they often exhibit several limitations such as
failure to detect zero-day attacks, low accuracy, higher computational
overhead and longer detection times.
Static detection techniques employ hash-based and/or signature-based detection
which rely on predefined patterns to identify ransomware executable and/or
their variants. These patterns are typically derived from known ransomware
samples. While static analysis can effectively detect known ransomware strains
with high accuracy, it struggles with detecting polymorphic or previously
unseen variants, i.e., zero-day attacks (Moser et al., 2007). Moreover,
adversaries can easily evade detection by altering the code structure or
through the obfuscation of ransomware executable, rendering static-based
methods less effective in dynamic threat landscapes. Zhang et al. (Zhang et
al., 2019) proposed a static analysis framework based on N-gram opcodes with
machine learning for ransomware classification. However, handling obfuscated
or polymorphic code still remains an open concern.
Dynamic detection techniques involve runtime monitoring and analysis of system
activities and behaviors to detect anomalies, suspicious patterns, or
deviations from established norms that may indicate the presence of ransomware
or other malicious code. By analyzing runtime behavior, these methods can
potentially identify previously unknown or emerging ransomware variants,
including zero-day attacks. However, behavior-based approaches may generate
false positives when the legitimate applications exhibit similar behavior
patterns, resulting in reduced accuracy and increased operational overhead.
Kharraz et. al. (Kharraz et al., 2015) proposed monitoring abnormal file
system activities as a mechanism to identify ransomware. They further extended
their research by developing UNVEIL (Kharaz et al., 2016), a dynamic analysis
system that detects ransomware by monitoring and analyzing the behavioral
patterns of file system activities such as suspicious I/O operations, file
modifications, and changes to the desktop environment that are indicative of
ransomware activities.

Scaife et al. (Scaife et al., 2016) developed CryptoDrop, employing techniques
such as calculating file entropy using Shannon’s formula, measuring file
version similarity through hash comparisons, and tracking file deletions to
detect ransomware. Similarly, Chen et al. (Chen et al., 2018) proposed
monitoring file deletions, creations, renames, and changes for ransomware
detection. Our behavioral model augments these work by detecting the creation
of ransom notes.

##  7\. Conclusion and Future work

To summarize, we proposed a two-phase approach for timely detection and
deterrence of ransomware attacks by developing new eBPF and ML algorithms. The
novelty of our work lies in the adoption of eBPF for automated static analysis
that gets triggered at the time of execution of new processes in the system.
Further, we have also presented a novel behavior-based ransomware detection
using the eBPF and NLP through the detection of ransom notes.
Future Work: We are working on extending the static analysis phase with the
creation of pattern matching based Yara rules that can further improve the
detection capabilities. We also aim to develop a more robust behavior model
that can build on the sequence distinct process/file operations and correlate
the time-series data to aid for robust recurrent neural network based models
to detect any zero-day attacks.

## References

  * (1)
  * nat (2023) 2023\.  National Cybersecurity Strategy.  (2023).  https://www.whitehouse.gov/wp-content/uploads/2023/03/National-Cybersecurity-Strategy-2023.pdf
  * Abuse.ch (2024) Abuse.ch. 2024.  MalwareBazaar Dataset.  https://bazaar.abuse.ch/export/. (2024).  Dataset containing SHA-256 hashes of malware samples.
  * Alasli and Ghaleb (2019) Mohammed Alasli and Taher Ghaleb. 2019.  Review of Signature-based Techniques in Antivirus Products. 1–6.  https://doi.org/10.1109/ICCISci.2019.8716381
  * Beaman et al. (2021) Craig Beaman, Ashley Barkworth, Toluwalope David Akande, Saqib Hakak, and Muhammad Khurram Khan. 2021.  Ransomware: Recent advances, analysis, challenges and future research directions.  Computers & Security 111 (2021), 102490.  https://doi.org/10.1016/j.cose.2021.102490
  * Bird et al. (2009a) Steven Bird, Ewan Klein, and Edward Loper. 2009a.  Natural language processing with python.  O’Reilly Media, Sebastopol, CA.
  * Bird et al. (2009b) Steven Bird, Ewan Klein, and Edward Loper. 2009b.  Natural language processing with Python: analyzing text with the natural language toolkit.  ” O’Reilly Media, Inc.”.
  * Calavera and Fontana (2019) D. Calavera and L. Fontana. 2019.  Linux Observability with BPF: Advanced Programming for Performance Analysis and Networking.  O’Reilly Media, Incorporated.
  * Chen et al. (2018) Li Chen, Chih-Yuan Yang, Anindya Paul, and Ravi Sahita. 2018.  Towards resilient machine learning for ransomware detection.  ArXiv abs/1812.09400 (2018).  https://api.semanticscholar.org/CorpusID:56895515
  * Dejaeghere et al. (2023) Jules Dejaeghere, Bolaji Gbadamosi, Tobias Pulls, and Florentin Rochet. 2023.  Comparing Security in eBPF and WebAssembly. In Proceedings of the 1st Workshop on EBPF and Kernel Extensions (eBPF ’23). Association for Computing Machinery, New York, NY, USA, 35–41.  https://doi.org/10.1145/3609021.3609306
  * Kharaz et al. (2016) Amin Kharaz, Sajjad Arshad, Collin Mulliner, William Robertson, and Engin Kirda. 2016.  UNVEIL: A Large-Scale, Automated Approach to Detecting Ransomware. In 25th USENIX Security Symposium (USENIX Security 16). USENIX Association, Austin, TX, 757–772.  https://www.usenix.org/conference/usenixsecurity16/technical-sessions/presentation/kharaz
  * Kharraz et al. (2015) Amin Kharraz, William Robertson, Davide Balzarotti, Leyla Bilge, and Engin Kirda. 2015.  Cutting the Gordian Knot: A Look Under the Hood of Ransomware Attacks. 3–24.  https://doi.org/10.1007/978-3-319-20550-2_1
  * Lang (1995) Ken Lang. 1995.  Newsweeder: Learning to filter netnews. In Proceedings of the Twelfth International Conference on Machine Learning. 331–339.
  * Lévai et al. (2023) Tamás Lévai, Balázs Edvárd Kreith, and Gábor Rétvári. 2023.  Supercharge WebRTC: Accelerate TURN Services with eBPF/XDP. In Proceedings of the 1st Workshop on EBPF and Kernel Extensions (eBPF ’23). Association for Computing Machinery, New York, NY, USA, 70–76.  https://doi.org/10.1145/3609021.3609296
  * Mansfield-Devine (2017) Steve Mansfield-Devine. 2017.  Ransomware: the most popular form of attack.  Computer Fraud & Security 2017, 10 (2017), 15–20.  https://doi.org/10.1016/S1361-3723(17)30092-1
  * Moser et al. (2007) Andreas Moser, Christopher Kruegel, and Engin Kirda. 2007.  Limits of Static Analysis for Malware Detection. In Twenty-Third Annual Computer Security Applications Conference (ACSAC 2007). 421–430.  https://doi.org/10.1109/ACSAC.2007.21
  * Scaife et al. (2016) Nolen Scaife, Henry Carter, Patrick Traynor, and Kevin Butler. 2016.  CryptoLock (and Drop It): Stopping Ransomware Attacks on User Data. 303–312.  https://doi.org/10.1109/ICDCS.2016.46
  * SonicWall (2024) SonicWall. 2024.  SonicWall Cyber Threat Report.  (2024).  https://www.sonicwall.com/threat-report/
  * Threatlabz (2023) Threatlabz. 2023.  An Archive of Ransomware Notes Past and Present Collected by Zscaler ThreatLabz.  (2023).  https://github.com/threatlabz/ransomware_notes Accessed: 2024-05-15.
  * Zhang et al. (2019) Hanqi Zhang, Xi Xiao, Francesco Mercaldo, Shiguang Ni, Fabio Martinelli, and Arun Kumar Sangaiah. 2019.  Classification of ransomware families with machine learning based on N-gram of opcodes.  Future Generation Computer Systems 90 (2019), 211–221.  https://doi.org/10.1016/j.future.2018.07.052