Can I put it here? Great. We'll be starting in one minute, counting down 60, 59. So last time I checked, I don't think I acknowledged or know anybody of you, so I'm not going to skip the first part kind of introduction myself. OK, we'll be starting now. Good afternoon. So it's my pleasure to be here today. The topic of today is an agile approach to thread modeling for securing Ajax Foundry. In this talk, I'm going to share some knowledge and lessons we learned during our journey of Ajax Foundry development. So before we start our session officially, please allow me introduce myself. Of course, my name here, King Yuzung. I'm working based out of Raleigh, North Carolina, or specifically Research Triangle Park, if you are familiar with the area. As a security architect in the IoT platform division of the Dell technology, I've been involved into a couple of open source as well as commercial products. In the open source project Ajax, I'm one of the major code contributors for the security component. And currently a co-chair of security working group. Before taking the position in Dell, I was a principal engineer in RSA security where I got involved into a couple of security products, including data loss prevention, or thread detection, and response. OK, after wasting about one minute of you guys, so let's go back to the business. This is today's session agenda. We will start with the first question, what is Ajax? The answer will be covered in the section one. Just like every open source project, the Ajax is facing all kinds of challenges here. So in section two, we are trying to just go over the security challenge we have. To address the challenges, we'd better to invest the tools that work. Thread modeling is one of the kind. So in section three, we are going to cover the thread modeling. Like what is thread modeling? What can we do with thread modeling? How can we perform thread modeling? So after section three, we have some ideas about thread modeling. We are going to use Ajax example. And trying to apply the background information knowledge we learned from the section three into the Ajax project to address the challenges we have. OK, this is section one about Ajax Foundry introduction. So we are going to answer the questions like what is Ajax and why we developed Ajax and what are the principles we are trying to follow during our designing and implementation of Ajax and how Ajax works. It is vital, important to understand the background information here before we bring the security into the table. OK, Ajax Foundry, where we call the Ajax most of the time, is open source, vendor neutral project. In Ajax, we are trying to build a framework that provides the interoperability and compatibility for the Ajax computing. So it is a platform independent. Means it supports both x86 and ARM architecture. And it works on Windows, Linux, or Mac, if you like. And it supports the customized plugin module. Those modules could be written with different languages. We support them through the common REST APIs from the framework. So the motivations behind the Ajax framework in today's IoT world, it is very noticeable that there are so many platforms available. It could be good or it could be bad. Depends on your viewpoints. So Ajax is trying to get into the place where we build and promote a common framework unifying Ajax computing. So it encourages the community to create ecosystem of plug and play. So any part of the platform could be replaced, could be upgraded, or it allows the security, the service to scale up and down based on the security, the services, capacity, and user cases. And it's very helpful to provide the tools to create Ajax-based IoT Edge solution quickly. So in the same time, collaborations between the open source projects and the standard group will benefit the industry as well. So as we see here, that is the high-level architecture of the Ajax. In the center of the architecture, we have the core service. So this mark is the grid. The dark area, those are required components that serve the foundation of the system. So it includes core data, command, metadata, registration, and configuration service. On top of the components, we are having replaceable or reference service, such as the scheduling, alert, notification, and the distribution service. So these are loosely separated. And we are trying to define the northbound and the southbound over here. The northbound here refers to the cloud side mainly, either the public or in-house. The southbound of the Ajax, that is, we are the devices, sensors, meters, thermostats, rest. System management and security are the service kind of cross-bounds, as we see here on both sides. And these are considered as a part of the underlying infrastructure. How the Ajax works currently. So Ajax is composed of a dozen of microservices.  So each microservice is responsible for a single feature of the system, such as a sensor data collection or data persistence, data exporting, system scheduling, et cetera. So the microservice communicates which is other through the address API interface. That's providing the maximum flexibility over here. The Ajax can be deployed through the Docker or Docker compose file, or snap distribution, which is another container system, if you like. And even the Ajax can be run over the native system. If you would like, just kind of a binary will build out of those source code. Okay, so this is the agenda for this section two. So every project has a challenges, and every project has its reward. In section two, we are going to discuss the challenges in the Ajax project. So focusing on security part. Of course, this is probably a major topic here. So Ajax roots in the IoT field. So it faces a similar challenges as other IoT projects. Ajax is open source project as well. So it has similar challenges as other open source projects. So we are in need of a strategy and track approach to respond to the challenges over here. So the power of the IoT device is improving rapidly in the past year. What could be done with the big bulky system in the past can be implemented into a very tiny chip right now. However, compared with the computers or other device, it still has very limited storage or processing power. And not like the PC or mic. Update of software could be just a click away here to upgrade an IoT device. Sometimes it requires multiple steps or even physical access. Authentication, authorization and secure communication are big issues in IoT as well. So taking example of the smart thermostats that send the data and receive the commands to change the temperature setting remotely. How could we just know the reading are authentic and the command to change the temperature is not from malicious users? And how we make sure the data reading would be stolen by some other unauthorized users. Those are questions we have to face and we have to answer. Security challenge exists in the open source project as well. This code base available for all the public. So we wish anybody who is interested can just step up and do the code review trying to catch the defects before adopting that. However, unfortunately, this is not the case all the time. And it is challenging to review the code base and identify the security issues in a short term without help. So nowadays it is almost impossible to find a software that doesn't depend on the third party modules. These modules bring potential security risks as well. And like any software development, a switching hands of the developers in the open source project is available and the design could be changed later as well. The security loopholes could be introduced around the same time. So to address those security challenges mentioned above, we introduce a threat modeling into our project. So threat represents a potential danger to something value in the system. The modeling is just a procedure to identify these value resources, recognize a potential tax against the resource, plan and implement some sorts of methods to reduce or remove the dangers. For the contributors of open source project, it provides guidance on security compliance. For the end user, it helps understanding what and where the potential attacks might happen. Instead of a band-aid style security plaques, it provides a progressive and practical approach to enhance the security of the project. So this is the section three we are going to cover. As we mentioned previously, threat modeling provides so many benefits for a project. So the next question that comes out is, how do we do it? In section three, we are going to find out the formal definition of threat modeling and when is the time to do that and who can do that or how can we do that? So here's the definition of a threat model and threat modeling from the open web application security project OS dot org. As we can see here, threat model is defined as a structured representation of all the information that affects security of application. The threat modeling here is a process of capturing, organizing and analyzing all the information and it enables the decision making about the risks. The output of threat modeling is a prioritized list of security improvements to the concepts, requirements, designs, or implementations. Basically it covers the whole scope of the software development. When should we start threat modeling? So just like the software development, the best time to start threat modeling is before we write the first line of the code here. It is time to recognize the risks and build the solutions into the system and it's cost efficient to make changes easily. However, it is not realistic for a lot of projects currently. So with agile development, whether adopted, it is a good idea to have the threat modeling at the start of each sprint to make sure the proposed new features are not introduced in the potential risks. At each milestone release of the project, having threat modeling with product roadmap will display much clear picture of the product and gaining as confidence on the security improvement. So in nutshell, performing the threat modeling when the system has changed, if you can. So who can do that? While there may be understanding, there might be a misunderstanding here that we have to have a security expert to the threat modeling. This is not true. So think about who is the best person to understand the product or the module in your team. The person could be in your team already. It is not very difficult to perform a threat modeling as long as the proper procedure is followed. So the goal would be far away and reachable. What if the project includes millions of lines called and too big to handle that happens all the time as well? So start from a smaller module, applying the threat modeling approach and expanding the coverage. So you will reach our goal sooner than you think. Okay. Let's go to the steps for the threat modeling here. The first type of threat modeling is to understand the system architecture and create a model that reflects the architecture and trying to bring down the smaller piece. So this type can be iterated further until each piece contains a small single feature. It is okay to have some abstracts for hiding the details so that it can be viewed as a whole during the one iteration. Next step, we utilize data flow diagram or whatever data flow graph you like to expose interaction between those components. So this is where we draw the trust boundary. With the trust boundary of the component, the communication is considered safe and reliable. Another important factor to be identified in the step here is called asset. So this is something we are trying to protect and attack from my interest at least. Having those information in mind, so we can move to the next step, which is identifying the potential attacks. Okay. Probably quite a few people already seen those triangle before that represents confidentiality, integrity, availability, or as known as CIA tried. So these are top three fundamental property of security in the threat model. So the confidentiality ensures the information can only be accessed by authorized individuals. Integrity ensures that the information is authentic and reliable. And availability means the resource accessible to meet a business need. In threat modeling, that's one more thing we have to think about. That's called non-repudiation, which means someone cannot deny something he has done. A good example would be data signature. A lot of people have been using that, which means your digital signature can only be used by the individual who send it. Okay, so taking those security factors and think from the opposite direction means how these properties could be violated. Then we have one of the most matured classification tech model here, Stride. Stand for spoofing, tempering, repudiation, information disclosure, denial of service and elevation of the privilege. This was promotes by Microsoft about data's goal and it was widely accepted as one of the practical methods of threat modeling. Because it answers very basic question, but very important question, how will my system be attacked by the hackers? Spoofing means an individual could pretend to be someone else other than himself. Tempering means an individual could modify something and the repudiation means an individual could deny what he did. Information disclosure means providing information to an unauthorized individual. The denial of the service means absorbing the resource so that the service is available for legit users. The elevation of the privilege means an individual in a lower privilege group could access the resource that are available for the higher privilege group user only. Once we identify those trust boundaries of the component, a set of need to be protect and the strike model, a strike threat, we are moving to the next step. That means we are trying to mapping these threats against the components. Let's imagine a user case that a module reveals temperature reading over a port and store the data onto the disk. The data will be our asset to be protected and the trust boundary is identified as a port. So based on the strike attack model we discussed before, is proofing possible? Yes, anyone can send data over the interface. Is tampering possible? Yes, the data could be modified before arriving at the port. How about a non-repudiation? Is it possible? As well, because owner of the device could claim, oh, we didn't send out the data reading at all. Information disclosure? Yes, of course. The reading data belonging to one device could be obtained by another un-threat user as well. And how about the denial of stories? It is possible. Because millions of requests can be sent to the port to use up all the resource over there. And how about the last one, the elevation of the privilege? Yes, the data could be constructed in a way that is to be used to change the user's group. Here we are recognizing all the potential attacks from multiple viewpoints. And next time we are trying to just reduce or just remove those threads. For reduce or remove the threads, we call that thread mitigation. So this is the stage of the thread mitigation as we displayed here. And if the threads are exposed during the design stage, which is pretty good, and we have the great chance to update the system design, adding the security enhancement or improvement over here, if they are exposed during the milestone release, which happens as well, it is good approach to include such information and possible solution in the project roadmap so that the user developer understand what we are going to address regarding security next step. So if a solution is not available, where the risk is considered very low, so it is not uncommon to accept and document the risk. And the last resort, probably not pretty, just transfer the risk without fixing it. This looks like city, whatever. However, if you read a lot of the term, service or license agreement of the software, you will find out, they do that way. Okay, this is our section four. We already understand what is thread modeling, what is thread model and what steps. So we are going to just use our project adjunct as an example to see how we are going to apply them. So this is a common practice. We can use that for any project if you like. When we go back to the high-level architecture of the adjuncts, so we learn from the top most level, as you can see. So this is kind of what they were divided into a different categories and loosely divided as the southbound and northbound over here. On the southbound over here, the sensor data is collected by the device service from the thing. And it is a place where adjunct interacts with outside world. So we define as trust boundary over here. The trust boundary is identified on the south side. On the north side, that is, we are connecting with the enterprise or cloud system. So which is another place where interaction with outside world of the adjuncts happens. So this will be another trust boundary we are defining. So in this level, our site are the rest API and points that could be consumed by the external entities. And those are the resource we are exposing to outside world. And those are the resource we are trying to protect in this level. When applying the strike model, we mentioned in the previous section on the site over here, we have the attack tables. As we can see here, we have assets we are trying to protect on this level and we have the threat against them and we have possible method of such threat. And even we have a severity level associated with those information. Those table gives us a clear and trackable list about what we are going to start regarding the security improvement of the adjuncts. Taking example of the table over here, we have a device rest API. The threat is spoofing and the method here is the attacker sends the data with a fake identification of the IoT. And we think, okay, this is severity is high, which we need to just address or just fix it. And the same device service rest API and it's facing the threat of information disclosure. One of possible method for information disclosure is manage the middle attack and the severity is high as well. And that's what we are going to protect. By following these steps, you are identifying the assets, you are identifying the threats of possible methods severity and the next step, let's just try to fix them. Once the threats are recognized, it is time to reduce or remove them. In the architecture level, we decide to adopt various technologies for the mitigation. So for example, in our projects, the rest API endpoints need to be protected. So we utilize API gateway to reduce attacking surface. A metering mechanism can be implemented in the API gateway to prevent the denial of service attack. And we implement the JSON web token, JWT, as well as all authentication with API gateway to mitigate the threat of spooving. Such steps can be performed in the next level of the smaller components. So let's go back to this architecture diagram here. We notice the dark side, again, that is the core service and the service around them are optional. The data is passed to the core service from the local persistence and the commands are passed over the core service for device and meters. So when we draw the trust boundary around the core service, we are identifying a new attacking surface and new assets. So for example, here in this level, we notice some microservice need a credential to access the database. So these credentials become the new assets we are trying to protect. And applying the threat model, and we are learning what kind of attacks may happen and what mitigations we need to adopt. So this approach can be applied repeatedly to the lowest model of the system to maximize the benefit of the threat modeling. With such least threats and mitigation strategies, the security is no more a hassle but a manageable and trackable approach. So in conclusion, with your threat modeling helps the team understanding and evaluate the security threats and the solutions quickly. And it is a practical approach to expose threat in different stage of development. So threat modeling is adapted in different level of the scope of the open source Ajax. We encourage every team to try on threat modeling and share the result with the community. At the end of the presentation, this is the least of the reference regarding threat modeling as well as Ajax Foundry. And these include books, technical talks, and links. More details of threat modeling can be found over there. And here we are just open the QA session, please. Can I just repeat the question a little bit? Yeah, so basically, we're assuming you're interacting in the larger world, what's the practical... Okay, so his question is what kind of a guideline we are finding where we feel that's helpful for those connecting between the Ajax and other device, probably northbound device or southbound device, right? So that's... Or some kind of horizontal. Yeah, horizontal is another topic as well. So the approach we are trying to get here is we are trying to just reduce the connections of the Ajax here. If you have an open model over there connecting from all around the world, so it's very difficult to detect. So in security means you'll have an open attacking surface which is not good at all. So one of the approaches we have here is just trying to reduce the attacking surface. And we open very limited port from Ajax. As you can see, we are opening quite a few REST APIs. That is either for the northbound side, but the southbound side, you'll see, they have different MQTTE or zero MQO, all kinds of connections. So in the Ajax, what we are doing here is we are trying to have a device service. So the device service is a single point to connect all those things. And if we decide the security trust boundary inside Ajax, that is another layer of the security trust boundary we connect, we are trying to define between the device service and the core part. We are trying to protect over there. If you define the trust boundary outside the Ajax, which is outside the device service, so you are facing all kinds of protocols MQTTE, zero MQO, and basically that's the problem, that's probably you have to kind of analyze the device and make sure those connections are protected. For MQTTE, you have those password credentials or for others you probably have applied the SSL or GLS. So basically that's the approach we are doing here. This, mm-hmm, yep. Okay, so this is probably a bigger topic we are not gonna cover here. Lynx Foundation has a project called A-Edge. So I'm not sure if you're familiar with that part. The Ajax part of the edge, the edge project starts at the beginning of this year starting from January to address those unifying the platforms where the kind of what you describe here as a far and edge, those smart device stuff. So Ajax here is serving as a center part of the framework. What you are describing kind of little bit of far and we have other project to address it. So think this as kind of our gateway to connecting all the information here. And there's other products trying to just intercept the traffic inside the Ajax. So they are analyzing the data as you describe just now. Those smart things, the traffic, they might be heavy but on their side the computing power is really, it's weak. So we cannot rely on them to just kind of detect attack. So instead we have to just kind of push a little bit higher on the Ajax side to just detect those malicious behaviors to detect attacks. So every project has a scope. So for the Ajax foundry is in the center as kind of a gateway part. So on the other side, I would say right now we are not going to cover that. We can just detect that. We can just tell probably and use the, okay, there are some malicious behavior on your IoT device side, but probably that's it. That's the scope for the Ajax foundry currently. I think if you're talking about the data center of the cloud side, the target side is kind of the local. It's not on the north side. So what you are describing the TVC part as I described back to the scope here on the north side. So we have an interface. It's called export service. Those are the place you're connecting with your cloud, with your maybe in-house data warehouse. And for this part, Dell has a hardware Dell gateway. So this one sits over there. Of course you can install this on different gateway system, not necessarily Dell or probably from Cisco for others. So this is not as powerful as the cloud side but it's not as weak as the far end of the edge. So it's set in the middle. So think that like described just now, think that as a gateway or half. So this is the kind of a deployment scope. I hope that answered your question. Okay, sure, no problem. Yeah. Mm-hmm. But this will be a variety of different examples. Okay. I think there's a one deployment scope, which is, you are describing here for the Ajax, means you're probably running multiple Ajax box, currently and they are connecting with each other and they are changing data, things like that, right? So I think this is something we are going to address during our next release. So we have the Ajax 1.0 release June of 2019 for the next roadmap. I think it's in coming October. Probably we can find more information over there. So the roadmap and the architecture and that's open to public. We are on the, let me just go back here. The last part that is a weekly page. So we can find there and we have the working group meeting weekly. So anybody is open to join. So I think the questions you have here could be answered there as well. Thank you. Sure. No more questions? Okay, thank you very much.


Welcome everyone and thanks for coming. As Philip says this is my second time in the seminar the last one was almost two years ago it's how to believe that we've been doing this for two years hopefully. Next time that we'll do it will be other options. So what I want to discuss today is what's been going on. Beyond the classical theory of uniform distribution in the last few years. So this is a very introductory level talk. So I apologize in advance for people who are more expert I see several here in the audience. It's not for them. It's more for people from outside the subject. The plan is to give a five minute survey of the theory, the classical theory of uniform distribution. That's a theory that started out about a century or so ago, works by Hardy and little world by a man by the corporate and other people. And this is a theory that has been going on for a while, and much more recently, the focus of the research is moved to much finer quantities which I will describe presently, namely near nearest neighbor spacing pair correlation related quantities. And some of this research has been driven by questions that have come from outside of number theory or even mathematics, which have to do with problems in quantum chaos. And also from new features of the zeros of the Riemann's data function which are being discovered about 50 years ago. So, which are also very briefly described. And so the plan is to spend a few minutes on the classical theory of uniform distribution, then define these finer statistics and describe how they occur in random models. And then in the theory of the Riemann's data function and in quantum chaos. This will be just a few minutes and then in the second half of the talk, I will discuss how these quantities are manifested in the examples and standard examples of classical uniform distribution theory, new things to be done. So let's just start with the classical theory of uniform distribution. And in this theory we take a sequence of real numbers and look at the fractional parts, which are numbers between zero and one. And then we say that the sequence is uniformly distributed mode one. If any sub interval of the unit interval of the unit circle contains the proportion of points as it contains is asymptotically the length of the interval. So that's this definition here. And in particular, uniformly distributed sequence must be dense. Here are three examples, numerical examples. The first one is you take the numbers just to be an arithmetic progression. And an irrational step. So take root two times and to be definite and look at the fractional parts of that sequence. And here is the histogram of these fractional parts of what you see here. And took 10,000 points and running from one to 10,000. And I bin them into, I think 20 bins, each of one over 20. And you see the height of the bars is the number of points that fall into each bin so there's roughly 500 points which fall into each bin. Here's a particular example of root two times in. So this is uniform distribution, whatever the definition is, this is uniform distribution because each bin visibly contains essentially the same number of points. Here's another example, instead of root two times then let's take the sequence login and look at its fractional path. And now if you look at this experiment where I take 10,000 points and divide them into bins into 20 bins, visibly, not all bins contains roughly the same number of points. So this sequence is experimentally not uniformly distributed. And as an exercise I suggest that you just prove that it will not be distributed. So these are two easy examples. Here is another example which is not too difficult when you take the sequence to be square root of integers and look at the fractional parts. And then you see here that it is roughly uniformly distributed, because the bin heights seem to oscillate around 500 which is the main value. It's not as uniformly distributed as this so-called chronicle sequence of root two times and but it's certainly uniformly distributed if you compare it to the picture of login. So these are three good examples to keep in mind and I think the experiments are very convincing. So let's look at more examples without the numerics this time so the example that I discussed can be generalized instead of root two times then you take alpha times in. If alpha is one then the fractional part will always be zero so that's not so interesting so you make alpha irrational and then the statement is that the fractional parts of alpha times and are uniformly distributed. Alpha is irrational. The example that we looked at before can be proven not to be uniformly distributed the fractional parts of login. So this was all known in the beginning of the 20th century. The German vial made a huge breakthrough in this theory and invented the method that allowed one to prove various sequences are uniformly distributed. For instance, if you look at alpha times n squared, when alpha is irrational, then vial prove that this is uniformly distributed. So this invented the method of what are called now vial sounds and vial differencing and so on for this purpose. And more generally, if you take the values of any polynomial at integer points, as long as there's one non-trigger coefficient which is irrational then the sequence that you get is uniformly distributed. Again, this is German vial. Another example that will be particularly relevant for me is instead of n squared, you take n to the theta. Well theta is any number. So if theta is an integer then this falls on the vial example. But you can take non-integer thetas. For instance, the case I'm interested in is theta equals a half. And the statement is that for any non-zero alpha and any non-integer theta, the sequence alpha times n to the theta is uniformly distributed. So again, this is old stuff. And some people who want to read up on this, there's a classic book by Coipers and Niederleiter, which describes this theory very succinctly. Another example of a result in a classical result, which I think is due to vial, is that if you take any sequence of distinct integers and look at the dilates by multiplying them by alpha, then for almost all alpha, you get a sequence which is uniformly distributed. Almost all is in the sense of a big measure. Now if you apply it to the sequence of powers of 10, for instance, the statement is that almost all dilates of 10 to the n are uniformly distributed and that turns out to be equivalent to the statement that alpha is normal. What is normal? You take the base 10 expansion of alpha. And for instance, you'd ask how often is the digit 3 appearing? What proportion of the digits that you get equal to 3? And the answer should be 1 tenth because 3 shouldn't be different than 5, 7, 9 or 2. Likewise, if you take any string of k bits, k digits, with k is fixed, let's say k is 7, so any string of 7 digits should occur equally often. That means with frequency 1 over 10 to the 7 in the decimal expansion. The number that satisfies this is called normal and Val's metric theorem says that almost all alphas are normal in base 10 or base 3 or base 2, any of your favorite bases. So this normality is a subject that I think was started by Emil Borrell in the beginning of the 20th century, and this gave a proof of that almost all numbers are normal, but we don't really know any natural, any nice number that is normal. For instance, we don't know that root 2 is normal or cube root or two or pi or he or any algebraic number is not known to be normal, even though we believe that any algebraic irrationality is normal in any basis. There are explicit examples that you can write down that are provably normal for one base. For instance, you know, I believe when he was in high school or an undergraduate wrote down this number so you take, you just concatenate all the number of base 10 expansions of consecutive integers like for 0.12345678, 91011 and so on. And this you can prove is normal to base 10 but is not known to the best of my knowledge to be normally many other base. And there are other examples like this, I wrote down the one which is due to Stoneham, which is normal to base two, but was proven not to be normal to base six. So the study of normal number is a, it's still a big and ongoing subject in the, for instance, we want to cover shared was here in the audience is an expert on this and there are many interesting questions about them but the most for me the most interesting question is whether roots to is normal and that is not. There are many preprints proving it but none but survived. Okay, so this in a few minutes is the classical theory of uniform distribution some of the highlights. Now let's move beyond. So once we know that the sequence is uniformly distributed. So look at finer statistics. These are people have started looking at those only very recently on the scale and the time scales of this theory. So discuss to such quantities, the level spacing distribution and the pair correlation function. So here's the definition you take a sequence of points in the unit interval the unit circle. So this is from x1 to xn. And now let's order them. And when you order them. This is a non trivial operation will give them a different name. So people call this the oldest statistics. So in the example we had before we took a square root of two times and that's an ordered sequence of real numbers but when you look at the mod one the order and gets mixed up. It's something completely different so to, to highlight this I gave them different names so the ease of the order statistics it's the same sequence of points but now labeled according to the order in which the line the unit interval. Okay, once you order them, you look at the gaps between nearest neighbors in this order. The end points in the unit interval then on average the size of the gap is one of them. That's the definition of an average. And you ask for the distribution of these gaps on the scale of the mean gap. You look at the proportion of nearest neighbor gaps between these older elements, which are, let's say between zero and X over in the typical gap, the average gap is one of them. And you take the limits and hope that the limit exists and if it does exist. You hope that it's given by some continuous density, and then density is called the level spacing distribution. So this is the line that the limits are not guaranteed to exist and the need not exist, but many interesting cases we believe they exist. So this is the level spacing distribution it's this distribution of new gaps between nearest neighbors of the sequence once you order. So that's one quantity. I'll show you examples in the next slide. The first quantity is simpler. It's called the pair correlation function. Again, it's not guaranteed to exist, but I'll give you a definition. So, in the level spacing distribution I looked at the gaps between nearest neighbors for the pair correlation function I look at gaps between any any two points in the sequence so now I don't need to order them. Okay. So I look at the number of gaps between any two points of the sequence which are less than a given multiple of the mean gap game the mean gap is one of them. Then I divide by n and take a limit and hope that that limit exists and if it exists that it's given by some nice density, and that density is called the pair correlation function. Now, let's go back to the levels facing distribution. By definition, it is a probability distribution, because you are asking for an asymptotic proportion. It may not exist, but if it exists, it's a probability distribution. In the case of the pair correlation function. It's not a probability distribution. And let's look at this definition so how many pairs of elements do I have I have roughly n squared pairs. So why am I dividing by n and not by n squared. So this reasoning for people who haven't seen this. It's true that they have n squared pairs, but the average gap is one of the end. So you assume that the difference, let's say that these numbers are all that the difference between the two of them will be roughly divided by n. So as soon as j minus i is big, then you will not be less than t over n. So each x i will only have a bounded number of other points which which high distance t over n from it. And since the end choices of x i that's why we divide by n. Okay, so people digested it. But these are the two quantities. The pair correlation is easier to define because it doesn't need this non trivial operation of ordering the levels it's easier to define it easier to study. But it's not a probability distribution and that gives you some other problems. Levels facing distribution is very intuitive. If you just stared it. But it requires this really non trivial operation of ordering the weapons. So look at examples not of deterministic sequences but of random sequences, because I want to know what to aim for when trying to prove something. So the first example is what is called a picket fence, you just look at capital and points, which are equally spaced. And let's say the end. You look at little n of a capital N, little and running from one to capital N. So the difference between successive points here and you don't need to order them become ordered is one of a capital and all the nearest neighbor spacing are all the same. When you normalize them you get the normalized nearest neighbor spacings are all one. And so the level spacing distribution is just a delta function. So this is not very exciting, but this is what it is very simple to study. Let's look at this more complicated never example. So you take random points in the unit in the unit interval random means you take capital and independent uniformly distributed points in the interval. And the question is, is the limiting levels facing distribution and it's an exercise in probability theory that the answer is yes. And that the level spacing distribution, let's say the expected value that's a simple thing to discuss is given by this exponential distribution. The plot here, it's the green curve. So I plotted the level spacing distribution for the case of uncorrelated levels it's called the Poisson ensemble Poisson model. Another thing that is easy to compute in this model is the pair correlation function and it turns out to be one. So that's the plot of the pair correlation function. Again, it's not the probability density it's it's it's not into the book. So that's the second example we had the picket fence we have the Poisson model. The third example is much more complicated. So instead of looking at random points in the interval. You look at Eigen values of random matrix. There are many flavors of random matrices, the whole subject called random matrix theory. So, I think the original, almost original flavor was to take the so called Gaussian ensembles, for instance the Gaussian autonomous ensembles which means you take a random and buy in real symmetric matrix. So random matrices and real Eigen values. So, randomness would mean that the matrix entries are independent Gaussians and you sort of choose the variance appropriately I won't describe it. Another example is, and by and so real symmetric you can take complex submission matrices again you get real Eigen values and that's called the Gaussian unitary ensemble and flavor which is technically easier to study is you take a random, for instance, random by and unitary matrix and look at its eigenvalue. So the matrices are random with respect to how measure on the unitary group, the eigenvalues are random but not independent the correlations in them. This is called the circular unitary ensemble which is Dyson's name for this particular way of choosing random matrices. In all these cases, you can work out what the level spacing distribution distribution of nearest neighbors. It's a non trivial thing. And it was done in the 60s. And, right, instead of writing down a complicated formula, I just, I just plotted here this red curve, which is what you get from the Gaussian ensemble. The Gaussian unitary ensemble is visibly very close. Okay, and you can also compute the pair correlation function that's easier and for instance for the Gaussian unitary ensemble, it is given by one minus the square of the sine kernel. So here is a plot of the three pair correlation functions for these models. The green one is Poisson which was one. And then there is the blue one is for GOE and the orange one is for GUE which is for GOE it has this nice explicit formula. What you see here is that for the random matrix theory, the pair correlation functions vanish at the origin, as does the level spacing distribution, while for the Poisson ensemble, the distributions do not vanish at the origin. And this is called level clustering, while for random matrix theory you get what's called level repulsion. There's very small probability of having close eigenvalues on the scale of the mean spacing. So that's what we now are aiming for. So now let's see how this is encountered in real life. Okay, so one version of real life is quantum chaos. So here's a particularly simple model of a quantum system. It's a quantum billiard. So what is a billiard for our purpose is that it's a plan of domain with let's say piecewise smooth boundary like this one. Then you think of this domain as a membrane, and you ask for its characteristics vibration so think of it as a drum you beat it and you ask for the frequencies. The way you compute the frequencies is by solving an eigenvalue equation and meaning you look for eigenfunctions of the flash with appropriate boundary conditions. For instance, the original boundary condition just asks for vanishing on the boundary. The eigenvalues here that's a non trivial thing. It was proved by Herman Vile. That not only are there lots of eigenvalues we can in fact count how many there are asymptotically and Vile's law says that in case of a plan of domain, the number of levels that eigenvalues up to X grows linearly with X asymptotically. And the coefficient tells you the area of the drum. So here is a plot of the so called spectral staircase. There is staircase and there's a linear approximation, and clearly you see the same. You see that asymptotically that same. And then the mean spacing here is constant. If the growth is linear, it means that the average spacing is one of this pre factor. So we can ask what is the spacing distribution, the level spacing distribution. It's a well defined question doesn't mean it has an answer, but the case you can ask the question. And it turns out to be an extremely complicated question we don't really have an answer that we can prove in any reasonable case but some fascinating conjectures that have emerged about it. And that two extreme cases about this right one is, for instance, what happens when you take a rectangle. The case of a rectangle you can actually write down the eigenvalues glorified sounds of two squares. And here is an experiment for the level spacing distribution of rectangle whose aspect ratio is pi over three. You can clearly see what's on here. I don't know how to prove this, but numerics to me seem very convincing. And it's a purely arithmetic question because eigenvalues are given here. And this is expected to hold for other so called integrable systems, unless there's the reason that it's not true, for instance for a square. It's not going to be true because lots of multiplicities for the sphere it's even less true because of multiplicities but once you recognize this you think okay this is a reasonable conjecture. The other extreme is when the dynamics are chaotic whatever that means here is an example you take a square and remove a concentric disk from the inside. You look at the eigenvalues of the fashion with seriously boundary conditions meaning the functions of Spanish on the boundary of the disc and the boundary of the circle. You don't, I don't know how to write down the eigenvalues in any explicit way but you can numerically compute them, at least if you're an expert in doing that kind of numerical analysis. This is one such early computation that was done a long time ago, and you clearly see something completely different than Poisson. You see level of repulsion in this smooth curve here is the GOE distribution and if you're betting men then you would say okay this is a reasonable thing. There's a lot of traps you can fall into and described in the same version, but they will not be going to it. So the universality conjectures is that in these two extremes, generically at least you will get these two distinct distribution and Poisson for integral systems and random matrix theory for chaotic dynamics. There are exceptions for instance, for the geodesic flow on the modular surface. The distribution looks like Poisson. But we can explain this after you see it you can explain it. And there's no case where these conjectures are no single example. Okay, so the next next example is the Riemann zeros. So for people who don't remember. This is the Riemann zeta function. It's defined by series or an infinite product over primes and it has an analytic continuation and the functional equation relating the values at S and the plan minus this zeros of this completed zeta function are supposed to all lie on the critical line, the line of symmetry of this functional equation that's the Riemann hypothesis, which numerically is certainly correct. And the Riemann formula tells us how many zeros we're supposed to have up to high T and answers roughly T log T, which means that the mean spacing between consecutive zeros behaves like one of a log T. So to look at things like level spacings or correlation, you will have to rescale. They are too dense. You want to get the mean spacing to be of size one so you have to rescale them because the zeros are getting denser and denser. And there was a, an absolutely fundamental discovery made by Montgomery about 50 years ago. He studied the pair correlation function, which I'll describe what it is in the next slide. And as a result of the studies, the conjecture is that the zeros of the zeta function a random matrix theory statistics specifically those of the Gaussian unitary ensemble. And the proof is a computation of 10 to the five zeros, the 10 to the 12 which are this for that many, many years ago. And you see a scatter plot here, the squares and you see a smooth curve which is the GUE level spacing and it's clearly the right time. And the difference by this plots containing, you know, hundreds of millions of zeros near the 10 to the 24 I think is the latest figure, which even better fit. Now, what Montgomery originally looked at is the pair correlation functions and his conjecture was in this form a look at pairs of zeros with different indices and you ask how many of the differences. So at most a times the mean spacing, which is to buy over log t and divide with a number of zeros up to this should be capital T. And the answer that the conjecture is that it's the integral of this kernel, and the story goes is that Dyson pointed out that this is something that Dyson had worked on the 60 series of papers on the statistical theory of the magic levels of complex systems. And we recognize that this is what you get for the per correlation of the GUE. So this is another plot of the pair correlation function and the smooth port is this factor here one minus the square of the sine curve, the scatter plot is the numeral for again 10 to the first 100,000 zeros and it looks good. These conjectures are not proven yet, there's some evidence again Montgomery proved that you get this, not exactly but at least the Fourier transforms of the two agreeing in their restricted range. And you can compute so to speak moments of these distributions which are not the pair correlation but three level and 17 level correlations. And under similar restrictions you see you get agreement so there's actually quite reasonable evidence for this much more so than the case of quantum chaos. Okay, so this is example of these new statistics, as you see them in nature. For the second half of the talk, the last third of the talk. I will discuss how you see these fair correlation and level spacing statistics in the examples of classical uniform distribution theory. We can make our favorite sequence like alpha and mode one alpha in school mode one and asked for its fair correlation function and level spacing distribution. This is something that took a while for people to look at the, there was a gap between Montgomery and this was done. And the result, which in retrospect tells us what are the nearest neighbor spacing of the chronicle sequence alpha times and the result is called the three gap theorem, which is a number of parents, for instance, they are sure in fifties. Here is the way to find out about the serum the hard way you do in America and you don't see anything stabilizing. Then you make up all kinds of excuses why it doesn't stabilize but this is the reason. So the theorem says that if you take the first 100,000 levels. If you take the first sequence order them. This is the non trivial thing, then that it's most three distinct gaps that are cheap. If you take the first 200,000. Again, you get it's most. Let's say exactly three distinct gaps that are not the same ones as you had before, but only three. In this particular case, there is no level space in this very distribution, the limit does not exist so it wasn't an imaginary question whether the limit exists it need not exist even this very natural example. This is disappointing. So let's move to something more interesting. Instead of alpha times and let's look at alpha times and squirt, which was uniformly distributed, as long as alpha is irrational. And I looked at this with Peter Sarnac and, for example, such a rescue in the late 90s. It was a quarter of a century ago, I'm ashamed to say. And the conjecture that we arrived at is that if alpha is your fan team, for instance, square root of two, my favorite example. The spacing of the level spacing distribution of alpha times in squared mode one up was on. So not only the level spacing, but the pair correlation functions and these are the more complicated correlation functions. So you find team covers all algebraic numbers. The form of definition is that you cannot approximate alpha to well by rationales in the sense. The right numbers are known to be like that, and almost all find a sense of measure theory of different. We don't know how to prove this the one one of the things that we did manage to show is that for almost all alpha the pair correlation is was on. For alpha and squared and we had the same results. If you take alpha times any integer polynomial integer coefficients as long as it's got degree at least two. Because if a polynomial is degree one we are back to the chronicle sequence which we know now doesn't have a level spacing distribution. That was the theory as almost 25 years ago, and it was dormant for a couple of decades until a new generation of people started looking at it, and there's actually new developments here for instance. There's a nice criterion for when you can expect to get almost sure pair correlation function. They abstracted some of the arguments you have in that theory and the term and the relevant quantity turns out to be the additive energy of this sequence of integers. I take a sequence of integers I want alpha times they end to be almost truly pair correlation for Sonia. Well says almost truly alpha times a and is a uniform distributed. The criterion has to do with additive energy. So the additive energy is defined as number of quadruples of coincidences between pairs. That's the definition. My definition. It's at most n cube because if I know KL and M then I know way of it. And it's at least n squared because if I take K equals M and L equals M I sort of get the coincidence. So the additive energy is between n squared and to always for any sequence of distinct integer. And then the criterion was that if the additive energy is slightly less than the upper bound, the trivial up above. So slightly less here is n cubed over the power of login, then almost surely alpha times a and it's passed on pair correlation. So that's a positive result. There's an interesting negative result. If you look at the sequence of crimes, well then the additive energy can be computed. It doesn't fall into this upper band, but this is not the necessary and sufficient condition that Alan Walker showed that almost surely the pair correlation is not possible. So here's an interesting sequence where you can show that almost surely you don't have possible and pair correlation. So this is integer sequences. I'm not looking at the chat. Now let's look at non integer sequence powers. So instead of n squared, I want to do into the half. Okay, so into the half is particularly interesting sequence. As I mentioned, failure had proven that alpha times routine is uniformly distributed in the 1920s or 30s. In the 90s and the late 90s, Michael Boschernitz and did some remarks on this and they discovered the picture like this for the level space and distribution. So that doesn't look like was on doesn't look like anything we've seen before. And no one elkis and Kurt McClellan proved that the level of spacing distribution of the fractional parts of the 10 does exist. And they computed what it was what it is. It's a definite thing. But it's not was on it's not random matrix theory you don't see a level repulsion. And these algebraic measures that come up in the homogeneous dynamics and they use homogeneous dynamics in studying this. It's got this funny property that it's actually constant level space and distribution is a constant in the interval near the origin and then it decays but it doesn't decays financially it's not algebraic decay. So it's not possible. So it's not possible can be determined but it's not possible. So this is number one. The second development is very curious one. So Yens Markov and Daniel Elbaz and Ilya Vinogrado show computed the pair correlation function for fruit and one. So you have to remove ends which are squares, otherwise you get multiplicities. So once you do that, you can use these methods of homogeneous dynamics to study the pair correlation function, and surprisingly to me, and to them. They show that the pair correlation is Poisson. You don't know what to make of this.  So let's try to perturb the problem instead of looking at square root of n let's look at cube root of two times square root of n more fun. And here is an empirical plot of the level space and distribution. And this looks what's wrong. If you compare it to what happens to one time through 10, they are clearly different, except this is a theorem, and this is a conjecture. This is a conjecture. I don't know this, but I think it's an interesting conjecture. Let's say if we take. Okay, let's say cubal to 10. Merically, the level spacing distribution, the nearest neighbor gap distribution is clearly Poisson. So I was very intrigued by this and tried for a while to say something about the pair correlation function of this. And eventually, Nicholas Tech now, at that time a postdoc in Tel Aviv that I think is now in Caltech is usually everywhere dense but they think physically in Caltech right now. So he managed to show that the pair correlation function alpha times root n is Poisson for almost all. Without giving a single example. That will come later. So what do we know about this theory, and this is all very, very recent. So I started in the beginning of the 20th century now let's move to the last year or two. So Christoph Eisleitner, Daniel Elba's and Mark Munch understood how to do alpha times into the theta provided theta is non integer which is bigger than one. And they show that almost surely the pair correlation here is Poisson. But the method, they kept complaining that the method doesn't work for theta less than one. I'm quite happy that they failed because I was really interested in theta equals a half. And we succeeded in doing this for theta between zero and one. And so now we know that for all theta alpha times into the theta mode one is Poisson and except when theta is one. The integer case is what I did with Peter Sark quarter of a century ago and now any non integer data is known. And in this case of alpha into the theta there's also the deterministic result which I think is very beautiful by Chris Lutz go and make a stack now. And they prove that alpha times into the theta is Poissonian for almost not for almost for all alpha provided theta is less than one third or slightly even better than that. But they can't get to a half the method that she fails. So this is the state of the art for alpha and to the half which is started out within this section. So let me end with to some of the ingredients just to slide they will be happy if I finish ahead of time. So this is number theory, the end of the day this is number theory so until now it was hiding that let's let me explain what it is that you need to do here. So let's start with a case when theta is two or integers. So after doing some harmonic analysis, what we've reduced to is counting solutions of the euphantine inequality, which in the case when theta is an integer is actually inequality. Okay, so I look at the number of integers, the six integers involved number of six to pose of integers, roughly all of the same size. So that the difference of so that the size of this polynomial is bound is less than one. So if they're all integers, if theta is two, let's say these are all integers, then it means that this difference is zero. Okay. So in the case theta equals to we asked to count how many solutions there are this euphantine equation in variables which are roughly of the same size of size capital M. And what the theory needs is that the number of the solutions is slightly less than and to the fourth. So in the case when theta is two, let's understand how many solutions does the system have. Okay, so what I do is I fix the right hand side here I fix J2X2 and Y2 and ask so those n cube choices and then I ask how many trippers, J1X1Y1 I have which for which J1 times the difference of these squares, it's a definite number. And the answer is, there are very few such choices because because you're using now that you have x squared here so x squared minus y squared factors as x minus y times x plus y. This is deep stuff. And then you ask how many triples of Jx and y there are so that this product equals a definite number of size at most n cube. And the answer it's a divisive function, and very few divisive for number of most K to the epsilon choices and n cube choices is J2X2 and Y2 and therefore we found that the utmost end to the three plus excellent solutions which is within what we need. So this is how you solve the problem, roughly speaking, in the case of theta is an integer, as long as that integer is bigger than one, when theta is one it doesn't work. Last slide, thankfully, is what to do with non integer theta, then this trick doesn't work. So I still need to solve this euphantine inequality but now it's a genuine inequality, think of theta being half. So I have six variables so n to the six options. I need less than n to the fourth solution. So just to say heuristic, the size of this polynomial is roughly n to the, this is J is n, x to the theta is n to the theta so this is n to the one plus theta. So you take n to the six points and put them in an interval of length n to the one plus theta if every integer, if every point is sort of equally likely you expect n to the four minus theta solutions. So that would be enough for what you need. Except if theta is big, this is actually wrong because those diagonal solutions, you take J1 equals J2, X1 equals X2, Y1 equals Y2, you clearly have a zero for this polynomial and thus n cubed such points. So you shouldn't take this too literally. The high-slide albas in Manch did is they use the decoupling, let's call it. They reduce this system to a system of four variables. Essentially this kind of system. So now you have, we got rid of the J's. This is important and you're asking for the number of solutions of this you find inequality and Robert and Sargo actually did this not that long ago. And you can count, you can give an upper bound for the number of solutions of this inequality, you find inequality. The diagonal solution X1 equals Y1, X2 equals Y2, that gives you n squared solution. So this is this term. And this term is this random heuristic that I explained to you. So please, this upper bound makes some sense. Now, the decoupling and this will be a Sargo theorem was sufficient for theta bigger than one, but I wanted theta equals the half. Then you had to have some extra steps. And we managed to do these extra steps. I won't get into this. I slightly wasn't much needed to know something about the ringman's data function. That's what you use for the counting they need to know to know sub convex bound any sub convex bound will do and we needed some other things. In any case, this is the state of the art now for this particular example. So let me just conclude with leave you with a couple with some homework. So then I mentioned these problems so alpha is your fountain. I want to show that alpha times n squared is Poissonian level spacing is Poissonian. We know percolation we don't have a little spacing. And instead of root and root and I explained that almost surely we know that the percolation is Poissonian. And I want the level spacing distribution and here's the experiment. It's clearly true. But I don't know how to prove it. So this is homework for people. Okay, thank you. I will stop here.


with Mike Tyson back then. When we come from the same piece of cloth, he wasn't in prison, I was in prison. So we have, he was a Muslim, we went to Juma prayer together, you know? And like I say, I'm not a go to along to get along. If I feel like something's supposed to be done, I'ma say it. Yeah, we on Boss Talk 101. So let it go. Wow, man, you being in California, man, it's a lot of scenarios out there. We just interviewed Kenya Ware and she was telling us about the night when Tupac got killed and she was in Vegas and she was talking to her right before that. He was in Vegas that night? So a lot of people say that she would have something to do with it. I'm just telling you, even being in the car. That's a scenario set up, but you say, well, you been to Vegas? Yes, a lot of times. And on fight night at Mike Tyson fight, Las Vegas Boulevard is packed. Right. Bumper to bumper. You got a trail car, you got police in the car and you got another car. California, Gag Vegas, we're territorial. We don't know your turf. Yeah.  What are you going top of the curve and run over the pedestrians and shoot in the car? And nobody got the license plate. How that sound? Wow. You was kind of a thought about it. You was there. You was you was there in Vegas. Were you working with Mike Tyson then? You was. So what? Well, how did you end up in that relationship with Mike Tyson for us? One of the other brothers, Lowe had got can and Captain Shahid Muhammad put me on that detail. You know, one of the best details I've ever had. Mike is a genuine. I mean, he's one of the best people you could ever have. Why do you say that? He's a giver.  Man, he would give you anything you need. He come over to my mother's house and sleep on the couch. So he would come to your mother's house. Yeah. And so what would what would conversations be like with Mike Tyson back then? We come from the same piece of cloth. He wouldn't prison. I was in prison. So we have he he was a Muslim. We went to Juma prayer together, you know. And I like I say, I'm not a. Go to along to get along. If I feel like something's supposed to be done, I'm going to say it like, bro, it's not it's not a good look. Everybody else will do what you want to do because you pay in the tab. That don't work with me. Because you don't need me. But Mike Tyson don't need no bodyguard. He can beat up every and anybody that comes his way. Put itself because I can knock you out. You sue me. What you going to get some parole? Mike said, hit you. You're going to sue him. You seen him and he had filed on the airplane on the airport. Yeah, he should have had you right by his side when that happened. Yeah, I blew that behind the situation. I told about getting my house burglarized. Wow. And I went to the feds for a year. And so do you think you like Mike Tyson? He got a new show or a podcast that he's doing, man. And he he went off on Boosie on there. Well, he he didn't want to. He didn't say it's stirring things to a lot of people on there. You got a podcast and he's doing his thing on there, too. Yeah, I get ready to get him on when I do this Potscrow Farms podcast. I'll do a smoke on there all day.