V I Danilov
email: vdanilov43@mail.ru.

A Lambert-Mogiliansky

Preparing a (quantum) belief system

Keywords: belief, quantum-like, persuasion, measurement

In this paper we investigate the potential for persuasion linked to the quantum indeterminacy of beliefs. We first formulate the persuasion problem in the context of quantum-like beliefs. We provide an economic example of belief manipulation that illustrates the setting. We next establish a theoretical result showing that in the absence of constraints on measurements, any state can be obtained as the result of a suitable sequence of measurements. We finally discuss the practical significance of our result in the context of persuasion.

Introduction

The theory of persuasion was initiated by Kamenica and Gentskow [START_REF] Kamenica | Bayesian Persuasion[END_REF] and further developed in a variety of directions. The subject matter of the theory of persuasion is the use of an information structure (or measurement) that generate new information in order to modify a person's state of beliefs with the intent of making her act in a specific way. The question of interest is how much can a person, call him Sender, influence another one, call her Receiver, by a selecting a suitable measurement and revealing its outcome. A key feature is that Receiver is rational and knows the intent of Sender to manipulate her action.

Receiver's decision to act depends on her beliefs about the world. In [START_REF] Kamenica | Bayesian Persuasion[END_REF] and related works the beliefs are given as a probability distribution over a set of states of the world. That is a central assumption [START_REF] Kamenica | Bayesian Persuasion[END_REF] is that uncertainty is formulated in the standard classical framework. As a consequence the updating of Receiver's beliefs follows Bayes rule.

However as amply documented the functioning of the mind is more complex and often people do not follow Bayes rule. Cognitive sciences propose alternatives to Bayesianism. One avenue of research within cognitive sciences appeals to the formalism of quantum mechanics. A main reason is that QM has properties that reminds of the paradoxical phenomena exhibited in human cognition. Quantum cognition has shown successful in explaining a wide variety of behavioral phenomena (see for a survey 1 Bruza and Busemeyer [START_REF] Bruza | Quantum Cognition and Decision-making[END_REF]). Moreover there exists by now a fully developed decision theory relying on the principle of quantum cognition (see [START_REF] Danilov | Expected Utility under Non-classical Uncertainty[END_REF][START_REF] Danilov | Dynamic consistency of expected utility under non-classical (quantum) uncertainty[END_REF]). Therefore in the following we shall use the Hilbert space model to represent the belief of an individual and capture the impact of new information on those beliefs. Clearly, the mind is likely to be even more complex than a quantum system but our view is that the quantum cognitive approach already delivers interesting new insights with respect to persuasion.

In quantum cognition, the system of interest is the decision-maker's mental representation of the world is represented by a cognitive state. This representation of the world is modelled as a quantum-like system so the decision relevant uncertainty is of non-classical (quantum) nature. As argued elsewhere ( [START_REF] Dubois | Our (represented) world and quantum-like object[END_REF]) this modeling approach allows capturing widespread cognitive difficulties that people exhibit when constructing a mental representation of a 'complex' alternative. The key quantum property that we use is that some characteristics (cf properties) of a complex mental object may be "Bohr complementary" that is incompatible in the decision-maker's mind: they cannot have definite value simultaneously. A central implication is that measurements (new information) modifies the cognitive state in a non-Bayesian well-defined manner.

It turns out that this has a close counter-part in Physics (see, for example, [START_REF] Frohlich | The preparation of states in Quantum Mechanics[END_REF]). In Quantum Mechanics experiments one often needs to know the state of a particle before performing operations on it in order to be able to draw conclusions. In order to determine that state, physicists 'prepare' particles in a definite quantum state, e.g. by means of filtering: for instance they measure the spin of a set of particles and keep for further operation those that are in state + while throwing away the others. By doing so they have effectively created particles with the needed spin property. The term preparation is rather broad -it covers any kind of operations that affects the state of a single system or the composition of a set of systems. One such operation is measurement. A von Neumann direct measurement prepares a system in the (pure) state that obtains as the result of the measurement.

Generally, a von Neumann measurement modifies a quantum state according to the von Neumann-Luders rule for updating.

In [START_REF] Danilov | Dynamic consistency of expected utility under non-classical (quantum) uncertainty[END_REF], we learned that dynamically consistent, that is rational, quantum-like decision-makers update their beliefs according to the von Neumann-Luder's postulate. We take this result as starting point to investigate the potential of manipulation of Sender when facing a rational quantum-like Receiver. Our central result in Theorem 1 is that, in the absence of any constraints on the choice of measurements, there always exists a sequence of measurements that secures obtaining any target state starting from any initial state. In terms of persuasion, Sender can always persuade Receiver to believe anything that favors him. This is in sharp contrast with the classical setting where the expected posterior must be equal to the prior. Theorem 1 is of course a theoretical result which does not mean that Sender can make Receiver do whatever he wants. First, Receiver may not be willing to take the desired action in any belief state. Second, even if there exists a belief state such that Receiver takes the desired action it may require measurements that are not practically feasible. They may be too costly or Receiver would get annoyed. Classical measurements face similar practical constraints. A distinction however is that classical measurements can always be performed as a single measurement while this is not true in a quantum situation.

Kamenica and Gentskow motivated their paper by the fact that attempts to manipulate command a sizable share of our resources in the economy. Persuasion is at the heart of advertising, courts hearings, lobbying, financial disclosures and political campaign among other activities. As suggested by Akerlof and Schiller [START_REF] Akerlof | Phishing for Phools -the economics of manipulation and deception[END_REF], the power of manipulation seems however much larger and more determinant than what the classical approach suggests. Our results suggest that quantum cognition may provide a better model to explain the extent and power of manipulation in society. This research is a step in a broader project which aims at proposing an alternative to the foundations of the functioning of free markets in the spirit of Akerlof and Schiller.

The model

We shall formulate our model in terms of a communication game as we want to facilitate the comparison with Kamenica and Genskow (KG) [START_REF] Kamenica | Bayesian Persuasion[END_REF]. There are two players R (Receiver) and S (Sender). We are interested in persuasion aimed at influencing Receiver's choice over uncertain alternatives which we model as quantum lotteries following Danilov et al [START_REF] Danilov | Dynamic consistency of expected utility under non-classical (quantum) uncertainty[END_REF].

In the most general context a belief of Receiver is a point B in some convex set B (the set of states of the Receiver beliefs). The Receiver chooses an action a from some finite set A. Any action can be considered as a linear function on B, a : B →R where a (B) is the expected utility of Receiver in state B that is when she holds belief B. Naturally she chooses an action a * = a * B that gives her the highest possible expected utility that is a * B ∈ arg max(a (B) , a ∈ A). So the set of states can be decomposed into convex regions B a (a runs over A, B = ∪ a B a ). In region B a , the optimal action of Receiver is a.

Sender's utility from actions is captured by his utility function u : A → R. Here we assume that Sender's utility only depends on the action chosen by Receiver. Sender's problem amounts to acting on Receiver's state of beliefs so as move it into a region that induces the most favorable decision to him, i.e. to persuade her to act in a particular manner. His means of persuasion are information (signal) structures, we shall also use the term "measurement".

In such a general framework, we do not know how to characterize a measurement and how Receiver's belief B changes in response to new information obtained from a measurement. We below provide a brief description of the classical setting and thereafter we develop our argument in the quantum context where we also do know how to proceed relying on the Hilbert space model.

The classical setting

The classical means of persuasion have been well described in KG. There is a set Ω of states of Nature.

Receiver's belief is a probability distribution or measure β on Ω, β (ω) ≥ 0, β ω (ω) = 1 (above we denoted that β as B). For the sake of simplicity we shall assume that the set Ω is finite. So the set B is the simplex ∆ (Ω) of probability distributions on Ω. An information structure (or measurement device) is a map ϕ : Ω → ∆ (S) , where S is a set of signals (outcomes) of our measurement device. In a state ω ∈ Ω this device gives (randomized) signal ϕ (ω) ∈ ∆ (S) . If we write this more carefully such a device is given by a family (f s , s ∈ S) of function f s on Ω; f s (ω) gives the probability of obtaining signal s in state ω ∈ Ω. Of course all the functions f s must be nonnegative and their sum ( s f s ) must yield the unity function 1 Ω on Ω.

If Receiver holds a belief β = (β (ω) , ω ∈ Ω) then she can easily compute the probability for the signals. The probability of receiving signal s given prior β, is equal to

p s = ϕ (β) (s) = ω β(ω)ϕ(ω)(s) = ω β (ω) f s (ω) .
More interesting for us is that Receiver can use Bayes' rule when she receives signal s to update her beliefs, i.e. to form the posterior

β s ∈ ∆ (Ω) , given as β s (ω) = f s (ω) β (ω) /p s .

For Receiver (and for

Sender) what is important is the change in the belief from β to β s upon receiving signal s. Because as she receives signal s she will choose action a * (β s ) and Sender will receive utility u (a * (β s )) . On average

when Sender uses such an information (signal) structure he receives utility p s u (a * (β s )) . And so we can ask which is the best measurement device for Sender? Kamenica and Genskow formulate the problem in the classical information context and characterize the optimal measurement.

The quantum setting

The description of a quantum system starts with the fixation of a Hilbert space (in our case a finite dimensional) over R, that is a real vector space H equipped with a symmetric scalar product (., .) .

We shall be interested not so much in the Hilbert space H as in operators (that is linear maps from H to H). For such an operator A we denote by A * its conjugate operator which is defined by the following condition: (v, Aw) = (A * v, w) for all u, w in H. The self-conjugate operators (for which we have A = A * ) are called Hermitian will play most important role in our analysis.

The notion of trace will be a central instrument in what follows. The trace T r of a matrix can be defined as the sum of its diagonal elements. It is known that the trace does not depend on the choice of basis. With the help of the trace one can introduce the notion of state of a quantum system.

It is defined as a nonnegative Hermitian operator B (nonnegativity means that (Bv, v) ≥ 0 for any v ∈ H) with trace equal to 1. This notion replaces the concept of probability distribution in the classical context. The nonnegativity of the operator is analogous to the nonnegativity of a probability measure, and the trace 1 to the sum of probabilities which equals 1.

General Hermitian operators play the role of random variables on Ω. In fact for any Hermitian operator A and a state B we can define the 'expected value' of A in state B as T r(AB). In our work [START_REF] Danilov | Dynamic consistency of expected utility under non-classical (quantum) uncertainty[END_REF] we showed that a quantum lottery can also be expressed as an Hermitian operator and that the expected utility of lottery A (in belief state B) is expressed as T r(AB).

In this way, Receiver's preferences over lotteries are determined by her belief state B. The set of (belief) states (that we earlier denoted by B) we denote by St. It is a compact convex set, the extreme points of this set are called pure states (they correspond to one-dimensional projectors). Lotteries or actions are understood as affine functions on St.

We still have to define what we understand as measurement device (or information structure, cf. KG). And here we must recognize that there exist three (more and more general) candidates to serve as measurement devices (see [START_REF] Nielsen | Quantum Computation and Quantum Information[END_REF]). Such a measurement is given by a family of Hermitian operators (Q s , s ∈ S) which are nonnegative and sum up to E ( Q s = E). We have no problem defining probabilities p s = T r(Q s B) as before.

But with the posterior the situation is more complicated. We can (as we did in our article [START_REF] Danilov | Dynamic consistency of expected utility under non-classical (quantum) uncertainty[END_REF]) take

the positive square root R s = √ Q s (so that R 2 s = Q s ).
It always exists and define the posterior B s as R s BR s /p s . The expected posterior is given by the same formula:

B = s p s B s = s R s BR s .
This kind of measurements are not repeatable; the number of signals may be largely bigger than the dimension of H. They are called indirect because they can be understood as follows. We include our system in a larger one (which is described by a higher dimensional Hilbert space H) and perform a direct measurement (see above) of this larger system.

The most general measurements.

Although we shall not make use of them much, a few words are in place. They generalize the measurements in 2) in terms of more general formation of the posterior. Above we used a canonical (or simplest) decomposition of Q s into the product R s R s . However we could use a more general decomposition Q s = A s A * s (where A s is not necessarily a Hermitian operator; if A is Hermitian then A = A * and we return to the square roots). Now the most general measurement device is given by an arbitrary family of operators (A s , s ∈ S) with the sole condition that s A s A * s = E. The probability for signal outcome s is defined as earlier p s = T r(A * s BA s ) = T r(A s A * s B) but the posteriors are defined slightly differently as B s = A * s BA s /p s . This generalization may appear somehow artificial. But there are a highly meaningful considerations in defense of its use. Consider the case when we perform two (or more) measurements (even direct ones) in a row. First with device (P s ) and thereafter with device (Q t ) . It is natural to consider that the outcome (s, t) is obtained with probability T r(Q t (P s BP s ) Q t ). And that the posterior state is (with precision up to a multiple) equal to Q t (P s BP s ) Q t . However if the measurements are not compatible, then operators P s and Q t do not commute and their product A st = P s Q t is not Hermitian. And we have (A st )

* = P * s Q * t = Q t P s .
So that a combination or a sequence of measurements is given by a collection (A st ) .

On the other side this kind of most general measurements gives too much generality: they allow not only describing measurements but also a unitary evolution of a system. It is however not very clear how to realize an unitary evolution (true this concern may also be relevant for measurement even direct ones). And finally the expected posterior even in the state E/d can differ from E/d. In fact it is equal to s A * s A s /d. This is a quite strange and unattractive property. Therefore we shall not use those most general measurements and instead we shall work (whenever needed) with repeated direct measurements.

Quantum measurements be they direct or more general are characterized by a few distinguishing features. Most importantly, the performance of a measurement impacts on the state of the system.

As a first consequence and in contrast with the classical case, beliefs do not converge toward complete information about the 'true state' of the system. In the quantum context, the belief state may be pure, i.e. represent maximal (rather than complete) information and yet change upon the reception of new information. An expression of this is that measurements may be incompatible. As a consequence and in contrast with the classical case, a sequence of direct measurements cannot generally be merged into a single direct measurement. Therefore, in this paper we opted for the following approach. On the one hand we limit ourselves to direct measurements while on the other hand allow for sequences of direct measurements. Yet another variant amounts to performing mixed measurements. The procedure begin with playing a roulette lottery which determines which direct measurement will be performed.

Then the selected measurement is carried out and a signal obtained. In the classical context, this procedure works very well (cf. [START_REF] Kamenica | Bayesian Persuasion[END_REF]) but as we shall see we are able to obtain very powerful results even without mixing.

A second consequence of the impact of measurements on the state is the so called 'decoherence' which turns out to be of great value in our context. Assume that we perform a measurement (for instance a direct one given by the family of projectors P s ) but do not learn the result. Such a measurement can be simply ignored in the classical context. In the quantum context such a "blind' measurement induces nevertheless a change in the posterior B = s P s BP s . As we shall see such blind measurements (clearly useless in a classical context) provide a powerful mean of changing the beliefs of Receiver. They also have a meaningful interpretation in the cognitive quantum context.

An illustrative example

Before introducing our central result we wish to provide an example of quantum persuasion in a very common context, i.e. when a seller wants to persuade a potential buyer to purchase an item. So in that situation we identify Sender with the seller and Receiver with the consumer. More specifically, our consumer is considering the purchase of a second hand smartphone at price 30 euros of uncertain value to her, it depends on its technical quality which may be standard or excellent. She holds subjective beliefs about the probability that the smartphone is excellent. Based on those beliefs, she assigns an expected utility value to the smartphone which determines her decision to buy or not the item.

Let H be a two-dimensional Hilbert space with an orthonormal basis (e 1 , e 2 ) and let (P 1 , P 2 ) be the corresponding projectors, so that [START_REF] Danilov | Dynamic consistency of expected utility under non-classical (quantum) uncertainty[END_REF], the smartphone is expressed as a quantum lottery A which gives a utility equal to 100 in state |e 1 (the smartphone is excellent) and 0 in |e 2 (the smartphone is standard); in matrix form the lottery writes as

P 1 =   1 0 0 0   . Following
A =   100 0 0 0   .
Assume further that the utility when not buying the smartphone is u = 30 (she keeps the money). Given belief B Receiver does not want to buy the smartphone so the seller earns 0.

Can Sender persuade the Receiver by selecting an appropriate measurement? We next show that he indeed can induce her to buy with probability 1. Consider another property (characteristics) of the smartphone that we refer to as Glamour (i.e. whether celebrities have this brand or not). The Glamour

property can measured with direct von Neumann measurement (Q 1 , Q 2 ) with two possible outcomes Glamour |G corresponding to projector Q 1 =   1/2 1/2 1/2 1/2   and not Glamor |N G corresponding to Q 2 =   1/2 -1/2 -1/2 1/2   .
The Glamour property is represented by the basis (|G , |N G ) of the state space (of the mental representation of the smartphone) which is a 45 • rotation of basis (e 1 , e 2 ). This means that the (|e 1 , |e 2 ) and (|G , |N G ) are two properties (perspectives) that are incompatible in the mind of Receiver. Or equivalently (P 1 , P 2 ) and (Q 1 , Q 2 ) are measurements that do not commute with each other. Receiver can think in terms of either one of the two perspectives but she cannot synthesize (combine in a stable way) pieces of information from the two perspectives. This is illustrated in figure 1.

T d d d d d d d d d s 0 E P 1 P 2 B = Q 1 B = Q 2 B )
Assume that Sender brings the discussion to the Glamour perspective and performs the measurement so Receiver learns whether her preferred celebrity has this smartphone. With some probability p (= 0.9) the new cognitive state is B = Q 1 and with the complementary probability 1 -p = .1 it is B = Q 2 . We note that Eu (a; B ) = Tr (AB ) = .5 > .3 and Eu (a; B") = Tr (AB") = .5 > .3. In both cases Receiver is persuaded to buy and Sender gets utility 10. In general, it is not possible to persuade Receiver with probability 1 by means of a single measurement. However as Theorem 1 below shows it is theoretically possible to manipulate beliefs with a sequence of appropriate measurements.

Our central result

In order to formulate our central result we return in more details to the description of direct measurements. A direct measurement device M is given by an orthonormal basis (e 1 , ..., e n ), where n = dim H, and (e i , e j ) = δ ij , and a collection of signals (s 1 , ..., s n ) (some s i may coincide). The vector e i should be understood as one-dimensional projectors P i ; P i (x) = (x, e i ) e i . How does such a measurement device operate? Upon the reception of signal s i the system transits into state |e i (or P i ) with probability p i = T r (BP i ) . If we represent initial state B in matrix form in the basis (e 1 , ..., e n ) , we have p i = b ii where b ii is the corresponding diagonal element of the matrix. This is true when the signal is fully disclosed that is distinct from all others. If all the s i distinct but the result is not communicated (a blind measurement) the system transits into the mixed state

p i P i .
The existence of blind measurements is an interesting distinguishing feature of the quantum formalism. In the classical context a measurement without outcome has no impact whatsoever.

A second useful feature of the quantum situation is related to conditional measurements. Assume that we performed a measurement according to the above described device (with signal s i ). As we receive signal s we may thereafter perform a new measurement M s (which can depend on signal s). In the classical context this kind of conditionality does not play any role because a compound measurement always is a measurement. But in the quantum context as we shall see further, such composition are generally not direct (von Neumann) measurements although they are measurements in the most general meaning. Of course we can iterate that procedure conditioning on the result from the second measurement and so on.

Our main result is that starting from any initial state it is possible to transit to any state by means of a suitable sequence of conditional measurements. In term of persuasion and beliefs, it means that Sender can always persuade Receiver to take any desirable for him decision independently of Receiver's prior. Of course, this is a theoretical result. In practice, it may not be possible to 'play' with Receiver so easily. Measurements are connected with costs, Receiver may be impatient or get tired of all information etc... Theorem 1. For any prior B, any target belief state T , and any ε > 0, there exists a sequence of direct conditional measurements such that with a probability larger than 1 -ε the posterior is equal to T .

We understand this result as follows: there exists in principle a rather simple and constructive strategy for Sender to persuade Receiver to believe anything Sender wants him to believe.

To start we show that the target state can be taken as pure. In fact the final state T can be represented (by force of the spectral theorem) as a mixture of orthogonal pure states, T = i q i P i , where q i ≥ 0, i q i = 1, P i are projectors on (unit) vector e i . Let P be the projector on the following vector e = i √ q i e i , that is P (x) = (x, e) e for x ∈ H. In the basis (e 1 , ..., e n ) the projector P is given by the matrix ( √ q i q j ).

We assert that if we perform a blind measurement with basis (e 1 , ..., e n ) , state P transits into state T . In fact, the expected posterior is P = i P i P P i = i q i P i = T.

Hence, in order to arrive at state T it is sufficient to arrive at pure state P . We next show how to transit into an arbitrary pure state P.

Suppose that P is a projector on (unit) vector |e 1 . We complete it to an orthonormal basis (e 1 , ..., e n ) and as our main measurement M we take a non-degenerated (complete) direct measurement in this basis. Whatever the initial state B was, after the performance of M, the state transits into one of the pure states |e 1 , ..., |e n and the signal informs us which one of them. Assume that the signal is s 2 so the system is now in state |e 2 . In that case we construct an auxiliary direct measurement device M 2 with the following orthonormal basis (e In figure 2 we illustrate the conditional measurement scheme used in the proof of Theorem 1 for the case when n = 3. M 2(3) represent blind measurements.

T T T r r r r j r r r r j r r r r j % % % M M M M 3 M 2 ... ... 1 1 2 3 1 2 3 M 2 M 3 r r j %
The strategy used in the proof of the theorem has two nice features. First it does not require knowing the prior of Receiver. Second it only appeals to a restricted number of measurements, M and the instrumental M i (i = 2, ..., n). As earlier mentioned in practice the optimal strategy will have to take into account costs of measurements and constraints on the feasible number of iterations.

Therefore, it can be interesting to consider the case when the number of measurement is limited.

Discussion

Manipulation is both an old and a very actual topic in social sciences. Recently an approach has received a lot of attention in the field of economics: Bayesian persuasion. The starting point is that you can manipulate rational people's behavior by acting upon their beliefs by choosing a suitable information structure or measurement that generate new information. This theory is developed in the classical uncertainty setting.

An alternative approach to decision-making under uncertainty uses the quantum formalism to describe uncertainty. Relying on the recent success of quantum cognition in explaining behavioral 10 anomalies, we have investigated the scope of manipulation when a person's representation of the world, i.e. her belief are represented as a quantum-like system.

Quite remarkably, we establish that a person's beliefs are in theory fully manipulable. For any target state and any initial state there exists a sequence of direct measurements such that the target state is reached with a probability close to one.

In practice, this potential for manipulation is not expected to be realized because measurements are costly, people have limited patience or because constructing the appropriate measurements is not practically feasible. However, there are situations where it makes perfect sense. We provide a simple example showing that under some circumstances a single measurement in a very common situation can be sufficient to achieve desired behavior with probability one. The example also illustrates the impact and power of blind measurements. A blind measurement is a measurement that is performed but the signal is not communicated to Receiver. This capture the idea of changing the focus of a person's mind without bringing any new information. In our example simply to "divert" Receiver's attention to the Glamour perspective of the smartphone. As note by Akerlof and Schiller " just change people's focus and one can change the decisions they make." [1, p.173].

Our results suggest that the potential for manipulation of human behavior may indeed be much greater than what is proposed by main stream economic theory. This finding is in line with recent works in economics that emphasize the role of manipulation in the functioning of markets.

5 

 5 The consumer's (Receiver) decision is d ∈ {Y, N } accept or refuse to buy. The seller (Sender) receives utility 10 when selling the phone at price 30 whatever its quality and 0 otherwise. Assume now that Receivers' belief (her cognitive state) is represented by the operator B = in the basis (e 1 , e 2 ). She assigns probability 1/5 to the state |e 1 (the smartphone is Excellent) and 4/5 to the state |e 2 (the smartphone is standard). Receiver's expected utility for the smartphone in the belief state B is represented by the trace of the product of operators A and B : Eu (A; B) = Tr (AB) = (1/5) * 100 + (4/5) * 0 = 20 < 30 = u.

2 

 2 Interestingly the example illustrates another non-classical phenomenon. Namely that the mere fact of measuring without knowing the outcome triggers a significant change in beliefs. Here the 'expected posterior' EB = pB + (1 -p)B = = B in contrast with classical persuasion which is constrained by Bayesian plausibility meaning that the expected posterior must equal the prior.

1 .

 1 Direct (or projection, or von Neumann) measurements.Such a measurement is given by a family (P s , s ∈ S) of projectors with the property s P s = E where E is the identity operator on H. (A projector is an Hermitian operator such that P 2 = P .)The probability p s to obtain a signal-outcome s (in a state B ∈ St) is equal to T r (P s B) . And the posterior belief-state is B s = P s BP s /p s (it is easy to check that it is a state). Here all is standard and simple especially if projector P s is one-dimensional (that is a pure state); in this case the posterior B s is equal to P s . If we repeat the measurement we obtain the same outcome s and the state does not change. This type of measurement is repeatable or "first kind ". The only thing that must be underlined is that the expected posterior B = s p s B s = s P s BP s is generally different from the prior B as is illustrated in the example below. This contrasts with the classical case.

2. Indirect, or unsharp measurements (or POVM).

  If we perform M 2 (recalling that the system is now in |e 2 ) the system will with equal probability transit into (e 1 + e 2 ) / √ 2 or (e 1 -e 2 ) / √ 2 (we could let M 2 be a blind measurement). Now we once more apply M and with probability 1/2 we obtain the desired state |e 1 (and the undesired state |e 2 with the same probability). If we obtain |e 1 we are done. If we obtain |e 2 we again apply M 2 and thereafter M. After N iterations the state will have transited into the target state |e 1 (or P ) with Above we consider the case when the first measurement gave outcome e 2 . A similar procedure secures the desired state whenever the first outcome is e i , i = 1 . Instead of M 2 we use M i with basis (e 1 + e i ) / √ 2, (e 1 -e i ) / √ 2, e 3 , ...e i-1 , e i+1 , ...e n . Which proves the Theorem 1.

	probability 1 -(1/2)

1 + e 2 ) / √ 2, (e 1 -e 2 ) / √ 2, e 3 , ..., e n . N .


Clara Maria Colombini
email: cmcolombini@email.it

Antonio Colella
email: antonio.colella@esercito.difesa.it

Marco Mattiucci
email: marco.mattiucci@carabinieri.it

Aniello Castiglione
email: castiglione@ieee.org

Antonio Colella

Network Profiling: Content Analysis of Users Behavior in Digital Communication Channel

Keywords: Digital Profiling, Channel Profiling, Intrusion Protection System, User Behavior, Network Profiling

de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

It is now known that technology development is pushing the communication means towards prompted use of the network. This causes, in the event of an investigation, that Digital Forensics experts are forced to manage enormous masses of data that flow in the channel, in a very short time. Moreover, the growing trend of pervasive computing technology increases the need to tightly control the networks that provide access to servers, storage and databases. An important mean for monitoring the networks is the control of network performance and, in particular, the profiling of the network itself, in order to collect and analyze information of flowing traffic that are generated by routers, firewalls and all other network equipment. In this scenario, we believe that additional method of analysis of the data stream is necessary and that this new method should be able to improve the results of investigation, reducing the times at the same time. What we propose here is to apply the technique of analysis of digital profiling [START_REF] Colombini | Digital Profiling: a Computer Forensics Approach[END_REF] to a communication channel in order to extrapolate the patterns useful to find the profiling of user's digital behavior. From these patterns we can obtain a raw "sample profile" that can be used for the automatic comparison during the monitoring operations of the channel. This approach allows to obtain the immediate detection of any "abnormal behavior" that might reveal the implementation of illegal operations. To better present our research we chose to make a brief overview on profiling of cyber-criminals, Network Security and Intrusion Detection System in order to describe the scenario wherein our model has been applied.

Cyber-Crime and Profiling

The application of Digital Profiling (DP) technique in the cyberspace is not easy, especially in terms of appropriate investigation method [START_REF] Colombini | Digital scene of crime: technique of profiling users" to appear in Journal of Wireless Mobile Networks[END_REF]. The main causes can be summarized as follows:

inappropriate and incomplete documentation on this subject; difficulties to combine the human nature with Computer Science paradigms; manifested distrust towards traditional criminal profiling and in general psychological investigations.

Behavior of offender can be the same every attack, but it can also be unique to the individual under analysis, and may occur only sporadically. From the offender's point of view, most of what they do when they are committing a crime is acting normally, for them. From another point of view, they are acting out on needs and patterns developed over the life course, some of which may be abnormal needs and patterns. If there are repeated crime scenes (as with a serial or repeat offender), it is much more likely, with proper examination, that any unique behavior, need, and pattern will be uncovered.

Three elements link crimes in a series:

method of operation (modus operandi ); ritual (signs of fantasy or psychological need); signature (unique combinations of behaviors).

Signature, in a hacker behavior for instance, is a sort of "trademark" and reflects a compulsion on the part of criminals to go beyond just committing the crime to "express themselves", reflecting in some way their personality. In a defacing attack, for instance, this aspect is more evident than in others because the acting of hack is visible to everyone. Anyway, the motivations, actions, and modus operandi of traditional crimes respect to cyber-crimes are different. For example, it appears that as of 2009, we have entered a new era where organized cyber-criminals can operate identity theft and resale operations, as well as, engaged in cyber-war. The approach to hacking as multi-stage process leads to individuate three main stages, that are: casing, scanning, and enumeration. For example, the time of action can change from 48/72 hours of constantly working during a network intrusion, to a longer period such as the operations performed by pedophiles. However, hackers have found ways to streamline the efficiency of the classic methodology. In particular, the most recent development has been the use of viruses and trojans as part of the modus operandi. The difference with the past is that the "new" method uses a virus or trojan that is either custom made or standard and has the same effect as one had been hacked into the target system to install a keylogger. Clearly, the new method is considered easier than the old one.

Network Security

Before focusing the new approach to DP we should recall some notions of Network Security to better cover the topics useful to face cyber-criminal challenges. Security of a complex system is an active process that have at least four steps. The process can be considered as a circular structure. These steps are generically as follows [START_REF] Aterno | Computer Forensics e Indagini Digitali[END_REF].

-Estimation of possibilities: that is concerning the evaluation of policies, procedures, laws, internal regulations, financial availability, technical skills, etc.. All these possibilities are important to determine if the system is able to defend itself. -Implementation of protective barriers: the barriers to intruders, for instance, are implemented by hardware, software, human factor and security policies. They are built in order to carry out a form of prevention from possible damage and, at same time, to increase the perception of the security degree. -Intrusion detection system: that implies identification of violations of security policies and management system. -System Response: that is the step in which is possible to remedy the problem by classifying the solutions and by finding available means in order to not allow that these problems happen in the future.

Thus, the purpose of the cycled structure is to minimize the risk of loss of resources arising from complexity of system. This risk depends mainly on three factors: the possible threats, the potential vulnerabilities as well as the intrinsic value of the resource.

Network Intrusion

"A wise man always walks with his head down, humble as the dust -it does not matter how smart you are, how many years you studied, how many accomplishments you have already had, one day you will challenge someone with more knowledge than you, with more cunning, with more skills ... " [START_REF] Bejtlich | The Tao of network security monitoring[END_REF].

An intrusion is a violation of security policies and/or of a secure system management. An intruder in a computer system is primarily a curious person [START_REF] Shinder | Scene of the Cybercrime[END_REF]. Just such attitude, in fact, guides the early stages of the intrusion even from a technical standpoint. He seeks to identify, by means just apparently with little risky, system vulnerabilities and other data, such as connections, active services, applications, accessible, available ports, the type of operating system, etc.. After this activity, having had determined the vulnerabilities, the attacker can initiate its action of intrusion revealing his true nature through one of the following activities:

use of a service available to enter the system apparently; use of a service, within the limits of its abilities, making him perform functions not budgeted; use of a service in order to determine the fall and to eventually assume the privileges at the wake.

At this point the intrusion can actually be accomplished in several ways:

-Copy, alteration and/or removal of data (files, logs, databases, etc..); appropriation of other services; ownership of privileges and password(s); alteration of the software and creation of backdoors; creation of a tunnel to the system being attacked and/or to other systems; installation of bots/worms for remote communications or surveys.

All this may continue for some time, at least until the intruder or his tracks are not detected or the intruder itself loses interest and ceases to employ resources or damages the system permanently.

Intrusion Detection System -IDS

In order to better introduce the authors claims, it is important to recall what is written in the field of network analysis and in particular on the Intrusion Detection System (IDS). These are, in fact, main tools for carrying out an inquiry either for incident response or digital network investigation. The examination of how IDS works and is classified. In fact, allow us to present a new approach based on behavioral profiling of users linked with the device traces left (e.g., a common PC) in a digital communication channel. Obviously, our goal is very difficult to achieve and can not find conclusion in this paper, but further studies needs to be conducted in the near future. Saying that, now we can move to IDS examination.

The intrusion detection can be considered as the "problem of identifying those users or malware and bots that are using (or attempting to use) the resources of a computer system without having the required privileges." [START_REF] Mukherjee | Network Intrusion Detection[END_REF]. In the process IDS the symptoms highlighted by the system or data in digital communications are used to realize that the intrusion has occurred or is occurring. The purpose of the ID is to identify evidence of cyber-attack in order to ensure effective protection of the system. IDS systems can be classified according to the following functional attributes [START_REF] Bace | Intrusion Detection Systems[END_REF] [START_REF] Laing | How to guide: implementing a network based intrusion detection system[END_REF]. However, current intrusion detection systems are able to recognize and generate alarms in presence of already known menaces or phenomena, characterized by a specific protocol or communication patterns whose templates should be preconfigured in the IDS attacks knowledge base. This can severely limit their effectiveness in presence of completely new (and unknown) menaces, the so called 0-day attacks. To cope with this problem new ID systems are emerging, based on the concept of anomaly detection, and based on the on-line examination of several linear or nonlinear statistic properties of the ongoing traffic, aiming at inferring the occurrence of anomalous phenomena characterized by some deviance from the "normal" (or baseline network traffic behavior [START_REF] Francesco | Network anomaly detection through nonlinear analysis[END_REF].

Classification According to the Source of Data

a Network based IDSs (NIDSs) [START_REF] Roesch | Snort -Lightweight Intrusion Detection System for Networks[END_REF]: intercept and analyze packets that travel over the network using a "stealth" network card, active real-time and whose use is restricted to the administrator of the network. b Host based IDSs (HIDSs) [START_REF] Crosbie | A building block approach to Intrusion Detection[END_REF]: monitor and analyze predetermined log file and in particular the operating system audit log. Operate in either real time or periodically. c Application-based IDSs (AIDSs): Special HIDS that focus on particular audit log of specific applications. d Stack-based IDSs (SIDSs) [START_REF] Laing | How to guide: implementing a network based intrusion detection system[END_REF] operate directly on the TCP/IP stack by monitoring the passage of packets through the layers of network protocol.

Classification According to the Method of Analysis

a Fingerprint based IDSs are based on a database of classes of attacks. When a match between an event and a recently recorded class of features is found (or at least match only in part) there is an high probability that the IDS has detected an intrusion in progress. b Historical profile based IDSs: IDSs commercial and experimental attempt to determine an average profile over the period of use of the controlled system. If the IDS detects an abrupt change in this profile then a possible intrusion or at least an irregular operation is going to occur [START_REF] Stephenson | The application of Intrusion Detection Systems in a Forensic Environment[END_REF].

Classification According to the Type of Reaction

a Active IDSs react to the abnormal situation of specific applications running under administrative privileges, changing the system environment (for exam-ple, isolating resources) and sometimes, if unable to identify the intrusion, even acting directly responsible for the attack on isolating and recording accurately subsequent actions and communications. b Passive IDSs: report alarms to the system administrator who is responsible for deciding what action to take.

At last, IDSs, while providing an important input to prevent, block and contrast attacks against Digital Forensics analysis, unfortunately, are still very "rigid" in their activities referring to precise patterns and pre-packaged, and also show a marked sensitivity to parameter settings. This means that the implementation of an IDS with a firewall to anticipate barriers in a network system is absolutely valid, but what if it does not follow a long period of evaluation, observation and analysis of statistics on the data provided, the cost of employing be too high compared to the benefits. Without fear of contradiction, an IDS must be chosen with different intervention policies at home and various parameters that can be selected and reviewed at least every 6 months based on precise analytical observations of the behavior of the network system.

In any case, the last goal of modern IDS systems is the timely generation of sufficiently accurate alerts that can be used to trigger automatic protection countermeasures such as the determination and distribution of the proper filtering rules [START_REF] Francesco | Containing large-scale worm spreading in the Internet by cooperative distribution of traffic filtering policies[END_REF] to defeat the detected attacks. In the near future, these mechanism will be properly orchestrated to cooperate in a structured organization working as self-learning distributed security solution [START_REF] Santis | An intelligent security architecture for distributed firewalling environments[END_REF] or operating like a kind of network immune systems [START_REF] Francesco | Automated detection and containment of worms and viruses into heterogeneous networks: a simple network immune system[END_REF] where firewalls and detectors play the roles of network antibodies.

Network Profiling of Digital Communication Channel

In order to test the application of the method of behavioral analysis offered by the Digital Profiling of a digital communication channel, and to extrapolate the patterns of behavior, you chose to take a sample analysis of log files for access to a corporate web server on which they are resident, on the web portal and the Intranet.

The web server log files record the values for each request received from the server itself. The data are collected in text: when a user accesses a web page, the browser makes a request to the server resources, the system of allocation and management of the web site from which the page is called. The resources required may consist of web files (HTML, PHP,. ASP, etc..), image files or graphics, sound files, video files, and special applications. The web server accesses resources and sends them to your browser, so you can view them. This exchange activities between browser and web server is recorded in the log file, and creates a log of requests to a server by browsers of the users and the resulting responses [START_REF] Farinella | Tecnologia database per l'analisi di log file di Web Server[END_REF]. The information contained in log files are normally stored in the format known as the Common Log File Format, a text file in which each request from browser to web server corresponds to a string. The log file records only the web pages needed and the resources associated with them as audio files, graphics files, etc.. Each server response -indicating success, error, timeout (i.e. no response) -is recorded by the server log file. The specific type chosen for the log file was created by experimentation in order to maintain control of accesses to the public for statistical purposes(number of users in different periods of the year, attendance at different hours of the day, pages most viewed, etc...). It also records the accesses to the Intranet, reserved for employees through authentication, where a number of users employees own the publishing rights in areas dedicated to each business structure that provides its own documentation. In particular, the control has been implemented following the discovery of a leak of confidential information, in the published literature within the Intranet. This site discusses and summarizes the application of the method of Digital Profiling used to out line the behavior of digital users in order to detect any misconduct.

The Method of Analysis

In the analysis of log files, depending on the purpose it is intended, are used to highlight relationships between data and build a result of behavioral models that describe two types of approach:

-Top down: search for confirmation of facts already known or assumed (eg, an action resulting from an intrusion has already occurred) bottom-up: to find information useful to construct hypotheses (e.g., the most likely causes that produce a particular result).

This research proposes to apply the method of Digital Profiling [START_REF] Colombini | Digital Profiling: a Computer Forensics Approach[END_REF] with both bottom-up and top-down approach. The cycle of analysis takes place in 6 phases.

Step 1 -Identification of the target.

Step 2 -Collection of data log files.

Step 3 -Identification of characteristic properties (features) from the mass of data collected from log files and collect this information (indicators) contained the features detected.

Step 4 -Detection of possible subjects to which it is possible to attribute behavior Digital.

Step 5 -Analysis of information and construction of the behavior of digital accesses.

Step 6 -Construction of the user profile and usage of digital information obtained, depending on the objective.

Application of Method: a Case Study

Phase 1 -Objective In the case study,the goal is extrapolation of the profile of users accessing the portal/intranet via the digital reconstruction of the behavior of the various requests that come to the web server. The collection of log files has been confined here in a span of 90 days, identified as the period in which the intrusion occurred.

Phase 2 -Data collection Log files are chosen as standard for access to the IP address of a web portal resident on the web server with one part open to the public and a private Intranet to employees, consisting of an enterprise document repository with access through authentication(username+ password unique to each individual user). These special log files are specifically configured by the company to perform statistics on areas of greatest influx both by external users to the portal by employees in the documentary Intranet, in order to improve the efficiency of the service offered in terms of both external and internal communications. They were chosen for this analysis because of their relative simplicity makes it an ideal sample for a more agile and easy illustration of the application being tested. Log files are structured in records consisting of 8 fields, according Table 2.

2012-04-16 02:35:34 document document.pdf visualization john.smith 10.6.301.0 yes /intranet/office01/data/ 1. DATE: gives information on the distribution of accesses in the days of the week: year-month-day (in yyy.mm.dd). 2. TIME: provides information on the distribution of accesses in the daytime: hour.minutes.seconds (in hh.mm.ss). 3. USERNAME: contains information on the identity of the user-employee or as an alternative means to access the portal from an external user.

firstname.lastname (employee -internal access).

anonymous (external access). 4. IP: provides the identification number of the machine from which the user/ employee has logged on, where indicator is IP number.

OBJECT TYPE: provides the type of file being accessed:

-Document: means access to a file; folder: indicates access to a folder or area. 6. OBJECT NAME: contains the name the extension of the file or folder name to which you have access: Name.extension-full name of the file. 7. OBJECT PATH: provides the entire path to the object sought within the web site or Intranet. -Display: visualizes the document in read/download, allowed to all users; creation: allows the publication of a new document or folder (action reserved for users with permission to publish); edit: edits a new document or folder (action reserved for users with permission to publish); delete: allows deletion of a new document or folder (action reserved for users with permission to publish).

Phase 4 -Conduct of digital extrapolation Depending on the original purpose, each ENTITY detected can be considered the main actor in which to disclose the information (indicators) derived from the Feature of the other elements of the log file, for the delineation of their digital behavior. It then considers the set log file L, which belong to the entity E:

L = E 1 • • • E n
Each entity E is formed in turn by one or more Features f , properties that characterize it:

E = f 1 • • • f n
Each Feature f contains a value that represents the indicator i, i.e., characterizing the information. The goal of the set of indicators is to form the behavior of each Entity.

E = i 1 • • • i n
We discuss here briefly the extrapolation of the behavior pattern of entities subject to company analysis after successful intrusion. Within the log file of the case to identified ENTITIES interest, each of which has its own digital personal behavior. The application of the method can be implemented with two different approaches of cited. In this case we assume knowledge of an intrusion already occurred, and we use a top-down approach, identifying the ENTITIES primary object of the intrusion, i.e. the file containing the stolen information, indicated by the field OBJECT NAME. Entity OBJECT -Digital model of behavior: the Feature which characterize its behavior contain digital indicators with which it is possible to build the model behavior of the follow Entities.

-OBJECT NAME: indicates not only the file on which the action was done, but how many times it has been accomplished in the time interval considered. -PATH: identifies the area where the object is contained (in this case within the Intranet with the subfolders), the indicators that they extract provides guidance on:

• Vulnerabilities in the implementation of security measures for the affected area; • presence of other types of confidential documents also present in the object of intrusion. -ACTION: the type of action that was performed on the object-target:

• Display (ie the download file);

• create (upload a file or creating a folder);

• edit (edit the file as its replacement, moving, renaming the file);

• delete (delete a file or a folder of files). -DATE and TIME: the date and time when the operation was performed on the object. Indicators are also obtained from extracts statistical information on the days and hours of the day when the shares were the most frequently performed.

-IP: The IP address of the machine you are logged on (whether fixed or Domain) or IP address of the source provider (if dynamic). It also indicates how many times the same IP has made other actions.

Similarly, but with a bottom-up approach, we can apply the same method of profiling the log file from the user anonymous, useful if you want a model to study the behavior of users who access the web server from outside domain, in order to implement security measures with the aim of preventing any abnormal behavior. In this way we can create a primary entity (USERANONYMOUS), using the primary USER ENTITY, filtered with Feature "Anonymous" from the USERNAME field. The Feature which characterize its behavior contain digital indicators with which it built its digital model of behavior: ACTION, OBJECT NAME, DATE and TIME, IP.

Phase 5 -Analysis of information and construction of the behavior profile of digital accesses The information derived from the measured indicators are the behavioral profile of the subject being treated as the main entity. In the case of the Entity OBJECT, that is, the file object intrusion, with reference to the time period examined (90 days), the indicators have revealed that it has been shown, by an anonymous user, with an IP not identified, for 5 times in one month:

-3, Saturday morning, at 10:12 am; -4, Sunday morning, at 11:05 am; -10, Saturday morning, at 9:55 am; -11, Sunday morning, at 10:00 am; -17, Saturday morning, at 10:47am.

Similarly,the behavioral profile was obtained USERANONYMOUS, which connects mainly in the evening after 18, Saturday and Sunday morning browsing documents information on services and products offered by the company.

Phase 6 -Comparisons of the obtained profiles and usage of given digital information, depending on the objective Last operation is the comparison between the obtained profiles in order to reveal affinity in the digital behavior. Using connection dates as a filter, we selected users access to anonymous on Saturday and Sunday morning, in the 3 month period. The comparison with the dates reserved for the display of files allowed to isolate two anonymous users online on the dates and times in which the confidential file with the same IP address was downloaded.

Considerations

In this paper it is shown the possibility to apply the Digital Profiling to a data stream with the aim to extrapolate the profile of the entity of interest by looking at a set of log files resulting as the access log of a web server in a given time interval. The application of the method is also possible on any other entity within a log file, in order to extrapolate the digital behavior of "someone" (or "something") of interest. A second factor to be considered is that it is also possible to make a comparison between different behaviors in order to build broader profiles, composed of different behaviors of the "actors" who populate the data flow. Indeed, where there is no availability of specific log files, it is possible to reconstruct the profile by comparing different behaviors of the different entities available in a given log file.

Conclusions

The Digital Profiling of a set of log file could be very useful for the identification of a perpetrators of a cyber-crime (e.g., phishing, attacks on servers, etc.), where the extrapolation of the digital behavior of selected entities, as subject of a set of log file, can make the reconstruction and subsequent analysis of the modus operandi of the offender (i.e., the intruder in case of a network intrusion). The proposed approach is able to reveal information about:

-Target of the attack (fraud, Denial of Service, political attack, etc.); tools and techniques used for intrusion (rootkits, shells, worms, social engineering, etc.); technical skills used; possible correlation with measures of social engineering; time chosen for the attack (day/night, intra/end of week, etc.); duration of the attack and possible frequency (single or fragmented in predetermined time intervals, etc.); correlation of the moment chosen for the attack with external events; choices of victims (national or foreign government institution, bank, commercial organization, etc.); typology of (eventual) anti-forensic techniques adopted; achievement of goal.

Fig. 1 .

 1 Fig. 1. Network profiling cycle of analysis

Table 1

 1

	is a typical line of a log file in the Common

Table 1 .

 1 Log file in the Common Log File Format

Table 2 .

 2 Log files are structured in records consisting of 8 fields 8. ACTION: shows actions performed by the user:

	Field	Definition	Description
	01/Feb/1998:10:10:00	Data Time	Date and time for the request.
	+0100
	Document	Object Time	Type of object searched by the user, consist-
			ing of a document (text / spreadsheet / im-
			age, etc..), from an area of the site or the
			Intranet..
	Document.pdf	Object Name	Name of the file object of the request.
	Visualization	ACTION	Type of action taken by the user on the file
			or folder / area sought..
	John.smith	USERNAME	Contains the user name, consisting of first-
			name.lastname and kept in the Active Direc-
			tory enterprise, with which the user-employee
			makes the request for access to the portal,
			which allows him access to the Intranet. In
			the case of access by a user not recognized by
			the system, the field describes it as anony-
			mous, with the right of access only to the
			public.
	10.6.301.0	IP	identifies the IP address of the machine, in-
			side the company domain, from which the
			user has logged-dependent. When accessing
			from outside the corporate domain, the field
			identifies it as N.D.
	IS	INTRANET	Access to employees or less restricted area by
			the user.
	/intranet/uffice01/data/ OBJECT PATH Location of the file / folder that the user has
			accessed.