Effective identification of source code authors using byte-level information

ABSTRACT

Source code author identification deals with the task of identifying the most likely author of a computer program, given a set of predefined author candidates. This is usually .based on the analysis of other program samples of undisputed authorship by the same programmer. There are several cases where the application of such a method could be of a major benefit, such as authorship disputes, proof of authorship in court, tracing the source of code left in the system after a cyber attack, etc. We present a new approach, called the SCAP (Source Code Author Profiles) approach, based on byte-level n-gram profiles in order to represent a source code author's style. Experiments on data sets of different programming-language (Java or C++) and varying difficulty (6 to 30 candidate authors) demonstrate the effectiveness of the proposed approach.A comparison with a previous source code authorship identification study based on more complicated information shows that the SCAP approach is language independent and that n-gram author profiles are better able to capture the idiosyncrasies of the source code authors. Moreover, the SCAP approach is able to deal surprisingly well with cases where only a limited amount of very short programs per programmer is available for training. It is also demonstrated that the effectiveness of the proposed model is not affected by the absence of comments in the source code, a condition usually met in cyber-crime cases.

REFERENCES

• 1: Haibiao Ding , Mansur H. Samadzadeh, Extraction of Java program fingerprints for software authorship identification, Journal of Systems and Software, v.72 n.1, p.49-57, June 2004 [doi>10.1016/S0164-1212(03)00049-9]
• 2: Frantzeskou, G., Gritzalis, S., Mac Donell, S., Source Code Authorship Analysis for supporting the cybercrime investigation process, (ICETE04), Vol 2, pages (85-92), 2004.
• 3: A. Gray , P. Sallis , S. MacDonell, IDENTIFIED: A Dictionary-Based System for Extracting Source Code Metrics for Software Forensics, Proceedings of the 1998 International Conference on Software Engineering: Education & Practice, p.252, January 26-29, 1998
• 4: Gray, A., Sallis, P., and MacDonell, S., Software forensics: Extending authorship analysis techniques to computer programs, in Proc. 3rd Biannual Conf. Int. Assoc. of Forensic Linguists (IAFL'97), pages 1--8, 1997.
• 5: Keselj, V., Peng, F., Cercone, N., Thomas, C., N-gram based author profiles for authorship attribution, In Proc. Pacific Association for Computational Linguistics 2003.
• 6: Keselj, V.,. Perl package Text::N-grams http://www.cs.dal.ca/~vlado/srcperl/N-grams , 2003.
• 7: Kilgour, R. I., Gray, A.R., Sallis, P. J., and MacDonell, S. G., A Fuzzy Logic Approach to Computer Software Source Code Authorship Analysis, Accepted In Proc. Of (ICONIP'97). Dunedin. New Zealand, 1997.
• 8: Krsul, I., and Spafford, E. H, Authorship analysis: Identifying the author of a program, In Proc. 8th National Information Systems Security Conference, pages 514--524, National Institute of Standards and Technology., 1995.
• 9: Thomas A. Longstaff , E. Eugene Schultz, Beyond preliminary analysis of the WANK and OILZ worms: a case study of malicious code, Computers and Security, v.12 n.1, p.61-77, Feb. 1993 [doi>10.1016/0167-4048(93)90013-U ]
• 10: MacDonell, S.G, and Gray, A.R. Software forensics applied to the task of discriminating between program authors. Journal of Systems Research and Information Systems 10: 113--127 (2001).
• 11: Fuchun Peng , Dale Schuurmans , Shaojun Wang, Augmenting Naive Bayes Classifiers with Statistical Language Models, Information Retrieval, v.7 n.3-4, p.317-345, September-December 2004
• 12: P. Sallis , A. Aakjaer , S. MacDonell, Software forensics: old methods for a new science, Proceedings of the 1996 International Conference on Software Engineering: Education and Practice (SE:EP '96), p.481, January 24-27, 1996
• 13: Eugene H. Spafford, The internet worm program: an analysis, ACM SIGCOMM Computer Communication Review, v.19 n.1, p.17-57, Jan. 1989 [doi>10.1145/66093.66095]
• 14: Eugene H. Spafford , Stephen A. Weeber, Software forensics: can we track code to its authors?, Computers and Security, v.12 n.6, p.585-595, Oct. 1993 [doi>10.1016/0167-4048(93)90055-A ]
• 15: Efstathios Stamatatos , George Kokkinakis , Nikos Fakotakis, Automatic text categorization in terms of genre and author, Computational Linguistics, v.26 n.4, p.471-495, December 2000 [doi>10.1162/089120100750105920]

INDEX TERMS

Primary Classification:
  K. Computing Milieux
  K.4 COMPUTERS AND SOCIETY
      K.4.1 Public Policy Issues
          Subjects: Abuse and crime involving computers

General Terms:
Experimentation, Security

Keywords:
software forensics, source code authorship identification