KR101544253B1 - Method for detecting software plagiarism based upon analysis on call frequency of application programming interfaces - Google Patents

Abstract

A method for detecting software plagiarism through application programming interface (API) call frequency analysis is disclosed. The software plagiarism detection method according to the present invention includes an API call feature information extraction step of extracting API call feature information of a first program and a second program and a step of extracting API call feature information of the first program, And a similarity determination step of comparing similarity between the first program and the second program. Therefore, it is possible to statically analyze the executable file of the comparison target programs without effectively obtaining the source code of the programs to be compared or dynamically analyzing the executable file of the program to be compared, and effectively detect whether the software is plagiarized .

Description

FIELD OF THE INVENTION [0001] The present invention relates to a method for detecting software plagiarism based on application program interface call frequency analysis,

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a software plagiarism detection method, and more particularly, to a method of determining software plagiarism using a birthmark that defines a characteristic of software.

Software plagiarism is on the rise in the software industry. Software plagiarism is the development of software by unauthorized use of source code or open source code of software developed by others without permission or license.

The first method is to compare the similarity between the source codes of the comparative software and the second method is to compare the similarities between the executable files of the comparative software .

The first method is a method of comparing the token sequence extracted from the source codes or the syntax tree. It is necessary to obtain the source code of the software to be basically compared, It is difficult to apply the present invention to a situation in which it is not easy.

 The second method is a method of mutually comparing feature information extracted from program execution files (hereinafter referred to as "birthmarks"). However, research on most existing feature information is based on definition and extraction of feature information of a Java program And there is no research on the definition and extraction of feature information of Windows programs.

It is an object of the present invention to solve the above problems and provide a method of detecting plagiarism of software, comprising the steps of: comparing static software bus marks extracted through static analysis of program execution files constituting software, And to provide a method of detection.

According to an aspect of the present invention, there is provided a software plagiarism detection method including: an API call characteristic information extraction step of extracting API (Application Programming Interface) call characteristic information of a first program and a second program; And a similarity determination step of comparing the API call property information and the API call property information of the second program with each other to determine a similarity between the first program and the second program, .

Here, the step of extracting the API call characteristic information may include the steps of: creating an API function call graph of the first program and the second program; And generating API call property information of the second program.

At this time, the step of creating the API function call graph may be configured to disassemble the first program and the second program, and to generate the API function call graph using the disassembled result.

Here, the API function call graph may be configured to define a calling relationship between functions constituting the first or second program and a calling relation for an API used in the first or second program of at least a part of the functions. .

Here, the API call property information generated in the step of generating the API call property information may be expressed by a vector including an element count as a count value of a call count per API used in the first or second program .

At this time, the API call property information may be configured by multiplying each element by a weight for each API determined by a TD-IDF (Term Frequency-Inverse Document Frequency) method. In this case, the weight for each API may be generated based on a value obtained by multiplying the number of calls per API of the target program by an inverse number of the number of programs using the API.

Here, the degree of similarity determination may be performed by calculating a degree of similarity between the first program and the second program through a cosine similarity operation on the API call characteristic information of the first program and the API call characteristic information of the second program, And calculate a similarity value value to indicate.

In this case, the similarity determination step determines whether the similarity value between the first program and the second program belongs to a section in which the similarity value is set by a predetermined threshold value, and determines whether or not the first program and the second program are plagiarized .

At this time, the predetermined threshold value may be determined experimentally.

The software plagiarism detection method according to the present invention as described above can be applied to the field of software copyright protection.

The detection method according to the present invention statically analyzes the executable file of the comparison target programs without obtaining the source code of the comparison target programs or dynamically analyzing the executable file of the comparison target program, Can be effectively detected.

FIG. 1 is a flowchart illustrating a software plagiarism detection method according to an embodiment of the present invention.
2 is a conceptual diagram for explaining the concept of a function call graph for extracting API call property information according to the present invention.
3 is a table summarizing 40 programs to be tested in the method of detecting plagiarism according to the present invention.
4 is a graph for explaining an experimental example to which the software plagiarism detection method according to the present invention is applied.

While the invention is susceptible to various modifications and alternative forms, specific embodiments thereof are shown by way of example in the drawings and will herein be described in detail. It should be understood, however, that the invention is not intended to be limited to the particular embodiments, but includes all modifications, equivalents, and alternatives falling within the spirit and scope of the invention. Like reference numerals are used for like elements in describing each drawing.

The terms first, second, A, B, etc. may be used to describe various elements, but the elements should not be limited by the terms. The terms are used only for the purpose of distinguishing one component from another. For example, without departing from the scope of the present invention, the first component may be referred to as a second component, and similarly, the second component may also be referred to as a first component. And / or < / RTI > includes any combination of a plurality of related listed items or any of a plurality of related listed items.

It is to be understood that when an element is referred to as being "connected" or "connected" to another element, it may be directly connected or connected to the other element, . On the other hand, when an element is referred to as being "directly connected" or "directly connected" to another element, it should be understood that there are no other elements in between.

The terminology used in this application is used only to describe a specific embodiment and is not intended to limit the invention. The singular expressions include plural expressions unless the context clearly dictates otherwise. In the present application, the terms "comprises" or "having" and the like are used to specify that there is a feature, a number, a step, an operation, an element, a component or a combination thereof described in the specification, But do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, or combinations thereof.

Unless defined otherwise, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs. Terms such as those defined in commonly used dictionaries are to be interpreted as having a meaning consistent with the contextual meaning of the related art and are to be interpreted as either ideal or overly formal in the sense of the present application Do not.

Hereinafter, preferred embodiments according to the present invention will be described in detail with reference to the accompanying drawings.

First, terms used in the present invention are summarized.

A software birthmark is unique feature information of a program and can be extracted from an executable file of a program (EXE file of a Windows program or byte code of a Java program).

Let f (p) be a set of features extracted from program p. If f (p) satisfies the following two conditions, f (p) can be called the bus mark of program p.

First, f (p) must be obtained from program p itself.

Second, when the program q is generated based on the source code of the program p, it is defined as a software plagiarism, and f (p) = q (p) is established at this time. Alternatively, program q and program p may be defined as being in plagiarism even if f (p) and q (p) are similar in level.

Software bus marks can be categorized into two types - static birthmarks and dynamic birthmarks. The static bus mark is based on features extracted from the executable of the program itself, and the dynamic bus mark is based on the characteristics that appear during the execution of the executable file.

The static bus mark has a robustness to software plagiarism techniques using various source code conversion methods, but it has a high probability of false alarms that incorrectly detect similar kinds of software as plagiarism.

On the other hand, the dynamic bus mark has a disadvantage in that it can be easily changed because it depends on the input and execution environment of the program, and it does not provide the global characteristic of the program and only provides local characteristics of the partial code actually being executed .

The API call characteristic information is information used as a static software bus mark in the software plagiarism detection method according to the present invention and may mean a vector having a number of calls per API of the target program as the value of an element corresponding to each API have.

The API function call graph may refer to analysis means used to generate API call feature information in the software plagiarism detection method according to the present invention.

Software plagiarism detection method according to the present invention

The present invention relates to a plagiarism detection technique using static bus marks among the above-described software bus marks.

FIG. 1 is a flowchart illustrating a software plagiarism detection method according to an embodiment of the present invention.

1, a software plagiarism detection method according to the present invention includes an API call characteristic information extraction step (S110) and a similarity degree determination step (S120) for determining a similarity degree between two programs using the extracted API call characteristic information .

As a detailed example, the API call characteristic information extracting step (S110) generates the API call characteristic information of the comparison target programs using the generated function API call graph (S112) of creating the API function call graph of the comparison target programs (Step S113).

Hereinafter, the programs to be compared are defined as a first program (p) and a second program (q). In addition, the API call characteristic information may be the software bus mark of each program described above.

The step of creating the API function call graph (S112) further includes a step S111 of disassembling each program (first and second programs) to create an API function call graph of the comparison target programs . An IDApro disassembler may be typically used for disassembly, but various other disassemblers may be used.

The API function call graph can be created by disassembling the entire program executable code first and then creating an API function call graph based on the disassembled result, or by simultaneously creating the disassembly and API function call graph ≪ / RTI >

Hereinafter, the concept of an API function call graph will be described. The API function call graph is used as a means for extracting API call characteristic information functioning as a software bus mark in the present invention and can be prepared for each of the comparison target programs (the first program and the second program). However, the means for extracting the API call property information according to the present invention is not necessarily limited to the API function call graph.

2 is a conceptual diagram for explaining the concept of a function call graph for extracting API call property information according to the present invention.

Referring to FIG. 2, the API function call graph 200 includes a node (hereinafter referred to as a " node ") designating functions f ₁ , f ₂ , ..., f ₆ constituting a comparison target program nodes 211 and 216 and nodes 221 and 222 for specifying APIs a ₁ and a ₂ used in the program. Also, the API function call graph expresses the call relation between the functions and the APIs as an edge which is a link between the nodes.

At this time, the number of calls per API of the target program of the graph can be determined through the API function call graph. In step S113, the number of calls per API is counted using the created API function call graph to obtain API call property information Respectively.

The number of API a calls in the API function call graph can be defined as the number of nodes satisfying the following two conditions.

Condition 1) Node without an incoming edge

Condition 2) A node that can directly or indirectly reach the node corresponding to API a

2, the target program uses two APIs (API a ₁ and API a ₂ ), the number of API a ₁ calls is 2, and the API and the number of calls of a ₂ is 3. For example, in the case of API a ₁ , a function node that satisfies both condition 1 and condition 2 becomes two-node 211 for function f ₁ and node 216 for function f ₆ . For example, in the case of API a ₂ , the function node that satisfies both condition 2 and condition 3 is three-node 212 for function f ₂ , node 213 for function f ₃ , node (for function f ₆ ) 216) -.

In step S113, when the value obtained by counting the API used by the program and the number of calls per API using the API function call graph is obtained, the API call characteristic information is generated as the software bus mark.

In the present invention, the API call property information may be represented by a vector including an element having a value obtained by counting the number of calls per API available in the program. For example, if there are 1000 APIs available to the target program, the API call property information can be expressed as a vector having 1000 elements corresponding to APIs a ₁ to a ₁₀₀₀ . As an example, if the target program is a Windows program, the total number (n) of APIs defined in the MSDN (Microsoft Developer Network) may be the number of elements (n) of the API call property information vector of the target program.

However, the API call property information should be implemented as a vector (n-dimensional vector) having the number of elements (n) of all APIs existing in principle. However, exception handling, thread generation, Since the APIs that perform essential tasks such as process termination and memory allocation are APIs commonly used in most programs, When included as information, it may be difficult to differentiate between programs.

Therefore, in the step S113 of the present invention, a method of generating the API call characteristic information by applying the term frequency-inverse document frequency (TD-IDF) technique and applying the weight for each API to the API call characteristic information may be used.

The TD-IDF technique is a widely used technique in the information retrieval domain and is a numerical statistical technique that can be used to evaluate the importance of terms in a document. TF (term frequency) means the number of occurrences of words in the document, and DF (document frequency) means the number of documents containing the word. IDF is the reciprocal of DF, and TF-IDF is the product of TF and IDF.

When the TD-IDF technique is applied to extract the API call property information of the present invention, the TF may correspond to the number of API calls in the program, and the DF may correspond to the number of programs that call the API.

Accordingly, the step S113 of the present invention may include a step of multiplying TD and IDF experimentally obtained for each API as a weight for a corresponding API element of a vector representing the API call characteristic information.

As a result, TF is a weighted value with a high value for frequently used APIs in a program, and IDF (the inverse of DF) is a weighted value with a low value for APIs commonly used in many programs. This means that when an API that is not widely used in other programs is frequently used in a specific program, the API can be an API that specifies the characteristics of the specific program.

Next, the similarity determination step S120 is a step of calculating similarity by comparing the API call characteristic information of the target programs extracted through step S110. The calculated similarity may be used to determine whether the target programs are in a plagiarism relationship with each other by comparing with a predetermined threshold value. The predetermined threshold value can be determined experimentally.

Since the API call characteristic information extracted in step S110 is represented as a vector, the similarity determination in step S120 may be performed using the similarity value derived by calculation of cosine similarity for determining the similarity between vectors.

Equation (1) is an example of a calculation formula for calculating the similarity value between the first program and the second program.

Here, V _p and V _q are expressed as vectors as API call characteristic information (i.e., software bus marks) of the first program and the second program, respectively.

{V _p } _i and {V _q } _i designate the i-th element of the V _p vector and the V _q vector, respectively, and the calculation result of Equation (1) has a value of 0 to 1.

In step S120, the similarity value calculated by Equation (1) may be further compared with predetermined threshold values to determine plagiarism or non-plagiarism between target programs.

At this time, the predetermined threshold value? May be a value for determining three intervals to be compared with the similarity value determined through Equation (1). For example, SIM (V _p , V _q ) calculated by Equation (1) can be used to determine whether or not the target programs are plagiarized by a relationship with the threshold value? The threshold value [epsilon] can be experimentally determined, and an example of an experiment for determining the threshold value will be described later.

1) When SIM (V _p , V _q ) > = 1 -?, It is determined that the first program and the second program are in a plagiarism relation with each other.

2) When SIM (V _p , V _q ) < = epsilon, it is determined that the first program and the second program are in a non-plagiarism relation (that is, each is an independent program).

3) If ε <SIM (V _p , V _q ) <1- ε, the conclusion of whether or not the first program and the second program are plagiarized is reserved.

Experimental Example ( experimental study )

Hereinafter, in order to verify the accuracy of the software plagiarism detection method according to the present invention, an experimental example of 40 programs belonging to 10 categories will be described.

3 is a table summarizing 40 programs to be tested in the method of detecting plagiarism according to the present invention.

Referring to FIG. 3, four programs are selected for each category for ten categories (text editors, FTP clients, etc.).

One pair of four programs (for example, 1 and 2, 3 and 4) for each category is composed of different version programs of the same program, and each pair (pair consisting of 1 and 2, 4) consists of a completely different program. Therefore, it is presumed that it should be judged as 'plagiarism' because it will have a high degree of similarity between programs constituting a pair of the four programs, and it is assumed that each pair should be judged as 'non-plagiarism' since they will have a low degree of similarity.

In order to verify the accuracy of the detection method of the present invention, three accuracy indicators (precision, recall, F-measure) are defined in the following equations (2) to (4).

In Equations 2 to 4, CC denotes a set of program pairs classified as 'plagiarism' by a human expert, and CI denotes a set of program pairs classified as 'plagiarism' by a human expert. In the case of the 40 programs illustrated in FIG. 3, one of four programs (for example, 1 and 2, 3 and 4) for each category can be classified as 'plagiarism' 2, and a pair consisting of 3 and 4) can be classified as 'non-plagiarism'.

Also, PC means a set of program pairs classified as 'Plagiarism' by the method according to the present invention, and PI means a set of program pairs classified as 'Plagiarism' by the method according to the present invention.

4 is a graph for explaining an experimental example to which the software plagiarism detection method according to the present invention is applied.

In FIG. 4, the x-axis represents the threshold value (?), And the y-axis represents the accuracy measured by the set threshold value?.

Referring to FIG. 4, it can be seen that the detection method according to the present invention has the highest accuracy (precision: 0.97, recall: 0.95, F-measure: 0.96) when the threshold value? Is set to 0.4.

As described above, when the threshold value? Is set to 0.4, when the similarity value belongs to the range of [0, 0.4], the comparison target programs are determined as non-plagiarism, and the similarity value is set to [0.6, 1.0] If they belong to the range, the programs to be compared are judged as plagiarism.

It will be apparent to those skilled in the art that various modifications and variations can be made in the present invention without departing from the spirit or scope of the present invention as defined by the following claims It can be understood that

211 to 216: function node
221, 222: API node

Claims (12)

A method for software plagiarism detection,
An API call characteristic information extraction step of extracting API (Application Programming Interface) call characteristic information of the first program and the second program;
Assigning a pre-set API weight value to the API call property information of the first program and the API call property information of the second program; And
And a similarity determination step of comparing the first program, the API call property information, and the API call property information of the second program with each other to determine a similarity between the first program and the second program,
Wherein the step of extracting the API call characteristic information comprises the steps of: receiving, by the API function call of each of the first program and the second program, nodes having no incoming edge and directly or indirectly reaching the API, When the first program and the second program are connected to each other, acquiring the number of nodes connected to each API for each of the first program and the second program, and acquiring the API of each of the first program and the second program based on the number of nodes connected to the respective APIs And generates a call frequency bus mark as API call characteristic information. The method according to claim 1,
Wherein the API call characteristic information extracting step creates a API function call graph of the first program and the second program. delete delete The method according to claim 1,
Wherein the API call property information is expressed by a vector including an element count as a call count value per API used in the first or second program. The method according to claim 1,
Wherein the weight for each API is determined by a TD-IDF (Term Frequency-Inverse Document Frequency) method. The method of claim 6,
Wherein the weight for each API is generated based on a value obtained by multiplying the number of calls per API in each of the first program and the second program by an inverse number of the number of programs calling each API. The method according to claim 1,
Wherein the degree of similarity determining step determines a degree of similarity based on a degree of similarity indicating a degree of similarity between the first program and the second program through a cosine similarity calculation on the API call characteristic information of the first program and the API call characteristic information of the second program, A software plagiarism detection method that calculates a value. The method of claim 8,
Wherein the similarity determination step determines whether a similarity value between the first program and the second program belongs to a section set by a predetermined threshold value and determines whether the first program and the second program are plagiarized or not, Way. The method of claim 9,
Wherein the predetermined threshold is determined experimentally. Obtaining the number of nodes connected to each API when there are no incoming edges and nodes directly reaching one or more APIs (application programming interfaces) are connected to one or more APIs by API function calls of the program;
Generating an API call frequency bus mark of the program based on the number of nodes connected to each of the APIs;
(C) assigning a pre-set API weight to each API of the API call frequency bus mark;
(D) calculating an API calling frequency bus mark of the first program corresponding to the program and applying the weight for each API, and calculating a degree of similarity between the API calling frequency bus mark of the second program to which the weight for each API is applied, The software plagiarism detection method. The method of claim 11,
Wherein the weight for each API is determined by multiplying the frequency of each API in the program by the reciprocal of the number of programs calling each API in the first and second programs.

Images