Automatic Source Code Plagiarism Detection

Service-oriented computing (SOC) promises a world of cooperating services loosely connected, constructing agile Web applications in heterogeneous environments conveniently. Web application interface (API) as an emerging technique attracts more and more enterprises and organizations to publish their deep computing functionalities and big data on the Internet, Web API has become the backbone to promote the development of SOC, thus forming the prosperous Web API economy. However, the number of available Web APIs on the Internet is massive and growing constantly, which causes the Web API overload problem. Quality of service (QoS) as an indicator is able to well differentiate the quality of Web APIs and has been widely applied for high quality Web API selection. Since testing QoS for massive Web APIs is resource-consuming, and the QoS performance depends on contextual information such as network and location, hence accurate QoS prediction has become very crucial for personalized Web API recommendation and high quality Web application construction. To address the above issue, this paper presents a context aware deep factorization machine model (CADFM for short) for accurate Web API QoS prediction. Specifically, we first carry out detailed data analysis using real-world QoS dataset and discover a positive relationship between QoS and contextual information, which motivates us to incorporate beneficial contexts for enhancing QoS prediction accuracy. Then, we treat QoS prediction as a regression problem and propose a context aware CADFM framework that integrates the contextual information via embedding technique. Particularly, we adopt MF and MLP for high-order and nonlinear interaction modeling, so as to learn the complex interaction between users and Web APIs accurately. Finally, the experimental results on real-world QoS dataset demonstrate that CADFM outperforms the classic and the state-of-the-art baselines, thereby generating the most accurate QoS predictions and increasing the revenue of Web APIs recommendation.

A Metadata Approach for Building Web Application User Interface

Source Code Authorship Attribution can answer many interesting questions such as: Who wrote the malicious source code? Is the source code plagiarized, and does it infringe on copyright? Source Code Authorship Attribution is done by observing distinctive patterns of style in a source code whose author is unknown and comparing them with patterns learned from known authors' source codes. In this paper, we present an efficient approach to learn a novel representation using deep metric learning. The existing state of the art approaches tokenize the source code and work on the keyword level, limiting the elements of style they can consider. Our approach uses the raw character stream of source code. It can examine keywords and different stylistic features such as variable naming conventions or using tabs vs. spaces, enabling us to learn a richer representation than other keyword-based approaches. Our approach uses a character-level Convolutional Neural Network (CNN). We train the CNN to map the input character stream to a dense vector, mapping the source codes authored by the same author close to each other. In contrast, source codes written by different programmers are mapped farther apart in the embedding space. We then feed these source code vectors into the K-nearest neighbor (KNN) classifier that uses Manhattan-distance to perform authorship attribution. We validated our approach on Google Code Jam (GCJ) dataset across three different programming languages. We prepare our large-scale dataset in such a way that it does not induce type-I error. Our approach is more scalable and efficient than existing methods. We were able to achieve an accuracy of 84.94% across 20,458 authors, which is more than twice the scale of any previous study under a much more challenging setting.

Brain cancers caused by malignant brain tumors are one of the most fatal cancer types with a low survival rate mostly due to the difficulties in early detection. Medical professionals therefore use various invasive and non-invasive methods for detecting and treating brain tumors at the earlier stages thus enabling early treatment. The main non-invasive methods for brain tumor diagnosis and assessment are brain imaging like computed tomography (CT), positron emission tomography (PET) and magnetic resonance imaging (MRI) scans. In this paper, the focus is on detection and segmentation of brain tumors from 2D and 3D brain MRIs. For this purpose, a complete automated system with a web application user interface is described which detects and segments brain tumors with more than 90% accuracy and Dice scores. The user can upload brain MRIs or can access brain images from hospital databases to check presence or absence of brain tumor, to check the existence of brain tumor from brain MRI features and to extract the tumor region precisely from the brain MRI using deep neural networks like CNN, U-Net and U-Net++. The web application also provides an option for entering feedbacks on the results of the detection and segmentation to allow healthcare professionals to add more precise information on the results that can be used to train the model for better future predictions and segmentations.

To increase and maintain web application security, developers could use some different methods, one of them is static code analysis. This method could find security vulnerabilities inside a source code without the need of running the program. It could also be automated by using tools, which considered more efficient than manual reviews. One specific method which is commonly used in static code analysis is taint analysis. Taint analysis usually utilizes source code modeling to prepare the code for analysis process to detect any untrusted data flows into security sensitives computations. While this kind of analysis could be very helpful, static code analysis tool for Laravel-based web application is still quite rare, despite its popularity. Therefore, in this research, we want to know how static code (taint) analysis could be utilized to detect security vulnerabilities and how the projects (Laravel-based) should be modeled in order to facilitate this analysis. We then developed a static analysis tool, which models the application’s source code using AST and dictionary to be used as the base of the taint analysis. The tool first parsed the route file of Laravel project to get a list of controller files. Each file in that list would be parsed in order to build the source code representation, before actually being analyzed using taint analysis method. The experiments was done using this tool shows that the tools (with taint analysis) could detect 13 security vulnerabilities from 6 Laravel-based projects with one False Negative. An ineffective sanitizer was the suspected cause of this False Negative. This also shows that proposed modeling technique could be helpful in facilitating taint analysis in Laravel-based projects. For future development and studies, this tool should be tested with more Laravel and even other framework based web application with a wider range of security vulnerabilities.

High throughput experimental technologies, also called "omics" technologies, generate considerable amounts of data. Research laboratories can approach their scientific questions from an "omics" perspective. In this context, they can either generate new experimental data or collect published data among the one already available in the public databases (SRA, GEO, PRIDE, etc.). One experimental data are collected, the challenge remains to analyse them and also to integrate them to answer the initial scientific question. This is a clear challenge from an informatic, statistical and methodological point of view. Indeed, many analyses can be performed on a single experimental data set, using multiple bioinformatics tools or softwares, with different sets of parameters. Therefore, the issues of annotation, storage, mining and integration of multi-omics data analysis results is an important challenge in biology. In our laboratory, our aim is to perform an in silico modeling of iron metabolism and homeostasis in pathogenic yeasts. This requires the data mining of hundred high throughput experiments (genomics, transcriptomics and proteomics). With the help of TailorDev, we improved our methodology for monitoring our analyses and the associated results. This partnership led to the creation of the Pixel Web Application (Web App). Pixel was developed following expert development practices (unit and functional tests, integration and continuous deployment, code review, etc.). With the idea to respect FAIR principles, Pixel was designed to help data storage in such a way that all information required to reproduce any time a particular analysis, can be easily possible. Also, a hierarchical system of tags, dynamically managed via the web application, empowers the queries and the filters to find interesting results in the system. Several functionalities were also developed to combine and integrate them for a new cycle of data analysis and exploration. The Pixel project was designed as an Open Source solution. The source code is publicly available on GitHub ( https://github.com/Candihub/pixel ) and distributed as a Docker container on DockerHub.

This paper is a continuation of our previous work on solving source code authorship identification problems. The analysis of heterogeneous source code is a relevant issue for copyright protection in commercial software development. This is related to the specificity of development processes and the usage of collaborative development tools (version control systems). As a result, there are source codes written according to different programming standards by a team of programmers with different skill levels. Another application field is information security—in particular, identifying the author of computer viruses. We apply our technique based on a hybrid of Inception-v1 and Bidirectional Gated Recurrent Units architectures on heterogeneous source codes and consider the most common commercial development complex cases that negatively affect the authorship identification process. The paper is devoted to the possibilities and limitations of the author’s technique in various complex cases. For situations where a programmer was proficient in two programming languages, the average accuracy was 87%; for proficiency in three or more—76%. For the artificially generated source code case, the average accuracy was 81.5%. Finally, the average accuracy for source codes generated from commits was 84%. The comparison with state-of-the-art approaches showed that the proposed method has no full-functionality analogs covering actual practical cases.

One of the important modules of a black-box automatic program grader is a "checker". In programming competition environment, a checker is a program written for the purpose to check the output of the contestant's program for a task that has many solutions. Usually, a checker is written manually as needed. In this paper, the idea of the output checker in the programming competition environment is extended to input checker and source code checker as a part of the automatic grader in our programming learning environment. Input checker validates the input coverage. The source code checker is used to validate a set of properties from a source code against the given coding specification. A Domain-Specific Language (DSL) grammar is designed and developed as a specification for the automatic generation of the output, input, and source code checkers. The DSL grammar and the checker generator tool set are used to evaluate source codes in our programming class. By writing the checkers specification in DSL, the specification is automatically documented and can be reused for similar properties.

In Engineering and Scientific computing, a significant number of software systems that are being commonly used by the Engineering community are developed and deployed as Open Source Systems (OSS). This collaborative development model has been widely accepted in both academia and industry. As these systems are typically developed by developers who are experts in their fields (e.g., Engineering), some of those programmers may be lacking an essential skillset today's software quality and engineering concepts (e.g., source code maintainability and analyzability, source code vulnerability, parallelization, etc.). An empirical study is presented that examines some of the source code quality aspects and programming practices (e.g., jumps statements, usage of recursion) from software engineering perspective in ten open source Engineering software systems. The studied systems are written in the C/C++ programming languages and comprised of over ten million lines of code, and present numerous tasks of the engineering community, including computer-aided design, computational fluid dynamics, and finite element analysis. Static analysis methods are applied to each system to determine the number of jump statements (Goto and Break statements) and functions that are recursively invoked. Functions that contain direct or indirect recursive calls are determined and counted. The results show that number of the used jump statements and functions that have recursive calls are significant and thus pose more of a roadblock to effectively and automatically maintain, comprehend, analyze, and re-engineer systems. Lastly, this leads to inefficiencies in a software engineer's ability to accomplish these common tasks. The study showed that issues in source code stemming from the lack of coding standards have increased over time and are prevalent.

At ISB Atma Luhur, there is a web application specifically for students in accessing academic information in which the usage is good enough, but felt less practical and effective. After logged in, a student must provide some input, such as clicking on buttons and menus to display academic information. This web application interface is felt too small if opened by using a mobile browser that causes some students to experience difficulty in tapping buttons or menus. The solution that can be offered to overcome this problem is to use an Android-based chatbot. The chatbot can simplify the process of accessing information, i.e., by chatting on chatbot application and its interface size is adjusted according to the user device. The used model, method, and software development tools, respectively, are prototype models, object-oriented methods, and UML (Unified Modeling Language). The created chatbot apply NLP (Natural Language Processing) algorithm and entity extraction method, so that chatbot can respond appropriately and according to requests from students. The created chatbot makes the academic information at ISB Atma Luhur can be accessed easily, quickly, and efficiently by students without having to zoom in and zoom out.

The source code of a web application executed on the web browser has been exposed to leakage, and it is difficult to implement various web functions compared with other general applications. Therefore, in practical web applications, web plug-in technologies are used. However, web plug-in technology has a platform dependency and is attacked by malicious codes which resulting in a damage of the system. On the other hands, the web-based emulator is independent of platforms as well as web browsers. Recently, various web emulators were introduced, and users can use it as the virtual machine environment of diverse platforms on the web browser. However, these web-based emulator doesn’t provide an interface API to access other web application. In this paper, we propose the modified web-based emulator with the interface module and API, called as the web emulator-based execution engine. Using the proposed system, a native code in a web application is easily written by C, and C++ and compiled. Furthermore it can be distributed and executed directly on the emulator-based web application execution engine. Therefore it solves the leak problem of source codes that is the vulnerability of web applications. The proposed emulator-based web application execution engine is a new concept combined web plug-in and emulator. In the experiment we developed an interface module and an API for the proposed emulator-based web application execution engine. The experimental emulator-based web application was implemented and tested to evaluate the overall system.KeywordsWeb applicationObfuscationEmulatorJavaScriptNative binary

Dynamic web pages composed of inter-woven (tangled) source code written in multiple programming languages (e.g., HTML, PHP, JavaScript, CSS) makes it difficult to analyze and manage clones in web applications. Despite more than a decade of research on software clones, there are not many studies towards the investigation of code clones in web applications. In this paper, we present an in-depth study on the patterns (i.e., forking and templating) of exact and near-miss code clones in two industrial dynamic web applications having distinct architecture. The findings of our study confirm the believed patterns for cloning and suggest that specialized techniques and tool support are necessary for effectively managing clones in the tangled source code of dynamic web applications.

As web applications is becoming more prominent due to the ubiquity of web services, web applications have become main targets for attackers. In order to steal or leak sensitive user data managed by web applications, attackers exploit a wide range of input validation vulnerabilities such as SQL injection, path traversal (or directory traversal), cross-site scripting (XSS), etc. This paper propose a technique that can verify input values of Java-based web applications using static bytecode instrumentation and runtime input validation. The technique searches for target methods or object constructors in compiled Java class files, and statically inserts bytecode modules. At runtime, the instrumented bytecode modules validate input values of the targets, and take countermeasure against malicious inputs. The proposed technique can mitigate the input validation vulnerabilities in Java-based web applications without source codes. To evaluate the effectiveness of the proposed technique, experiments are carried out with an insecure web application maintained by OWASP WebGoat Project. The experimental results show that the proposed technique successfully mitigates input validation vulnerabilities such as SQL injection and path traversal.

Due to the constant evolution of technology, each day brings new programming languages, development paradigms, and ways of evaluating processes. This is no different with source code metrics, where there is always new metric classes. To use a software metric to support decisions, it is necessary to understand how to perform the metric collection, calculation, interpretation, and analysis. The tasks of collecting and calculating source code metrics are most often automated, but how should we monitor them during the software development cycle? Our research aims to assist the software engineer to monitor metrics of vulnerability threats present in the source code through a reference prediction model, considering that real world software have non-functional security requirements, which implies the need to know how to monitor these requirements during the software development cycle. As a first result, this paper presents an empirical study on the evolution of the Linux project. Based on static analysis data, we propose low complexity models to study flaws in the Linux source code. About 391 versions of the project were analyzed by mining the official Linux repository using an approach that can be reproduced to perform similar studies. Our results show that it is possible to predict the number of warnings triggered by a static analyzer for a given software project revision as long as the software is continuously monitored.

Code search and comprehension have become more difficult in recent years due to the rapid expansion of available source code. Current tools lack a way to label arbitrary code at scale while maintaining up-to-date representations of new programming languages, libraries, and functionalities. Comprehensive labeling of source code enables users to search for documents of interest and obtain a high-level understanding of their contents. We use Stack Overflow code snippets and their tags to train a language-agnostic, deep convolutional neural network to automatically predict semantic labels for source code documents. On Stack Overflow code snippets, we demonstrate a mean area under ROC of 0.957 over a long-tailed list of 4,508 tags. We also manually validate the model outputs on a diverse set of unlabeled source code documents retrieved from Github, and we obtain a top-1 accuracy of 86.6%. This strongly indicates that the model successfully transfers its knowledge from Stack Overflow snippets to arbitrary source code documents.