Английскй учебник

Idea Plagiarism: If the author of the Source Article expresses a creative idea or suggests a solution to a problem, the idea or solution must be clearly attributed to the author.

352

UNIT 4. SOFTWARE FORENSICS

1..

1.How can you identify software forensics?

2.What are the objectives of software forensics?

3.What characteristic features of the author’s style can you find in any program?

4.How can source code authorship analysis be divided?

5.Where is code authorship analysis used?

TEXT

SOFTWARE FORENSICS

Computers and networks have played an important role in peoples’ everyday life over the last decade. But while computers have made our lives easier and have improved our standard of living, have also introduced a new venue of criminal activities.

Cyber attacks in the form of viruses, trojan horses, logic bombs, fraud, credit card cloning, and plagiarism of code have increased in severity and frequency.

The creation of a new field with its own methods and tools, called software forensics, has helped to tackle these issues in a proper way and not in an ad hoc manner. The term software forensics implies the use of these tools and methods for some legal or official purpose. Software forensics could be used to examine and analyze software in any form, source or executable code, to identify the author.

Although source code (the textual form of a computer program that is written by a computer programmer) is much more formal and restrictive than spoken or written languages, there is still a

353

large degree of flexibility when writing a program. This flexibility includes characteristics that deal with the layout of the program (placement of comments, indentation), characteristics that are more difficult to change automatically by pretty printers and code formatters, and deal with the style of the program (comment lengths, variable names, function names) and features that we hypothesize are dependent on the programming experience (the statistical distribution of lines of code per function, usage of data structures). Research studies on this field have proved that many of these features (layout, style, structure) of computer program can be specific to a programmer. Source code authorship analysis can be divided into 5 sub-fields according to the application area:

1.Author identification. The aim here is to decide whether some piece of code was written by a certain programmer. This type of application area has a lot of similarities with the corresponding literature where the task is to determine that a piece of work has been written by a certain author.

2.Author characterization. This application area determines some characteristics of the programmer of a piece of code, such as cultural educational background and language familiarity, based on their programming style.

3.Plagiarism detection. This method attempts to find similarities among multiple sets of source code files.

4.Author discrimination. This task is the opposite of the above and involves deciding whether some pieces of code were written by a single author or by some number of authors.

5.Author intent determination. In some cases we need to know whether a piece of code was written having this as its goal or was the result of an accidental error. In many cases, an error during the software development process can cause serious problems.

It seems that source code authorship analysis is an important area of practice in computer security, computer law, and academia as well as an exciting area of research.

2.. ,

.

Models:

In my opinion – #

I can’t make up my mind, but … – , &, …

I am keeping an open mind for the moment. –

.

I’m (not) sure that …. – 6 ( ) , …

1.Computers have made our lives easier.

2.Computers have introduced a new venue of criminal activities.

3.Credit card cloning and plagiarism of code are quite legal type of activity.

4.Software forensics could be used to examine and analyze software in any form.

5.Cyber attacks in the form of viruses are a widespread phenomenon which shouldn’t be fought against.

6.The textual form of a computer program written by a computer programmer is less more formal and restrictive than spoken or written languages.

7.The flexibility of source code includes characteristics dealing with the layout of the program, the style of the program and characteristics that are more difficult to change automatically by pretty printers and code formatters.

8.Source code authorship analysis can be divided into 5 sub-fields according to the application area.

9.Source code authorship analysis is an important area of practice in computer security and computer law.

3. !$ $ .

WHAT IS ….?

354

7. !. «Applying Authorship Analysis in Cybercrime Investigation».

% 1* – « »: !, , $ , , -

$ . 8 ( 4 -5 ), -

! . ,

, , , ! ,

$ , ! , -

. .

The large amount of cyber space activities and their anonymous nature make cybercrime investigation extremely difficult. One of the major tasks in cybercrime investigation is tracing the real identity source of an illegal document. Normally the investigator tries to attribute a new illegal message to a particular criminal in order to get some new clues. Conventional ways to deal with this problem rely on manual work, which is largely limited by the sheer amount of messages and constantly changing author IDs. Automatic authorship analysis should be highly valuable to cybercrime investigators. Figure 1 depicts the typical process of cybercrime identity tracing using the authorship analysis approach.

Fig. 1

Fig. 1. A Framework of Cybercrime Investigation with Authorship Analysis assumes that an investigator has a collection of illegal documents created by a particular suspected cyber criminal. In the first step the feature extractor runs on those documents and generates a set of style features, which will be used as the input to/for the learning engine. A feature-based model is then created as the outcome of the learning engine. This model can identify whether a newly found illegal document is written by that suspicious criminal under different IDs or names. This information will help the investigator focus his/her effort on a small scope of illegal documents and effectively keep track of more important cyber criminals. Cyberspace texts have several characteristics which are different from those of literary works or published articles and make authorship analysis in cyber space a challenge to researchers. One big problem is that cyber documents are generally short in length. This means that many language-based features successfully used in previous studies may not be appropriate (e.g., vocabulary richness).

356

Through observation we were able to spot illegal sales of pirate software in all three newsgroups. Figure 2 is an example of such a message.

From: "The Collectaholic" <mkusz@comcast.net>

Subject: Software Titles - Only $3.00

Newsgroups: misc.forsale.computers.other.software

Date: 2002-10-04 12:07:22 PST

All CDs are the original CDs in working condition and come with all the original documentation. Shipping is $3.00 for first title and $.50 for each additional title.

$1.00 Titles

PC World The Best of MediaClips: sounds and graphics that can be used onmedia projects…

$3.00 Titles

Boggle: classic word game

Canon Publishing Suite: layout, drawing & photo editing tools

Fig. 2. Illegal Internet Newsgroup Message

We then identified the 9 most active users (represented by a unique ID and email address) who frequently posted messages in these newsgroups. Messages posted by these users were carefully checked to determine whether or not they indicated illegal activities. Between 8 and 30 illegal messages per user were downloaded for use in the experiment.

8. . .

TEXT

(Title)_________________________________________________

1._________________________________________________________________________

a)_____________________________________________________________

b)_____________________________________________________________

c)_____________________________________________________________

d)_____________________________________________________________

e)_____________________________________________________________

2._________________________________________________________________________

3._________________________________________________________________________

4._________________________________________________________________________

Forensic linguists are involved in many areas that relate to crime, both solving crime and absolving people wrongly accused of committing crimes. Some of these areas of research include:

357

voice identification (for instance, determining whether the voice on a threatening tape recording was that of the defendant; sometimes also called forensic phonetics);

author identification (determining who wrote a particular text by comparing it to known writing samples of a suspect; sometimes also called forensic stylistics);

discourse analysis (analyzing the structure of a writing or spoken utterance, often recorded, to help determine issues such as who is introducing topics or whether a suspect is agreeing to engage in a criminal conspiracy);

linguistic proficiency (did a suspect understand the Miranda warning or police caution?);

dialectology (determining which dialect of a language a person speaks, usually to show that a defendant has a different dialect from that on an incriminating tape recording. As opposed to voice identification, which analyzes the acoustic qualities of the voice, dialectology uses linguistic features to accomplish similar goals).

Author identification is a very interesting and potentially useful area, but it is hampered by the fact that documents in a forensic setting (ransom notes, threatening letters, etc.) are usually much too short to make a reliable identification. Moreover, which linguistic features are reliable indicators of authorship, and how reliable those features are, remains to be discovered. Research is ongoing, however, and the availability of large corpora of speech and writing samples suggests that the field may advance in the future (although the typically small size of the documents in most criminal cases will always be a problem). Moreover, it may be sufficiently reliable to eliminate someone as an author, or select an author from a small group of suspects.

Discourse analysis is a very broad field, and how acceptable its conclusions are depends on the methodology that is used and how any conclusions are described. Discourse analysist can provide helpful information by close analysis of a covert recording and, for instance, showing that the suspect's use of "I" rather than "we" might indicate noncomplicity in a conspiracy. Linguists have also pointed out that when a suspect is recorded as saying "yeah" or "uh-huh" in response to a suggestion, the suspect is not necessarily agreeing with the suggestion, but may simply be providing a feedback marker to indicate he has understood the utterance, as we routinely do in ordinary conversation. Courts have a mixed record in whether they allow discourse analysists to testify as experts, but even when not allowed to testify they may be useful to the lawyers in preparing a case.

Proficiency testing and dialectology are both time-tested and relatively noncontroversial areas of linguistics. Of course, because of the influence of mass media and population mobility, dialects are becoming less distinct than they once were, and people often mix dialect features. This is a serious problem with linguistic origin analysis. Determining a person's origin by means of his or her dialect or language is also complicated by the fact that many languages straddle a border or are spoken in multiple countries.

(by Peter Tiersma, PhD, University of California)

9..

1.What do forensic linguists deal with?

2.What type of research do they perform?

3.What are the main difficulties in author identification?

4.What does discourse analysis depend on?

5.Why are proficiency testing and dialectology noncontroversial areas of lin-

guistics?

358

10. #' $ . , & $#

.

?

11. .

4/15,-)( % (1/:1 *)6 .* 1% + )

- " % -

— , ,

) " ) # . ( , $- " , ) , % & $ - # .

- " % " ) # , - # .

) # % :

•);

•$ -

# ?

( # " &, " $ - # “ ”.% % :

•, ( ) -;

• $ " $ ;

•, -( , ) $" ;

• , ;

• # " ?

359