1. Прочитайте текст и ответьте на вопросы.

1. How can you identify software forensics?

2. What are the objectives of software forensics?

3. What characteristic features of the author’s style can you find in any program?

4. How can source code authorship analysis be divided?

5. Where is code authorship analysis used?

TEXT

SOFTWARE FORENSICS

Computers and networks have played an important role in peoples’ everyday life over the last decade. But while computers have made our lives easier and have improved our standard of living, have also introduced a new venue of criminal activities.

Cyber attacks in the form of viruses, trojan horses, logic bombs, fraud, credit card cloning, plagiarism of code have increased in severity and frequency.

The creation of a new field with its own methods and tools, called software forensics, has helped to tackle these issues in a proper way and not in an ad hoc manner. The term software forensics implies the use of these tools and methods for some legal or official purpose. Software forensics could be used to examine and analyze software in any form, source or executable code, to identify the author.

Although source code (the textual form of a computer program that is written by a computer programmer) is much more formal and restrictive than spoken or written languages, there is still a large degree of flexibility when writing a program. This flexibility includes characteristics that deal with the layout of the program (placement of comments, indentation), characteristics that are more difficult to change automatically by pretty printers and code formatters, and deal with the style of the program (comment lengths, variable names, function names) and features that we hypothesize are dependent on the programming experience (the statistical distribution of lines of code per function, usage of data structures). Research studies on this field have proved that many of these features (layout, style, structure) of computer program can be specific to a programmer. Source code authorship analysis can be divided into 5 sub-fields according to the application area:

1. Author identification. The aim here is to decide whether some piece of code was written by a certain programmer. This type of application area has a lot of similarities with the corresponding literature where the task is to determine that a piece of work has been written by a certain author.

2. Author characterization. This application area determines some characteristics of the programmer of a piece of code, such as cultural educational background and language familiarity, based on their programming style.

3. Plagiarism detection. This method attempts to find similarities among multiple sets of source code files.

4. Author discrimination. This task is the opposite of the above and involves deciding whether some pieces of code were written by a single author or by some number of authors.

5. Author intent determination. In some cases we need to know whether a piece of code was written having this as its goal or was the result of an accidental error. In many cases, an error during the software development process can cause serious problems.

It seems that source code authorship analysis is an important area of practice in computer security, computer law, and academia as well as an exciting area of research.

2. Согласитесь или опровергните утверждения. Начните свой ответ с одной из речевых моделей.

Models:

In my opinion – По моему мнению

I can’t make up my mind, but … – Не могу принять решение, но …

I am keeping an open mind for the moment. – Пока у меня нет никакого мнения на этот счет.

I’m (not) sure that …. – Я (не) уверен, что …

1. Computers have made our lives easier.

2. Computers have introduced a new venue of criminal activities.

3. Credit card cloning and plagiarism of code are quite legal type of activity.

4. Software forensics could be used to examine and analyze software in any form.

5. Cyber attacks in the form of viruses are a widespread phenomenon which shouldn’t be fought against.

6. The textual form of a computer program written by a computer programmer is less more formal and restrictive than spoken or written languages.

7. The flexibility of source code includes characteristics dealing with the layout of the program, the style of the program and characteristics that are more difficult to change automatically by pretty printers and code formatters.

8. Source code authorship analysis can be divided into 5 sub-fields according to the application area.

9. Source code authorship analysis is an important area of practice in computer security and computer law.

3. Заполните таблицу информацией из текста.

WHAT IS ….?

Author identification	Author characterization	Plagiarism detection	Author discrimination	Author intent determination

4. Найдите в тексте словосочетания с данными ниже словами. Переведите их на русский язык. Составьте с этими словами дополнительные словосочетания, которые не встречались в тексте, и проиллюстрируйте их значение на примерах.

5. Напишите дефиниции данным ниже терминам из текста.

1. Viruses are ……..

2. Trojan horses are …….

3. Logic bombs are ……..

4. Credit card cloning is ………

5. Cyber attacks are …………

6. Прочитайте текст и замените русские слова в скобках на их английские эквиваленты. Сформулируйте основную идею текста.

AUTHORSHIP ANALYSIS IN CYBERCRIME INVESTIGATION

The development of networking (технологий), and the Internet in particular, has created a new way to share (информацию) across (время и пространство). While computer (сети) have enhanced (качество жизни) in many aspects, they have also opened a (новую сферу криминальной деятельности). These activities have spawned the (понятие) of cybercrime, which (относится) to illegal computer-mediated activities that can be conducted through (всемирные электронные сети), such as the Internet. One predominant type of cybercrime is distribution of (нелегальных материалов) in cyber space. Such materials include pirate software, (детская порнография), stolen properties, etc. Cyber criminals have been using various Web-based (каналы, чтобы распространять) illegal materials such as Email, websites, Internet newsgroups, Internet chat rooms, etc. One common characteristic of these channels is (анонимность). People usually do not need to provide their real identity information, such as (имя, возраст, пол и адрес), in order to participate in cyber activities. Compared to conventional (преступлениями), cybercrime conducted through such (анонимные каналы) imposes unique challenges for law enforcement agencies in criminal identity tracing. The situation is further (осложняется) by the sheer amount of cyber (пользователей) and activities, making the manual approach to criminal identity tracing impossible for meeting cybercrime investigation requirements.

7. Проектная работа. «Applying Authorship Analysis in Cybercrime Investigation». ПРОЕКТ – это «пять П»: проблема, планирование, поиск информации, продукт, презентация. Группа делится на несколько подгрупп (по 4 -5 человек), каждый студент получает самостоятельный участок работы в проекте. Ознакомьтесь с материалом, предложенным ниже, распределите роли, кто, за что будет отвечать, кто выступит с презентацией, кто подберет дополнительный материал по теме, кто подготовит наглядные материалы и т.п.

The large amount of cyber space activities and their anonymous nature make cybercrime investigation extremely difficult. One of the major tasks in cybercrime investigation is tracing the real identity source of an illegal document. Normally the investigator tries to attribute a new illegal message to a particular criminal in order to get some new clues. Conventional ways to deal with this problem rely on manual work, which is largely limited by the sheer amount of messages and constantly changing author IDs. Automatic authorship analysis should be highly valuable to cybercrime investigators. Figure 1 depicts the typical process of cybercrime identity tracing using the authorship analysis approach.

Fig. 1

Fig. 1. A Framework of Cybercrime Investigation with Authorship Analysis assumes that an investigator has a collection of illegal documents created by a particular suspected cyber criminal. In the first step the feature extractor runs on those documents and generates a set of style features, which will be used as the input to/for the learning engine. A feature-based model is then created as the outcome of the learning engine. This model can identify whether a newly found illegal document is written by that suspicious criminal under different IDs or names. This information will help the investigator focus his/her effort on a small scope of illegal documents and effectively keep track of more important cyber criminals. Cyberspace texts have several characteristics which are different from those of literary works or published articles and make authorship analysis in cyber space a challenge to researchers. One big problem is that cyber documents are generally short in length. This means that many language-based features successfully used in previous studies may not be appropriate (e.g., vocabulary richness).

Through observation we were able to spot illegal sales of pirate software in all three newsgroups. Figure 2 is an example of such a message.

Fig. 2. Illegal Internet Newsgroup Message

We then identified the 9 most active users (represented by a unique ID and email address) who frequently posted messages in these newsgroups. Messages posted by these users were carefully checked to determine whether or not they indicated illegal activities. Between 8 and 30 illegal messages per user were downloaded for use in the experiment.