一句话:提出基于程序依赖图的 token 序列归一化方法,使自动化混淆攻击失效,从而检出自动化软件抄袭。
软件抄袭检测器已使用数十年,但自动化抄袭生成器的出现使得规避检测不再需要编程能力:这些生成器可轻易实施混淆攻击,通过插入语句破坏相关程序之间的匹配,从而利用现有检测器的弱点。本文提出一种新颖且语言无关的防御机制,借助程序依赖图(PDG)对 token 序列进行归一化,使此类自动化插入式混淆攻击难以奏效。作者在多个真实世界数据集上评估该方法,结果表明其能够击败抄袭生成器:在面对自动化混淆时具备鲁棒性,同时保持较低的误报率。
While software plagiarism detectors have been used for decades, the assumption that evading detection requires programming proficiency is challenged by the emergence of automated plagiarism generators. These generators enable effortless obfuscation attacks, exploiting vulnerabilities in existing detectors by inserting statements to disrupt the matching of related programs. Thus, we present a novel, language-independent defense mechanism that leverages program dependence graphs, rendering such attacks infeasible. We evaluate our approach with multiple real-world datasets and show that it defeats plagiarism generators by offering resilience against automated obfuscation while maintaining a low rate of false positives.