Java Birthmarks --Detecting the Software Theft--

Abstract

and Ken-ichi MATSUMOTO † , Members SUMMARY To detect the theft of Java class files efficiently, we propose a concept of Java birthmarks, which are unique and native characteristics of every class file. For a pair of class files p and q, if q has the same birthmark as p's, q is suspected as a copy of p. Ideally, the birthmarks should satisfy the following properties: (a) preservation -the birthmarks should be preserved even if the original class file is tampered with, and (b) distinction -independent class files must be distinguished by completely different birthmarks. Taking (a) and (b) into account, we propose four types of birthmarks for Java class files. To show the effectiveness of the proposed birthmarks, we conduct three experiments. In the first experiment, we demonstrate that the proposed birthmarks are sufficiently robust against automatic program transformation (93.3876% of the birthmarks were preserved). The second experiment shows that the proposed birthmarks successfully distinguish non-copied files in a practical Java application (97.8005% of given class files were distinguished). In the third experiment, we exploit different Java compilers to confirm that the proposed Java birthmarks are core characteristics independent of compiler-specific issues.

Comparative Analysis of Technical Methods for Detecting Software Thefts

“…Tamada birthmark [7] is the first practical application of static software birthmark for Java programs.  Inheritance Structure: Every Java program has class hierarchy beginning from java.lang.Object.…”

Analyzing Stack Flows to Compare Java Programs

“…Tamada et al [2], [3] first suggested a practical application of static software birthmarks and presented a method to compare the birthmarks for Java class files. Their technique consists of four individual birthmarks: constant values in field variables, sequence of method calls, inheritance structure, and used classes.…”

“…To measure discrimination capability, the threshold value for determining code clones was set as = 0.2, which was determined to maximize precision and recall in the detection of common modules in Java programs [12]. To evaluate and compare performance of the proposed method, Stigmata 2.0 † was used for the Tamada birthmark [2], [3] and the kgram birthmark [4], [5]. We also compared the performance of the stack pattern birthmark [6].…”

“…Its performance is compared with the Tamada birthmark [2], [3], the k-gram based birthmark [4], [5], and the stack pattern birthmark [6]. The Java programs listed in Table 1 (a) were used as benchmark programs, and three transformation methods were applied to evaluate the detection of modified programs.…”

“…Experiments are conducted to test the proposed method in relation to these criteria, and its performance is evaluated by analyzing falsepositive rates, false-negative rates, and transformation variations. Additionally, the method is compared with three previous approaches, namely, the Tamada birthmark [2], [3], the k-gram based birthmark [4], [5], and the stack pattern birthmark [6]. The experimental results demonstrate that the proposed method is more effective than the previous methods in terms of the above criteria.…”