Method, system and program product for determining java software code plagiarism and infringement

An analysis tool extracts class data from Java objects within a potential plagiarizing Java program and the original Java program, and then compares classes common to the potential plagiarizing program and the original across various performance metrics. Similarities disclosed by the analysis tool are output for user or programmatic comparison of the matches between the potentially plagiarizing Java program byte code and the original program's byte code.

CROSS-REFERENCE TO RELATED APPLICATIONS

The present application is related to the following co-pending U.S. patent applications filed on even date herewith, and incorporated herein by reference in their entirety:

Ser. No. 10/881,967, entitled “METHOD, SYSTEM AND PROGRAM PRODUCT FOR DETERMINING STANDARD JAVA OBJECTS”

Ser. No. 10/881,969, entitled “METHOD, SYSTEM AND PROGRAM PRODUCT FOR EVALUATING JAVA SOFTWARE BEST PRACTICES ACROSS MULTIPLE VENDORS”

Ser. No. 10/881,968, entitled “METHOD, SYSTEM AND PROGRAM PRODUCT FOR OPTIMIZING JAVA APPLICATION PERFORMANCE THROUGH DATA MINING”

BACKGROUND OF THE INVENTION

1. Field of the Invention

The present invention relates to computer systems, software architectures and programs, and more particularly to a method, system and computer program product for evaluating Java programs to determine code plagiarism.

2. Description of the Related Art

Java is a robust, portable object-oriented programming language developed by Sun Microsystems, Inc., that is gaining wide acceptance for writing code for the Internet and World Wide Web (hereinafter, “Web”). The nature of Java programming allows programmers to easily decompile Java code and review its source code. As such, competitors are able to obtain software from other vendors and review their source code as part of their process of developing their own Java programs. It is a simple matter for the Java source code itself to be copied into the new software program being developed. This copying of the Java source code infringes on the copyright of the original author of the Java source code. Unfortunately, there are few tools available to discover such code plagiarism, and the typical detection devices that are available are easily fooled when the plagiarizing source code is slightly modified or changed from the original source code.

This difficulty in detecting code plagiarism is further complicated when source code for the infringing software is not available. There are a variety of this obfuscation programs that limit access to source code of a program. Without viewing the original source code, it is extremely difficult to determine if program code has been copied. Using artificial intelligence algorithms, software can analyze source code for keywords, patterns, and compare them to known software programs. If duplication of a known software program is found within a certain probability, the new code is considered to be copied or duplicated. However, such a technique has hereto only been capable of detecting such patterns in source code.

Accordingly, it would be valuable to provide a tool for detecting code plagiarism and intellectual property infringement of a java program, even when the original code has been modified somewhat by the plagiarist. Such a tool would have particular value if you could detect code plagiarism even if the Java source code was not available.

SUMMARY OF THE INVENTION

In accordance with one embodiment of the present invention, an analysis tool extracts class data from a potentially infringing software program and an original program, and then determines what class data of the software program matches the class data from the original software program. The analysis tool then outputs the comparison as a function of class data. The tool or user can then determine the similarity of the software program to the original software program based on the comparison output.

DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS

In a preferred embodiment, the present invention provides a facility to analyze Java byte code to determine if the code has been plagiarized from another source program. This is accomplished by an analysis tool performing a pre-analysis to train itself on particular programming metrics of the original program, and then performing a dynamic analysis of the potentially plagiarizing or infringing Java program to determine if its byte code matches the criteria or programming metrics extracted from the original program's byte code. The function of the analysis tool in a typical software environment is described below.

FIG. 1is a block diagram of a general-purpose computer system100to which the present invention may be applied. The computer system100includes at least one processor (CPU)102operatively coupled to other components via a system bus104. A read only memory (ROM)106, a random access memory (RAM)108, a display adapter110, an I/O adapter112, and a user interface adapter114are coupled to system bus104.

Display adapter110operatively couples a display device116to system bus104. A disk storage device (e.g., a magnetic or optical disk storage device)118is operatively coupled to system bus104by I/O adapter112. User interface adapter114operatively couples a mouse120and keyboard124to system bus104. One or more objects are created when an Object-Oriented Program (not shown) is executed in computer system100.

The present invention has particular utility in Java applications. Java is a robust, portable object-oriented programming language developed by Sun Microsystems, Inc. Java attains its portability through use of a virtual machine or “Java Virtual Machine”, or “JVM”. The JVM enables isolating the details of the underlying hardware from the compiler used to compile the Java programming instructions.

Java applications are typically constructed using a development toolkit such as the “JDK” (Java Development Kit) product from Sun Microsystems, and are executed using the “JRE” (Java Runtime Environment) product, also from Sun Microsystems. Programs are executed from the command line when using the JRE. The Java Runtime Environment includes the JVM, as well as a number of files and classes that are required to run Java applications or applets. Hereinafter, the terms “JVM” and “runtime environment” will be used interchangeably unless otherwise noted.

Java program source code typically consists of a set of class definitions stored in a series of text files. A Java class contains both methods and data. Java source code is compiled into binary code, referred to as Java “byte code.” Byte codes are machine independent so that they can be executed on any machine's JVM, where the JVM is tailored to the specific operating environment. After the source code files are compiled into Java byte code class files, they are then typically loaded into memory by a class loader for interpretation by a JVM interpreter before the associated program is executed. Class loading can also occur when a Java program dynamically attempts to load another class at run time. The Java class loader uses a predetermined search strategy when locating class files, which gives precedence to particular locations. According to the Java 1.2 platform specification, the highest priority search locations are the bootstrap run time and internationalization classes in the JRE, named “rt.jar” and “I18N.jar,” respectively. The Java Archive (JAR) or “.jar” file is a repository that contains one or more Java class files and is simply called a “Java jar” or “JAR”. JAR files provide compression, backward compatibility with existing Java applets, portability, and security features.

With reference now toFIG. 2A, there is shown a block diagram of a software architecture for computer system100, in accordance with the preferred embodiment of the present invention. In a preferred embodiment, an analysis tool written in Java, called the Byte Code Inspector (BCI)200, is executing in CPU102. BCI200accesses database202, which is contained within disk storage device118, for the storage and retrieval of analysis data. Database Mining Tool (DMT)204is also executing in CPU102. In a preferred embodiment, a commercially available database mining tool such as Enterprise Miner produced by SAS, Inc. may implement DMT204.

BCI200decompiles a known Java class or JAR file (known Java files208) to extract specific method information to be placed in database202.FIG. 2Bis a logical block diagram of a Java file method entry203in database202. In a preferred embodiment, method entry203stores method information for a specific class of a Java file, including the vendor214, method signature216, byte code218and byte arguments220. A number of method entries203are created in database202corresponding to each Java class contained in known Java files208.

BCI200retrieves methods of a class being analyzed from a commercially available toolkit called the byte code engineering library (BCEL)206. In a preferred embodiment, BCI200has been implemented using a publicly available byte code engineering library such as the open source Byte Code Engineering Library, which is available from The Apache Software Foundation on the Internet at http://jakarta.apache.org/index.html. This library is used to separate a Java class file into its constituent parts.FIG. 2Cshows a graphical representation of a Java class file as viewed by the BCEL206. As can be seen inFIG. 2C, the library separates the byte code for class225into various attributes, including a header230, constant pool235, access rights240, implemented interfaces245, fields250, methods255and class attributes260.

With reference now toFIG. 3, there is shown a flow diagram of a process implemented by BCI200for unpacking a Java archive for use in the pre-analysis process800(seeFIG. 5), in accordance with the preferred embodiment of the present invention. As shown inFIG. 3, process300begins at step302, when the user loads the known Java files208into BCI200. At step304, BCI200extracts all class files contained in the known Java files208by calling Java's zip file utility class (shown at306) to obtain the list of classes from the known Java files208. At step308, BCI200obtains all methods for each class extracted from the known Java files208(at step304) by calling the BCEL206to get the corresponding list of methods known to be contained within each class (shown at310). At step312, BCI200extracts the method signature, byte codes, byte arguments and other fields for each method (shown at314) by calling the BCEL206. Thereafter, process300ends at step316, when BCI200stores the method information214-220for each method of each class extracted at step312in database202within method entry203.

FIG. 4shows a screen shot of the graphical user interface window (GUI)400of BCI200.FIG. 4shows an example where “rt.jar” has been decompiled by BCI200to extract all class files402within the rt.jar archive, and then to further extract all methods404within the class files402. For example, the “java.lang.Comparable”405and “java.lang.ClassLoader”406class files402are shown within left windowpane412. Additionally, the “java.lang.ClassLoader” class406is shown expanded in the GUI400, thereby listing all of its methods404below the expanded class file406. For example, the “protected void <init>(ClassLoader arg1)” method408is listed as one of the methods404of the ClassLoader class406. All byte codes extracted from the user-selected method in the left hand windowpane412of the GUI400are listed in the right hand windowpane414. For example, as shown inFIG. 4, if the user selects the “protected void <init>(ClassLoader arg1)” method408(e.g., using a mouse) the constituent byte codes are shown in the right hand windowpane414.

With reference now toFIG. 5, there is shown a flow diagram for evaluating the original program's and the potential infringer's implementations of a Java class, in accordance with a preferred embodiment of the present invention. In a preferred process, a common Java class is selected from among the byte code of each program for analysis. As seen inFIG. 5, process800begins at step802, where a database (database202) of byte codes for the program to be analyzed is created. In a preferred embodiment, a BCEL from an open source provider may be accessed to provide the byte code database for the potential infringing program. At step804, BCI200extracts one or more classes that are common to the two programs from byte code database202. In a preferred embodiment, a rt.jar for each program (known Java files208) is accessed. Then, at step806, BCI200performs process300to find all the methods that are common for each of the vendor implementations within each of the classes identified at step804. Here, using the database created in step802, BCI200breaks the byte codes of the found methods into multiple pieces, whereby method attributes are stored in association with the original vendor program and the potential infringing program in database202.

At step808, BCI200analyzes each of the methods found in step806for programming metrics of interest, for example, such as size of the code, security implemented, performance provided, etc. At step810, each of the analyzed classes, dependencies and metadata are stored in a database.FIG. 6shows an example of database202entries indicating the type of data stored at step810. The database900shows data for the original vendor's program916and the compared vendor's program918, and shows columns for vendor902, class904, method906, number of lines of code908, number of native cells910, number of try/catch blocks912, and number of referred classes for the analyzed program914, etc., for example.

With reference now toFIG. 7, there is shown a flow diagram of a process for comparing a vendor's program with an original program to determine if the vendor's program plagiarizes source code of the original program, in accordance with an alternative preferred embodiment of the present invention. Process1000begins at step1002, where the pre-processed byte code information from each of the original vendor program and the vendor program to be compared are retrieved from database202by BCI200. At step1004, BCI200converts the retrieved byte code information into a matrix format to facilitate a comparison of the byte codes. In a preferred embodiment, BCI200complies the byte code information stored within database202into a table or matrix, for example, in the form ofFIG. 6. At step1006, BCI200performs a comparison of each common method within the matrix900. For example, each common method shown in column906ofFIG. 6is compared at step1006. As shown inFIG. 6, the “findCLASS” method would be compared between the original vendor (Row916) with the compared vendor (Row918). For each method compared at step1006, BCI200would execute some type of text mining algorithm (signified by function1008) on the two matrixes for each of the common methods for the two programs (original and compared) to determine similarities between the methods. In a preferred embodiment, a clustering tool kit (CLUTO) that operates by running clustering algorithms on the byte codes is utilized for this step. At step1008, the actual byte code that comprises the methods being compared is loaded in the text mining tool to determine similarities (based on clustering, classification, association, etc.).

Thereafter, the process proceeds to step1010, where BCI200determines the similarity between the compared codes based on the detected similarities at step1008. BCI200would demonstrate the similarities at step1010by generating a visual representation of the comparison using a visualizing tool. For example a WEKA machine learning GUI tool could be used.FIG. 8shows an example of an output of such a WEKA visualization tool showing the methods compared and the number of matching byte codes for each such method across the two compared programs. By viewing the processed information, segments of code can be analyzed according to similarities. If code segments are within a “threshold of similarity”, for example, a threshold number of identical byte codes shown in the vertical axis ofFIG. 8, the methods can be considered duplicated. As will now be appreciated, because this analysis is performed on top of compiled Java code, the semantic space has been limited so that false positives and false negatives are reduced, and the process has a higher degree of accuracy of determining duplicated code.

While the invention has been particularly shown and described with reference to a preferred embodiment, it will be understood by those skilled in the art that various changes in form and detail may be made therein without departing from the spirit and scope of the invention. For example, the present invention may be implemented using any combination of computer programming software, firmware or hardware. As a preparatory step to practicing the invention or constructing an apparatus according to the invention, the computer programming code (whether software or firmware) according to the invention will typically be stored in one or more machine readable storage mediums such as fixed (hard) drives, diskettes, optical disks, magnetic tape, semiconductor memories such as ROMs, PROMs, etc., thereby making an article of manufacture in accordance with the invention. The article of manufacture containing the computer programming code is used by either executing the code directly from the storage device, by copying the code from the storage device into another storage device such as a hard disk, RAM, etc., or by transmitting the code for remote execution. The method form of the invention may be practiced by combining one or more machine-readable storage devices containing the code according to the present invention with appropriate standard computer hardware to execute the code contained therein. An apparatus for practicing the invention could be one or more computers and storage systems containing or having network access to computer program(s) coded in accordance with the invention. While this invention is described in terms of the best mode for achieving this invention's objectives, it will be appreciated by those skilled in the art that variations may be accomplished in view of these teachings without deviating from the spirit or scope of the present invention.