## 4 Experimental Setup
### Raw Data of Mouse Dynamics Collected for VRL-Based Questions  
In this scenario, the designed exams include VRL-based questions, which are C++ coding questions and run a C++ compiler within the question. The exams are performed on four different C++ coding problems. The mouse movement behavior of 50 students answering a question honestly and while cheating is collected. As shown in Figures 5-8 are samples of mouse dynamics movement of two different VRL-based questions answered by students, which are questions 1 and 3 using both the Histogram and kernel density estimate (KDE).  
As shown in Figure 5, the mouse movement behavior of students answering question 1 honestly and then when they are cheating is presented. This mouse movement behavior is considered raw data collected, which is used to train the Cheating detection system. As shown in Figure 5a, when the students were answering the question, they performed many movements in the place of the terminal of the question on the right side of the screen. On the other side, in Figure 5b, when they cheated, the least movement is performed in place of the terminal of the question, and almost all movement is on the other side, which indicates cheating.  
\begin{table}
\begin{tabular}{c c c} \hline \hline  & **MM** & **PC** & **DD** \\ \hline Train & 561 (21\%) & 1998 (77\%) & 26 (1\%) \\ Test & 272(21.1\%) & 989 (77.6\%) & 13 (1.3\%) \\ \hline \hline \end{tabular}
\end{table}
Table 4: The number of different actions present in test and train datasets.  
Figure 4: Screenshots for designed exams are as follows: (**a**) a screenshot of a C++ coding question; (**b**) a screenshot of a true & false question.  
As shown in Figure 6b, a little to no movement, mostly in the right part of the screen where the terminal of the question can be noticed by the naked eye as a pattern of cheating. While in Figure 6a, the movement increases in the place of the question's terminal. From Figures 5 and 6, the differences in raw data (x and y coordinates) by using kernel density estimate (KDE) and Histogram methods for cheating and solving honestly are seen. As shown in Figures 7 and 8, another C++ coding question is tested within the exam and the raw data of mouse dynamics is collected. From Figure 7a, it is noticed, as in Figure 5a, that almost the mouse movement of the student answering the question honestly is in the place of the question's terminal.  
Figure 5: 2-d KDE plot showing the density distribution of raw mouse cursor movements of students as follows: (**a**) a KDE plot of question 1 answered by students without cheating; (**b**) a KDE plot of question 1 answered by students who are allowed to cheat.  
Figure 6: A histogram of raw mouse movements showing the difference in the frequency of movements is as follows: (**a**) a KDE plot of question 1 answered by students without cheating; (**b**) a KDE plot of question 1 answered by students who are allowed to cheat.  
However, in the case of cheating, as presented in Figure 7b, the least movement is in the question's terminal place. Furthermore, the same observation is seen in Figure 8a,b, that in case of cheating, the mouse movement is scattered along the screen, while when solving the question honestly, most of the mouse movement is in the place of the question's terminal.