Software dynamic birthmark techniques construct birthmarks using the captured execution traces from running the programs, which serve as one of the most promising methods for obfuscation-resilient software plagiarism detection. However, due to the perturbation caused by non-deterministic thread scheduling in multi-threaded programs, such dynamic approaches optimized for sequential programs may suffer from the randomness in multi-threaded program plagiarism detection. In this paper, we propose a new dynamic thread-aware birthmark FPBirth to facilitate multi-threaded program plagiarism detection. We first explore dynamic monitoring to capture multiple execution traces with respect to system calls for each multi-threaded program under a specified input, and then leverage the Apriori algorithm to mine frequent patterns to formulate our dynamic birthmark, which can not only depict the program’s behavioral semantics, but also resist the changes and perturbations over execution traces caused by the thread scheduling in multi-threaded programs. Using FPBirth, we design a multi-threaded program plagiarism detection system. The experimental results based on a public software plagiarism sample set demonstrate that the developed system integrating our proposed birthmark FPBirth copes better with multi-threaded plagiarism detection than alternative approaches. Compared against the dynamic birthmark System Call Short Sequence Birthmark (SCSSB), FPBirth achieves 12.4%, 4.1% and 7.9% performance improvements with respect to union of resilience and credibility (URC), F-Measure and matthews correlation coefficient (MCC) metric, respectively.

中文翻译：

---

使用频繁行为模式挖掘的多线程程序抄袭检测

软件动态胎记技术使用从运行程序中捕获的执行跟踪构建胎记，这是最有前途的混淆弹性软件抄袭检测方法之一。然而，由于多线程程序中的非确定性线程调度造成的扰动，这种针对顺序程序优化的动态方法可能会受到多线程程序抄袭检测中的随机性的影响。在本文中，我们提出了一种新的动态线程感知胎记 FPBirth，以促进多线程程序抄袭检测。我们首先探索动态监控，以捕获针对指定输入下每个多线程程序的系统调用的多个执行跟踪，然后利用 Apriori 算法挖掘频繁模式来形成我们的动态胎记，它不仅可以描述程序的行为语义，还可以抵抗多线程程序中线程调度引起的执行痕迹的变化和扰动。使用 FPBirth，我们设计了一个多线程的程序抄袭检测系统。基于公共软件抄袭样本集的实验结果表明，集成我们提出的胎记 FPBirth 的开发系统比其他方法更好地应对多线程抄袭检测。与动态胎记系统调用短序列胎记（SCSSB）相比，FPBirth 在弹性和可信度联合（URC）方面实现了 12.4%、4.1% 和 7.9% 的性能提升，