Exploiting thread-related system calls for plagiarism detection of multithreaded programs

Dynamic birthmarking used to be an effective approach to detecting software plagiarism. Yet the new trend towards multithreaded programming renders existing algorithms almost useless, due to the fact that thread scheduling nondeterminism severely perturbs birthmark generation and comparison. In this paper, we redesign birthmark based software plagiarism detection algorithms to make such approach effective for multithreaded programs. Our birthmarks are abstractions of program behavioral characteristics based on thread-related system calls. Such birthmarks are less susceptible to thread scheduling as the system calls are the sources that impose thread scheduling rather than being affected. We have conducted an empirical study on a benchmark that consists of 234 versions of 35 different multithreaded programs. Our experiments show that the new birthmarks are superior to existing birthmarks and are resilient against most state-of-the-art obfuscation techniques.