# Plagiarism checks for source code

In one of my answers I elaborated on the way we do language-tailored plagiarism checks on student submissions:

The general idea is to strip comments, whitespace, variable and function names, literals, and thus only keep the general structure of a program, i.e. parentheses, curly braces, semicolons, etc. (for C-like, that is). Then compare this 'hash' for all hand-ins, and when you find a match manually check if the programs look alike. For example, the hash of the program below would be something like #<>(,*){(;;--){("",);}}:

#include <stdio.h>
void repeat(int n, char *word) {
for (; n; n--) {
printf("%s\n", word);
}
}


While this model has proven successful in the past, there are a few obvious ways to escape these plagiarism checks:

• Moving functions around
• Changing parameter order
• Omitting / using { and } around single-line blocks

Fortunately, these are not the things most students think about (usually, they rename functions and variables / include comments). However, I am interested in improving this model or using something that already exists which would tackle these issues above as well - not only because I want to be able to detect plagiarism but also because I find this an interesting problem.

In particular, I am thinking about a system that would actually parse the programs and compare the abstract syntax trees for similarities. Does any such system exist?

• Not sure if this is a full-fledged answer or not, but you could look into using Moss. Basically, you upload your student's code to their online service, and it gives you back a link to a temp webpage with stats. It seems to support a wide variety of languages, and works reasonably well (though I have very very limited experience using it). I think this paper describes the high-level algorithm it uses? – Michael0x2a Sep 5 '17 at 12:59
• Two simple ideas (that don't answer your question, of course) are (a) require full bracing of all statement blocks (as many employers do) and -otherwise (b) omit bracing from your hash. It is also relatively easy to alphabetize functions before applying the hash, or while doing it. – Buffy Sep 5 '17 at 13:00
• @Buffy I think removing braces from the hash would lead to many false positives, but requiring them or adding them programmatically would be a good idea. As for sorting functions, this still fails when students also rename functions. But perhaps defining an ordering on function types could work. – user24 Sep 5 '17 at 14:24
• @SeanHoulihane I don't think it's equivalent, because it changes the hash. Those braces tell you something about the control flow, and that is harder to change than variable names. // I want more positives. This system works fine and gives almost no false negatives (except for some very small assignments where there are not many ways to do things), but the problem is that it is easy to fool. // That confidence stems mostly from the impression that those students who are going at length to understand the algorithm and trying to fool it are usually not those wanting to fool it :-) – user24 Sep 5 '17 at 17:40
• I put this in a comment rather than an answer because i'm not going to chase it beyond "yes". There is one built into the Polarion tool. I was sprprised to see that it (1) found the lifted code, and (b) recognized it was attributed correctly. – pojo-guy Sep 6 '17 at 4:07

I have been responsible for using performing and evaluating tools for detecting software plagiarism in my academic department.

There are several published review articles in the scholarly journals. One such report Culwin, MacLeod & Lancaster, 2001, UK JISC, "Source Code Plagiarism in UK HE Computing Schools, Issues, Attitudes and Tools" gives an overview.

Basically, there are published algorithms and methodologies you could implement yourself, open source software you can run locally, or an internet based service you can register and use.

One such tool that you can run locally is JPLAG from the University of Karlsruhe in Germany. This has several language syntax implemented, and as it is open source you can amend as desired.

The best online tool is MOSS from Stanford which is the one I ended up using.

If you wanted to research the various published techniques for detection, Google Scholar is a good source.

As for the ready-made solutions, you can check Computer Code Originality Checker http://codep.lab.p1k.org/ (for Python language). It is based on an effective fuzzy searching algorithm that deals with the above-mentioned plagiarism techniques, detecting both absolutely similar and partly similar sequences in the source code.

The service is free, but the registration is required for access. Here is the link to the Registration Form: https://docs.google.com/forms/d/e/1FAIpQLSfa0dgcWBp70NHFwKk44H5QwpA8Appjwj4eZ7GO5YW62xy7Lw/viewform?usp=sf_link

• Hello, and welcome to Computer Science Educators! I'm slightly reticent to do anything with that link without knowing more about p1k. Out of curiosity, are you in any way affiliated with them? – Ben I. Apr 12 '19 at 11:58

You may be interested in the Levenshtein distance metric. This is used to compare sequences and is robust to quite a number of different transformations. Its implemented in the core PHP library (for some reason) and the Wikipedia article below contains a C implementation.

https://en.wikipedia.org/wiki/Levenshtein_distance