OBA2: An Onion approach to Binary code Authorship Attribution

A critical aspect of malware forensics is authorship analysis. The successful outcome of such analysis is usually determined by the reverse engineer's skills and by the volume and complexity of the code under analysis. To assist reverse engineers in such a tedious and error-prone task, it is desirable to develop reliable and automated tools for supporting the practice of malware authorship attribution. In a recent work, machine learning was used to rank and select syntax-based features such as n-grams and flow graphs. The experimental results showed that the top ranked features were unique for each author, which was regarded as an evidence that those features capture the author's programming styles. In this paper, however, we show that the uniqueness of features does not necessarily correspond to authorship. Specifically, our analysis demonstrates that many “unique” features selected using this method are clearly unrelated to the authors' programming styles, for example, unique IDs or random but unique function names generated by the compiler; furthermore, the overall accuracy is generally unsatisfactory. Motivated by this discovery, we propose a layered Onion Approach for Binary Authorship Attribution called OBA2. The novelty of our approach lies in the three complementary layers: preprocessing, syntax-based attribution, and semantic-based attribution. Experiments show that our method produces results that not only are more accurate but have a meaningful connection to the authors' styles.     

“署名”三辨——兼评“安顺地戏案”等近期案例

作品上的自然人的姓名或组织的名称并非都是《著作权法》意义上的"署名"。"署名"必须针对特定作品表明作者的身份,因此有别于剧种名称,如"安顺地戏"等。根据英美法系国家版权法和《世界版权公约》的规定,"■"标记之后所接的姓名或名称表示的是版权归属,并非表明作者身份的"署名"。而且在版权归属于一个组织的情况下,该组织不可能对作品享有"署名权"。""标记之后所接的姓名或名称表示的则是商标注册人。即使图形商标构成作品,由于存在许可使用的情形,该姓名或名称也并非"署名"。只有作者才享有在作品上"署名"的权利,因此在作品上冒他人之名并非侵犯他人"署名权"的行为。     

A novel approach of mining write-prints for authorship attribution in e-mail forensics

There is an alarming increase in the number of cybercrime incidents through anonymous e-mails. The problem of e-mail authorship attribution is to identify the most plausible author of an anonymous e-mail from a group of potential suspects. Most previous contributions employed a traditional classification approach, such as decision tree and Support Vector Machine (SVM), to identify the author and studied the effects of different writing style features on the classification accuracy. However, little attention has been given on ensuring the quality of the evidence. In this paper, we introduce an innovative data mining method to capture the write-print of every suspect and model it as combinations of features that occurred frequently in the suspect's e-mails. This notion is called frequent pattern, which has proven to be effective in many data mining applications, but it is the first time to be applied to the problem of authorship attribution. Unlike the traditional approach, the extracted write-print by our method is unique among the suspects and, therefore, provides convincing and credible evidence for presenting it in a court of law. Experiments on real-life e-mails suggest that the proposed method can effectively identify the author and the results are supported by a strong evidence.     

A novel approach of mining write-prints for authorship attribution in e-mail forensics

There is an alarming increase in the number of cybercrime incidents through anonymous e-mails. The problem of e-mail authorship attribution is to identify the most plausible author of an anonymous e-mail from a group of potential suspects. Most previous contributions employed a traditional classification approach, such as decision tree and Support Vector Machine (SVM), to identify the author and studied the effects of different writing style features on the classification accuracy. However, little attention has been given on ensuring the quality of the evidence. In this paper, we introduce an innovative data mining method to capture the write-print of every suspect and model it as combinations of features that occurred frequently in the suspect's e-mails. This notion is called frequent pattern, which has proven to be effective in many data mining applications, but it is the first time to be applied to the problem of authorship attribution. Unlike the traditional approach, the extracted write-print by our method is unique among the suspects and, therefore, provides convincing and credible evidence for presenting it in a court of law. Experiments on real-life e-mails suggest that the proposed method can effectively identify the author and the results are supported by a strong evidence.     

Author gender identification from text

Text is still the most prevalent Internet media type. Examples of this include popular social networking applications such as Twitter, Craigslist, Facebook, etc. Other web applications such as e-mail, blog, chat rooms, etc. are also mostly text based. A question we address in this paper that deals with text based Internet forensics is the following: given a short text document, can we identify if the author is a man or a woman? This question is motivated by recent events where people faked their gender on the Internet. Note that this is different from the authorship attribution problem.In this paper we investigate author gender identification for short length, multi-genre, content-free text, such as the ones found in many Internet applications. Fundamental questions we ask are: do men and women inherently use different classes of language styles? If this is true, what are good linguistic features that indicate gender? Based on research in human psychology, we propose 545 psycho-linguistic and gender-preferential cues along with stylometric features to build the feature space for this identification problem. Note that identifying the correct set of features that indicate gender is an open research problem. Three machine learning algorithms (support vector machine, Bayesian logistic regression and AdaBoost decision tree) are then designed for gender identification based on the proposed features. Extensive experiments on large text corpora (Reuters Corpus Volume 1 newsgroup data and Enron e-mail data) indicate an accuracy up to 85.1% in identifying the gender. Experiments also indicate that function words, word-based features and structural features are significant gender discriminators.     

个人言语判别特征在短文本作者鉴别中的应用

目的以法律语言学为视角,通过测试语用、语篇语义以及语篇信息文本特征值对文本作者的判别能力,探究短文本作者鉴别或同一认定的方法。方法采用实验、语篇分析和统计的方法,对4位作者的28篇微博(每人7篇)共11种组合形式(二人组、三人组和四人组)逐一进行了文本特征值的测试和文本作者的判别分析。结果从语用、语篇语义学以及语篇信息领域抽取的5个特征值的不同组合对4名作者的所有11种判别组合都能进行显著区分,判别正确率达到85.7%~100%。结论基于4位作者微博文本的判别分类器已经建立并可以继续推演用于其他短文本作者的鉴别分析。     

An analysis of contributors to the journal of criminal justice

An analysis of the contributors of publications to the Journal of Criminal Justice was undertaken to evaluate if the initial objectives of the editorial board had, in fact, been achieved. Analysis was based upon authorship, academic discipline of author(s), general topic area, source of article, and specific component area of article.     

试论著作人身权的权利限制——一起委托作品著作人身权纠纷引发的法律思考

著作人身权,是发表、署名权、修改权和保护作品完整权的统称,而不是泛指作者作为自然人所享有的人身权.这些权利虽与作者的格利益和身份利益有着密切联系,但不同于传统民法中的人身权,因此,不能根据传统民法原理推导出著作人身权不能与作者的人身相分离的结论.在委托作品合同关系中,除署名权以外的著作人身权的归属是可以由合同约定的.此外,著作人身权还要受到相关法律和习惯,尤其是行业惯例的限制.     

Impulsivity,attribution and prison bullying: Bully-category and perpetrator–victim mutuality

The current study explores bullying behaviours among adult male prisoners, examining its relationship with aggression attribution and impulsivity. Employed are two separate methods of analysis to determine how this may influence results. Participants were 102 prisoners. All completed a revised version of the Direct and Indirect Prisoner behaviour Checklist (DIPC-R), the Barratt Impulsivity Scale: Version II (BIS-12) and the Expressive Aggression Scale (EXPAGG). Analysis included categorical analysis with prisoners placed into one of four groups (pure bully, pure victim, bully/victim and not-involved), and factorial analysis where perpetration and victimisation were assessed as continuous variables and evidence of interactions explored. It was predicted that perpetration would be associated with higher instrumental attributions and higher impulsivity than non-perpetration. It was predicted that a factorial analysis would demonstrate no interactions between perpetration and victimisation across aggression variables, questioning the utility of a distinct ‘bully–victim’ group. Bullies were found to have higher instrumental attribution scores than non-bullies, with no differences for expressive attribution. Victims were more impulsive than non-victims with evidence that perpetration moderated this relationship. A categorical analysis demonstrated that bully/victims were more impulsive, at least in relation to pure bullies. Results suggested that it was the combined effect of indirect and direct aggression which promoted differences between victims and bullies in relation to attribution and impulsivity. Results are discussed with reference to previous research concerning prison bullying, with directions for future research focused on exploration of perpetrator–victim mutuality using a range of variables and distinct methods of analysis.     

基于可视化知识图谱分析我国社工人才研究热点与脉络

基于中国知网(CNKI)期刊数据库数据,运用CiteSpace和VOSviewer软件,绘制我国社工人才研究的可视化知识图谱,探索发文趋势、研究主体、热点以及脉络。在研究中发现:该课题的发文数量总体呈上升趋势,但缺乏高质量文献,研究进程分为"进展缓滞——关注骤升——相对稳定"三个阶段;主要研究者参与合著的总体情况较好,但相互间合作不足,学界整体合作水平较低且合著分散,尚未形成学术共同体;研究热点集中于社工人才流失和激励保障、社工专业人才培养和社工人才队伍建设;演进脉络为"社工人才队伍建设——社工专业人才培养",并从研究主体、研究方法和研究内容等方面提出相应建议。     

Gender and Publication Patterns: Female Authorship Is Increasing,But Is There Gender Parity?

Women's authorship has historically been underrepresented in criminal justice publications. The current study updates previous research by examining the authorship patterns of articles published in 8 criminological journals spanning 2007 to 2013. Women's representation increased from earlier rates but remained below that of their male contemporaries. This growth corresponded with general trends of increasing coauthorship, suggesting that the recent gains in women's representation do not indicate decreases in gender disparities. Men also were more likely to have sole-authored articles and be lead authors in papers coauthored by men and women. In addition, the vast majority of articles included at least 1 male author, and far fewer included a female giving men a larger visual presence. Gender representation also varied considerably between mainstream/traditional journals and 2 gender-specialized journals.     

Contribution and collaboration in joint authorship: too many misconceptions

Legal context: This Article examines the requirements of collaborationand contribution in joint authorship. It discusses the mainUK case law and provides a comparative assessment of the requirementsin the US and Canada. Key points: The author identifies and examines misconceptionssurrounding the definition of joint authorship; the nature ofthe requirements of collaboration and contribution; the confusionwithin the definition of what amounts to sufficient contribution.The author asserts that joint authorship cannot be determinedby using similar conceptions applicable to individual authorship.At the heart of the argument is the belief that the unavoidableresult of the present definition of joint authorship is denialof reward for authors and artists. Practical significance: This Article argues that the rules ofjoint authorship, as presently configured, do not recognizeintellectual input that should be recognized. The Article defendsthe proposition that this has far-reaching effects on the creativeprocess. It discourages authors from creating or contributingvaluable materials to other authors. More importantly, the flawsinherent in the present definitions of collaboration and contributionin joint authorship contradict the aims of our copyright systemthrough the denial of authorial contributions and withholdingof reward from authors.     

卫生行政执法案卷评查制度的应用与效果(上)

基于从事卫生法制工作及案卷评查工作的多年经验,梳理有关卫生行政执法案卷评查的目的、意义、方式方法。以行政处罚案卷为例,简要介绍案卷评查的内容、标准及需要重点关注的问题,希望能为今后的卫生行政执法案卷评查工作提供参考。     

论“署名权”应改为“保护作者身份权”

我国现行著作权法中规定的"署名权,即表明作者身份,在作品上署名的权利"与我国著作权法第三次修订草案送审稿中曾拟定的"署名权,即决定是否表明作者身份以及如何表明作者身份的权利"的表述,都以偏概全,名不副实。其实署名权是表明作者身份权的下位概念,表明作者身份权又是保护作者身份权的下位概念。建议在我国著作权法第三次修改中,将"署名权"改为"主张作者身份和反对损害作者身份的权利"的保护作者身份权。我国著作权法中的著作人身权应当由保护作者身份权、保护作品完整权与发表权共同构成。     

Gunshot location through recorded sound: a preliminary report

Using a video tape and three still photographs, we analyze recorded sound to attribute authorship in a fatal shooting incident. We measure the acoustic signature of the scene with four test detonations, and we discuss two methods of processing putative echoes in the audio band of the video. They allow us to locate 11 out of 17 shots, with a precision of 0.4 x 1.0 m2. Combining the location of the shots with the known positions of the participants, we arrive at the clear attribution of eight shots; three other shots (among which is the fatal one) probably issue from the same shooter, who remains unidentified within a small group of men. Our results lead to the exculpation of the main suspect. We analyze the statistical significance of the results, use Monte Carlo simulations to set an upper bound to the probability of false positives, and discuss areas of improvement of the method.     

一直涉案打印文件言语人的同一认定

涉案打印文件言语人的同一认定,即打印文件撰稿人的认定,这是新时期文件检验面临的一个新的、需要深入研究的重要课题。文章以一起跨世纪侦查的重大案件为主,阐述了从涉案打印文件言语特征(形式)和思想内涵(内容)两方面成功认定案件嫌疑人的具体做法和体会。文章认为,只要满足相关条件,以现代语言科学有关理论为指导,根据打印文件言语特征,认定案件嫌疑人是可行的,也是科学的。     

On Being a Novice Forensic Evaluator: Reflections from Early Career Forensic Psychologists

Previous research has considered the psychologist’s professional transition from trainee to independent practitioner. However, this work has generally focused on the experiences of psychotherapists or general psychologists. The purpose of the current commentary is to reflect on the experiences of early professional forensic evaluators. This commentary addresses four specific areas including difficulties with adversarial allegiance, perceptions of professional competency, balancing responsibilities associated with “expert” status, and roadblocks to standard test administration and scoring. When applicable, we reference empirical literature and professional ethical guidelines. We also offer suggestions for coping with these experiences. We hope this commentary will normalize these experiences for other early career evaluators as well as aid graduate students’ transition into the independent evaluator role.     

贷款诈骗罪构成要件疑难问题研究

贷款诈骗罪构成要件的疑难问题集中地体现于二点:单位骗贷问题与非法占有目的。在疏理了对单位骗贷问题的无罪论、等同论和变通论等观点之后,重点阐释了变通论的不足与等同论的合理根据。对非法占有目的问题,应在应然上坚持客观主义立场的不要说,同时应注意认定此目的时的复杂情形。同时,对本罪客观方面的疑难之处,本文也予以简要分析。     

In search of copyright author(s)

Who should be considered the author of a work protected by copyright?In recent years, there has been an expanding critical literatureexamining notions of authorship and the role of the author inthe creative process, often leading to suggestions for waysin which the copyright framework might be recalibrated to recognizecollective effort. This book by Lior Zemer is an excellent additionto those works. Eloquently written and skilfully referenced in the eight chaptersthat make up Zemer's book, its key aim is to persuade the readerthat the individual and the public should be seen as joint authorsof creative works. In making his arguments, he takes us froma Conceptual Challenge (Chapter 2) to a