Tracing Coding Behavior Patterns by Function-Calling Features of Code

Protean malware mutations and premeditated cyber attacks are threatening security of information systems worldwide. There is an urgent need for effective methods to trace the source of code. In this paper, through study of coding behavior, which is a social characteristic of code, we trace the source of code preliminarily. Based on function-calling relation graph, three function-calling features of code are proposed to distinguish different coding patterns of programmers: relative edit distance shows the orderliness of code, semivariogram reveals programmers' coding logic (Breadth First Coding or Depth First Coding) and ODD value suggests different function arrangement styles. Tested in experiments, these features are able to trace the coding behavior patterns of programmers, providing assistance with source tracing as expected.