{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,8,23]],"date-time":"2026-08-23T16:28:03Z","timestamp":1787502483370,"version":"build-2736575974"},"reference-count":91,"publisher":"Association for Computing Machinery (ACM)","issue":"1","license":[{"start":{"date-parts":[[2019,2,13]],"date-time":"2019-02-13T00:00:00Z","timestamp":1550016000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"DOI":"10.13039\/501100000240","name":"New Brunswick Innovation Foundation","doi-asserted-by":"crossref","id":[{"id":"10.13039\/501100000240","id-type":"DOI","asserted-by":"crossref"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Comput. Surv."],"published-print":{"date-parts":[[2020,1,31]]},"abstract":"<jats:p>Code authorship attribution is the process of identifying the author of a given code. With increasing numbers of malware and advanced mutation techniques, the authors of malware are creating a large number of malware variants. To better deal with this problem, methods for examining the authorship of malicious code are necessary. Code authorship attribution techniques can thus be utilized to identify and categorize the authors of malware. This information can help predict the types of tools and techniques that the author of a specific malware uses, as well as the manner in which the malware spreads and evolves. In this article, we present the first comprehensive review of research on code authorship attribution. The article summarizes various methods of authorship attribution and highlights challenges in the field.<\/jats:p>","DOI":"10.1145\/3292577","type":"journal-article","created":{"date-parts":[[2019,2,14]],"date-time":"2019-02-14T14:36:17Z","timestamp":1550154977000},"page":"1-36","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":79,"title":["Code Authorship Attribution"],"prefix":"10.1145","volume":"52","author":[{"given":"Vaibhavi","family":"Kalgutkar","sequence":"first","affiliation":[{"name":"University of New Brunswick, NB, Canada"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1360-528X","authenticated-orcid":false,"given":"Ratinder","family":"Kaur","sequence":"additional","affiliation":[{"name":"University of New Brunswick, NB, Canada"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Hugo","family":"Gonzalez","sequence":"additional","affiliation":[{"name":"University of New Brunswick, NB, Canada"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Natalia","family":"Stakhanova","sequence":"additional","affiliation":[{"name":"University of New Brunswick, NB, Canada"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Alina","family":"Matyukhina","sequence":"additional","affiliation":[{"name":"University of New Brunswick, NB, Canada"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2019,2,13]]},"reference":[{"key":"e_1_2_1_1_1","volume-title":"Retrieved","author":"Aiken Alex","year":"1994"},{"key":"e_1_2_1_2_1","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.1983.235271"},{"key":"e_1_2_1_3_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2014.03.012"},{"key":"e_1_2_1_4_1","doi-asserted-by":"crossref","unstructured":"Saed Alrabaee Paria Shirani Mourad Debbabi and Lingyu Wang. 2017. On the feasibility of malware authorship attribution. arXiv:1701.02711.  Saed Alrabaee Paria Shirani Mourad Debbabi and Lingyu Wang. 2017. On the feasibility of malware authorship attribution. arXiv:1701.02711.","DOI":"10.1007\/978-3-319-51966-1_17"},{"key":"e_1_2_1_5_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2016.04.002"},{"key":"e_1_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-66402-6_6"},{"key":"e_1_2_1_7_1","volume-title":"Retrieved","author":"Arghire Ionut","year":"2018"},{"key":"e_1_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.patrec.2012.10.027"},{"key":"e_1_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1145\/988241.988245"},{"key":"e_1_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.1109\/COMPSACW.2012.46"},{"key":"e_1_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1145\/986953.986959"},{"key":"e_1_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.1145\/800182.810404"},{"key":"e_1_2_1_13_1","volume-title":"Proceedings of the 12th Australasian Document Computing Symposium. 32--39","author":"Burrows S.","year":"2007"},{"key":"e_1_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-00887-0_61"},{"key":"e_1_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1002\/spe.2146"},{"key":"e_1_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23304"},{"key":"e_1_2_1_17_1","doi-asserted-by":"publisher","DOI":"10.5555\/2831143.2831160"},{"key":"e_1_2_1_18_1","unstructured":"Aylin Caliskan-Islam Fabian Yamaguchi Edwin Dauber Richard Harang Konrad Rieck Rachel Greenstadt etal 2015. When coding style survives compilation: De-anonymizing programmers from executable binaries. arXiv:1512.08546.  Aylin Caliskan-Islam Fabian Yamaguchi Edwin Dauber Richard Harang Konrad Rieck Rachel Greenstadt et al. 2015. When coding style survives compilation: De-anonymizing programmers from executable binaries. arXiv:1512.08546."},{"key":"e_1_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1145\/2480362.2480668"},{"key":"e_1_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICTAI.2012.112"},{"key":"e_1_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.1109\/COMPSACW.2010.56"},{"key":"e_1_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.jss.2008.11.848"},{"key":"e_1_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.1007\/s11416-013-0183-6"},{"key":"e_1_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.1979.234165"},{"key":"e_1_2_1_25_1","volume-title":"Proceedings of the 20th Usenix Security Symposium. 33--48","author":"Curtsinger Charles","year":"2011"},{"key":"e_1_2_1_26_1","doi-asserted-by":"crossref","unstructured":"Edwin Dauber Aylin Caliskan Richard Harang and Rachel Greenstadt. 2017. Git blame who?: Stylistic authorship attribution of small incomplete source code fragments. arXiv:1701.05681.  Edwin Dauber Aylin Caliskan Richard Harang and Rachel Greenstadt. 2017. Git blame who?: Stylistic authorship attribution of small incomplete source code fragments. arXiv:1701.05681.","DOI":"10.1145\/3183440.3195007"},{"key":"e_1_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.1145\/3183440.3195007"},{"key":"e_1_2_1_28_1","doi-asserted-by":"crossref","unstructured":"Lucas Davi and Ahmad-Reza Sadeghi (Eds.). 2015. Code-reuse in malware. In Building Secure Defenses Against Code-Reuse Attacks. Springer Cham Switzerland 22--26.  Lucas Davi and Ahmad-Reza Sadeghi (Eds.). 2015. Code-reuse in malware. In Building Secure Defenses Against Code-Reuse Attacks. Springer Cham Switzerland 22--26.","DOI":"10.1007\/978-3-319-25546-0"},{"key":"e_1_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.1016\/S0164-1212(03)00049-9"},{"key":"e_1_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.1145\/800037.800955"},{"key":"e_1_2_1_31_1","first-page":"3","article-title":"N-gram analysis for computer virus detection","volume":"2","author":"Dubba Krishna S. R.","year":"2006","journal-title":"Journal in Computer Virology"},{"key":"e_1_2_1_32_1","doi-asserted-by":"publisher","DOI":"10.5555\/1295109.1295123"},{"key":"e_1_2_1_33_1","doi-asserted-by":"publisher","DOI":"10.1016\/0360-1315(87)90042-X"},{"key":"e_1_2_1_34_1","volume-title":"Retrieved","author":"Firestine Brandi","year":"2017"},{"key":"e_1_2_1_35_1","doi-asserted-by":"publisher","DOI":"10.1145\/356715.356717"},{"key":"e_1_2_1_36_1","volume-title":"Proceedings of the 1st International Conference on E-Business and Telecommunication Networks. 85--92","author":"Frantzeskou Georgia"},{"key":"e_1_2_1_37_1","first-page":"1","article-title":"Identifying authorship by byte-level N-grams: The source code author profile (SCAP) method","volume":"6","author":"Frantzeskou Georgia","year":"2007","journal-title":"International Journal of Digital Evidence"},{"key":"e_1_2_1_38_1","doi-asserted-by":"publisher","DOI":"10.1145\/1134285.1134445"},{"key":"e_1_2_1_39_1","doi-asserted-by":"crossref","volume-title":"Source Code Author Identification Based on N-gram Author Profiles","author":"Frantzeskou Georgia","DOI":"10.1007\/0-387-34224-9_59"},{"key":"e_1_2_1_40_1","doi-asserted-by":"publisher","DOI":"10.1109\/CW.2010.36"},{"key":"e_1_2_1_41_1","doi-asserted-by":"publisher","DOI":"10.1145\/3176258.3176322"},{"key":"e_1_2_1_42_1","doi-asserted-by":"publisher","DOI":"10.1145\/800037.800954"},{"key":"e_1_2_1_43_1","unstructured":"Dick Grune. 1991. Concise Report on Algorithms in Sim. Report distributed with Sim software.  Dick Grune. 1991. Concise Report on Algorithms in Sim. Report distributed with Sim software."},{"key":"e_1_2_1_44_1","doi-asserted-by":"publisher","DOI":"10.5815\/ijisa.2017.05.04"},{"key":"e_1_2_1_45_1","doi-asserted-by":"publisher","DOI":"10.1145\/953363.953366"},{"key":"e_1_2_1_46_1","doi-asserted-by":"publisher","DOI":"10.1145\/800181.810326"},{"key":"e_1_2_1_47_1","volume-title":"Proceedings of the 6th International Conference on Software Engineering. 197--206","author":"Peter"},{"key":"e_1_2_1_48_1","first-page":"79","article-title":"Authorship attribution: A principal component and linear discriminant analysis of the consistent programmer hypothesis","volume":"15","author":"Hayes Jane Huffman","year":"2008","journal-title":"International Journal on Computers and Their Applications"},{"key":"e_1_2_1_49_1","doi-asserted-by":"publisher","DOI":"10.1002\/stvr.412"},{"key":"e_1_2_1_50_1","doi-asserted-by":"publisher","DOI":"10.1093\/llc\/13.3.111"},{"key":"e_1_2_1_51_1","volume-title":"BRAIN: Searching for the first PC virus in Pakistan. Retrieved","author":"Hypponen Mikko","year":"2011"},{"key":"e_1_2_1_52_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICCIT.2008.267"},{"key":"e_1_2_1_53_1","first-page":"255","article-title":"N-gram-based author profiles for authorship attribution","volume":"3","author":"Ke\u0161elj Vlado","year":"2003","journal-title":"Proceedings of the Pacific Association for Computational Linguistics"},{"key":"e_1_2_1_54_1","doi-asserted-by":"publisher","DOI":"10.5555\/1484611.1484627"},{"key":"e_1_2_1_55_1","doi-asserted-by":"publisher","DOI":"10.1109\/ITNG.2007.17"},{"key":"e_1_2_1_56_1","doi-asserted-by":"publisher","DOI":"10.1016\/S0167-4048(97)00005-9"},{"key":"e_1_2_1_58_1","doi-asserted-by":"publisher","DOI":"10.1016\/S0167-4048(97)00005-9"},{"key":"e_1_2_1_59_1","doi-asserted-by":"publisher","DOI":"10.1145\/3230833.3230849"},{"key":"e_1_2_1_60_1","doi-asserted-by":"publisher","DOI":"10.1145\/1276958.1277364"},{"key":"e_1_2_1_61_1","first-page":"1","article-title":"Obfuscating C++ programs via control flow flattening. Annales Universitatis Scientarum Budapestinensis de Rolando E\u00f6tv\u00f6s Nominatae","volume":"30","author":"L\u00e1szl\u00f3 T\u0131mea","year":"2009","journal-title":"Sectio Computatorica"},{"key":"e_1_2_1_62_1","doi-asserted-by":"publisher","DOI":"10.1109\/CTC.2014.14"},{"key":"e_1_2_1_63_1","doi-asserted-by":"publisher","DOI":"10.1109\/ecrime.2010.5706698"},{"key":"e_1_2_1_64_1","doi-asserted-by":"publisher","DOI":"10.1109\/ISCIT.2012.6380857"},{"key":"e_1_2_1_65_1","doi-asserted-by":"publisher","DOI":"10.1145\/201998.202010"},{"key":"e_1_2_1_66_1","doi-asserted-by":"publisher","DOI":"10.1145\/1150402.1150522"},{"key":"e_1_2_1_67_1","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.1976.233837"},{"key":"e_1_2_1_68_1","doi-asserted-by":"publisher","DOI":"10.1145\/2950290.2983962"},{"key":"e_1_2_1_69_1","doi-asserted-by":"publisher","DOI":"10.1145\/75427.75469"},{"key":"e_1_2_1_70_1","doi-asserted-by":"publisher","DOI":"10.1145\/382222.382462"},{"key":"e_1_2_1_71_1","doi-asserted-by":"publisher","DOI":"10.1109\/13.28038"},{"key":"e_1_2_1_72_1","first-page":"11","article-title":"Finding plagiarisms among a set of programs with JPlag","volume":"8","author":"Prechelt Lutz","year":"2002","journal-title":"Journal of Universal Computer Science"},{"key":"e_1_2_1_73_1","doi-asserted-by":"publisher","DOI":"10.1145\/2001420.2001433"},{"key":"e_1_2_1_74_1","volume-title":"Miller","author":"Rosenblum Nathan","year":"2011"},{"key":"e_1_2_1_76_1","doi-asserted-by":"publisher","DOI":"10.1145\/1806672.1806678"},{"key":"e_1_2_1_77_1","volume-title":"Proceedings of the International Conference Software Engineering: Education and Practice. IEEE","author":"Sallis Philip J."},{"key":"e_1_2_1_78_1","doi-asserted-by":"publisher","DOI":"10.1145\/872757.872770"},{"key":"e_1_2_1_79_1","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.1983.236460"},{"key":"e_1_2_1_80_1","doi-asserted-by":"publisher","DOI":"10.1109\/SSBSE.2009.18"},{"key":"e_1_2_1_81_1","doi-asserted-by":"publisher","DOI":"10.1515\/popets-2018-0007"},{"key":"e_1_2_1_82_1","doi-asserted-by":"publisher","DOI":"10.1016\/0167-4048(93)90055-A"},{"key":"e_1_2_1_83_1","first-page":"3","article-title":"A survey of modern authorship attribution methods","volume":"60","author":"Stamatatos Efstathios","year":"2009","journal-title":"Journal of the Association for Information Science and Technology"},{"key":"e_1_2_1_84_1","doi-asserted-by":"publisher","DOI":"10.1007\/s10579-010-9115-y"},{"key":"e_1_2_1_85_1","volume-title":"Proceedings of the 2014 IEEE SoutheastCon. IEEE","author":"Matthew"},{"key":"e_1_2_1_86_1","doi-asserted-by":"publisher","DOI":"10.1145\/369585.369598"},{"key":"e_1_2_1_87_1","volume-title":"Proceedings of the Conference on Duplication, Redundancy, and Similarity in Software. 1--10","author":"Walenstein Andrew","year":"2007"},{"key":"e_1_2_1_88_1","doi-asserted-by":"publisher","DOI":"10.1145\/1653662.1653696"},{"key":"e_1_2_1_89_1","doi-asserted-by":"publisher","DOI":"10.1093\/comjnl\/33.2.140"},{"key":"e_1_2_1_90_1","doi-asserted-by":"publisher","DOI":"10.1145\/236462.236525"},{"key":"e_1_2_1_91_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2015.09.001"},{"key":"e_1_2_1_92_1","doi-asserted-by":"publisher","DOI":"10.1371\/journal.pone.0187204"},{"key":"e_1_2_1_93_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-63579-8_22"}],"container-title":["ACM Computing Surveys"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3292577","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3292577","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T20:58:07Z","timestamp":1750193887000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3292577"}},"subtitle":["Methods and Challenges"],"short-title":[],"issued":{"date-parts":[[2019,2,13]]},"references-count":91,"journal-issue":{"issue":"1","published-print":{"date-parts":[[2020,1,31]]}},"alternative-id":["10.1145\/3292577"],"URL":"https:\/\/doi.org\/10.1145\/3292577","relation":{},"ISSN":["0360-0300","1557-7341"],"issn-type":[{"value":"0360-0300","type":"print"},{"value":"1557-7341","type":"electronic"}],"subject":[],"published":{"date-parts":[[2019,2,13]]},"assertion":[{"value":"2017-12-01","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2018-09-01","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2019-02-13","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}