Using the uniqueness of global identifiers to determine the provenance of Python software source code

We consider the problem of identifying provenance free/open source software (FOSS) and specifically need where reused code has been copied from. propose a lightweight approach to solve based on identifiers-such as names variables, classes, functions chosen by programmers. The proposed is able efficiently narrow down small set candidate origin products, be further analyzed with more expensive techniques make final determination.By analyzing PyPI (Python Packaging Index) open ecosystem we find that globally defined identifiers are very distinct. Across PyPI's 244 K packages found 11.2 M different global (classes method/function names-with only 0.6% shared among two types entities); 76% were used in one package, 93% at most 3. Randomly selecting 3 non-frequent from an input product enough its origins maximum products within 89% cases.We validate mapping Debian implemented Python corresponding packages; this uses five trials, each trial three randomly python file subject then ranks results using popularity index requires inspect top result. In our experiments, method effective finding true project recall 0.9 precision 0.77.