cheating in online exam

8/10/2019 Cheating in Online Exam

1/120

2010:112

M A S T E R ' S T H E S I S

Behavioral Detection of Cheatingin Online Examination

Matus Korman

Lule University of Technology

D Master thesis

Computer and Systems SciencesDepartment of Business Administration and Social Sciences

Division of Information Systems Sciences

2010:112 - ISSN: 1402-1552 - ISRN: LTU-DUPP--10/112--SE


2/120


3/120

Acknowledgements

I would like to thank everyone, who contributed in, opposed to, assisted with, orotherwise helped me carrying out the study as well as writing this thesis a resultof the study.

My thanks go to Dan Harnesk, PhD. (supervisor), Soren Samuelsson, PhD., andJohn Lindstrom, PhD., for the valuable advice and research guidance I was given;to Hugo Quisbert, PhD., Artjom Vassiljev and Viola Veiderpass for constructive op-position; to Lars Furberg for the ideas, which helped me to navigate to the researchproblem chosen and the interesting discussions we had; to Neil Costigan, PhD., forhis inspiring work and presentations; to professor Ann Hagerfors for managing is-sues also related to my study; and to my family for their mental support and advice.My further thanks go to Amir Molavi, Onur Yirmibesoglu, Marko Niemimaa, ElinaLaaksonen, Nebojsa Mihajlovski, Vladimir Kichatov, Ali Fakhr, Darya Plankina,Anna Selischeva, Sana Rouis, Svante Edzen, Peter Anttu, and others, who con-tributed to my thoughtflow through discussions, or supported me in different other

ways.

Special thanks go to Behaviometrics AB and the people, efforts of whom relateto the study.

Also thanks to the contributions of all of you, the study has been done the wayit has, and I feel having learned valuable knowledge and gained practice, for whichthereisuse in the future.


4/120

Abstract

This thesis relates to studying possibilities of detecting online examination cheatingthrough the measures of human-computer interaction dynamics.

The need for and use of online or computer-based examination seems to be growing,while this form of examination gives students a broader spectrum of opportunitiesincluding those for cheating, as compared to non-computerized ways of examination.The times are changing, there are many different reasons for examination dishonesty,many ways of performing it, and many ways of coping with it. Given an equilib-

rium at this level, new ways of violation deserve new ways of prevention, or at leastdetection.

The study focuses on a method of computer-based examination cheating detec-tion based on measures of behavior and machine learning, and tries to link it toa broadly taken concept of academic dishonesty. The detection potential of thismethod is mainly indicated by cue leakage theory, subjects of which can be han-dled with use of pattern recognition and anomaly detection theory, all through abehavioral biometrics approach.


5/120

Contents

1 Introduction 1

1.1 Topic. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3

1.2 Research goals and delimitation. . . . . . . . . . . . . . . . . . . . . 31.3 Significance of the study . . . . . . . . . . . . . . . . . . . . . . . . . 4

1.4 Document structure . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

2 Background 7

2.1 Examination cheating . . . . . . . . . . . . . . . . . . . . . . . . . . 7

2.1.1 Whats wrong with cheating? . . . . . . . . . . . . . . . . . . 8

2.1.2 Why do students cheat? . . . . . . . . . . . . . . . . . . . . . 92.1.3 The mission: preventing cheating . . . . . . . . . . . . . . . . 16

2.1.4 How do students cheat? . . . . . . . . . . . . . . . . . . . . . 19

2.1.5 Detecting cheating as a means of prevention. . . . . . . . . . 212.1.6 Cheating review summary . . . . . . . . . . . . . . . . . . . . 22

2.2 Specifics of distance operation. . . . . . . . . . . . . . . . . . . . . . 26

3 Conceptual framework 29

3.1 Cue leakage theory . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29

3.2 Pattern recognition theory. . . . . . . . . . . . . . . . . . . . . . . . 30

3.3 Anomaly detection . . . . . . . . . . . . . . . . . . . . . . . . . . . . 313.4 Behaviometrics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32

3.4.1 Biometrics in general. . . . . . . . . . . . . . . . . . . . . . . 33

3.4.2 Specifics of behaviometrics . . . . . . . . . . . . . . . . . . . 383.4.3 Keystroke dynamics . . . . . . . . . . . . . . . . . . . . . . . 41

3.4.4 Mouse dynamics . . . . . . . . . . . . . . . . . . . . . . . . . 43

3.4.5 Linguistic dynamics . . . . . . . . . . . . . . . . . . . . . . . 44

3.4.6 Special purpose behaviometrics . . . . . . . . . . . . . . . . 443.5 Vision of a behavioral cheating detection approach . . . . . . . . . . 48

3.5.1 The angle of attack. . . . . . . . . . . . . . . . . . . . . . . . 49

3.5.2 Behavioral characteristics as the cheating detection unifier. . 503.5.3 The detection mechanism . . . . . . . . . . . . . . . . . . . . 50

4 Methodology 534.1 My setting and the research method . . . . . . . . . . . . . . . . . . 53

4.2 Validity of a research design . . . . . . . . . . . . . . . . . . . . . . . 55

4.3 Reliability and validity of a measure . . . . . . . . . . . . . . . . . . 56

4.4 Research design and research process . . . . . . . . . . . . . . . . . . 57

4.4.1 Empirical inputs . . . . . . . . . . . . . . . . . . . . . . . . . 58


6/120

4.4.2 Observations . . . . . . . . . . . . . . . . . . . . . . . . . . . 594.4.3 Questionnaire . . . . . . . . . . . . . . . . . . . . . . . . . . . 624.4.4 Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63

5 Analysis and observations 655.1 Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65

5.1.1 Quantitative molecular level. . . . . . . . . . . . . . . . . . . 655.1.2 Qualitative molecular level . . . . . . . . . . . . . . . . . . . 665.1.3 Qualitative molar level. . . . . . . . . . . . . . . . . . . . . . 66

5.2 Observations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 675.3 Observation 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67

5.3.1 General highlights . . . . . . . . . . . . . . . . . . . . . . . . 675.3.2 Session-specific highlights . . . . . . . . . . . . . . . . . . . . 68

5.4 Observation 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70

5.4.1 General highlights . . . . . . . . . . . . . . . . . . . . . . . . 705.4.2 Session-specific highlights . . . . . . . . . . . . . . . . . . . . 705.5 Observation 3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73

5.5.1 General highlights . . . . . . . . . . . . . . . . . . . . . . . . 735.5.2 Session-specific highlights . . . . . . . . . . . . . . . . . . . . 73

5.6 Triangulative analysis remarks . . . . . . . . . . . . . . . . . . . . . 75

6 Results and findings 776.1 Behavioral anomaly indication . . . . . . . . . . . . . . . . . . . . . 776.2 Indicating cheating . . . . . . . . . . . . . . . . . . . . . . . . . . . . 776.3 Indication difficulties . . . . . . . . . . . . . . . . . . . . . . . . . . . 77

7 Conclusion and discussions 797.1 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 797.2 Cheating detection and prevention approach discussion. . . . . . . . 80

7.2.1 Behaviometric aspects . . . . . . . . . . . . . . . . . . . . . . 807.2.2 Cheating aspects . . . . . . . . . . . . . . . . . . . . . . . . . 827.2.3 Psychological aspects . . . . . . . . . . . . . . . . . . . . . . 83

7.3 Research approach discussion . . . . . . . . . . . . . . . . . . . . . . 847.4 Outlooks for further research . . . . . . . . . . . . . . . . . . . . . . 84

Appendices 97

A Subjects of automated observation 99A.1 Basic structure of the analytics . . . . . . . . . . . . . . . . . . . . . 99A.2 Keystroke dynamics features . . . . . . . . . . . . . . . . . . . . . . 100A.3 Mouse dynamics features . . . . . . . . . . . . . . . . . . . . . . . . 100A.4 Silence dynamics features . . . . . . . . . . . . . . . . . . . . . . . . 100A.5 Linguistic dynamics features. . . . . . . . . . . . . . . . . . . . . . . 101

B Subjects of manual observation 105

C Questionnaire and observation task content 107C.1 Questionnaire . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107

C.2 Authentic writing and formulating . . . . . . . . . . . . . . . . . . . 108


7/120

C.3 Verbatim copying by reading . . . . . . . . . . . . . . . . . . . . . . 109C.4 Verbatim copying by listening . . . . . . . . . . . . . . . . . . . . . . 109C.5 Copying by reading and reformulating . . . . . . . . . . . . . . . . . 110


8/120

List of Figures

2.1 A cheating-extended model of Ajzens theory of planned behavior . . 10

2.2 Model of student cheating decision based on internal (personal) andexternal factors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

2.3 Model of cheating causation . . . . . . . . . . . . . . . . . . . . . . . 15

2.4 Graphical overview of cheating and counter-cheating relations . . . . 24

2.5 Overview of a cheating and counter-cheating process . . . . . . . . . 25

3.1 A classification example . . . . . . . . . . . . . . . . . . . . . . . . . 30

3.2 Biometric system error rates. . . . . . . . . . . . . . . . . . . . . . . 36

3.3 A typical architecture of a biometric system . . . . . . . . . . . . . . 36

3.4 Fusion of biometric systems . . . . . . . . . . . . . . . . . . . . . . . 37

3.5 The biometric menagerie. . . . . . . . . . . . . . . . . . . . . . . . . 39

3.6 An example process of mouse dynamics analysis . . . . . . . . . . . 43

3.7 Deterrence mechanism of cheating detection . . . . . . . . . . . . . . 49

3.8 Model of the cheating detection approach . . . . . . . . . . . . . . . 52

4.1 Research process overview . . . . . . . . . . . . . . . . . . . . . . . . 584.2 The observation design used in the study . . . . . . . . . . . . . . . 60

4.3 The observation process (including questionnaire). . . . . . . . . . . 62

4.4 Data flow and control relations of the data gathering and analysisprocesses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63

7.1 The cheating prevention approach . . . . . . . . . . . . . . . . . . . 82

A.1 Analytics structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99

A.2 Context and process of the automated analysis part . . . . . . . . . 100

C.1 Example free diagram . . . . . . . . . . . . . . . . . . . . . . . . . . 109

C.2 Diagram to copy (redraw) . . . . . . . . . . . . . . . . . . . . . . . . 110

List of Tables

2.1 Factors correlated to plagiarism behavior 1 . . . . . . . . . . . . . . 13

2.2 Factors correlated to plagiarism behavior 2 . . . . . . . . . . . . . . 14

iv


9/120

3.1 Meta-functions of a computer mediated communication text analysisframework . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45

3.2 Text analysis linguistic features 1 . . . . . . . . . . . . . . . . . . . . 45

3.3 Text analysis linguistic features 2 . . . . . . . . . . . . . . . . . . . . 46

4.1 Levels of the predictor variable (PV) . . . . . . . . . . . . . . . . . . 61

7.1 Biometric properties of the approach . . . . . . . . . . . . . . . . . . 817.2 Discussion of measure validity. . . . . . . . . . . . . . . . . . . . . . 85

A.1 Explanation of terms used in the description of features . . . . . . . 101A.2 Keystroke dynamics features . . . . . . . . . . . . . . . . . . . . . . 102A.3 Mouse dynamics features . . . . . . . . . . . . . . . . . . . . . . . . 103A.4 Silence dynamics features . . . . . . . . . . . . . . . . . . . . . . . . 104A.5 Linguistic dynamics features. . . . . . . . . . . . . . . . . . . . . . . 104


10/120


11/120

Chapter 1

Introduction

Cheating in online examination is an educational problem similarly as it is in conven-

tional examination. Because of its lower detectability, however, universal reputationof distance degrees suffers. This study strives to explore and verify possibilities ofdetecting specific types of cheating based on behavioral measures of computer inter-action taken during an online examination. Detecting cheating is seen as a way topreventing it (lowering its extent).

Distance education became an educational field in 1970s and since then it isgaining popularity in diverse parts of the world (Keegan, 1996; Allen & Seaman,2005,2007;Howell et al.,2003). According toAllen & Seaman(2008), nearly 22%of all higher education enrollments in the United States in year 2007 were onlineenrollments. The number was around 4 million and there is still a growing ten-dency. Moreover, online education is dominantly perceived as critical to long-terminstitutional strategy by educational institutions at least across the United States(Allen & Seaman, 2008). Based on different trends and factors, the interest fordistance education is increasing and expected to increase further (Hawkridge,1995;Irele,2005;Allen & Seaman,2003). The trends have varied characters, among othermotivational (Parker,2003;Maguire,2005;Allen & Seaman,2008), social, politicaland technological (Bates,1995;Howell et al., 2003). Relatively high future growthof distance education is expected in developing countries (Koul,1995).

Distance education is a form of education, in which teachers and class audi-ence are separated by physical distance and/or by time (Moore & Kearsley, 1996,chap. 1) as compared to conventional (on-site) education, which is based on face-

to-face meetings and time-synchronous physical presence of students, required bythe technology predominantly employed (Keegan,1996, chap. 1,2). FollowingKee-gan(1996), distance education and conventional education differ at least in physicalcentralization and time-synchronization (accessibility), economics, market, and alsodidactics (Reushle & McDonald, 2004; Reushle et al., 1999), administration andevaluation. Nowadays, not only different universities around the world offer coursesand programs for distance studies, there are whole universities often called openuniversities, which are built on the concept of, and provide solely distance educa-tion.

As to the process of education, the concept of physical decentralization andtime-asynchronization is also applicable to the process of assessment including ex-

amination (Mason,1995), since the two are often employed at the same time, or in

1


12/120

a mutually successive manner. Distance examination is in different forms used tovalidate the level of knowledge, skills or abilities of students/examinees. The mostcommon distance examination method seems to be online examination, which uses

a network-enabled computer environment (e.g., the Internet) to set up a two-waycommunication.

Although dependent on specific environment, while major concerns in distanceeducation compared to on-site education are mostly related to finding, achieving andmaintaining effective means of teaching/tutoring, learning, student support and ad-ministration (Holmberg, 1995; Keegan, 1996; Bates, 2005; Kim et al., 2008), theproblems of fairness assurance and trust seem to be often more challenging in on-line examination compared to traditional/conventional examination means (Rowe,2004). Public trust and fairness in education including examination is an importantattribute (Rumyantseva,2005;Heyneman,2002), yet seemingly tricky to achieve andmaintain (Herberling,2002). The technology, which on one hand enables distributed

and asynchronous education, opens up a broad range of cheating possibilities withinan examination process on the other hand. Controlling or at least perceiving largelyunknown and distant examination environments as a way to detect and prevent ex-amination dishonesty seems to be non-trivial. Also as a matter of this fact, distanceeducation often renders less accepted than conventional (on-site) education (Colum-baro & Monaghan,2009;Bourne et al., 2005). In a more general context,Allen &Seaman(2003) shows that online education is perceived inferior to conventional ed-ucation, however, near future beliefs (for three years later) show an optimistic turnin the balance. Around six years later, Columbaro & Monaghan(2009) show thatsuch beliefs have been and might tend to be too optimistic, since more than 95%of employers would prefer to accept a traditional degree to an online one in several

different fields according to their study.

Examination cheating and academic dishonesty in general seem to have been aneducational problem since a long time ago (Cizek,1999). According toUC Berke-ley(2009), cheating can be defined as fraud, deceit, or dishonesty in an academicassignment, or using or attempting to use materials, or assisting others in usingmaterials, that are prohibited or inappropriate in the context of the academic as-signment in question (no page numbering). Students often tend to shortcut achiev-ing their grades and maintaining their sense of personal integrity otherwise thanthrough investing adequate amount of effort and time (Diekhoff et al.,1996). Aca-demic cheating is prevalent and at the same time, it seems to have growing tendency

(Cizek,1999;Dick et al., 2003;McCabe et al., 2006;Wehman,2009;Howell et al.,2009). A study inMcCabe et al. (2006) shows that cheating was reported by 56%business students and 47% non-business students. An earlier McCabes study (alsomentioned in the paper) shows that 66% of all students reported at least one seriouscheating incident in the past year, while among engineering students the numberwas 72% and business students led with 84%. According to a survey carried out inthe United States, around 94% students reported cheating in any form, around 65%students reported test cheating and more than 50% students reported plagiarism.According to Stumber-McEwen et al.(2009), there is a wealth of studies on preva-lence of cheating available, however, their quantitative results vary greatly basedon the type of survey and specific survey conditions. As to on-site examination,

cheating also applies to distance examination (Underwood, 2006; Wehman, 2009).

2


13/120

Different sources perceive the cheating prevalence among on-site and online exam-ined students differently (Stumber-McEwen et al., 2009; Herberling, 2002; Watson& Sottile,2010). Assuming that an online examination environment tends to be less

cheat-constraining and less perceivable by examiners than an on-site one, studentsmay generally tend to cheat more from distance as also believed by Rowe(2004).

Following an information security approach (Whitman & Mattord, 2008), theoccurrence of online examination cheating as an undesirable activity is a form ofrisk, and the higher the cheating severity and probability, the greater the risk con-trol importance. The ultimate goal of risk control, in this context applied to theeducational field, is to effectively reduce risk related to the educational process.Effectively reducing risk of online examination cheating is a problem.

There are multiple approaches to controlling online examination cheating (Olt,2002), many of them suitable in one way or another. The primary approach usablewith the thesis concerns is the police approach monitoring for and reacting on

suspicion or detection, along with deterrence-based cheating demotivation. This ap-proach is somewhat analogous to a feedback control system (Astrom & Murray,2008,chap. 1) and within such one needs to first perceive the examination environmentand detect anomalies in order to be able to make effective control actions. Perceiv-ing a distant online examination environment and effectively detecting cheating is aproblem.

1.1 Topic

The topic of this thesis is to explore and verify possibilities of detecting specific typesof online examination cheating based on behavioral measures of human-computerinteraction. More specifically, the focus lies on utilizing behaviometrics (behavioralbiometrics) for the analysis of keystroke, mouse and linguistic dynamics.

The primary motivation for this study is to enable or help faculties to both(1) fight the prevalent and rather invisible online examination cheating, and to (2)indirectly increase the acceptance of online grades.

By content, this study is focusing on the use of behaviometrics (work withkeystroke, mouse and linguistic dynamics) based on information technology andmachine learning(software, pattern recognition, anomaly detection, visualization)for detecting examination cheating (an educational concern).

1.2 Research goals and delimitation

The goal of the research endeavor is not to enable one to exactly tell whether astudent cheats or not. According to the character of a probabilistic analysis processand the variety of input data to it in context and time frame of this thesis, such a goalwould render extremely difficult to achieve to me. Instead, I consider the followinginformation to be both useful and realistic to indicate based on the measures ofhuman-computer interaction (keystroke and mouse events with their timings, andlinguistic features from keystrokes):

1. Histogrammatically displayedextent of behavioral anomalycompared to a be-

havioral baseline

3


14/120

2. Histogrammatically displayedamount of stress

3. Histogrammatically displayedprobability of cheatingtogether with the type of

possible cheating activity (e.g. copying by reading, listening, etc.) for eachsuspicious segment of behavior during the examination session time

Being able to effectively and in a highly automated way provide the above about thetarget population(described below) is the research vision (in a longer term). Thegoal of this study, however, is to approach this vision with focus on the first and thethird point.

The target population to which the research goal relates are distance students, agreat part of whose might be employed adults (Paulsen & Rekkedal,2001), mostlyaged between 25 to 40 years. The rest of the target group might be graduate studentsaged mostly between 20 and 30 years. The age ranges used are assumptive and they

constitute a part of the studys delimitation.The following are research questions, answering which I expect to contribute to

achieving the research goal:

RQ-1 What are the behavioral signs of tasks carried out when cheating thatmanifest themselves on keystroke, mouse and linguistic dynamics of theusers computer interaction during a computer-based examination?

RQ-2 How distinct is normal behavior from a cheating behavior and how dis-tinct are different types of cheating behavior from each other?

The following are delimitation statements for this study: (1) A small number ofparticipants of online examination simulations (observations) are selected based onconvenience, instead of careful alignment to the target population. (2) No specialequipment such as skin humidity, body temperature or heartbeat sensors is usedwithin the study. (3) Automation of the whole cheating detection process fromgathering inputs to seeing indications of cheating type and amount itself, is not apart of the study.

1.3 Significance of the study

The contribution the study aims at is to identify and prototype a new approach to de-tecting computer-based examination cheating using such behaviometric techniques,operation of which does not depend on the availability of any student-uncommonhardware1. No previous work known to the author has been done within this topicat the time of writing.

Being able to reliably detect and perceive examination cheating could help assur-ing examination fairness, promoting academic integrity, and hence be a step towardsshifting motivation of many students from cheating to seemingly more strategicallyvaluable personal efforts.

1Assuming that in order to carry out an online examination, at least a computer with keyboard

and mouseis available to the student.

4


15/120

1.4 Document structure

After having introduced the topic, drawn the research goal, questions and delimi-

tation statements in the introductionchapter, the document describes the problembackground and parts of the state of the art in the background chapter. The chapterconceptual frameworkcontains description of core theories and concepts applied inthe study. The research method and its details are described as next in the methodchapter. Observationsuseful to know before analysis, are described in the chapternamed respectively. Findings of the study are summarized in theresults and findingschapter. Finally, the whole research is summarized and concluded in the conclusionchapter, and different questions are additionally discussed from the authors pointsof view.

5


16/120

6


17/120

Chapter 2

Background

This chapter summarizes some cheating-related background and the state of the art

in relation to the research problem and the approaches chosen to solve it.

2.1 Examination cheating

This section tries to outline cheating from different perspectives and answer to acouple of questions, which could arise with regards to cheating. Firstly, cheating isdescribed and some reasons for its negative consideration are given. Subsequently,this section looks at how cheating is done, how can one detect it, why studentscheat and how can one prevent it. Finally, what was stated about cheating so faris summarized according to my apprehension, and a description on what distance

operation can change regarding cheating is drawn.As described earlier, examination cheating is a highly prevalent matter. Wehman

(2009) provides an extensive summary of self-reported academic dishonesty identifiedby a number of scholars through a period of sixteen years from 1992 to 2008.

Before going deeper toward consequences, forms, reasons, and ways of detect-ing and preventing cheating, let us attempt to define or at least characterize whatcheating is. Based on the fact that the threshold of what is considered as cheatingdepends on course-specific context and is therefore variable, Dick et al. (2003) tryto define cheating in a way, which overcomes this problem:

A behavior may be defined as cheating if [at least] one of the two followingquestions can be answered in the positive:

Does the behavior violate the rules that have been set for the assessmenttask?

Does the behavior violate the accepted standard of student behavior atthe institution?

(Dick et al.,2003, p. 172)

Although the second question asked by Dick et al. uses the term accepted standardof student behavior, practical image of which looks rather informal and fuzzy, thedefinition seems to reflect the perception of cheating pretty well in general and

also in the fuzziness, on the other hand. As said afterwards regarding the previous,

7


18/120

in both cases, this assumes that the accepted rules and standards have beenclearly laid out for students. (Dick et al.,2003,p. 172)

Facing the reality, this might not be the case in many academic environments,though. Another problem with the definition is that technically breaking the rules orsuch standard might also be inadvertent (unintentional), or too trivial, so it ratherbecomes perceived as poor learning behavior instead of cheating.

Severity is an important parameter of cheating, especially in responding to cheat-ing or handling it otherwise. Dick et al. (2003) proposes a number of factors toconsider regarding cheating severity (seriousness):

The presence of deception (deceptive intention) in achieving an unfair advan-tage.

The presence of direct harm to some other person by the cheating behavior.

Course-relative value of the assessment task, on which the cheating was present.

Width of the cheating scope (1-2 students, or more?)

The presence of criminal behavior within the cheating behavior.

The cheaters learning outcome achievement (as inversely related).

Dick et al. (2003) uses the term management of cheating as an organizationalprocess with three stages as follows:

1. Cheating preemption stagetrying to reduce cheating incidence within courses

by e.g. design of academic integrity policy and programs, culture, examinationenvironment, assessment etc.

2. Cheating detection stage trying to detect student cheating by e.g. examiningturned in assignments and student behavior

3. Cheating response stagetrying to reactively respond to detected student cheat-ing

2.1.1 Whats wrong with cheating?

Although the answer to this question might in its simple form sound pretty obvious,

let us try to look for a broader and more explicit answer. Taken very generally,academic dishonesty including examination cheating would perhaps not be a soundproblem unless it had some serious consequences within the society.

Cheating is an important issue that needs to be considered for two main reasons.The first reason is that students who cheat are likely to have not achievedcompetence in a variety of skills that will be necessary for them to use in theirprofession. Graduating incompetent professionals is likely to cause:

Damage to society, as incompetent professionals may produce work thatfails or is even dangerous to human life.

Damage to the profession, as every professional represents the profession

to the wider community and any incompetence will reflect badly on it.

8


19/120

Damage to the reputation of the institution as employers realise that thegraduates from an institution are sometimes or are often incompetent.

Damage to the reputation of the degree for the same reason.

The second reason that cheating is an important issue for academics is the harmit causes to individual students. It

Harms the educational environment for all students as academics mustspend time and energy controlling cheating that could be better utilizedon enhancing positive learning

Harms the cheating student by their loss of learning and leaves themunprepared for their profession when they graduate

Harms their fellow students who do not cheat as the cheating studentgains an unfair advantage over them. In an environment where grades areimportant for scholarships and future employment, this can have serious

consequences.

(Dick et al.,2003, p. 173)

Besides that, cheating can pose a greater risk to the ones who cheated and weredetected:

The student learns little when the opportunity to learn is ignored, the gratifica-tion of creating something that he or she distinctly owns is lost, and if discoveredby others, the career of the student could be ruined depending upon the con-text and seriousness of the offense (Whitley & Keith-Spiegel,2001). (Wehman,2009,p. 12)

Regarding student recommendation of examination process (presumably influ-encing course and degree reputation), Shen et al. (2004) carried out a field exper-iment on 114 students showing that perceived examination fairness is positivelycorrelated to ethical recommendations about the examination process.

Digging a bit into cheating dynamics and following Albert Banduras social cog-nitive theory (Bandura, 1991, 2002), especially in terms of social referential com-parison, not only single acts of cheating are harmful. It is also the forming effectof making the perception of cheating more common in surrounding human environ-ment, which pushes the thresholds of social acceptability at people and hence, aidsfurther establishment and spreading of the cheating culture (McCabe et al.,2006;Megehee & Spake, 2008). Within such a culture, cheating even forms itself away

from being perceived as dishonest (Cizek,1999).Summarized and perhaps a bit extended, too, Whitley & Keith-Spiegel (2002)

states that a faculty should be concerned about academic dishonesty because ofthe following eight issues: (1) Equity, (2) character development, (3) the missionto transfer knowledge, (4) student morale, (5) faculty morale, (6) students futurebehavior, (7) reputation of the institution, and (8) public confidence in higher edu-cation.

2.1.2 Why do students cheat?

The question why people cheat seems to be important to answer for a discussion of

detection as a form of cheating prevention. Although a deep and thorough answer

9


20/120

Figure 2.1: Model of Ajzens (1991) Theory of Planned Behavior extended byStone et al.(2009)

to the question is beyond the limits of the thesis focus, this part provides a moregeneral and somewhat more near-the-surface answer instead.

From a pragmatic perspective and according to Ajzens (1991) Theory of PlannedBehavior (TPB) extended by Stone et al. (2009) (outlined on figure 2.1), peopleintend to cheat and perform it according to three components (1) beliefs aboutcheating and its outcomes, (2) perceived normative acceptability of cheating, and(3) the ability (or difficulty) to cheat and remain undetected (thus unpunished).Although the theory describes an internal cheating control mechanism, it does notexplain what are the incentives for considering a cheating behavior at all. For theneeds of this study, let us simply assume the following:

Cheating is one of the strategies to achieve perceived goals with taking anexamination, which could in most cases be the achievement of a score (grade)good enough at a cost low enough; certainly not the only one, though.

Within the process of decision making, people (students) choose strategies

based on perceived feasibility in terms of costs (e.g. invested time, effort,money or mood, risk to undertake etc.) and benefits (e.g. receiving betterexamination score, receiving more social acceptance from certain peers, etc).

For a deeper insight towards more under the hood relations between student goals,motivation and expectancy, one can refer toCovington(2000) andEccles & Wigfield(2002).

From a different perspective, Lawrence Hinmans words say:

People with integrity not only refrain from cheating, but dont want to cheat.[...] People with integrity have a sense of wholeness, of who they are, thateliminates the desire to pretend through cheating, through plagiarizing, and

the like that they are someone else. For them, signing their name to something

10


21/120

Figure 2.2: Model of student cheating decision based on internal (personal) and externalfactors based onDick et al. (2003)

signifies that it is theirs. They would not want to pass something off as theirown. (Hinman,1997,no page numbering)

People with integrity also have a clear vision of what is right and what is wrong.Their world is not the murky world of thoughtless and easygoing relativism, buta world that is sharply illuminated by the light of their vision of goodness. Andadded to this clarity of vision is the strength of will to act of the basis of thatvision. They see what is right, and they stand up for it, even when the personal

cost is high. (Hinman,1997,no page numbering)

Dick et al. (2003) identified four reasons based on which a student may decideto cheat: Sensitivityas the ability to interpret a moral situation, judgementas theability to determine if a certain action is correct or not, [self-]motivation as theinfluence of internal values, character as the ability to resist pressures to performan immoral act.

As an extension to the previous model, Dick et al. provide a model of studentcheating decision based on internal factors (personal domain) and the external onesas shown in figure2.2. Technologyis in this context seen as the enabler of differentpossibilities, cheating among other. Societal context refers to e.g. influence of a

students peer group, family, media, role models, culture, etc. Situational contextmay include e.g. heavy or irrelevant course load, inadequate teaching, difficult as-signments, lack of environment control from the examiners or proctors, some sortof dependence on passing the examination, etc. Demographic factorsincluding age,gender, marital status, socioeconomic status, ethnicity, religiosity. (Dick et al.,2003)

Diekhoff et al. (1996), OLeary (1999) and McCabe et al. (2006) discuss rela-tionships between cheating and cheater properties such as age, gender, cultural,educational or professional background, etc. For instance in environments wherewords are perceived as belonging to society more than belonging to individual,cheating tends to be perceived as more acceptable and hence, more commonplace(OLeary,1999).

The importance of performing well on examination, and hence increased fear-

11


22/120

based cheating pressure evoked by conditions with high student population andgrading strongly affecting an individuals future career, also tends to result in highercheating rates among students (Howell et al., 2009). Opposed to that, dominantly

intrinsically motivated students (those with dominant mastery goal orientation),show less cheating behavior than their dominantly performance goal oriented ordominantly neutral peers (Rettinger & Kramer,2008).

According to Whitley & Keith-Spiegel (2002), there are five norms, which areusually not perceived as academically dishonest by students: (1) Students may studyfrom old tests without explicit permission (as long as the tests are not stolen),(2) taking shortcuts such as reading condensed books, listing unread sources inbibliography, and faking lab reports is permissible, (3) unauthorized collaborationwith others is fine, especially when helping friends, (4) some forms of plagiarism suchas omitting sources and using direct quotations without citation are acceptable, (5)conning teachers by faking excuses for missing deadlines and so, is permissible. Such

misconceptions make students more leaned towards the respective cheating withoutrealizing the seriousness of it.

On top of that, Wehman (2009) has identified that fear of negative teacherevaluations and student morals and habits back from years ago are topics related tothe cheating problem.

Students often know that they are conducting an immoral activity when cheating.As summarized by Whitley & Keith-Spiegel (2002) and corresponding with TPB,theory of cognitive dissonance (Aronson, 1969) and neutralization theory (Harris& Dumas, 2009), students justifications for academic dishonesty (seemingly beingapplicable to any kind of consciously immoral activity in general) can includedenialof injury (it doesnt hurt anyone), denial of personal responsibility(I got sick and

couldnt read the stuff), denial of personal risk (they cant punish me anyhow),selective morality (I only cheat to pass the classes, or friends come first, theyneeded help), trivializing (minimizing seriousness) (the assignment has a littleweight in final grade),a necessary act(if I dont do well, my parents will kill me),and dishonesty as a norm (everyone does it).

Another argument placing cheating into a more acceptable light is that cheating,and more specifically plagiarism, versus collaborative spreading of knowledge, seemto be a bit conflictive and fuzzy in borders:

There is a certain unambiguity about when collaborating in learning commu-nity to extend knowledge and understanding stops and submitting only yourown work starts. (Le Heron,2001,p. 3?)

Le Heron(2001) also says the following regarding student expectations:

Student expectation is that their study will qualify them for a high paying job.Many are mature students re-training and in order to re-join the workforcequickly they often take more papers than they can cope with. Some studentshave the expectation that will pass because they have paid reasonably high fees.(Le Heron,2001, p. 245)

Extensively interviewing six first-year masters students from three different pro-grams at a university,Love & Simmons(1998) identified a set of factors correlatedto plagiarism behavior, which are divided into several groups based on character of

the factors: mediation character (inhibiting vs. contributing), factor type (internal

12


23/120

Mediation Type Effect Factor

Inhibiting

Internal Positive

Personal confidencePositive professional ethics

Fairness to authorsDesire to work or learnFairness to others

Negative Fear of detection consequences

Guilt

External

Professors knowledgeProbability of being caughtTime pressureCheating perceived as dangerousType of work requiredNeed for knowledge in the future

Contributing

Internal Negative personal attitudesLack of awareness

Lack of competence

External {Grade, time, task} pressure

Professor leniency

Table 2.1: Factors correlated to plagiarism behavior according to Love & Simmons(1998)

vs. external), and emotional effect (positive vs. negative). Those are summarizedin table 2.1. The set of factors is further extended by theoretical summary ofOlt(2007) andMegehee & Spake(2008) as summarized on table 2.2 according to theapprehension of the author of this thesis. Although the authors focus on plagiarismbehavior, the results seem to have partial relevance to cheating in general.

As an addition to the tables, Iyer & Eastman (2008) found that perceptionsof low social desirability at students are directly correlated to the amount of theircheating behavior.

In form of an extended application of TPB, figure 2.3 graphically summarizescauses of cheating and the expected benefits as one of cheating factor groups.

13


24/120

Mediation Type Factor

Inhibiting Internal Academic achievement

Age

Contributing

Internal

Difficulty seeing marks of plagiarismDisorganizationCryptomnesiaFear of failureProcrastination and lazinessSense of alienation

Thrill seekingSocial activitiesCheating rationalizationAbsenteeism

External

Unrealistic assignmentsAmbivalence of faculty and administrationBenefits outweigh risksCompetition (jobs and graduate school)Devaluing assignment by the instructorEthical lapsesInformation overloadInstitutions subscriptions to market ideologiesInstructor bad exampleProminent bad examplesOpportunityPeer observationSocial networkingInstructors failure to keep pace with tech. advancesInstructors failure to rotate curriculumInstructors lenienceLack of trust between student and instructorPrevious cheating experience

Internal

Cultural backgroundGenderMarital status

Major

External Student perception of instructor

Testing environment

Table 2.2: My apprehension of factors correlated to plagiarism behavior according to Olt(2007)and Megehee & Spake(2008) those additional to table2.1

14


25/120

Fig

ure2.3:Modelofcheatingcausation(inspiredbyWhitley&Keith-Spiegel,2002)

15


26/120

Within an analogy between cheaters in the educational field and attackers inthe field of information security, as there are different types of attackers, theremight be similarly different types of cheaters. According to Whitman & Mattord

(2007), attackers have different motivations to intrude such as personal and socialstatus, the thrill of doing it, revenge, financial gain, ideology, industrial espionage,etc. Attempting to draw an analogy, cheaters might also cheat for different reasonssuch as a notion of personal gain (grades or other academic credit, personal orsocial status), providing oneself an additional layer of failure protection (althougha forbidden one), to accommodate oneself with a social environment, or simplypossessing a habit of cheating.

Although students are mostly believed to cheat for grades Cizek(1999), viewsand experiences on it may slightly differ, e.g. that cheaters mostly just want to passa course or an examination (Le Heron,2001).

To sum up this section, it seems that there wont be any existential emergency

for cheating intentions among students at least as long as we use the kinds of schoolsystems we use today. That could mean a very long time in the future well haveto keep combating cheating in one way or another. Besides, there are a number ofcheating correlates, which might make cheating a clue or a signal directed towardimproving other educational issues at an institution.

2.1.3 The mission: preventing cheating

In the history of education and assessment, a number of cheating prevention methodshave taken place. Each of those can be categorized according to its preventionapproaches or strategies.

Lawrence Hinman in Olt (2002) has identified three approaches to minimizingcheating:

The virtues approachseeking to promote students intrinsic motivation (self-motivation) to be honest and learn instead of cheating. It is a promotion-basedand deeply positively oriented approach.

The prevention approach seeking to eliminate or reduce cheating opportuni-ties and suppress elements of cheating culture. This is a neutrally orientedapproach not promoting, not deterring, just reducing the time-space to cheat.

The police approachseeking to detect and punish cheating in reaction to it.

This approach is based on punishment and deterrence (as described and dis-cussed by e.g. Carlsmith et al.,2002) in other words, the big brother style.

Inspired by the risk management terminology ofWhitman & Mattord(2008), all ofthe approaches can be seen as a form of cheating avoidance, the last one perhapsalso being partially mitigative.

Similarly,Olt(2002) has identified four basic strategies for minimizing academicdishonesty in online assessment. For the sake of more clarity, I assigned names tothose (in italics):

1. Environment control strategy. This strategy focuses on acknowledging the dis-

advantages of online assessment and finding ways to overcome them through

16


27/120

technical and operational means of perceiving and/or controlling the exami-nation environment.

2. Hardened assessment design strategy. This strategy focuses on effectively de-signing online assessment and the assignments (questions) in order to reducethe cheating-proneness.

3. Unique assignment strategy. This strategy focuses on the uniqueness of assign-ments or rather the correct answers to them by e.g. rotating or modifyingthe curriculum, so that e.g. sharing graded assignments or exams does nothelp cheaters much.

4. Integrity policy strategy. This strategy focuses on providing students with anacademic integrity policy in order to promote an integral environment (freefrom cheating).

In the field of combating plagiarism, Usick (2004) in Olt (2007) has created aplagiarism prevention model called Three-Rs model, which stands for (1) respectbetween instructor and student towards each other and the academic discipline, (2)relevancy in linking together the course matter with the real world matter in astudents perception, and (3)refresh-ing of the integrity policy awareness.

Within the area of information systems teaching,Le Heron(2001) tried to iden-tify countermeasures to cheating in plain paper-based examination. Those are: Oralexplanation of skillsin addition to writing a paper, oline performance consistencytest in addition to writing a paper, online skills testonly. In context of LeHeronsresearch, online skills test has rendered most effective in terms of all cheating detec-tion, provability and student skills verification, although it is potentially possible fora student to reuse a work completed by someone else at an earlier session. Anotherpoint is that online testing poses additional administration requirements such as reg-istering and identifying students, marking procedures, and securing the examinationprocess (Le Heron,2001).

Howell et al.(2009) has identified a number of ways used to combat cheating:

The Honor System, which builds on creating a honest and cheating-resistantatmosphere and culture.

Banning or controlling electronic devices.

Photo and/or government identification.

Physical biometric scanningsuch as fingerprinting and palm vein scanning.

Commercial security systemssuch as web camera or 360-degree camera surveil-lance systems, behaviometric (behavioral biometric) authentication and iden-tification systems, systems based on asking and getting answers to personalquestions gathered from a database.

Cheat-resistant computers using a highly restrictive computer environment,which allows students to more or less only write the exam using the computer.

Lawsuitsto fight companies and websites providing braindumps (answer sheets

in different forms), which is an approach mostly used by large corporations.

17


28/120

Computer-adaptive testing and randomized testing. Instead of having the samevariant of test for each examinee, rest of the test varies based on how one hasanswered the answered questions.

Statistical analysis [-based detection]. This includes different types of statisticalanalysis and forensic methods, among other behaviometrics used differentlythan for plain authorization or identification.

FollowingCizek(1999), Rowe(2004) and Deubel (2003), there are a few morecheating fighting ideas as e.g.:

Knowing the writing style of students before examining them to be able toeasier detect diction or writing style anomalies.

Planning for unexpected matters, which can occur when using information

technology, or simply examination operation in general. For instance, a studentcomputer may crash, or may be taken down intentionally. Similarly, studentsmay ask for using a bathroom or having a drink or a snack innocently, or inan attempt to realize fraudulent intentions such as cheating.

Entrapmentsuch as trying to plant fake tests in locations, where curious peoplesearching exam questions or answers are likely to find those. It is an analogyto honeypots in network security as discussed inWhitman & Mattord(2007).This method applied to education, however, seems to lay over the border ofprofessional ethics.

From a faculty-defensive point of view,Whitley & Keith-Spiegel(2002) inWehman(2009) list three conditions, which can make a faculty liable for student harm if afaculty member (1) makes a malicious false accusation, (2) discusses a cheating caseand uses a students name together with individuals not involved in the case reso-lution, and (3) violates a students right to due process by ignoring the institutionsprocedures for resolving academically dishonest accusations. Wehman (2009) alsoidentified reasons why faculty personnel does not always take action in response todetecting cheating, the latter the less frequent: being aware that nothing would haveprevented the faculty from acting, being afraid of inability to prove the case, stu-dent denial of the incident, it would be too time consuming to pursue, being afraidof law suits, having feared hassle faced from administration, student negotiated agood excuse, being lazy, being afraid that management skills would be perceivedas lacking, knowing that student was making decent progress in the course, beingafraid of student violence, being afraid of damaging relationship with the student,and identified cheating after a grade was given to the student. That is to say thatthere are a lot of hinders in proceeding from cheating detection to reaction for thosewhich have the interest or responsibility to do so.

Finally, Dick et al. provide a recommendation:

An ounce of prevention is worth pound of cure deterring cheating is farmore effective than detecting and punishing cheating due to the costly natureof formal responses to cheating, so academic should focus their time and energyon pre-empting cheating rather than detecting cheating. (Dick et al., 2003,p.

182)

18


29/120

In conclusion, there seems to be quite a number of different means to fightcheating, however and as seemingly generally valid, no silver bullets that simplyfix it all alone. According to what was summarized, an educational institution

needs to employ a broad range of approaches and methods to be effective in thisprocess. Omitting one or more approaches as e.g. focusing on detection, reactionand deterrence only, while not cheat-proofing the environment and/or building anintegral culture, might not work very well, especially in the long run. Althoughthis study primarily aims at the police approach, this section was also meant tomention that this approach needs some complementary support, since it is itself tooincomplete to rely on as the only one.

2.1.4 How do students cheat?

In my point of view, to answer the question how does cheating occur is required in

order for cheating detection methods to be developed. Since providing a compre-hensive list of cheating methods would be vast, yet not directly useful for the study,this section tries to categorize the methods by their operational similarity, instead.

First of all, the word examinationmight be mostly associated with a typical longand extensive individually written examination at the end of a course. There are,however, different types of examination, or assessment in general. Kim et al.(2008)lists several from available literature (described below) and compares their usageat three different programs at a university. According to assessment type, thereis formative assessment (assessment of learning experience progress; continuous,ongoing assessment and feedback), and summative assessment (measuring learningat the end of the process; traditional tests). Besides, assessment can be catego-

rized based on individuality to individual assessment (e.g. personal assessment,self-assessment), and team assessment (e.g. assessment in collaborative learning).According toassessment instrument or method, there are paper or essay (e.g.student papers and reports), exam, quiz or problem set (e.g. conventional tests,proctored testing, midterm and final exams, self-tests),discussion or chat (e.g. on-line discussion, chat or e-mail), project, simulation or case study (e.g. authenticassessment, collaborative projects, case studies),reflection (e.g. meta-cognitive es-say), portfolio (e.g. electronic portfolio, portfolio essay), peer evaluations. Theseare different types of examination, presumably each prone to cheating in one wayor another, all to different extent.

Rowe (2004) identifies three main categories of cheating problems: (1) getting

assessment answers in advance, (2) unfair retaking of assessments, and (3) gettingunauthorized help during assessment. Those can be further broken into slightly moreitems for the sake of being more specific. Inspired byAirasian(2001),Cizek(1999),Stumber-McEwen et al.(2009),Howell et al.(2009),Rowe(2004),Dick et al.(2003)andFaucher & Caves(2009), the following categories of examination cheating canbe identified. Those are, however, still rather general, as chosen for the purpose ofthis study:

Using physical resources to cheat. This can occur in form of reading own orothers crib, desk or hand notes, papers, books, pieces of clothing or tissues,looking at other students work, or using steganographic methods (e.g. ultra-

violet light) to extract notes or other data protected respectively.

19


30/120

Using electronic resources to cheat. For example, using resources as notes,papers, e-books, web sites, old student work or old answer sheets from a com-puter network, computer, telephone or other electronic medium, which are not

allowed to use.

Using communication, which is not allowed. An example is talking to peers,listening to someone online or using a radio device, or other exchange of signalswith peers and anyone else besides the examiners and/or persons, with whomit is allowed in a specific way. Even talking to an examiner asking detailsabout a question as it was unclear, in order to get more information to figureout an answer to that one or some other question is, in fact, also cheating.

Using unauthorized intelligencesuch as obtaining answers or examination ques-tions in advance.

Impersonation, which means using someone else to take parts or whole exam-ination instead of the authentic person.

Fabrication of facts or measurements such as misreporting error of measure-ment, etc.

Corrupting examination integritysuch as changing answers when teachers al-low students to grade each others tests, or unauthorized access to the testsbetween being taken and being graded.

Process-level tricks such as using deceptive excuses, or unfair retaking of ex-

ams, and hence, training oneself for specific type of questions instead of ade-quately learning the study matter.

Social engineeringsuch as grade negotiation through exploitation of personalsympathy etc.

Organized cheating and faculty personnel corruptionsuch as bribing examiners,proctors, illegal infiltration of the grading process and other types serious fraud(it is in fact also a form of examination or grading process integrity corruption).

Plagiarism, which means using parts of someone elses work without givingadequate credit.

To sum up, there has been a number of different cheating categories identifiedacross the existing literature. Some of the categories cover tens or perhaps hundredsof specific cheating methods. Information about those together with fairly advancedcheating tactics can be read in Cizek (1999, chap. 3). For the purpose of thisstudy, however, describing those detailed seems to be marginally important, sincenew technologies are being invented, and cheaters keep on modifying the existingways to cheat and finding new ones all the time.

Methods used to cheat on tests are like snowflakes: There is an infinite numberof possibilities. The possibilities are, however, related to the type of testing

being considered. (Cizek,1999, p. 37)

20


31/120

Many forms of exam-time cheating seem to have a common denominator ob-taining information from disallowed sources to give correct answers without havinglearned the subject matter (reading, hearing, etc.), or letting someone else answer

instead of the authentic person. The rest of cheating types seems to require longertime or other than exam conditions to set up, and hence, it is of marginal interestfor this study.

2.1.5 Detecting cheating as a means of prevention

One of the strategies in the mission of preventing cheating is deterrence throughdetection and response. As discussed previously, in order to respond, one mustdetect first. There are a number of approaches to detection of different kinds ofcheating. The following list tries to identify those based on existing literature suchasCizek(1999),Howell et al. (2009) orRowe(2004):

Checking for identitythat it is the authentic person who is being examined.

Checking for forbidden toolssuch as crib notes, electronic devices, etc.

Using examination proctors, who manually observe an examination environ-ment. For more completeness, those can also be undercover proctors acting asbeing examinees or indifferent individuals during an examination.

Automated surveillance systems, which in different ways monitor students dur-ing examination.

Plagiarism detection systems and Internet searches, which try to detect collu-

sion between students, cut-and-paste plagiarism, and the usage of paper mills(old paper databases) by e.g. searching in those and searching the Internetfor similar texts among everything freely accessible and indexed by the searchengines (such as Google).

Statistical analysis methods, most of which analyze parameters of student re-sponses to examination assignments or questions and the similarities of those ina group. Besides that, statistical methods can also address different measuresof human behavior.

Possibly alsoauditing and intra-organizational intelligence1, which can be usedfor combating e.g. personnel corruption.

Similarly,Harris(2009) identified some strategies of detecting plagiarism: Look-ing for clues, knowing the possible sources of a suspect paper and/or searching for thepaper online, using a plagiarism detector system, which can automate the previous.Further regarding the clues, the following examples are mentioned: Mixed citationstyles, lack of references or quotations, inconsistent formatting, off topic elements,signs of datedness such as lack of recent sources from a certain year, anachronismssuch as referring to long past events such as they were current or recent, anomaliesand inconsistencies in style (vocabulary usage, rhetorical structure, punctuation,spelling, layout, etc.), and smoking guns such as e.g. text (Thank you for using

1

This item has been added by the author and it is not mentioned in the literature cited herein

21


32/120

TermPaperMania), inconsistently embedded links (URLs) and other forms of directand apparent plagiarism evidence (Harris,2009).

Additionally,University of Alberta Libraries(2009) identifies a clue that if a sub-

mitted paper exceeds students research or writing capabilities, or has an anomaloustone (too professional, journalistic or scholarly), or simply somehow largely exceedsexpectations from the student, it might signalize plagiarism or some other form ofcheating.

Within cheating detection based on personal vigilance, Dick et al. identify tech-niques as careful scrutiny, eye inspection, hand analysis, observation, and patternspotting. Three comparisons commonly made are

(1) across the students looking for similarities of submissions, (2) within anindividual assessment looking for changes in style or unusual ideas, (3) withprevious work by the same student looking for dramatic changes in quality.(Dick et al.,2003, p. 181)

As an important note and also relevant to this study, Cizek(1999) points out thedifficulty and pitfalls of taking probabilistic evidence as sufficient to prove cheating.Although the class of statistical cheating detection methods seems to be the mostpromising regarding power and availability, the methods may function rather as anindicator and deterrent than a tool providing strong evidence alone. Another fact isthat Cizek focused on statistical methods of analyzing examination answers, whichdo not take eventual measures during the examination process, building on suchassumptions as e.g. that the methods cannot detect use of cheat sheets (crib notes),impersonation, electronic communication, etc. In contrast, this study is hoping toshow the opposite.

2.1.6 Cheating review summary

This part tries to summarize what was reviewed about examination cheating in thissection so far and how it is perceived by the author. It is complemented by figures2.4and2.5.

In the very narrow goal context of attaining an examination pass (or a scorehigh enough), cheating simply renders as a highly viable strategy. As such, it isprobably often going to be chosen by students as well as its high performance isprobably often going to be confronted with the ideals of morality, ethics, principlesof academic integrity and productivity at both personal and societal level. Those

seem to be facts one can not do much about. On the other hand, within cheatingprevention in terms of its preemption, one can try to change the parameters of somestudent decision making processes by e.g.:

Strengthening the idealsof morality and ethics, or the perception of academicintegrity principles so that they outweigh cheating incentives in the processof cheating consideration. An example way to accomplish this is the use ofacademic integrity programs.

Broadening the perceived goal contextby e.g. making students understand whyand how it is beneficial for them to all (1) learn the study matter properly, (2)

not getting caught cheating because of its probable consequences, and (3) not

22


33/120

contributing to spreading of the cheating culture. This can also be a goal ofan academic integrity program.

Limiting both challenges and possibilities of cheating by e.g. course, assess-ment and assessment environment design optimization. The optimization itselfseems to be a non-trivial task, which needs to address a number of differentrelations between (1) cheating incentives, (2) their factories inside a studentmind and (3) the extrinsic arousal of those.

Increasing the risk (penalty and probability) of being caught upon cheating bye.g. hardening consequences of being detected cheating and increasing cheatingdetection capabilities.

Cheating itself can occur in a number of forms. Also thanks to the generally de-sired and deeply valued student inventiveness, the forms cheating effectively change

over time, which makes it both costly and inefficient to address detection and pre-vention of narrow cheating form groups one by one. Moreover, doing so can make thecounter-cheaters at best a couple of steps behind the cheaters. Regarding cheatingdetection, there are efforts to develop more effective methods capable of detecting abroader and more general range of cheating forms, i.e. through applying automatedstatistical analysis to different measures of human behavior.

Last and not least, in the ways of both detecting and preventing cheating, thereare hinders and limits of different kind ranging from misalignment between thecounter-cheating and administrative, through fear from reporting cheating, up topolitical unsuitability of e.g. cheating detection methods.

23


34/120

Figure 2.4: Graphical overview of cheating and counter-cheating relations

24


35/120

Figure2.5:Overviewofac

heatingandcounter-cheatingprocess

25


36/120

2.2 Specifics of distance operation

There is no doubt about the great accessibility advantages and freedom in the choice

of study tempo the concept of distance work provides. On the other hand and withinsome reflection, the distance mode of operation could affect at least the followingaspects compared to the conventional one:

The study/examination environment and the student perception of it. A dif-ference between on-site and distance study/examination environment seemsto be apparent. On-site students can attend school sessions together withpeers in an environment with a strongly academic feel, walking or travel toschool, attend lectures seeing peers and lecturers, and often feel as being apart of a student community sharing similar goals together with others whoare physically near. One can have a lunch and talk to peers, study togetherand cooperate on assignments face to face, etc. Distance students attend

school sessions from behind a computer screen, seeing and hearing peers andlecturers on a videoconferencing tool, reading course matters from a remotelearning management system and rather seldom having a computer-mediatedpeer discussion (Paulsen,2001), perhaps physically alone for most of the time.Independently from whether one is in some ways superior or inferior to theother, there are certainly many differences between how an on-site student anda distance student can perceive and feel about their studies. Similarly the dif-ference seems to apply to the examination process. Sitting in a controlled roomwith an adequate surveillance feels certainly different from sitting in ones of-fice or living room having a microphone and webcamera with a constant andlimited angle of sight on.

The possibilities and capacities of communication channels among studentsand between students and teachers. One can surely e-mail or call a peer or ateacher independently from whether one is an on-site or a distance student.The difference might come if one wants to discuss a topic face to face, simplybecause it could under some circumstances be more effective. (Paulsen,2001;Stumber-McEwen et al., 2009) A question is if a videoconferencing tool canbe a sufficient replacement for a physical meeting (see Media SynchronicityTheory byDennis & Valacich,1999) for all types of students not only in termsof plain words being said, but also how they are being said and heard, how bothcommunication parts perceive the atmosphere, how close do they feel toward

each other as people, and more in general, what is the overall enjoyabilityof such meeting compared to a physical meeting, not forgetting a range ofmotivational factors and cheating correlates possibly involved - such as thosementioned earlier in the text (e.g. tables2.1and2.2). Paulsen(2001) presentsan empirical study about distance student perspectives in Norway, stating thatthe usage of electronic discussion forums is weak and while communicationwith teachers is mostly perceived as satisfactory, communication among studypeers is mostly seen as lacking.

The level of examiner perception and control of the examination environment.The ability to control the environment, or at least to perceive and detect differ-

ent activities of examinees or students, changes from conventional to distance

26


37/120

environment and mode of operation (Rowe,2004). On a conventional examina-tion, an examiner can often see parts of the classroom from different angles andalso hear what is happening. Although this could be possible within a distance

examination as well, it could require rather special surveillance equipment forstudents, which comes with a cost to obtain and operate. Yet a different typeof problem is the analytical capacity of such detection systems - does it justrecord data (e.g. voice, video, keystrokes, etc.) and make the actual detectionof tens or hundreds of students up to a human, or can it operate automatedly?

The behavioral distance between acceptable operation and cheating. In otherwords, how much syntagmatic behavioral difference there is between the two.

The level of cheating possibilities. Provided that an environment is largelyuncontrolled and unperceived by the examiners, how and how well can onekeep students away from cheating?

Indirectly the extent to which employers accept distance degrees. The publictrust in and employee acceptance of distance degrees seems to be smaller com-pared to conventional degrees (Columbaro & Monaghan,2009;Bourne et al.,2005;Allen & Seaman,2003). Although it might be tricky to identify the rea-sons for this mistrust, some of them could presumably be related to differentassumptions about quality limits of distance education, cheating in distanceassessment, or simply doubts about a nonstandard and unconventional way ofstudying.

The intention with these lines is not to mark one of the two environments as superior

or inferior to the other. It is to signify that an environment may have practicallybeneficial advantages, while at the same time, it may have practical disadvantages,some of them in form of threats.

A different and more friendly view toward the concept of distance education isthat it best suits adults in need of additional or continued education, who cannotafford an interruption from their job (Paulsen & Rekkedal, 2001). Moreover, com-pulsory time-bound sessions have been shown as dramatically reducing applicationinterest of this type of students (ibid).

Regarding statistics and comparison between cheating among on-site and dis-tance students, there are a couple of studies showing varied results (Stumber-McEwenet al., 2009; Herberling, 2002; Watson & Sottile, 2010). Some of them state that

distance students cheat more, some of them state the opposite. Let this be anyhow,according to the results presented, distance students cheat as well as their on-sitecounterparts do and that seems to be a good reason to find ways of reducing thatmatter.

27


38/120

28


39/120

Chapter 3

Conceptual framework

This chapter identifies important theoretical concepts related to cheating detection

in context of this study. Those include cue leakage theory, pattern recognition theory,anomaly detection, and behaviometrics. Finally, my vision of a cheating detectionapproach binds them by outlining the approach, and the vision gets related to aspecific goal through the summarized theory on examination cheating.

3.1 Cue leakage theory

Cue leakage theory is a concept based on the fact that when someone performs anactivity, the person tends to unconsciously leave cues about the activity being per-formed. Perhaps the most common example is lying, which leaves different cues,

many in form of muscular activity such as facial gestures (Ekman,1985). Althoughthe process of leaving cues is to some extent deliberately controllable (ibid), it isquestionable whether one can hide all respective cues when e.g. lying to another per-son face to face. Generalized, the concept applies to the field of deception deception(DePaulo et al., 2003;Anolli et al.,2001), recent research in which also focuses onthe electronic (computer-based) and networked environment, specifically text-basedasynchronous computer-mediated communication (TAC) (Zhou et al., 2003, 2004;Zhou, 2005; Adkins et al., 2004; Fuller et al., 2006; Lee et al., 2009). Althoughdeception detection is not directly used in this study, linguistic features used in thestudy are inspired or taken from studies related to deception detection in TAC.

Speculatively extending the theory further, cue leakage does not only apply to

deception activity, in context of which it is mostly spelled. Assumedly, it applies toany process or activity conscious or unconscious. Moreover, it assumedly appliesto all systems, not only humans. In example, an attacked computer system ornetwork often behaves in an anomalous way during an active intrusion and thereoften remains evidence of the intrusion afterwards (Whitman & Mattord,2007). Inanother example, decreasing morale of a football team (a social system) leaves cuesbased on which one can often notice the matter with or without any words flowing.Even in another example, a dog having knowingly performed something undesirableoften behaves differently than usually by gaze, facial gestures, movement, etc.Those are all cues, each bearing a meaning, which strengthens by combination.

Finally applied to education, one can expect the very same concept to apply

as well. A student constructing sentences and subsequently writing these using a

29


40/120

Figure 3.1: A classification example

keyboard should well have different keystroke dynamics and/or text diction than thesame student rewriting text from a book, which is written by someone else havingdifferent language habits.

3.2 Pattern recognition theory

Pattern recognition theory is a theory based on a scientific discipline called patternrecognition. The aim of pattern recognition

is the classification ofobjectsinto a number of categories or classes. (Theodor-

idis & Koutroumbas,2006)

Those objects are generically referred to as patterns (ibid).Nowadays, pattern recognition is broadly used in fields of e.g. automated decision

making, optical character recognition, speech recognition, computer-aided diagnosis,and so on (Theodoridis & Koutroumbas,2006).

The measures used for classification are known as features. Generally, there is aset of features for each classification problem, which form a classification vector

x= (x1, x2, . . . , xn) (3.1)

wheren is the number of features considered. A single classification vector identifies

a single pattern (object) (ibid). Based on a specific recognition problem, differentfeatures can be used, i.e. spatial coordinates (position), time, latency, color, speed,volume, radiation intensity, etc. An example is outlined in figure 3.1, where thefeature vector consists of two features (x1and x2), based on which patterns (objects)are classified to four classes. Those classes can be disjunct as well as they can overlap.

Usually, the nature of practical pattern recognition problems is fairly complexand multivariate, and it is not possible or viable to define classes precisely accordingto specific criteria. Therefore, classes are usually defined approximately and classifi-cation mechanisms oftenmisclassifypatterns according to the intended classificationcriteria.

Theodoridis & Koutroumbas(2006) have identified two major types of pattern

recognition:

30


41/120

1. Supervised pattern recognition, which operates based on a priori known clas-sification information. Such classifiers can either be designed with a model ofthe classification problem, or they can be trained by training feature vectors

before they classify inputs.

2. Unsupervised pattern recognition, which is just given input patterns, and thoseare subsequently clustered to groups based on similarities within the set ofinput patterns.

According toHuang(2006), Thomason(1990) andJain et al.(2000), there arefive approaches to pattern recognition: (1) template matching (the simplest one),(2) decision-theoretic (Jain et al.,2000), (3) syntactic-structural (Thomason,1990),(4) functional (Huang,2006), and (5) neural network based.

3.3 Anomaly detectionAnomaly detection seems to be an important concept for methods and technologyrelated to different fields including biometrics or intrusion detection, especially whenhaving profiles to which subject measures are matched. In short,

anomaly detection refers to the problem of finding patterns in data that donot conform to expected behavior. These nonconforming patterns are oftenreferred to as anomalies, outliers, discordant observations, exceptions, aberra-tions, surprises, peculiarities, or contaminants in different application domains.Of these, anomalies and outliers are two terms used most commonly in thecontext of anomaly detection; sometimes interchangeably. Anomaly detectionfinds extensive use in a wide variety of applications such as fraud detection for

credit cards, insurance, or health care, intrusion detection for cybersecurity,fault detection in safety critical systems, and military surveillance for enemyactivities. (Chandola et al.,2009, p. 15:1)

Applied to distance examination, an example of anomalous behavior could be abehavior indicating that a student is copying text from somewhere while workingon a task with no reading allowed.

Chandola et al. (2009) did a survey on techniques and application domains inthe area of anomaly detection, and also drew a general summary about the field.Applications of anomaly detection cover at least (1) cyber-intrusion detection, (2)fraud detection, (3) medical anomaly detection, (4) industrial damage detection, (5)image processing, (6) textual anomaly detection, and (7) sensor networks (ibid).

Within the concept of anomaly detection, three types of anomalies are used(Chandola et al.,2009):

Point anomaly having a collection of data, from which an individual datainstance is anomalous with respect to the rest of the data.

Contextual anomaly, also called conditional anomaly if a data instance isanomalous based on a specific context (conditions). Detecting this kind ofanomaly requires one to have contextual (environmental) attributes to definea context, andbehavioral (indicator) attributesto define normal or anomalousbehavior and detect an anomaly. Contextual attributes can be defined as

spatial,graphs,sequential, or profile.

31


42/120


43/120

This section will first describe common aspects of biometrics in general, then thespecifics of behaviometrics, and finally continue describing selected behaviometricmethods, which are of interest for this study.

3.4.1 Biometrics in general

Characteristics as face, voice, body figure, color, motorics, etc. have been naturallyused for recognition among animals and humans since ages ago. Recently, peoplestarted to use those also officially for police and forensic use, starting by body mea-surements and later also fingerprints (Jain et al.,2004). Nowadays, those methodsare mostly automatedly used for a wide range of purposes including the govern-mental, forensic, military, healthcare, commercial and academic, yet those are notlimited to security and access control.

The term biometrics refers to the usage of pattern recognition techniques to

measurable physiological or behavioral characteristics (Gamboa & Fred,2004;Jainet al., 1999, 2004). Hence, biometrics can be divided into two major groups: (1)

physiological biometricsand (2)behavioral biometrics, each measuring the respectivetype of characteristics (Gamboa & Fred,2004;Shanmugapriya & Padmavathi,2009).

Biometrics identify people by measuring some aspect of individual anatomy orphysiology (such as your hand geometry or fingerprint), some deeply ingrainedskill or behavior (such as your handwritten signature), or some combination ofthe two (such as your voice) (Anderson,2008, p. 457).

Within the field of information security, it is possible to authenticate or identifya person based on four groups of information, according to Whitman & Mattord

(2008):

What a person knowssuch as an alphanumeric code or a combination of username and password.

What a person hassuch as a key, file, magnetic card, integrated chip card, orsome other authentication token.

What a person is, which in fact more precisely means what a person seems tobe based on physiological characteristics such as a fingerprint, iris or retinalpattern, DNA etc.

What a person producesincludinghow a person produces it (or behaves) such asvoice, signature pattern, gait, keystroke dynamics, and other types of behavior.

The following are the properties desirable for a biometric method working witha set of personal characteristics, inspired byJain et al.(1999):

Universalitymeaning that at best nearly everyone possesses the characteristics(exceptions always tend to occur).

Uniquenessmeaning that no two different persons are equal in terms of thecharacteristics.

Permanenceas the time invariance of the characteristics at a person.

33


44/120

Collectability as the quantitative measurability of the characteristics, oftenincluding its cost (not necessarily monetary).

Performanceas both the effectivity and efficiency of the method in terms ofits accuracy and resource demands.

Acceptabilityas the extent to which people (including the public) are willingto accept the use of the method.

Circumventionas the ease of deliberately fooling a system based on the be-haviometric method. Often, in order to keep this level low, one has to protectthe confidentiality (Whitman & Mattord,2008) of biometric profiles well.

Biometric methods and systems usually rely on three types of usage operationaccording toJain et al.(2004):

Enrollment, which measures a subject for the first time, extracts features fromthe measurement, creates a biometric profile containing the measurement-based features and stores the profile in a database.

Authentication, also callednegative recognition, which validates the authentic-ity of a subject according to a given biometric profile and the subject measures.

Identification, also calledpositive recognition, which tries to identify a subjectaccording to a set of biometric profiles and the subject measures.

Although not found in the literature, biometric methods can also identify patternswithin the subject measures, both dependently or independently from a biometricprofile. An example of such special application is automated stress measurement(Vizer et al.,2009).

Within the operations mentioned above, four main groups of errors can occur,according toPeacock et al.(2004),Gamboa & Fred(2004) andJain et al.(2004):

Failure to capture (FTC), also called failure to acquire, when a system failsto take subject

cheating in online exam

Documents