Developing a online exam application, how do I prevent cheaters?

I have the task of developing an online examination software for a small university, I need to implement measures to prevent cheating...

What are your ideas on how to do this?

I would like to possibly disable all IE / firefox tabs, or some how log internet activity so I know if they are googling anwsers...is there any realistic way to do such things from a flex / web application?

From stackoverflow mmattax

• Randomize questions, ask a random set of questions from a large bank... time the answers...

  Unless you mean hacking your site, which is a different question.

  From Ben Scheirman

• Short of having the application run completely on the user's machine, I do not believe there is a way to make sure they are not google-ing the answers. Even then it would be difficult to check for all possible loop-holes.

  I have taken classes that used web based quiz software and used to work for a small college as well. For basic cheating prevention I would say randomize the questions.

  From Ryan Lanciaux

• I'd probably implement a simple winforms (or WPF) app that hosts a browser control in it -- which is locked in to your site. Then you can remove links to browsers and lock down the workstations so that all they can open is your app.

  This assumes you have control over the workstations on which the students are taking the tests, of course.

  From Guy Starbuck

• Simply put, no there is no realistic way to accomplish this if it is an online exam (assuming they are using their own computers to take the exam).

  Gastoni : There is no way to prevent cheating if you allow me to use my own computer. I can always use a virtual machine that will bypass any restrictions you put on a browser.
  From pix0r

• Will they always take the test on test machines, or will they be able to take the test from any machine on the network? If it will be specific machines, just use the hosts file to prevent them from getting out to the web.

  If it is any machine, then I would look at having the testing backend change the firewall rules for the machine the test is running on so the machine cannot get out to the interwebs.

  From EBGreen

• Try adding SMS messages into the mix.

  From jdelator

• Is opening the browser window full screen an option? You could possibly also check for the window losing focus and start a timer that stops the test after some small period of time.

  bdonlan : At which point I hit ctrl-alt-f1 and go to the text console, without the browser ever losing focus...
  From Chuck

• As a teacher, I can tell you the single best way would be to have human review of the answers. A person can sense copy/paste or an answer that doesn't make sense given the context of the course, expected knowledge level of the students, content of the textbook, etc, etc, etc.

  A computer can do things like check for statistical similarity of answers, but you really need a person for final review (or, alternatively, build a massive statistical-processing, AI stack that will cost 10x the cost of human review and won't be as good ;-))

  From Ben Collins

• No, browsers are designed to limit the amount of damage a website or application can do to the system. You might be able to accomplish your goals through Java, an activex control, or a custom plugin, but other than that you aren't going to be able to 'watch' what they're doing on their system, much less control it. (Think if you could! I could put a spy on this webpage, and if you have it open I get to see what other websites you have open?)

  Even if you could do this, using a browser inside a VM would give them the ability to use one computer to browse during the test, and if you could fix that they could simply use a library computer with their laptop next to it, or read things from a book.

  The reality is that such unmonitored tests either have to be considered "open book" or "honor" tests. You must design the test questions in such a manner that references won't help solve the problems, which also means that each student needs to get a slightly different test so there is no way for them to collude and generate a key.

  You have to develop an application that runs on their computer, but even then you can't solve the VM problem easily, and cannot solve the side by side computers or book problem at all.

  From Adam Davis

• Thanks for all the responses, I do not know all of the details, but I am assuming that I will not have control over the target machine...therefore it needs to be platform agnostic and web based.

  I am already planning to have timing features and randomized order of questions...

  From mmattax

• I agree with Adam, that even with the limitations that I suggested, it would still be trivial to cheat. Those were just "best effort" suggestions.

  From EBGreen

• Your only hopes are a strong school honor code and human proctoring of the room where the test is being given.

  As many other posters have said, you can't control the student's computer, and you certainly can't keep them from using a second computer or an iPhone along side the one being used for the test -- note that an iPhone (or other cellular device) can bypass any DNS or firewall on the network, since it uses the cellular provider's network, not the college's.

  Good luck; you're going to need it.

  From David Singer

• Random questions and large banks of questions help. Randomizing even the same question (say changing the numbers, and calculating the result) helps too. None of these will prevent cheating though.

  In the first case, if the pool is large enough, so that no two students get the same question, all that means is that students will compile a list of questions over the course of several semesters. (It is also a ton of work for the professors to come up with so many questions, I've had to do it as a TA it is not fun.)

  In the second case, all you need is one smart student to solve the general case, and all the rest just take that answer and plug in the values.

  Online review systems work well with either of these strategies (no benefit in cheating.) Online tests? They won't work.

  Finally, as for preventing googling... good luck. Even if your application could completely lock down the machine. The user could always run a VM or a second machine and do whatever they want.

  From Rob Rolnick

• My school has always had a download link for the Lockdown browser, but I've never taken a course that required it. You can probably force the student to use it with a user agent check, but it could probably be spoofed with some effort.

  Proctored tests are the only way to prevent someone from cheating. All the other methods might make it hard enough to not be worth the effort for most, but don't discount the fact that certain types of people will work twice as hard to cheat than it would have taken them to study honestly.

  Stephan Eggermont : excuse me, can i use that on a virtual machine? Zero security

  PanJanek : Virtual machine (for advanced cheaters) or even simpler: another computer standing next to my.
  From Ben Robbins

• Ban them from using any wireless device or laptop and keylog the machines?

  From $pageUsers[$post.author].name

• Since you can't block them from using google, you've got to make sure they don't have time to google. Put the questions in images so they can't copy and paste (randomize the image names each time they are displayed).

  Make the question longer (100 words or more) and you will find that people would rather answer the question than retype the whole thing in google.

  Give them a very short time. like 30-45 seconds. Time to read the question, think for a moment, and click either A, B, C, D, E,

  (having just graduated from CSUN I can tell you scantron tests work.)

  For essay questions? do a reverse google lookup (meaning put their answer into google as soon as they click submit) and see if you get exact matches. If so, you know what to do.

  From Christopher Mahan

• You could enforce a small time window during which the test is available. This could reduce the chance that a student who knows the answers will be free to help one who doesn't (since they both need to be taking the test at the same time).

  If it's math-related, use different numbers for different students. In general, try to have different questions for different copies of the test.

  If you get to design the entire course: try to have some online homeworks as well, so that you can build a profile for each student, such as a statistical analysis of how often they use certain common words and punctuations. Some students use semi-colons often; others never, for example. When they take the test you get a good idea of whether or not it's really them typing.

  You could also ask a couple questions you know they don't know. For example, list 10 questions and say they must answer any 6 out of the 10. But make 3 of the questions based on materials not taught in class. If they choose 2 or 3 of these, you have good reason to be suspicious.

  Finally, use an algorithm to compare for similar answers. Do a simple hash to get rid of small changes. For example, hash an answer to a list of lower-cased 3-grams (3 words in a row), alphabetize it, and then look for many collisions between different users. This may sound like an obvious technique, but as a teacher I can assure you this will catch a surprising number of cheaters.

  Sadly, the real trouble is to actually enforce punishment against cheaters. At the colleges where I have taught, if a student objects to your punishment (such as flunking them on the test in question), the administration will usually give the student something back, such as a positive grade change. I guess this is because the student('s parents) have paid the university a lot of money, but it is still very frustrating as a teacher.

  From Tyler

• @Chuck - a good idea.

  If the test was created in Flash/Flex, you could force the user to make the application fullscreen in order to start the test (fullscreen mode has to be user-initiated). Then, you can listen for the Flash events dispatched when flash exits fullscreen mode and take whatever appropriate action you want (end the test, penalize the user, etc.).

  Flash/Flex fullscreen event info.

  blog.flexexamples.com has an example fo creating a fullscreen-capable app.

  From 81bronco

• The full screen suggestions are quite limited in their effectiveness as the user can always use a second computer or w/ multi monitor a second screen to perform their lookups. In the end it is probably better to just assume the students are going to cheat and then not count online tests for anything important.

  If the tests are helpful for the students they will then do better on the final / mid term exams that are proctored in a controlled setting. Otherwise, why have them in the first place...

  From Ben Childs

• Make the questions and answers jpeg images so that you cannot copy and paste blocks of text into a search engine or IDE (if it is a coding test). This combined with a tight time limit to answer each question, say three minutes, makes it much harder to cheat.

  From John Channing

• I second what Guy said. We also created a Flex based examination system which was hosted in a custom browser built in .NET. The custom browser launched fullscreen, all toolbars were hidden and shortcuts were disabled.

  Here is tutorial on how to create a custom browser with C# and VB.NET.

  From Christophe Herreman

• This will solve your problem. http://www.neuber.com/usermonitor/index.html This will allow you to view the student's browser history during and after the test as well as look in on their screen during the test. Any urls visited during test time will be logged, so you can show them the log when you put a big F on their report card. :)

  From Praesagus