A method for visualizing dynamic function calls

Abstract

The application discloses a dynamic function call visualization method, belongs to the technical field of information visualization, and specifically comprises the following steps: acquiring dynamic function call data; converting original data into hierarchical structure data with index information; determining function node layout and setting call edge attribute based on a breadth-first search algorithm; drawing a hierarchical function call overview; mapping a function call index interval to a node height; and drawing a fine-grained function call. The application provides a compact and left-aligned hierarchical function node layout method, provides an overview of binary and hierarchical information in a function call, and designs a graphic element on a function node, so that fine-grained function call timing information is displayed concisely and beautifully, and an analyst can quickly locate multiple occurrences of a call and efficiently identify a continuous or periodic call mode. The application can help the analyst to simplify a work flow and save working time.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of information visualization, and particularly relates to a dynamic function call visualization method. BACKGROUND

[0002] A computer program is a set of code instructions written by a programming language, which can be recognized and executed by a computer to achieve a specific purpose; a function is a reusable code segment with fixed functions; a program often calls several functions. Analyzing function call data generated during the dynamic running of a program can more directly understand the behavior intention and execution purpose of the program, which is an indispensable link in program understanding, program testing, vulnerability positioning, malicious file detection and other work.

[0003] Dynamic function call data mainly presents three characteristics: (1) binary, a function call involves a source function, i.e. caller, and a target function, i.e. callee; (2) hierarchy, function calls can be nested, i.e. one function calls another function, and another function calls another function, thereby forming a hierarchical structure; (3) time sequence, function calls occur in sequence, and sometimes there are continuous or periodic patterns of single function call or a group of function calls. When analyzing dynamic function call data, the binary, hierarchical and time sequence information needs to be comprehensively considered.

[0004] Viewing the original data of dynamic function calls is time-consuming and laborious, and visualization can help analysts explore more intuitively and friendly. However, traditional function call visualization methods, such as force-directed node-link diagram, heat matrix, orthogonal tree, ice column diagram, large-scale sequence view, etc., cannot comprehensively present the complete binary, hierarchical and time sequence information in function call data. Analysts usually need to coordinate multiple views to complete complex analysis tasks, which means that analysts need to master multiple visualization methods, and the analysis efficiency will be limited. In addition, traditional function call visualization methods also face problems in readability, comparability and scalability - force-directed node-link diagram may produce a large number of intersecting edges; the arrangement rules of functions in heat matrix greatly affect the comparison of different function call data; orthogonal tree and ice column diagram may have uneven space utilization; observing single function call in large-scale sequence view is easy to lose the target. Therefore, a dynamic function call data visualization method with good readability, comparability and scalability is needed to help analysts comprehensively explore the binary, hierarchical and time sequence information in function calls. SUMMARY

[0005] To address the shortcomings and deficiencies of existing technologies, the present invention aims to provide a visualization method for dynamic function calls that can simultaneously present binary, hierarchical, and temporal information in function call data, and has good readability, comparability, and scalability.

[0006] To achieve the above objectives, the technical solution adopted by the present invention comprises the following steps:

[0007] Step 1: Obtain dynamic function call data

[0008] Dynamic function call data consists of function call records generated during a single program execution. These records are stored in a table, with each record containing three fields: caller, callee, and index. The caller field stores the name of the calling function, and the callee field stores the name of the called function; both fields are of type STRING. The index field stores the index of the function call, and is of type INT. The value of the index field is then used to determine the function call's index. k A unique function call record can be determined, representing the (I)th function call during the dynamic execution of the program. k +1) The call is: the function in the caller field calls the function in the callee field;

[0009] Step 2: Convert the raw data into hierarchical data with index information.

[0010] Convert the raw data obtained in step 1 into hierarchical data; determine the parent-child relationship in the hierarchy based on the calling and called relationships between functions, merge the same calling edges under the same parent node, and record the index corresponding to the call occurrence.

[0011] Step 2.1: Initialize the set Funccall_set to record all call edge objects; traverse the dynamic function call records obtained in Step 1 in ascending order according to the index value, and regard the combination of caller and callee in each record as a call edge object caller|callee;

[0012] If caller|callee is not in Funccall_set, then add it to Funccall_set and record the corresponding attributes: caller, callee, and all call indices.

[0013] If caller|callee is in Funccall_set, then update the all_index attribute.

[0014] Step 2.2: Traverse Funccall_set to generate hierarchical data Hie_calldata with the program's entry function as the root node.

[0015] Step 3: Determine the function node layout and set the call connection attributes based on the breadth-first traversal algorithm.

[0016] Based on the hierarchical data Hie_calldata obtained in step 2.2, the layout is performed to generate the corresponding tree node array and edge array. The tree node array records each function node object, including basic attributes—function name, depth of the function node in the tree structure, and layout attributes—position on the canvas. The tree edge array records each edge object, including two basic attributes—source node object and target node object corresponding to the edge.

[0017] Function nodes are laid out in a hierarchical manner, extending from the root node to the leaf nodes from top to bottom, with the root node at the top. In addition, the layout is made compact and nodes are left-aligned, meaning that small gaps are maintained between different layers and small, equal gaps are also maintained between nodes in the same layer, extending from left to right. A connection is formed between the parent node and each of its child nodes. It is necessary to determine whether the connection is from the parent node to its first child node and record it as a boolean property isfirstLink in the connection object.

[0018] Step 3.1: Define the coordinates of a starting position (start_X, start_Y), the horizontal spacing between function nodes (node_spaceX), and the vertical spacing between nodes (node_spaceY). Initialize an array of function nodes (tree_funcnode) and an array of function call links (tree_calllink).

[0019] Step 3.2: Perform a breadth-first traversal on the hierarchical data `Hie_calldata` obtained in Step 2.2. This step is implemented using a loop, adding function node objects to the `tree_funcnode` array and function call link objects to the `tree_calllink` array. Based on the design principles of compact layout and left-aligned nodes, determine the position of the function node, where the depth is `d`, i.e., the `i`-th node `N` at the (d+1)-th level. (d,i) The x and y coordinates N_x on the canvas (d,i) , N_y (d,i) The calculation method is as follows:

[0020] N_x (d,i) =(start_X+(i-1)*node_spaceX)

[0021] N_y (d,i)=(start_Y + d * node_spaceY)

[0022] That is, the coordinates of the root node are the starting position coordinates defined in Step 3.2; the x-axis coordinate of the first function node in each layer is start_X, and the x-axis coordinate of the i-th node in any layer is (start_X + (i - 1) * node_spaceX); the y-axis coordinate of the nodes in the (d + 1)-th layer is (start_Y + d * node_spaceY).

[0023] In each call edge object, in addition to the source node -- parent node and target node -- child node of the call edge, it is also necessary to record whether the call edge is the edge from the parent node to its first child node: if so, the attribute value of isfirstLink is TRUE; if not, the attribute value of isfirstLink is FALSE.

[0024] Step 3.3: Since the entry function of the program is the root node and is located alone in one layer, to save space in the vertical direction, remove the root node object in the tree_funcnode array obtained in Step 3.2; remove the call edge object from the root node to its child nodes in the tree_calllink array obtained in Step 3.2; thus, the root node and the associated edges will not be drawn in the next step.

[0025] Step 4: Draw a hierarchical function call overview;

[0026] According to the tree_funcnode and tree_calllink obtained in Step 3.3, draw function nodes and call edges in layers; encode the function nodes as equal-sized squares, mark the function names inside the squares, and explicitly draw the call edges from the parent node to its first child node. The hierarchical layout can ensure the presentation of hierarchical information in the dynamic function call data, and the edges ensure the presentation of binary information.

[0027] Step 4.1: Define the side length of the square as node_size (node_size < node_spaceX and node_size < node_spaceY); define the mapping scale of the filling color of the square, that is, use the saturation of gray to map the frequency of function calls. The lighter the gray, the lower the frequency of the function being called by its parent node, and the darker the gray, the higher the frequency of the function being called by its parent node.

[0028] Step 4.2: Define the edge color as medium gray (#595959) and the style as an orthogonal polyline.

[0029] Step 4.3: Traverse the tree_funcnode obtained in step 3.3, and draw a function node with a side length of node_size at the corresponding position on the canvas, using the x-axis and y-axis coordinates of the function node as the top left corner of the square; determine the fill color of the function node according to the index number recorded in the all_index attribute value of the function node object; and display the function name in the center inside the square.

[0030] Step 4.4: Traverse the tree_calllink obtained in step 3.3, and determine the value of the isfirstLink attribute in the edge object. Only draw the edge if the attribute value is TRUE.

[0031] Step 5: Map the index range of the function call to the node height.

[0032] Since the nodes are of equal size and block-shaped, the node height is used as the time axis, and the index range of dynamic function call data is mapped to the node height to display fine-grained timing information of dynamic function calls.

[0033] Get the index range [0, I] of dynamic function call data max ] indicates that the function call data contains a total of (1+I max The height of the corresponding function node is node_size; the height allocated to each function call is h_singleIndex, calculated as follows:

[0034] h_singleIndex=node_size / (1+I max )

[0035] Step 6: Draw fine-grained function calls.

[0036] The primitive design on the function node uses a horizontal bar drawn at the corresponding height of the block and with the same width as the node to represent the timing information of the function corresponding to the block being called by its parent node; at the same time, the color of the horizontal bar is used to encode the type of the called function.

[0037] Step 6.1: Define the height of the horizontal bar as h_singleIndex calculated in Step 5; define the width of the horizontal bar as equal to the node side length, set to node_size; define the default color of the horizontal bar as dark gray; users can encode other types of information using the color of the horizontal bar as needed;

[0038] Step 6.2: In the `tree_funcnode` obtained in Step 3.3, each function node object records the function's name, the index `all_index` corresponding to the function being called by its parent node, and the x and y coordinates of the function node. Loop through `tree_funcnode`, for each function node object N... (d,i) Iterate through all index values ​​in the `all_index` array, recording the index range corresponding to the function nodes at the same level. Draw horizontal bars for the encoded call sequence information sequentially, and mark the index range of each level on the left side of the first function node. Here, the index value I... k The corresponding top-left vertex position H_x of the horizontal bar (d,i,k) ,H_y (d,i,k) The calculation method is as follows: 0≤I k ≤I max .

[0039] H_x (d,i,k) = The x-coordinate value N_x of the function node object (d,i)

[0040] H_y (d,i,k) = The y-coordinate value N_y of the node object to which the function belongs (d,i) +I k *h_singleIndex

[0041] The visualization method for dynamic function calls described in this invention effectively visualizes various types of information related to function calls, including binary, hierarchical, and temporal information. This method has the following beneficial effects:

[0042] 1. A hierarchical tree layout is adopted to ensure the presentation of binary and hierarchical information;

[0043] 2. At the same time, we have made the layout more compact and the function nodes left-aligned. On the one hand, this can improve the space utilization, and on the other hand, it can help analysts quickly compare the number of functions in different layers in a single sample and compare the hierarchical structure of function calls in different samples.

[0044] 3. This invention incorporates primitive design on function nodes, presenting fine-grained function call timing information in a concise and aesthetically pleasing manner, facilitating analysts to quickly locate multiple calls and efficiently identify continuous or periodic call patterns.

[0045] 4. This invention provides powerful dynamic function call data analysis tools for target users such as program developers, program testers, and security administrators, helping them streamline workflows and save time. Users can effectively perceive and identify the rich binary, hierarchical, and temporal information contained in dynamic function call data, laying a solid foundation for program understanding, program testing, and malicious file detection. Attached Figure Description

[0046] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the present invention will be described in detail below with reference to specific implementations and accompanying drawings.

[0047] Figure 1 This is a flowchart of the method described in this invention;

[0048] Figure 2 It is a diagram illustrating each design step through dynamic function calls;

[0049] Figure 3 This is a schematic diagram illustrating an example of visualizing dynamic function calls during program testing.

[0050] Figure 4 These are several examples of visualizations of dynamic function calls. Detailed Implementation

[0051] To make the objectives, technical solutions, and advantages of this invention clearer, the invention is described below with reference to specific embodiments shown in the accompanying drawings. However, it should be understood that these descriptions are merely exemplary and not intended to limit the scope of the invention. Furthermore, descriptions of well-known structures and technologies are omitted in the following description to avoid unnecessarily obscuring the concept of the invention.

[0052] It should also be noted that, in order to avoid obscuring the invention with unnecessary details, only the structures and / or processing steps closely related to the solution according to the invention are shown in the accompanying drawings, while other details that are not closely related to the invention are omitted.

[0053] See as Figure 1 As shown, this specific embodiment adopts the following technical solution: It includes the following steps:

[0054] Step 1: Obtain dynamic function call data

[0055] Dynamic function call data consists of function call records generated by a program running dynamically once. These records are stored in a table format, with each record containing three fields: caller, callee, and index.

[0056] The `caller` field stores the name of the calling function, and the `callee` field stores the name of the called function. Both fields are of type `STRING`.

[0057] The index field stores the index of the function call, and its data type is INT.

[0058] The value of the index field I kA unique function call record can be determined, representing the (I)th function call during the dynamic execution of the program. k +1) The call is: the function in the caller field calls the function in the callee field.

[0059] Table 1 shows an example of function call data generated by a PHP program running dynamically once:

[0060] Table 1:

[0061]

[0062]

[0063] Step 2: Convert the raw data into hierarchical data with index information.

[0064] The raw data obtained in step 1 (a binary time event sequence model) is converted into hierarchical data (tree model). The parent-child relationship in the hierarchy is determined based on the call and called relationships between functions, and the same call edges under the same parent node are merged, while the index corresponding to the call occurrence is recorded.

[0065] Step 2.1: Initialize the `Funccall_set` collection to record all call edge objects. Iterate through the dynamic function call records obtained in Step 1 in ascending order of their `index` values, treating the combination of `caller` and `callee` in each record as a call edge object `caller|callee`. If `caller|callee` is not in `Funccall_set`, add it to `Funccall_set` and record the corresponding attributes: caller, callee, and all call indices (`all_index`). If `caller|callee` is in `Funccall_set`, update the `all_index` attribute. For example, in the data shown in Table 1, for a call where the caller is the `_func2` function and the callee is the `hex2bin` function, the corresponding call edge objects are:

[0066] {name:"_func2|hex2bin", / / Name of the calling edge object caller:"_func2", / / Caller, i.e., the source function corresponding to the calling edge callee:"hex2bin", / / Callee, i.e., the target function corresponding to the calling edge all_index:[3,4,5,6] / / Array of all indices corresponding to the calling edge

[0067] }

[0068] Step 2.2: Traverse the `Funccall_set` to generate hierarchical data `Hie_calldata` with the program's entry function as the root node. For example, in the data shown in Table 1, the `__main__` function is the root node. It acts as the program's entry function, calling other functions but is not called itself. Functions directly called by `__main__` become child nodes of `__main__`, and so on, completing the recursion. Finally, the original data in Table 1 will be converted into a tree structure data in JSON format as shown below: recording the function node name (`name`), the function node's depth (`depth`), the function node's child nodes (`children`, this attribute is not recorded if there are no child nodes), and all call indices corresponding to the function node being called by its parent function (`all_index`, this attribute does not exist for the root node).

[0069]

[0070]

[0071] Step 3: Determine the function node layout and set the call connection attributes based on the breadth-first traversal algorithm.

[0072] Based on the hierarchical data `Hie_calldata` obtained in step 2.2, the layout is performed, generating the corresponding tree node array and edge array. The tree node array records each function node object, including basic attributes—function name, depth of the function node in the tree structure, and layout attributes—position on the canvas (x and y coordinates). The tree edge array records each edge object, including two basic attributes—the source node object and the target node object corresponding to the edge.

[0073] Function nodes are laid out hierarchically, extending from the root node to the leaf nodes from top to bottom, with the root node at the top. Furthermore, a compact layout and left alignment of nodes are implemented, maintaining small gaps between different layers and small, equal gaps between nodes within the same layer, extending from left to right. A connection is formed between a parent node and each of its child nodes. It is necessary to determine whether a connection is from the parent node to its first child node and record this as a boolean attribute `isfirstLink` in the connection object.

[0074] Step 3.1: Define the coordinates of a starting position (start_X, start_Y), the horizontal spacing between function nodes (node_spaceX), and the vertical spacing between nodes (node_spaceY). Initialize an array of function nodes (tree_funcnode) and an array of function call links (tree_calllink).

[0075] Step 3.2: Perform a breadth-first traversal on the hierarchical data `Hie_calldata` obtained in Step 2.2. This step is implemented using a loop, adding function node objects to the `tree_funcnode` array and function call link objects to the `tree_calllink` array. Based on the design principles of compact layout and left-aligned nodes, determine the position of the function node, where the depth is `d`, i.e., the `i`-th node `N` at the (d+1)-th level. (d,i) The x and y coordinates N_x on the canvas (d,i) , N_y (d,i) The calculation method is as follows:

[0076] N_x (d,i) =(start_X+(i-1)*node_spaceX)

[0077] N_y (d,i) = (start_Y + d * node_spaceY)

[0078] In other words, the coordinates of the root node are the starting position coordinates defined in step 3.2; the x-axis coordinate of the first function node in each layer is start_X, the x-axis coordinate of the i-th node in any layer is (start_X+(i-1)*node_spaceX); the y-axis coordinate of the node in the (d+1)-th layer is (start_Y+d*node_spaceY).

[0079] In each edge object, in addition to the source node (parent node) and target node (child node) of the called edge, it is also necessary to record whether the called edge is a connection from the parent node to its first child node: if so, the isfirstLink property value is TRUE; if not, the isfirstLink property value is FALSE.

[0080] Step 3.3: Since the program's entry function is the root node, located in a separate layer, to save vertical space, remove the root node object (in this example, the __main__() function node object) from the tree_funcnode array obtained in Step 3.2; remove the call connection objects between the root node and its child nodes from the tree_calllink array obtained in Step 3.2. Therefore, the root node and its associated edges will not be drawn in the next step.

[0081] Step 4: Draw a hierarchical overview of function calls.

[0082] Based on the tree_funcnode and tree_calllink obtained in step 3.3, draw the function nodes and call links in layers. Encode the function nodes as squares of the same size, mark the function names inside the squares, and explicitly draw the call links from the parent node to its first child node. The hierarchical layout can ensure the presentation of hierarchical information in the dynamic function call data, and the links ensure the presentation of binary information.

[0083] Step 4.1: Define the side length of the square as node_size (node_size < node_spaceX and node_size < node_spaceY); define the mapping scale of the filling color of the square, that is, use the saturation of gray to map the frequency of function calls. The lighter the gray, the lower the frequency of the function being called by its parent node, and the darker the gray, the higher the frequency of the function being called by its parent node.

[0084] Step 4.2: Define the link color as medium gray (#595959) and the style as orthogonal polyline.

[0085] Step 4.3: Traverse the tree_funcnode obtained in step 3.3. Taking the x-axis and y-axis coordinates of the function node as the upper left corner of the square, draw a function node with a side length of node_size at the corresponding position on the canvas; determine the filling color of the function node according to the number of indexes recorded in the all_index attribute value in the function node object; and display the function name centered inside the square.

[0086] Step 4.4: Traverse the tree_calllink obtained in step 3.3, and judge the attribute value of isfirstLink in the link object. Only when the attribute value is TRUE, draw the link. This link drawing principle is to eliminate the ambiguity brought by the polyline link in the compact layout (as shown in Figure 2 (b)). The overview view of the dynamic function call drawn in step 4 is as shown in Figure 2 (c).

[0087] Step 5: Map the index interval of the function call to the node height.

[0088] Since the nodes are of the same size and square-shaped, take the height of the node as the time axis and map the index interval of the dynamic function call data to the node height to display the timing information of the fine-grained dynamic function call.

[0089] Obtain the index interval [0, I max of the dynamic function call data, indicating that the function call data contains a total of (1 + I maxThere are 10 function calls, and the height of the corresponding function node is `node_size`. The height allocated to each function call is `h_singleIndex`, calculated as follows:

[0090] h_singleIndex=node_size / (1+I max )

[0091] Step 6: Draw fine-grained function calls.

[0092] The primitive design on the function node uses a horizontal bar drawn at the corresponding height of the block and with the same width as the node to represent the timing information of the function corresponding to the block being called by its parent node; at the same time, the color of the horizontal bar is used to encode the type of the called function.

[0093] Step 6.1: Define the height of the horizontal bar as h_singleIndex calculated in step 5; define the width of the horizontal bar as equal to the node side length, set to node_size; define the default color of the horizontal bar as dark gray (#888888).

[0094] Users can use the color of the horizontal bar to encode other types of information as needed. For example, in this case, the color of the horizontal bar is used to encode the type of the called function. The color mapping scale is as follows:

[0095] var typecolor=d3.scale.ordinal()

[0096] .domain(["COMMAND","FILE","STRING","ENCODE","ENVIRONMENT","OTHER"])

[0097] .range(["#EF8AB0","#997AC9","#5BCAE8","#5AC599","#F7C848","#888888"])

[0098] Step 6.2: In the `tree_funcnode` obtained in Step 3.3, each function node object records the function's name, the index `all_index` corresponding to the function being called by its parent node, and the x and y coordinates of the function node. Loop through `tree_funcnode`, for each function node object N... (d,i) Iterate through all index values ​​in the `all_index` array, recording the index range corresponding to the function nodes at the same level. Draw horizontal bars for the encoded call sequence information sequentially, and mark the index range of each level on the left side of the first function node. Here, the index value I... k The corresponding top-left vertex position H_x of the horizontal bar(d,i,k) ,H_y (d,i,k) The calculation method is as follows: 0≤I k ≤I max .

[0099] H_x (d,i,k) = The x-coordinate value N_x of the function node object (d,i)

[0100] H_y (d,i,k) = The y-coordinate value N_y of the node object to which the function belongs (d,i) +I k *h_singleIndex

[0101] Furthermore, the color of the horizontal bar is set according to the scale `typecolor` set in step 6.1 (this step requires the user to maintain a dictionary of function names and function types according to their own needs, and to look up the function node object N in the dictionary). (d,i) (Function type corresponding to function name). Users can also modify the dictionary and the color scale set in step 6.1 (typecolor) according to their own needs, such as adding, deleting, or modifying function types, modifying specific color mappings, or using colors to encode other data related to function call data (e.g., in malicious file detection, the color of the horizontal bar can be used to encode the sensitivity of the function).

[0102] In addition, since the number of horizontal bars inside a single function node can also reflect the frequency of function calls, users can selectively disable the gray saturation encoding of the function node itself.

[0103] The finished drawing looks like this Figure 2 As shown in (d), compared to the tree layout under the traditional Reingold-Tilford algorithm ( Figure 2 (a) The layout compactness and node left alignment proposed in this invention can achieve better comparability and scalability when visualizing dynamic function call data.

[0104] Furthermore, compared to traditional force-guided node link graphs, orthogonal trees, icicle diagrams, and large-scale sequence views, this invention can more comprehensively and holistically display the binary, hierarchical, and temporal information in dynamic function call data.

[0105] This invention provides powerful dynamic function call data analysis tools for target users such as program developers, program testers, and security administrators, helping users to efficiently complete tasks such as program understanding, program testing, and malicious file detection.

[0106] Figure 3 This document presents an example of a program testing process.

[0107] Figure 3 (a) is the source code of a PHP program;

[0108] Figure 3 (b) and Figure 3 (c) These are the dynamic function call data captured by the program under different inputs "68656C6C6F77" and "6576616C";

[0109] Figure 3 (d) and Figure 3 (e) are the corresponding visualization results.

[0110] Analysis of the visualization results reveals that when the input is "68656C6C6F77" ( Figure 3 (d) The program called a total of 9 functions, generating 26 function call records with a nesting depth of 2 levels; among them, the squares corresponding to the substr(), hexdec and chr functions all have 6 blue horizontal bars, indicating that there is a continuous call pattern for string type functions (strProc→substr, strProc→hexdec, strProc→chr).

[0111] In contrast, when "6576616C" is entered ( Figure 3 (e) also has a nesting depth of 2 levels, but it calls a total of 12 functions, generating 23 function call records; it also exhibits a continuous call pattern to string-type functions, but the number of consecutive calls differs. This is due to the different input strings. Further analysis reveals that the `eval` function in the first level is a system command-type function, a sensitive function in PHP, which can run strings as PHP code, posing a certain risk. The `phpinfo` function called by `eval` can lead to the leakage of environment or configuration information.

[0112] Therefore, testers can quickly identify certain security risks in the program and make necessary modifications and improvements using the dynamic function call visualization method proposed in this invention.

[0113] More implementations such as Figure 4 As shown.

[0114] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the invention can be implemented in other specific forms without departing from the spirit or essential characteristics of the invention. Therefore, the embodiments should be considered in all respects as exemplary and non-limiting, and the scope of the invention is defined by the appended claims rather than the foregoing description. Thus, it is intended that all variations falling within the meaning and scope of equivalents of the claims be included within the present invention.

[0115] Furthermore, it should be understood that although this specification describes embodiments, not every embodiment contains only one independent technical solution. This narrative style is merely for clarity. Those skilled in the art should consider the specification as a whole, and the technical solutions in each embodiment can also be appropriately combined to form other embodiments that can be understood by those skilled in the art.

Claims

1. A method for visualizing dynamic function calls, characterized in that: It includes the following steps: Step 1: Obtain dynamic function call data; Dynamic function call data consists of function call records generated by a program running dynamically once. These records are stored in a table format, with each record containing three fields: caller, callee, and index. The `caller` field stores the name of the calling function, and the `callee` field stores the name of the called function; both fields are of type `STRING`. The `index` field stores the index of the function call; its data type is `INT`. The value of the `index` field is used to... k It can identify a unique function call record, indicating that during the dynamic execution of the program, the function in the caller field called the function in the callee field; Step 2: Convert dynamic function call data into hierarchical data with index information; Convert the dynamic function call data obtained in step 1 into hierarchical data; determine the parent-child relationship in the hierarchy based on the calling and called relationships between functions, merge the same call edges under the same parent node, and record the index corresponding to the call occurrence. Step 2.1: Initialize the set Funccall_set to record all call edge objects; traverse the dynamic function call records obtained in Step 1 in ascending order according to the index value, and regard the combination of caller and callee in each record as a call edge object caller|callee; Step 2.2: Traverse Funccall_set to generate hierarchical data Hie_calldata with the program's entry function as the root node; Step 3: Determine the function node layout and set the call connection attributes based on the breadth-first traversal algorithm; Based on the hierarchical data Hie_calldata obtained in step 2.2, the layout is performed to generate the corresponding tree node array and edge array. The tree node array records each function node object, including basic attributes: function name, depth of the function node in the tree structure, and layout attribute, i.e., position on the canvas. The tree edge array records each edge object, including two basic attributes: the source node object and the target node object corresponding to the edge. Step 3.1: Define the coordinates of a starting position (start_X, start_Y), the horizontal spacing between function nodes node_spaceX, and the vertical spacing between nodes node_spaceY; initialize a function node array tree_funcnode and a function call link array tree_calllink; Step 3.2: Perform a breadth-first traversal on the hierarchical data Hie_calldata obtained in Step 2.

2. This step is implemented based on a loop, adding function node objects to the tree_funcnode array and function call link objects to the tree_calllink array. Step 3.3: Since the program's entry function is the root node, located in a separate layer, to save vertical space, remove the root node object from the tree_funcnode array obtained in step 3.2; remove the call connection objects between the root node and its child nodes from the tree_calllink array obtained in step 3.2; therefore, the root node and its associated connections will not be drawn in the next step. Step 4: Draw a hierarchical overview of function calls; Based on the tree_funcnode and tree_calllink obtained in step 3.3, draw function nodes and call links in layers; encode function nodes as equal-sized squares, mark the function name inside the squares, and explicitly draw call links from the parent node to its first child node; the hierarchical layout can ensure the presentation of hierarchical information in dynamic function call data, while the links ensure the presentation of binary information. Step 5: Map the index range of the function call to the node height; Since the nodes are of equal size and block-shaped, the height of the nodes is used as the time axis, and the index range of dynamic function call data is mapped to the node height to display fine-grained timing information of dynamic function calls. Get the index range [0, I] of dynamic function call data max ] indicates that the function call data contains a total of (1 + I) max The height of the corresponding function node is node_size; the height allocated to each function call is h_singleIndex, calculated as follows: h_singleIndex = node_size / (1 + I max ); Step 6: Draw fine-grained function calls; The primitives on the function nodes are designed using horizontal bars drawn at the corresponding height of the squares, with the same width as the node, to represent the timing information of the function corresponding to the square being called by its parent node; at the same time, the color of the horizontal bars is used to encode the type of the called function; Step 6.1: Define the height of the horizontal bar as h_singleIndex calculated in Step 5; define the width of the horizontal bar as equal to the node side length, set to node_size; define the default color of the horizontal bar as dark gray; users can encode other types of information using the color of the horizontal bar as needed; Step 6.2: In the `tree_funcnode` obtained in Step 3.3, each function node object records the function name, the index `all_index` corresponding to the function being called by its parent node, and the x and y coordinates of the function node; iterate through `tree_funcnode`, for each function node object... N (d,i) Where the depth is d, which is the i-th node of the (d + 1)-th layer. N (d,i) ； Iterate through all index values ​​in the `all_index` array, recording the index range corresponding to the function nodes at the same level. Draw and encode horizontal bars for the call sequence information sequentially, and mark the index range of each level on the left side of the first function node. Wherein, index value I... k The corresponding top-left vertex position H_x of the horizontal bar (d,i,k) , H_y (d,i,k) The calculation method is as follows: 0 ≤ I k ≤ I max ; H_x (d,i,k) = The x-coordinate value N_x of the function node object (d,i)； H_y (d,i,k) = The y-coordinate value N_y of the function node object (d,i) + I k * h_singleIndex.

2. The visualization method for dynamic function calls according to claim 1, characterized in that: In step 2.1, if caller|callee is not in Funccall_set, then add it to Funccall_set and record the corresponding attributes: caller, callee, and all_index. If caller|callee is in Funccall_set, then update the all_index attribute.

3. The method for visualizing dynamic function calls according to claim 1, characterized in that: In step 3, the function nodes are laid out in a hierarchical manner, extending from the root node to the leaf nodes from top to bottom, with the root node at the top. In addition, the layout is made compact and the nodes are left-aligned, that is, small gaps are maintained between different layers, and small, equal gaps are also maintained between nodes in the same layer, extending from left to right. A connection is formed between the parent node and each of its child nodes. It is necessary to determine whether the connection is a connection from the parent node to its first child node and record it as a boolean attribute isfirstLink in the connection object.

4. The method for visualizing dynamic function calls according to claim 1, characterized in that: Based on the design principles of compact layout and left alignment of nodes, the position of the function node is determined, with its x and y coordinates N_x on the canvas. (d,i) , N_y (d,i) The calculation method is as follows: N_x (d,i) = (start_X + (i-1) * node_spaceX); N_y (d,i) = (start_Y + d * node_spaceY); The coordinates of the root node are the starting position coordinates defined in step 3.1; the x-axis coordinate of the first function node in each layer is start_X, the x-axis coordinate of the i-th node in any layer is (start_X + (i-1) * node_spaceX); the y-axis coordinate of the node in the (d + 1)-th layer is (start_Y + d * node_spaceY); In each edge connection object, in addition to the source node, parent node, target node, and child node of the call edge of this edge connection object, it is also necessary to record whether the call edge is an edge connecting the parent node to its first child node: if so, the attribute value of isfirstLink is TRUE; if not, the attribute value of isfirstLink is FALSE.

5. The visualization method for dynamic function calls according to claim 1, characterized in that: Step 4 mentioned above is further divided into the following specific steps: Step 4.1: Define the side length of the square as node_size (node_size < node_spaceX and node_size < node_spaceY); define the mapping scale of the filling color of the square, that is, use the saturation of gray to map the frequency of function calls. The lighter the gray, the lower the frequency of the function being called by its parent node, and the darker the gray, the higher the frequency of the function being called by its parent node. Step 4.2: Define the edge color as medium gray and the style as an orthogonal broken line. Step 4.3: Traverse the tree_funcnode obtained in Step 3.

3. Taking the x-axis and y-axis coordinates of the function node as the upper left corner of the square, draw a function node with a side length of node_size at the corresponding position on the canvas; determine the filling color of the function node according to the number of indexes recorded in the all_index attribute value in the function node object; and display the function name centered inside the square. Step 4.4: Traverse the tree_calllink obtained in Step 3.3, and judge the attribute value of isfirstLink in the edge connection object. Only when the attribute value is TRUE, draw the edge.

6. The visualization method for dynamic function calls according to claim 1, characterized in that: In step 6, the color of the horizontal bar is set according to the scale `typecolor` set in step 4.

1. This step requires the user to maintain a dictionary of function names and function types according to their own needs, and to look up function node objects in the dictionary. N (d,i) The function type corresponding to the function name.

Images