Origin Trace Behavior Model for Application Behavior
A behavior model for a software application may identify a set of execution sequences that begin from a set of origins. The sequences may be further defined by a set of exits. In some cases, the sequences may be decomposed into subsequences or n-grams. The execution sequences and their frequencies may define a usage or behavior model for the application. The sequences may be defined by semantic level operations of an application, which may be defined by functions, call backs, API calls, or other blocks of code execution. The behavior model may be used for determining code coverage, comparing versions of applications, and other uses.
1 . A method performed on at least one computer processor, said method comprising:
receiving first tracer data observed from an application, said application comprising a plurality of functions, said first tracer data further comprising a sequence of said functions;
identifying a first origin within said first tracer data;
identifying a first plurality of sequences of said functions, at least some of said plurality of sequences beginning with said first origin;
determining an observed frequency for each of said first plurality of sequences; and
defining a behavior model for said application from said observed frequency for each of said first plurality of sequences.
2 . The method of claim 1 further comprising:
identifying a second plurality of sequences, each of said second plurality of sequences beginning with said first origin;
said first plurality of sequences being a subset of said second plurality of sequences.
3 . The method of claim 2 further comprising:
identifying n-grams within said second plurality of sequences, and using said n-grams as said first plurality of sequences.
4 . The method of claim 3 , said n-grams being at least tri-grams.
5 . The method of claim 3 further comprising:
for each of said second plurality of sequences, identifying a termination point.
6 . The method of claim 5 further comprising:
selecting a first exit point;
selecting a third plurality of sequences, each of said third plurality of sequences having said first origin and said first exit point; and
selecting said first plurality of sequences from said third plurality of sequences.
7 . The method of claim 6 further comprising:
identifying n-grams within said third plurality of sequences, and using said n-grams as said first plurality of sequences.
8 . The method of claim 1 , said functions comprising named functions within said application.
9 . The method of claim 8 , said functions comprising anonymous functions with said application.
10 . The method of claim 8 , said functions comprising application programming interface calls.
11 . The method of claim 1 , said first origin comprising a first function.
12 . The method of claim 11 , said first origin comprising a first value of a first parameter to a first function.
13 . The method of claim 12 further comprising:
identifying a second origin within said first tracer data, said second origin comprising said first function and a second value of said first parameter to said first function.
14 . The method of claim 1 further comprising:
generating a visualization of said behavior model.
15 . A system comprising:
a hardware processor:
an analyzer executing on said hardware processor, said analyzer that:
receives first tracer data observed from an application, said application comprising a plurality of functions, said first tracer data further comprising a sequence of said functions;
identifies a first origin within said first tracer data;
identifies a first plurality of sequences of said functions, at least some of said plurality of sequences beginning with said first origin;
determines an observed frequency for each of said first plurality of sequences; and
defines a behavior model for said application from said observed frequency for each of said first plurality of sequences.
16 . The system of claim 15 , said analyzer that further:
identifies a second plurality of sequences, each of said second plurality of sequences beginning with said first origin;
said first plurality of sequences being a subset of said second plurality of sequences.
17 . The system of claim 16 , said analyzer that further:
identifies n-grams within said second plurality of sequences, and using said n-grams as said first plurality of sequences.
18 . The system of claim 17 , said n-grams being at least tri-grams.
19 . The system of claim 17 , said analyzer that further:
for each of said second plurality of sequences, identifies a termination point.
20 . The system of claim 19 , said analyzer that further:
selects a first exit point;
selects a third plurality of sequences, each of said third plurality of sequences having said first origin and said first exit point; and
selects said first plurality of sequences from said third plurality of sequences.
21 . The system of claim 20 , said analyzer that further:
identifies n-grams within said third plurality of sequences, and using said n-grams as said first plurality of sequences.
22 . The system of claim 15 , said functions comprising named functions within said application.
23 . The system of claim 22 , said functions comprising anonymous functions with said application.
24 . The system of claim 22 , said functions comprising application programming interface calls.
25 . The system of claim 15 , said first origin comprising a first function.
26 . The system of claim 25 , said first origin comprising a first value of a first parameter to a first function.
27 . The system of claim 26 , said analyzer that further:
identifies a second origin within said first tracer data, said second origin comprising said first function and a second value of said first parameter to said first function.
28 . The method of claim 15 , said analyzer that further:
generates a visualization of said behavior model.