J-Viz: Sibling-First Recursive Graph Drawing for Visualizing Java Bytecode

TL;DR

J-Viz is a graph visualization tool for Java bytecode that uses a sibling-first recursive numbering scheme to help identify security issues and code reuse in Java applications.

Contribution

The paper introduces J-Viz, a novel visualization method using sibling-first recursive graph drawing tailored for Java bytecode analysis.

Findings

Effective in identifying security vulnerabilities

Helps detect repeated code usage

Facilitates understanding of Java bytecode structure

Abstract

We describe a graph visualization tool for visualizing Java bytecode. Our tool, which we call J-Viz, visualizes connected directed graphs according to a canonical node ordering, which we call the sibling-first recursive (SFR) numbering. The particular graphs we consider are derived from applying Shiver's k-CFA framework to Java bytecode, and our visualizer includes helpful links between the nodes of an input graph and the Java bytecode that produced it, as well as a decompiled version of that Java bytecode. We show through several case studies that the canonical drawing paradigm used in J-Viz is effective for identifying potential security vulnerabilities and repeated use of the same code in Java applications.