Comment by cortesi | Hacker News Reader

Comment by cortesi | Hacker News Reader

This is lovely. An interesting thing to think about here is the layout of the sequential time-series data. This visualisation breaks the sequence out into columns, which means that squares that are close to each other in the sequence don't cluster visually.

I've played with using space-filling curves for this to visualise binaries:

https://binvis.io/

You can play around on there with the scan layout (similar to the Netflix layout) and compare it to the Hilbert curve. You can click and drag to select regions in both (similar to the video for this visualisation).

There are tradeoffs - the Hilbert layout is not intuitive, and you have to play around to select regions accurately. On the other hand, the clustering lets you visually pick hotspots in much greater detail, e.g.:

https://binvis.io/#/view/examples/tcpview.exe.bin?colors=ent...

I've found it useful to be able to toggle between both scanning and clustered layouts, and plan to explore some more interaction paradigms when I get time to turn back to the project.

I did binary visualizations many years ago too:

https://github.com/brendangregg/Dump2PNG/wiki

So with the subsecond-offset heat map, you get clustering from one column to the next for events that happen at the same time offset. Which is common with periodic tasks: see the example patterns in the post.

It looks like we've traveled a similar path. The precursor to binvis is scurve, a (slow, dodgy) command-line tool to do basically what dump2png does:

https://github.com/cortesi/scurve

I have a blazing fast command-line version of binvis in Rust that I plan to release in the next month or so. I really need make some time to turn back to this.

binvis.io is pretty great!

So I was more interested in core dumps, which gets tricky since they can be 10s of Gbytes in size. Probably the most useful thing I figured out was this palette type:

  x86		grayscale with some (9) color indicators:
    green = common english chars: 'e', 't', 'a'
    red = common x86 instructions: movl, call, testl
    blue = binary values: 0x01, 0x02, 0x03

Building more understanding of file formats into binvis is perpetually on my todo list. This would let you interpret different segments of files differently, and correctly interpret instructions and other higher-level structures. It would also help with things like entropy calculation over sliding windows (where you don't want this to span file segments). There are so many interesting avenues to explore here.

While I'm thinking about it, you're of course quite right that spotting periodic patterns in a Hilbert curve layout is really hard. However, I've found that being able to spot them in a scanning layout is highly dependent on your column width matching/resonating with the period of the pattern you're looking for. Another thing on my todo list is to combine Hilbert layouts with Fourier transforms. There's a very suggestive paper on this that I'd love to explore:

https://arxiv.org/pdf/1508.03817.pdf

Wow I haven't seen your name in years, I had forgotten! I just want to thank you for having an incredible blog and visualization tools. sortvis.org was frequently a resource I used to learn sorting and then later as a tutor I shared it with other students to help them learn. I've shared sortvis and the posts you did on hilbert curves with young curious family members to inspire them, and it always did! So thank you!

And Brendans blog has been more recently inspiring and educational, seeing you guys chatting on HN is too cool. Thank you both for the awesome and freely accessible material.

My pleasure! Sortvis is down at the moment, but will be back up soon. I've been swallowed up in other projects, but I have a perpetual new year's resolution to write more blog posts. Keep an eye out in the next few months. :)

Reply on news.ycombinator.com