Discovery of application vulnerabilities involving multiple execution flows

A method for security analysis of an application comprising:

• conducting a flow-insensitive analysis on the application to obtain a set of potential vulnerabilities in the application;
• for each of the potential vulnerabilities, determining a relevant set of control flows that include the respective vulnerability;
• and
• for each relevant set of control flows, performing, by a hardware processor, a flow-sensitive analysis of at least one of the control flows in the corresponding relevant set to assess a validity of the respective vulnerability.

A method for security analysis of a web application comprising:

• conducting a flow-insensitive analysis on the application to obtain a set of potential witnesses of vulnerabilities in the application;
• for each of the potential witnesses, restricting a scope of analysis within program code of the application to a relevant set of control flows;
• and
• for at least one of the relevant sets of control flows, performing, by a hardware processor, a flow-sensitive analysis of a concatenation of the control flows in the corresponding relevant set to assess a validity of the respective witness across multiple executions of the web application.

A method for security analysis of an application comprising:

• conducting a flow-insensitive analysis on the application to obtain a set of potential vulnerabilities in the application;
• for at least one of the potential vulnerabilities, determining a relevant sequence of control flows that enable source to sink data propagation;
• and
• for at least one relevant sequence of control flows, performing, by a hardware processor, a flow-sensitive analysis of a concatenation of a plurality of control flows in the corresponding relevant sequence to assess a validity of the respective vulnerability.