Hybrid analysis of vulnerable information flows

A method of analyzing vulnerable information flows in an application, the method comprising:

• performing a black-box scan, using a hardware processor, of the application;
• based on the black-box scan, recording a call-tree representation of a plurality of call stacks arising in the application due to test inputs provided during the black-box scan, the call tree representation indicating paths between the plurality of call stacks;
• performing, for each of the paths in the call-tree representation that does not constitute a vulnerable information flow during the black-box scan, a static analysis, and by the static analysis determining at least one parameter value that, when abstracted, drives execution of the application, via the path in the call-tree representation that does not constitute a vulnerable information flow during the black-box scan, to flow to the at least one security sink;
• responsive to determining that abstracting the first parameter value does not drive execution of the application, via the path in the call-tree representation that does not constitute a vulnerable information flow during the black-box scan, to flow to the at least one security sink, abstracting at least a second parameter value, and determining whether abstracting both the first and second parameter values drives execution of the application, via the path in the call-tree representation that does not constitute a vulnerable information flow during the black-box scan, to flow to the at least one security sink;
• and
• generating a security report that identifies at least one of the paths in the call-tree representation that does not constitute the vulnerable information flow during the black-box scan, but flows to the at least one security sink when both the first and second parameter values are abstracted.