Patent ID: 8656496

Claim:
A method, comprising: determining by a computer system selected global variables in a program for which flow of the selected global variables through the program is to be tracked, the selected global variables being less than all the global variables in the program; and using a static analysis performed by the computer system on the program, where in the static analysis the program is not executed but is instead analyzed via a model of the program, performing the following: tracking flow through the program for the selected global variables, wherein tracking further comprises tracking flow through the program for a given one of the selected global variables by cloning object abstractions of an object having the given selected global variable per scope of the given selected global variable to create multiple clones of the object and by treating each of the clones in isolation, wherein flows through different clones of the object are not mixed; in response to one or more of the selected global variables being used in security-sensitive operations in the flow, analyzing use of each one of the selected global variables in a corresponding security-sensitive operation; and in response to a determination the use may be a potential security violation, reporting the potential security violation.