Patent ID: 8850405

Claim:
A method, comprising: using a static analysis, analyzing a software program to determine a plurality of paths from sources accepting information to sinks using that information or a modified version of that information and to determine multiple paths from the plurality of paths, where the determined multiple paths have a same transition from an application portion of the software program to a library portion of the software program and require a same downgrading action to address a vulnerability associated with source-sink pairs in the multiple paths, and where the analyzing comprises determining the plurality of paths using a path-sensitive analysis; and wherein determining the multiple paths using a path-sensitive analysis comprises: determining control dependencies in the software program, each control dependency corresponding to two different branches of paths, wherein a first statement on a first of the two different branches of paths controls whether a second statement on the second of the two different branches of paths is executed; splitting a state space to reflect the at least two branches of paths; and removing a selected path from the multiple paths, where the removed selected path corresponds to the second of the two different branches from the plurality of paths, in response to determining execution of the second statement is infeasible based on a state corresponding to the first statement; for the determined multiple paths, grouping the determined multiple paths into a single representative indication of the determined multiple paths; and outputting the single representative indication.