Patent Document ID: 8799874
Application ID: 13411779
Patent Flag: 1

Claim One:
1. A computer-implemented method comprising: a computer applying a first level of abstraction to model a plurality of run-time objects of a computer software application to produce a set of object abstractions of the run-time objects; the computer producing a first data-flow propagation graph using the set of object abstractions; the computer identifying a data-flow bottleneck at control locations within the first data-flow propagation graph; the computer applying a second level of abstraction to model any of the said run-time objects which are identified as created or returned by factory methods and having in the set of object abstractions a corresponding object abstraction that is traceable to the data-flow bottleneck, based on corresponding allocation sites and call sites that call factory methods encompassing the corresponding allocation sites, where applying the second level of abstraction decomposes the corresponding object abstraction into a plurality of object abstractions, thereby producing a modified set of object abstractions; the computer performing static data-flow analysis of the computer software application using the modified set of object abstractions; the computer invocating one of the factory methods at least two times, comprising a first invocation and a second invocation; the computer performing the first invocation using an untrusted argument; the computer performing the second invocation without using an untrusted argument, wherein if a static security analysis were performed using a data-flow propagation graph from the first invocation and the second invocation without using the modified set of object abstractions, a false positive report of a security vulnerability would result assuming that by default the statistic security analysis conservatively views two instances as being one for a same abstract object, wherein said method avoids the false positive report by modeling the factory method by applying a further level of abstraction, as opposed to modeling the factory method as a single abstract object.