A security policy oracle: detecting security holes using multiple API implementations
The SLAM project: debugging system software via static analysis