Combining static and dynamic data flow analysis: a hybrid approach for detecting data leaks in java applications

Protecting sensitive data requires controlling the behavior of third part software. Static and dynamic data flow analysis can aid, however both of them have limits. Static analysis often detects false data leaks, whereas the more precise dynamic analysis introduces a significant overhead. This paper proposes a novel hybrid approach that combines static and dynamic data flow analysis for detecting data leaks in Java applications. Our approach minimizes the overhead by computing a minimal set of "application points" that need to be monitored and injects control code on the target application. Our method has no loss in quality with respect to dynamic analysis. We show the feasibility of our approach by providing a tool and presenting a case study on a sample application.