Automated Detection of Information Flow Vulnerabilities in UML State Charts and C Code

Abstract—Information flow vulnerabilities in UML statecharts and C code are detrimental as they can cause data leakagesor unexpected program behavior. Detecting such vulnerabilitieswith static code analysis techniques is challenging because codeis usually not available during the software design phase andprevious knowledge about what should be annotated and trackedis needed. In this paper we propose textual annotations used tointroduce information flow constraints in UML state charts andcode which are afterwards automatically loaded by informationflow checkers that check if imposed constraints hold or not. Weevaluated our approach on 6 open source test cases availablein the National Institute of Standards and Technology (NIST)Juliet test suite for C/C++. Our results show that our approachis effective and can be further applied to other types of UMLmodels and programming languages as well, in order to detectdifferent types of vulnerabilities.