As part of a DARPA STAC project, we've built a system to identify security vulnerabilities in Java programs using techniques from Graph Drawing. We've used a semi-automated approach, creating interactive graphs representing the program structure that allow a human analyst to search through these programs efficiently.
I'll discuss the tradeoffs between several different algorithms we've tried and where we expect to make progress in the future, accompanied by a demo of our current system.