Combining Static and Dynamic Analysis for Automatic Identification of Precise Access-Control Policies