Practical static analysis for inference of security-related program properties