How to proceed?
What source model would be useful?
- calls between functions (particularly calls to Unix TCP/IP library)
How do we get this source model?
- statically with a tool that analyzes the source or dynamically using a profiling tool
- these differ in information characterization produced
- False positives, false negatives, etc.